Skip to content

fix: raise next floor and drop stale override pins to resolve Snyk vulnerabilities - #77

Merged
cs-raj merged 4 commits into
mainfrom
fix/snyk-patch-deps-20261007
Oct 29, 2026
Merged

fix: raise next floor and drop stale override pins to resolve Snyk vulnerabilities#77
cs-raj merged 4 commits into
mainfrom
fix/snyk-patch-deps-20261007

Conversation

@cs-raj

@cs-raj cs-raj commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Snyk flags undici 8.10.2 (2 critical, 6 high) and qs 6.16.0 (1 high) on main. Both are held there by exact pins: the undici override sits below the ^8.11.2 that jsdom asks for, and @contentstack/core 1.5.3 (its latest release) pins qs to 6.16.0 itself.

Fix

  • Merged main into this branch and kept this PR's removal of the stale qs, sharp, nanoid, undici and js-yaml override pins. The postcss 8.5.25 pin stays.
  • Regenerated package-lock.json from a clean install: undici now resolves to 8.12.3 and next to 16.4.3.
  • Added a qs: 6.16.1 override (patch, same major) until @contentstack/core ships a release without the exact pin.
  • No version change: 1.2.4 is already on main.

The kickstart is an app, so the lock file is what ships. Result: Snyk 9 → 0, npm audit 2 → 0. Still open: the 10 LGPL-3.0 licence flags on @img/sharp-libvips-* (a licence finding with no fixed version).

Verified: next build compiles and typechecks; collecting page data for / needs real stack credentials, same as before this change.

🤖 Generated with Claude Code

@cs-raj @claude
fix: raise next floor and drop stale override pins to resolve Snyk vu…
039de5d 
…lnerabilities

Lock file regenerated (cleared the next RCE/SSRF and dompurify XSS on its own).
Direct upgrades: next ^16.3.8
Overrides: removed stale pins sharp, qs, nanoid, undici, js-yaml (postcss kept);
the sharp pin was holding the vulnerable 0.35.4 in place.
Vuln count: snyk 4 -> 0 (20 sharp-libvips license flags unchanged), npm audit 10 -> 5
(remaining are open-ended tooling ranges with no fix). Compiles; prerender needs
real stack credentials, unchanged from main.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
@cs-raj
cs-raj requested a review from a team as a code owner October 7, 2026 10:49
@cs-raj cs-raj self-assigned this Oct 7, 2026
@snyk-io

snyk-io Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 20 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 20
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

cs-raj and others added 2 commits October 26, 2026 20:30
@cs-raj @claude
Merge remote-tracking branch 'origin/main' into fix/snyk-patch-deps-2…
db8a305 
…0261007

Conflicts in package.json (overrides) and package-lock.json resolved to this branch's side: the stale qs/sharp/nanoid/undici/js-yaml pins stay removed; only postcss 8.5.25 is kept.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@cs-raj @claude
fix: regenerate lock file and add 1 override to resolve Snyk vulnerab…
d5432ad 
…ilities

Lock file regenerated (fixed 8 on its own: undici 8.10.2 -> 8.12.3 once the stale pin is gone).
Direct upgrades: none
Overrides: qs 6.16.1 (@contentstack/core 1.5.3 pins qs to exactly 6.16.0)
Vuln count: snyk 9 → 0, npm audit 2 → 0. Build: next compiles and typechecks; collecting page data needs real stack credentials, same as before this change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 20 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 20
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 20 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 20
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj
cs-raj merged commit e5fffde into main Oct 29, 2026
7 checks passed
@cs-raj
cs-raj deleted the fix/snyk-patch-deps-20261007 branch October 29, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@netrajpatel netrajpatel netrajpatel approved these changes
@amit-kanswal-cs amit-kanswal-cs amit-kanswal-cs left review comments

Assignees

@cs-raj cs-raj

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cs-raj @netrajpatel @amit-kanswal-cs