From fcf225e7443f3951cc95fe7cd5ef8f8886ba8228 Mon Sep 17 00:00:00 2001 From: Harshi-Shah-CS Date: Wed, 4 Nov 2026 15:21:23 +0530 Subject: [PATCH 1/2] fix(deps): clear the Snyk findings that block every v2-dev commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pre-commit snyk test --fail-on=all failed on four findings already on v2-dev, so no commit could pass its hooks: - follow-redirects 1.16.1 (High, via axios): the lockfile moves to 1.16.2. - minimatch (Medium, SNYK-JS-MINIMATCH-22111072): @oclif/core moves 4.11.14 -> 4.14.0 in the lockfile, which drops the ejs > jake > filelist > minimatch 5 path. The advisory is fixed only in minimatch 11.0.1, and every @oclif/core 4 and 5 asks for ^10.2.5, so an override gives @oclif/core minimatch ^11.0.1. oclif calls only minimatch(name, pattern) in its plugin loader, which 11 keeps. - adm-zip 0.6.1 and deepmerge 4.3.1 (Medium) have no fixed release. A .snyk policy ignores each until 2026-12-04, with the reason: launch-cli only writes zips from local files and never parses one, and deepmerge is reached only through rollup's node-resolve with options launch-cli sets itself. The .talismanrc checksum for package.json is refreshed; Talisman flags its existing LNCH-SEC-* error codes, no secret. snyk test now finds no vulnerable paths. Build, lint and the full suite (3822 tests) pass. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Co-authored-by: Sakshi Koli --- .snyk | 22 +++++++ .talismanrc | 2 +- package-lock.json | 147 +++++++++++++++++++++++++++++++++++++++++++--- package.json | 3 + 4 files changed, 166 insertions(+), 8 deletions(-) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 00000000..c6762b2 --- /dev/null +++ b/.snyk @@ -0,0 +1,22 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.25.1 +# ignores vulnerabilities until expiry date; change duration by modifying expiry date +ignore: + SNYK-JS-ADMZIP-21707815: + - '*': + reason: >- + No fixed adm-zip release exists. launch-cli only builds a zip from the + user's own local files (src/uploads/upload.archive.ts) and never + parses an archive. Revisit when a fix ships. + expires: 2026-12-04T00:00:00.000Z + created: 2026-11-04T09:50:32.375Z + SNYK-JS-DEEPMERGE-19964053: + - '*': + reason: >- + No fixed deepmerge release exists. It is reached only through + @rollup/plugin-node-resolve during functions:serve, merging the plugin + options launch-cli sets itself, never external input. Revisit when a + fix ships. + expires: 2026-12-04T00:00:00.000Z + created: 2026-11-04T09:50:37.147Z +patch: {} diff --git a/.talismanrc b/.talismanrc index e44a06d..371c4f0 100644 --- a/.talismanrc +++ b/.talismanrc @@ -487,7 +487,7 @@ fileignoreconfig: - filename: src/commands/launch/secrets/list.test.ts checksum: 109d1165d7ce16943b50955f60fd8a753a870115fdf5501fb2a5e4a1cf436eaa - filename: package.json - checksum: 7ab7752a9256de42c91a49b77154596084534c183d22b91496f1f05a30011bf9 + checksum: 83e8c44d44e46b429f017de9af80e425d009ee0e660693e653365c7a0fbf701c - filename: test/integration/secrets-set.test.ts checksum: f01f5673125c48f537c593b9f8f3a728b6b16b42a3253c01f44558176ef48d89 - filename: src/secrets/secret.rules.test.ts diff --git a/package-lock.json b/package-lock.json index 3893485..c5988f3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2294,6 +2294,12 @@ "node": "^14.17.0 || ^16.13.0 || >=18.0.0" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "license": "BlueOak-1.0.0" + }, "node_modules/@istanbuljs/load-nyc-config": { "version": "1.1.0", "dev": true, @@ -2799,7 +2805,9 @@ } }, "node_modules/@oclif/core": { - "version": "4.11.14", + "version": "4.14.0", + "resolved": "https://registry.npmjs.org/@oclif/core/-/core-4.14.0.tgz", + "integrity": "sha512-QCJIZoVJxV7jywgVAUlsQwl3dr3Sa21kfi5z9KrYolbexWJUtFSEtMoNiBWojD05mYycLnB50gp/VxlGdaOCRA==", "license": "MIT", "dependencies": { "ansi-escapes": "^4.3.2", @@ -2807,10 +2815,9 @@ "clean-stack": "^3.0.1", "cli-spinners": "^2.9.2", "debug": "^4.4.3", - "ejs": "^3.1.10", + "ejs": "^6", "get-package-type": "^0.1.0", "indent-string": "^4.0.0", - "is-wsl": "^2.2.0", "lilconfig": "^3.1.3", "minimatch": "^10.2.5", "semver": "^7.8.1", @@ -2819,12 +2826,53 @@ "tinyglobby": "^0.2.17", "widest-line": "^3.1.0", "wordwrap": "^1.0.0", - "wrap-ansi": "^7.0.0" + "wrap-ansi": "^7.0.0", + "wsl-utils": "^0.4.0" }, "engines": { "node": ">=18.0.0" } }, + "node_modules/@oclif/core/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/@oclif/core/node_modules/ejs": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/ejs/-/ejs-6.0.1.tgz", + "integrity": "sha512-UaaM14yby8U3k02ihS1Bmj5Kz2d7CCQM1scxpgs4Mhkq8F1wR2gl3+Ts4h5Ne4Mnt7M9m4Dw7jsuMr3+xO4vZA==", + "license": "Apache-2.0", + "bin": { + "ejs": "bin/cli.js" + }, + "engines": { + "node": ">=0.12.18" + } + }, + "node_modules/@oclif/core/node_modules/minimatch": { + "version": "11.0.4", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.4.tgz", + "integrity": "sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==", + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/@oclif/plugin-help": { "version": "6.2.53", "license": "MIT", @@ -6072,6 +6120,7 @@ }, "node_modules/ejs": { "version": "3.1.10", + "dev": true, "license": "Apache-2.0", "dependencies": { "jake": "^10.8.5" @@ -7284,6 +7333,7 @@ }, "node_modules/filelist": { "version": "1.0.6", + "dev": true, "license": "Apache-2.0", "dependencies": { "minimatch": "^5.0.1" @@ -7291,12 +7341,14 @@ }, "node_modules/filelist/node_modules/balanced-match": { "version": "1.0.2", + "dev": true, "license": "MIT" }, "node_modules/filelist/node_modules/brace-expansion": { "version": "2.1.7", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", + "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -7304,6 +7356,7 @@ }, "node_modules/filelist/node_modules/minimatch": { "version": "5.1.9", + "dev": true, "license": "ISC", "dependencies": { "brace-expansion": "^2.0.1" @@ -7395,9 +7448,9 @@ "license": "MIT" }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", @@ -8851,6 +8904,39 @@ "node": ">=0.10.0" } }, + "node_modules/is-inside-container": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz", + "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==", + "license": "MIT", + "dependencies": { + "is-docker": "^3.0.0" + }, + "bin": { + "is-inside-container": "cli.js" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/is-inside-container/node_modules/is-docker": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz", + "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==", + "license": "MIT", + "bin": { + "is-docker": "cli.js" + }, + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/is-interactive": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz", @@ -9181,6 +9267,7 @@ }, "node_modules/jake": { "version": "10.9.4", + "dev": true, "license": "Apache-2.0", "dependencies": { "async": "^3.2.6", @@ -10614,6 +10701,7 @@ }, "node_modules/minimatch": { "version": "10.2.5", + "dev": true, "license": "BlueOak-1.0.0", "dependencies": { "brace-expansion": "^5.0.5" @@ -10629,6 +10717,7 @@ "version": "5.0.12", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -11271,6 +11360,7 @@ }, "node_modules/picocolors": { "version": "1.1.1", + "dev": true, "license": "ISC" }, "node_modules/picomatch": { @@ -11437,6 +11527,18 @@ "node": ">= 0.4" } }, + "node_modules/powershell-utils": { + "version": "0.1.0", + "resolved": "https://registry.npmjs.org/powershell-utils/-/powershell-utils-0.1.0.tgz", + "integrity": "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==", + "license": "MIT", + "engines": { + "node": ">=20" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/prelude-ls": { "version": "1.2.1", "dev": true, @@ -14039,6 +14141,37 @@ "node": "^12.13.0 || ^14.15.0 || >=16.0.0" } }, + "node_modules/wsl-utils": { + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.4.0.tgz", + "integrity": "sha512-9YmF+2sFEd+T7TkwlmE337F0IVzfDvDknhtpBQxxXzEOfgPphGlFYpyx0cTuCIFj8/p+sqwBYAeGxOMNSzPPDA==", + "license": "MIT", + "dependencies": { + "is-wsl": "^3.1.0", + "powershell-utils": "^0.1.0" + }, + "engines": { + "node": ">=20" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/wsl-utils/node_modules/is-wsl": { + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz", + "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==", + "license": "MIT", + "dependencies": { + "is-inside-container": "^1.0.0" + }, + "engines": { + "node": ">=16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/xdg-basedir": { "version": "4.0.0", "license": "MIT", diff --git a/package.json b/package.json index 8b34e06..3dd1049 100644 --- a/package.json +++ b/package.json @@ -144,6 +144,9 @@ "brace-expansion@1": "^1.1.21", "istanbul-lib-processinfo": { "uuid": "^11.1.1" + }, + "@oclif/core": { + "minimatch": "^11.0.1" } }, "engines": { From 6cad21396f5efe7cbea96f8e7d497d831099bed5 Mon Sep 17 00:00:00 2001 From: Harshi-Shah-CS Date: Wed, 4 Nov 2026 18:10:35 +0530 Subject: [PATCH 2/2] chore(deps): drop the .snyk ignores MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit snyk test --fail-on=all fails only on findings that have an upgrade or patch. adm-zip 0.6.1 and deepmerge 4.3.1 have neither, so the pre-commit hook and CI's security-sca check (SLA based) already pass without ignoring them. The hook was blocked only by follow-redirects and minimatch, which this PR fixes. Both remain reported, so they stay visible until a fix ships. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Co-authored-by: Sakshi Koli --- .snyk | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 .snyk diff --git a/.snyk b/.snyk deleted file mode 100644 index c6762b2..00000000 --- a/.snyk +++ /dev/null @@ -1,22 +0,0 @@ -# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. -version: v1.25.1 -# ignores vulnerabilities until expiry date; change duration by modifying expiry date -ignore: - SNYK-JS-ADMZIP-21707815: - - '*': - reason: >- - No fixed adm-zip release exists. launch-cli only builds a zip from the - user's own local files (src/uploads/upload.archive.ts) and never - parses an archive. Revisit when a fix ships. - expires: 2026-12-04T00:00:00.000Z - created: 2026-11-04T09:50:32.375Z - SNYK-JS-DEEPMERGE-19964053: - - '*': - reason: >- - No fixed deepmerge release exists. It is reached only through - @rollup/plugin-node-resolve during functions:serve, merging the plugin - options launch-cli sets itself, never external input. Revisit when a - fix ships. - expires: 2026-12-04T00:00:00.000Z - created: 2026-11-04T09:50:37.147Z -patch: {}