[dhruv-parekh-cs]

Summary

Automated snyk-fix sweep (02-Nov-2026). Retires two npm overrides entries that are no longer needed. No advisory is fixed by this PR and no dependency version changes: package-lock.json is untouched and the installed qs (6.16.2) and follow-redirects (1.16.2) are identical before and after.

Retired overrides (step 2.5)

Override	Why it is obsolete
"qs": "~6.16.2"	express@4.22.3 now declares qs ~6.16.0 and body-parser/@contentstack/management dedupe to it. A fresh resolution with no lockfile and no override yields qs 6.16.2 / 6.17.1, both at or above the override floor.
"follow-redirects": "^1.16.2"	A fresh resolution with no lockfile and no override picks follow-redirects 1.16.2 (the latest release) via axios.

Verification: after removal, npm install keeps the lock unchanged, npm run build passes, npm run test:unit (mocha + jest, 139 jest tests) passes, npm run test:integration (31 tests) passes, npm ci --dry-run accepts the lockfile, and the snyk test --all-projects result contains no qs or follow-redirects finding. The remaining overrides (tty-table > csv, tmp, serialize-javascript, diff) were each tested for removal and are still needed (their advisories return without them), so they are left in place.

Hooks bypassed (operator approved)

The commit and push were made with --no-verify, with explicit operator approval for this repo and this change only. The pre-commit hook runs snyk test --all-projects --fail-on=all, which fails on the four pre-existing, unfixable findings listed below (picomatch, adm-zip, deepmerge, minimatch). This PR does not touch them. The secrets scan was not part of the bypass concern: the diff is two removed lines in package.json.

Ecosystem-native audit (step 1.5)

npm audit: 61 (5 low, 56 moderate) before, 61 after. npm audit fix (non-force, run with the @contentstack scope pointed at npmjs.org, see below) rewrote about 370 lockfile lines but cleared no advisory (identical advisory set), so that churn was discarded. Everything remaining requires a breaking change (--force) and is dev-tooling (eslint, jest, mocha, nyc, oclif) or @oclif/core.

Snyk (--all-projects, 1 project: package-lock.json)

Findings are the same before and after this PR (4 distinct ids), none fixable without a risky change. Needs human review, not resolved by this PR:

• SNYK-JS-MINIMATCH-22111072 (medium, CVE-2026-118764): fixed only in minimatch 11.0.1, published 2026-11-01. @oclif/core pins ^10.2.5 and filelist pins 5.x. Tested a global override "minimatch": "^11.0.1": build, jest and integration tests pass, but it silently breaks mocha's test discovery (npm run test:unit fails with "No test files found", because mocha's glob needs minimatch 5 and 9). Reverted. A scoped override under @oclif/core was not attempted because it forces an untested major on a consumer that pins ^10. Revisit when @oclif/core ships a release on minimatch 11.
• SNYK-JS-PICOMATCH-21248802 (high, CVE-2026-112366, picomatch 4.0.5): fixedIn: [], vulnerable *, no upstream fix at any version (4.0.7 is latest).
• SNYK-JS-ADMZIP-21707815 (medium, CVE-2026-116137, adm-zip 0.6.1): fixedIn: [], vulnerable *, no upstream fix.
• SNYK-JS-DEEPMERGE-19964053 (medium, CVE-2026-93753, deepmerge 4.3.1 via @rollup/plugin-node-resolve): fixedIn: [], no upstream fix (stuck 3+ runs).

Warnings

• The repo-local .npmrc maps @contentstack to GitHub Packages, but @contentstack/cli-command and @contentstack/cli-utilities live on npmjs.org, so a plain npm audit fix fails with ETARGET. The audit run used --@contentstack:registry=https://registry.npmjs.org/ on the command line; no credential or config file was touched.
• npm test as a whole was not run as one command; its three parts (mocha unit, jest, integration) were run via npm run test:unit and npm run test:integration.
• No .github/workflows file needed a version sync (no runtime version changed).

Self code review (step 7.5)

2 rounds. Round 1 found one High: the trial minimatch ^11.0.1 override broke mocha test discovery and rewrote the dev-tool dependency tree (eslint, mocha, nyc); fixed by reverting it and parking the finding above. Round 2 over the final 2-line diff, re-derived from the current origin/development, found no High or Medium issues (no comments added or left behind, no tombstone, lockfile unchanged, no behavior surface touched).

#claude_code#
🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	10	25	✅ Passed
🟡 Medium Severity	5	7	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 10
• Medium without fixes: 7
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[dhruv-parekh-cs]

Reviewed the whole PR: no high or medium issues. Not approved: own PR.
Cross-repo (snyk-fix 02-Nov-2026 batch 4): independent dependency and image changes, any merge order.
— 🤖 launch-pr-review-agent (Claude)

---

Generated by Claude Code

[dhruv-parekh-cs]

Automated code review (snyk-fix 02-Nov-2026): 1 finding(s), High/Medium only.

[dhruv-parekh-cs]

[Medium] These two overrides aren't obsolete: they are the only manifest floor above the vulnerable versions.

In the resolved tree, express and body-parser declare qs ~6.16.0 (and @contentstack/management declares qs ^6.16.0), so 6.16.0 and 6.16.1 (SNYK-JS-QS-20943482 / SNYK-JS-QS-21755395) are still in range. axios declares follow-redirects ^1.16.0, so 1.16.1 (GHSA-mrwp-f3q8-3g9p) is also still in range. Today only package-lock.json keeps qs@6.16.2 / follow-redirects@1.16.2. A lockfile regeneration, a lockfile-conflict re-resolve, or an install from a mirror or cache that holds the older patch can silently put a vulnerable version back, with no override to stop it.

Suggested fix: keep both overrides. Retirement should wait until each parent's own declared range excludes the vulnerable versions, not just until the current resolution happens to land above them. That would make this PR a no-op, so closing it is reasonable.