fix(deps): resolve 6 Snyk vulnerabilities via npm overrides (+Claude)

[dhruv-parekh-cs]

Automated Snyk remediation pass (/snyk-fix, run date 12-Aug-2026). Surface in scope: Node.js. Public repo — Conventional Commits used.

Summary

All six findings are transitive (nothing vulnerable is declared directly), so each is pinned through the existing overrides block. Caret ranges throughout, so future compatible patches aren't blocked.

Issue	Severity	Package	Path	Override added	Class
SNYK-JS-BRACEEXPANSION-18512280	High	brace-expansion 2.1.2	@oclif/core > ejs > jake > filelist > minimatch@5.1.9 > brace-expansion	"minimatch@5": { "brace-expansion": "^2.1.4" }	Non-fixable
SNYK-JS-BRACEEXPANSION-18313044	High	brace-expansion 5.0.7	@oclif/core > minimatch@10.2.5 > brace-expansion	"minimatch@10": { "brace-expansion": "^5.0.9" }	Non-fixable
SNYK-JS-BRACEEXPANSION-18512280	High	brace-expansion 5.0.7	@oclif/core > minimatch@10.2.5 > brace-expansion	same minimatch@10 entry (^5.0.9 satisfies both advisories)	Non-fixable
SNYK-JS-FASTURI-18021349	High	fast-uri 3.1.3	@contentstack/cli-utilities > conf > ajv@8.20.0 > fast-uri	"fast-uri": "^3.1.5"	Non-fixable
SNYK-JS-FASTURI-18506908	High	fast-uri 3.1.3	same	same (^3.1.5 satisfies both advisories)	Non-fixable
SNYK-JS-JSYAML-18593780	High	js-yaml 4.3.0	@contentstack/cli-utilities > js-yaml	"js-yaml": "^4.3.1"	Non-fixable

Why brace-expansion is path-scoped rather than a single top-level override

The tree holds two brace-expansion majors at once — 2.1.2 under minimatch@5 and 5.0.7 under minimatch@10 — needing ≥2.1.4 and ≥5.0.9 respectively. A single top-level "brace-expansion": "^5.0.9" would force minimatch@5's copy across a major boundary. The two path-scoped entries patch each in place instead, matching the "minimatch@3": { … } selector style already used elsewhere in this repo's overrides.

Application-code changes

None. package.json / package-lock.json plus one .talismanrc line — see below.

.talismanrc change (please review)

The Talisman pre-commit hook already allowlists package-lock.json by content checksum. The lockfile content changed, so its recorded checksum went stale and blocked the commit (Talisman flags npm integrity fields — base64 SHA-512 digests — as "base64 encoded texts"). Only that one checksum was updated to the value Talisman itself reported; no new file was allowlisted and no scan was bypassed.

Validation

• npm install — pass, no peer-dependency warnings
• npm test — pass
• npm run build — pass
• snyk test --all-projects re-scan — clean, 0 issues remaining (the repo's own pre-commit Snyk gate also reported "Tested 463 dependencies for known issues, no vulnerable paths found")

Needs human review

None for this repo.

---

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Copilot]

Pull request overview

Updates dependency resolution to remediate six transitive Snyk findings in this Node.js CLI repo by adding/adjusting npm overrides, regenerating the lockfile accordingly, and updating the Talisman allowlist checksum for the modified lockfile.

Changes:

• Added overrides entries to force patched versions of fast-uri, js-yaml, and brace-expansion (scoped by minimatch major).
• Updated package-lock.json to reflect the new override-driven dependency graph.
• Updated .talismanrc checksum for package-lock.json so pre-commit secret scanning does not block the changed lockfile.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds new overrides pins/scoped overrides to remediate transitive vulnerabilities.
package-lock.json	Lockfile refreshed to reflect overridden versions (e.g., fast-uri, js-yaml, brace-expansion).
.talismanrc	Updates stored checksum for the modified package-lock.json.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.