Repository navigation
Conversation
…ilities Direct dep upgrades: @types/lodash 4.17.24 → 4.17.25 rimraf ^6.0.1 → ^6.1.3 ts-jest ^29.2.5 → ^29.4.12 Overrides added (transitive): @babel/core → 7.29.6 (fixes low: <=7.29.0) js-yaml → 3.15.1 (fixes high: <=3.15.0) Package version: 1.0.13 → 1.0.14 Vuln count: 2 high + 1 low (before) → 7 moderate (after). 7 moderate remain (jest/node-notifier chain, no safe fix available). Build verified passing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
…udit vulnerabilities Lock file regenerated (fixed 3 on its own vs master; on top of this PR it clears handlebars critical and brace-expansion high). Direct upgrades: none (this PR already has @types/lodash 4.17.25, rimraf ^6.1.3, ts-jest ^29.4.12) Overrides: js-yaml 3.15.1 → 3.15.2 (the 3.15.1 pin is inside GHSA-2883-xcg3-v3hh, fixed in 3.15.2); @babel/core 7.29.6 kept Vuln count: snyk 0 → 0, npm audit 13 → 7. Build verified passing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
amit-kanswal-cs
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
master's committed lock file carries 13 npm audit findings (1 critical, 3 high, 8 moderate, 1 low), all in the dev/test tree (jest, ts-jest, tslint, babel). Snyk test is clean (0): it reads only the production depsdebug,lodashandmongodb.Fix
This is a LIBRARY (
@contentstack/datasync-content-store-mongodb, published on npm): consumers resolve ourpackage.jsonranges themselves, so the lock file andoverridesonly change our own dev/CI install.@types/lodash4.17.25,rimraf^6.1.3,ts-jest^29.4.12; overrides@babel/core7.29.6 andjs-yaml3.15.2; version 1.0.13 → 1.0.14.js-yamloverride raised from 3.15.1 to 3.15.2: 3.15.1 is inside a high advisory (GHSA-2883-xcg3-v3hh, fixed in 3.15.2) reached through tslint and @istanbuljs/load-nyc-config.masterand regeneratedpackage-lock.json, which clearshandlebars(critical) andbrace-expansion(high). In the production tree only@mongodb-js/saslprepmoves (1.5.0 → 1.6.1)..talismanrc: thepackage-lock.jsonchecksum entry is replaced by afilecontent/base64contentignore, so the next lock regen does not trip Talisman.What remains (npm audit 7 moderate, dev-only): the
jest/ts-jest/node-notifier→uuidchain needs a major bump (jest 30, node-notifier 11).Verification:
npm run build-tspasses; Snyk 0 → 0, npm audit 13 → 7.🤖 Generated with Claude Code