[cs-raj]

Summary

Clean lock file regeneration plus dependency bumps for kickstart-sveltekit, with a patch version bump. Base branch is development.

Version bump

Branch	package.json version
main	0.1.3
development (before this PR)	0.1.2 (behind main, not bumped)
this PR	0.1.4 (patch bump, above main)

The hand edit in the working tree had set 0.1.3, which equals main, so this PR applies 0.1.4 so that development is ahead of main. If 0.1.3 was intended, change that single line.

What changed

• package.json: version -> 0.1.4 and 22 range changes across dependencies, devDependencies, optionalDependencies and overrides (@contentstack/delivery-sdk ^5.6.2, live-preview-utils ^4.5.3, vite ^7.3.7, svelte ^5.57.3, axios/dompurify/follow-redirects/uuid overrides, and others). These edits were made by hand in the working tree before this run and are included as they were.
• package-lock.json: deleted (there was no node_modules), then regenerated with a clean npm install (lockfileVersion 3).

Snyk (snyk test, vulnerabilities only; license findings listed separately)

Scan	Critical	High	Medium	Low	Total
Before: committed lock on development	2	13	12	1	28
Lock regen only (committed package.json, fresh lock)	0	0	0	0	0
After: this PR (bumps + fresh lock)	0	0	0	0	0

Fixed by the lock regeneration alone: all 28. dompurify 3.4.13 (8, incl. 2 critical), axios 1.19.0 (13), follow-redirects 1.16.0 (3), qs 6.15.2 (4). IDs: SNYK-JS-DOMPURIFY-20361471, -20536984, -21460653, -21460655, -21460657, -21755399, -21755401, -21755403; SNYK-JS-AXIOS-20244996, -20245042, -20245044, -20245046, -20245048, -20245050, -20245056, -20245058, -20245060, -20245062, -20245064, -20245066, -20341520; SNYK-JS-FOLLOWREDIRECTS-21249784, -21280747, -21762031; SNYK-JS-QS-19432017, -19432019, -20943482, -21755395. The package.json bumps cleared no further vulnerabilities.

Remaining vulnerabilities: none. New vulnerabilities introduced: none.
License findings (same before and after): 2 medium MPL-2.0 for lightningcss-linux-x64-gnu and -musl (version moves 1.32.0 -> 1.33.0).

Build and checks

Script	This PR	development as committed
npm run build with the VITE_CONTENTSTACK_* variables set	passes	passes
npm run build with no env at all	fails: API key for Stack is required (SvelteKit analyse step)	fails the same way
npm run check	passes, 0 errors, 1 warning (state_referenced_locally in src/routes/+page.svelte)	same warning
npm run lint	fails: prettier flags the same 11 files	fails: same 11 files

There is no test script. The lint failures and the no-env build failure are not caused by this change.

Notes

• npm install warns that eslint@9.39.5 is deprecated.
• development is 10 commits behind main, so a back-merge is pending; this PR does not include it.
• Nothing was merged or pushed to main or development.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed