Skip to content

fix: regenerate lock file to resolve Snyk vulnerabilities - #116

Closed
cs-raj wants to merge 1 commit into
masterfrom
fix/snyk-patch-deps-20261014
Closed

cs-raj wants to merge 1 commit into
masterfrom
fix/snyk-patch-deps-20261014

Conversation

@cs-raj

@cs-raj cs-raj commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Problem

Snyk/npm audit flagged vulnerable transitive versions in the committed lock file of this LIBRARY (published as @contentstack/datasync-manager).

Fix

  • Regenerated package-lock.json from scratch: npm audit critical 1 -> 0, high 50 -> 49.
  • No direct bump or override added: no patch/minor bump clears a finding, and consumers resolve our package.json ranges themselves, so overrides would only affect our own install.
  • Package version 2.3.1 -> 2.3.2.

Remaining (all dev-tooling, major bump needed, no safe in-range fix): jest 29 -> 30, semantic-release / @semantic-release/* , jest-html-reporter, node-notifier, tslint, and uuid/js-yaml/npm-bundled copies. Snyk test reports 0 findings before and after.

Verified: npm run compile passes; npm audit 61 -> 62 total (moderate +3 from newly published advisories).

🤖 Generated with Claude Code

Lock file regenerated (npm audit critical 1 -> 0, high 50 -> 49).
Direct upgrades: none (no patch/minor bump clears a finding)
Overrides: none
Vuln count: snyk 0 -> 0, npm audit 61 -> 62 (moderate 10 -> 13 from newly published advisories). Build verified passing.
Package version 2.3.1 -> 2.3.2.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings October 14, 2026 08:49
@cs-raj
cs-raj requested a review from a team as a code owner October 14, 2026 08:49
@snyk-io

snyk-io Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No blocking issues were identified, and compilation passes.

0 open findings

What changed in this PR

Regenerates the lock file to refresh transitive dependencies and bumps the package version to 2.3.2.

Changes:

  • Updates the package version from 2.3.1 to 2.3.2.
  • Refreshes dependency resolutions and lockfile metadata.
  • Leaves runtime dependency declarations unchanged.
File Description
package.json Updates the package version.
package-lock.json Refreshes locked dependencies and integrity metadata.

🧠 Review effort: Lite


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@cs-raj

cs-raj commented Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Closing: this only regenerated the lock file and bumped the version, and no Snyk finding changes (0 before, 0 after). Not needed.

@cs-raj cs-raj closed this Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants