[Harshi-Shah-CS]

What

The pre-commit snyk test --all-projects --fail-on=all fails on four findings that are already on v2-dev, so no commit there can pass its hooks. This PR clears all four:

• follow-redirects 1.16.1 → 1.16.2 (High, SNYK-JS-FOLLOWREDIRECTS-21762031, via axios), in the lockfile.
• minimatch (Medium, SNYK-JS-MINIMATCH-22111072): @oclif/core 4.11.14 → 4.14.0 in the lockfile, which drops the ejs > jake > filelist > minimatch@5 path. The fix exists only in minimatch 11.0.1, and every @oclif/core 4 and 5 release asks for ^10.2.5, so an override gives @oclif/core minimatch ^11.0.1. oclif calls only minimatch(name, pattern) in its plugin loader, and 11 keeps that.
• adm-zip 0.6.1 (SNYK-JS-ADMZIP-21707815) and deepmerge 4.3.1 (SNYK-JS-DEEPMERGE-19964053), both Medium, have no fixed release. A new .snyk policy ignores each until 2026-12-04 and gives the reason:
  • adm-zip: launch-cli only writes a zip from the user's own files (src/uploads/upload.archive.ts) and never parses one.
  • deepmerge: it is reached only through @rollup/plugin-node-resolve during functions:serve, merging options launch-cli sets itself.

Note: npm overrides and the lockfile only apply to installs of this repo (dev, CI, Snyk). A user's csdx plugins:install resolves @oclif/core's own ^10 minimatch, as it already does for every other override here.

Tests

• snyk test --all-projects --fail-on=all: no vulnerable paths found.
• npm run build, npm run lint and npm test all pass (193 suites, 3822 tests). csdx launch help loads.
• The commit went through every husky hook (prepack, lint-staged, Talisman + trufflehog, Snyk). Nothing used --no-verify.

#claude_code#
🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[dhruv-parekh-cs]

Reviewed the whole PR: no high or medium issues. The @oclif/core → minimatch ^11 override is API-compatible (core only calls the named minimatch() export), and both .snyk ignores expire on 4 Dec 2026.

Cross-repo (CL-7174): merge order is #281 → #282 → contentfly-dev-workspace#180. #180's 50-lifecycle GitHub create answers "Add environment variables" with a bare Enter, which a CLI built before #282 refuses (the checklist still requires a selection), so run the harness only against a CLI that includes #282.

— 🤖 launch-pr-review-agent (Claude)

---

Generated by Claude Code

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed