fix: bump 17 deps and add 2 overrides to resolve Snyk vulnerabilities by cs-raj · Pull Request #55 · contentstack/kickstart-sveltekit

cs-raj · 2026-08-09T10:14:19Z

Problem

Snyk flags one high finding on main: qs 6.16.0 (Uncaught Exception), pulled in by @contentstack/delivery-sdk → @contentstack/core, which pins that exact version. This branch had also fallen behind main, had merge conflicts, and its exact js-yaml / nanoid pins now held those packages below main's versions.

Fix

Merged main into this branch: kept main's version (0.1.3), tab formatting and dompurify range; kept this branch's newer dependency ranges (SvelteKit adapter, Svelte, Vite, Tailwind, ESLint, Prettier, the Contentstack SDKs, lightningcss and rollup binaries).
Added a qs 6.16.1 override (same major; the only fix while @contentstack/core pins 6.16.0).
Removed the stale js-yaml 4.3.1 and nanoid 3.3.18 pins: they forced versions below what @eslint/eslintrc and postcss ask for, and js-yaml 4.3.1 has a high advisory. Kept the cookie 0.7.1 override.
Regenerated package-lock.json.

Remaining

2 MPL-2.0 licence findings on lightningcss-linux-*: a licence, not something a version bump changes.
@sveltejs/kit / @sveltejs/adapter-node low advisories: fixed only in the next majors (kit 3, adapter-node 6).

Verified: Snyk 1 → 0, npm audit 3 → 2, npm run build passes on Node 22.

🤖 Generated with Claude Code

…bilities Direct dep upgrades: - @contentstack/delivery-sdk ^5.2.1 → ^5.5.2 - @contentstack/live-preview-utils ^4.4.4 → ^4.4.5 - @sveltejs/adapter-node ^5.5.4 → ^5.5.7 - @sveltejs/kit ^2.70.1 → ^2.70.2 (latest; ReDoS has no fix yet) - @tailwindcss/postcss ^4.3.1 → ^4.3.3 - eslint ^9.39.4 → ^9.39.5 - eslint-plugin-svelte ^3.19.0 → ^3.22.0 - globals ^17.6.0 → ^17.9.0 - prettier ^3.8.4 → ^3.9.6 - prettier-plugin-tailwindcss ^0.8.0 → ^0.8.1 - svelte ^5.56.3 → ^5.56.8 - svelte-check ^4.6.0 → ^4.7.5 - tailwindcss ^4.3.1 → ^4.3.3 - vite ^7.3.5 → ^7.3.6 - lightningcss-linux-x64-gnu 1.32.0 → 1.33.0 - lightningcss-linux-x64-musl 1.32.0 → 1.33.0 - @rollup/rollup-linux-x64-gnu ^4.62.0 → ^4.62.4 - @rollup/rollup-linux-x64-musl ^4.62.0 → ^4.62.4 Overrides added: - cookie → 0.7.1 (fixes out-of-bounds chars vuln) - dompurify → 3.4.13 (fixes XSS) - js-yaml → 4.3.1 (fixes CVE-2026-59870 ReDoS) - nanoid → 3.3.18 (fixes zero-size loop) Package version: 0.1.1 → 0.1.2 Vuln count: npm 6 → 0, Snyk 3 medium → 2 (1 remaining: @sveltejs/kit ReDoS, no fix yet). Build requires env vars (pre-existing).

snyk-io · 2026-08-09T10:14:31Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-08-09T10:14:51Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

…0260809 # Conflicts: # package-lock.json # package.json

…ties Lock file regenerated (fixed 0 on its own). Direct upgrades: none Overrides: qs 6.16.1 added; stale js-yaml 4.3.1 and nanoid 3.3.18 pins removed Vuln count: snyk 1 → 0, npm audit 3 → 2. Build verified passing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

snyk-io · 2026-10-26T15:57:43Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-10-26T15:58:15Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

…rabilities Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-10-29T09:05:07Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

cs-raj requested a review from a team August 9, 2026 10:14

cs-raj and others added 2 commits October 26, 2026 21:08

Merge remote-tracking branch 'origin/main' into fix/snyk-patch-deps-2…

d34b9f6

…0260809 # Conflicts: # package-lock.json # package.json

cs-raj requested a review from a team as a code owner October 26, 2026 15:57

cs-raj changed the title ~~fix: bump 18 deps and add 4 overrides to resolve Snyk vulnerabilities~~ fix: bump 17 deps and add 2 overrides to resolve Snyk vulnerabilities Oct 26, 2026

amit-kanswal-cs previously approved these changes Oct 27, 2026

View reviewed changes

fix: regenerate lock file and raise qs override to resolve Snyk vulne…

7000e0f

…rabilities Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cs-raj dismissed amit-kanswal-cs’s stale review via 7000e0f October 29, 2026 09:04

netrajpatel approved these changes Oct 29, 2026

View reviewed changes

cs-raj merged commit 510639f into main Oct 29, 2026
7 checks passed

cs-raj deleted the fix/snyk-patch-deps-20260809 branch October 29, 2026 09:23

cs-raj mentioned this pull request Nov 2, 2026

fix: regenerate lock file and bump deps to resolve Snyk vulnerabilities (0.1.4) #65

Merged

Navigation Menu

Repository navigation

fix: bump 17 deps and add 2 overrides to resolve Snyk vulnerabilities - #55

fix: bump 17 deps and add 2 overrides to resolve Snyk vulnerabilities#55
cs-raj merged 4 commits into
mainfrom
fix/snyk-patch-deps-20260809

cs-raj commented Aug 9, 2026 •

edited

Loading

Uh oh!

snyk-io Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

snyk-io Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

cs-raj commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Remaining

Uh oh!

snyk-io Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Aug 9, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

snyk-io Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Oct 26, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

github-actions Bot commented Oct 29, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cs-raj commented Aug 9, 2026 •

edited

Loading

snyk-io Bot commented Aug 9, 2026 •

edited

Loading

snyk-io Bot commented Oct 26, 2026 •

edited

Loading