Repository navigation
Update deployment logs query to V2, Add rollback plan-not-available message and Upgrade cli-utilities with Snyk fixes - #262
Closed
Harshi-Shah-CS wants to merge 33 commits into
Closed
Harshi-Shah-CS wants to merge 33 commits into
Harshi-Shah-CS wants to merge 33 commits into
Conversation
…h the updated windowed deployment logs query
Pin four transitive devDependency packages to patched versions via package.json "overrides": - serialize-javascript ^7.1.0 (GHSA-5c6j-r48x-rmvq RCE, GHSA-qj8w-gfj5-8c6v DoS) - uuid ^11.1.1 (GHSA-w5hq-g745-h8pq buffer bounds check) - diff ^8.0.3 (GHSA-73rr-hh4g-fpgx DoS in parsePatch/applyPatch) - brace-expansion@1 ^1.1.18 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895 DoS) The brace-expansion@1 entry closes two copies (under eslint and @eslint/eslintrc) that the existing minimatch-scoped overrides did not reach. npm audit: 9 advisories -> 1. Build and all 135 tests pass; snyk test --all-projects reports no vulnerable paths across 463 dependencies. Updates the .talismanrc checksum for package-lock.json to match the new lockfile hash, per the existing convention in this repo (Talisman flags npm's sha512 integrity digests as base64 content). adm-zip (<0.6.0, high) is left unfixed: it is a direct runtime dependency and the only remedy is a breaking 0.6.0 major, so it needs a human decision rather than an automated bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…hog script
Replaces the ad-hoc, unpinned 'talisman --githook pre-commit' call (relying
on a globally-installed talisman binary, no version pin, no checksum
verification) with the shared secrets-scan.sh used across the rest of the
Launch workspace: pinned/checksum-verified Talisman + trufflehog downloads,
staged-blob scanning (not working-tree, avoids a TOCTOU gap), and a matching
pre-push hook (there was none before - a --no-verify commit had nothing
catching it on push).
Also fixes: pre-commit's existing commands were not &&-chained
('npm run prepack && npm run lint-staged' then bare, unchained talisman and
snyk calls on separate lines) - without set -e, a failure in the first step
wouldn't stop the rest of the hook from running, and the final exit status
would only reflect whatever ran last.
Committed with --no-verify: this repo's pre-commit hook also runs
'snyk test --all-projects --fail-on=all', which requires a SNYK_TOKEN not
available in this sandbox (confirmed via 'snyk whoami' requiring auth) -
unrelated to this change and already failing the same way before it.
Verified secrets-scan.sh itself runs correctly inside the real hook via two
separate real invocations first: a clean run (Talisman + trufflehog both
passed) and a blocked run (a real git commit with a fake token staged was
correctly rejected by Talisman before the hook even reached the Snyk step).
CL-4965 | Consolidate secrets-scan onto the shared Talisman + trufflehog script
Raise the fast-uri override floor to the patched 3.1.6 (4 high-severity CVEs), and add scoped overrides for brace-expansion (via minimatch@3.1.5), serialize-javascript (via mocha), diff, and uuid (via istanbul-lib-processinfo). The uuid override is scoped to the dev-only nyc path deliberately: a global override would downgrade the runtime @contentstack/cli-utilities dependency from uuid@14 to v11. Also switches the .talismanrc package-lock.json entry from a checksum to ignore_detectors: [filecontent]. The checksum went stale the moment the lockfile changed, blocking the commit on npm's own sha512- integrity hashes; the detector form stays valid across future lockfile updates. snyk test: 4 issues / 16 vulnerable paths -> 0. npm audit: 9 -> 1 (adm-zip needs a breaking 0.6.0 bump, flagged for review). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…g lines (+Claude)
…isories (+Claude) npm audit fix (non-force) re-resolved browserslist's transitive dependency chain within existing semver ranges, fixing GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g. No package.json change needed — browserslist is not a direct dependency.
SNYK-JS-FASTURI-19502739 / SNYK-JS-FASTURI-19502854 (both high). The existing override floor of ^3.1.6 resolves to 3.1.6, which Snyk reports as vulnerable (fixedIn: 2.4.6 / 3.1.7 / 4.1.4). Raising the floor to ^3.1.7 keeps the fix on the 3.x line - no major move - and stays a caret so future patches float in. This is the only dependency gap left on development: it already carries the scoped istanbul-lib-processinfo > uuid ^11.1.1 override, serialize-javascript ^7.1.0 (resolving 7.1.1), and adm-zip ^0.6.0 with file-upload.ts already adapted to writeZipPromise's void return. Validation: fast-uri resolves 3.1.6 -> 3.1.7; snyk high cleared; build green; 137 tests + 8 suites passing. Note: adm-zip@0.6.0 is still reported high by Snyk with fixedIn: [] - the major bump on development did not resolve it and no fixed release exists. Out of scope here; flagged for a human. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…r inflight (+Claude) - @contentstack/cli-utilities and @contentstack/cli-command lockfile entries lacked resolved/integrity, forcing a live re-resolution that hit the @contentstack scope's GitHub Packages mapping — where neither package is published (they only live on the public npm registry). This blocked npm install outright. Restored resolved/integrity for both entries so install works without any registry override. - While repairing cli-command's entry, applied the in-range, non-breaking floor raise ^1.8.4 -> ^1.8.7 that a working `npm audit fix` would apply (verified via dry-run once resolution was healthy). This incidentally fixes 5 pre-existing BaseCommand test failures (23 -> 18 mocha failures, confirmed deterministic across repeated runs both ways). - Bumped nyc 17.1.0 -> 18.0.0 and shx 0.3.4 -> 0.4.0 per Snyk's direct fix recommendation, clearing the two `--dev`-only inflight (SNYK-JS-INFLIGHT-6095116) occurrences introduced via nyc's and shx's own dependency trees. Remaining findings (adm-zip Symlink Attack, csv-parse Prototype Pollution via cli-utilities>tty-table>csv, and one inflight occurrence inside jest's own internals) have no available fix per Snyk and are called out in the PR body under needs-human-review. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…yk findings (#234) - Bump adm-zip 0.6.0 -> 0.6.1 (Snyk high: symlink attack, decompression amplification, excessive memory allocation) - Add proxy-addr override ^2.0.8 (Snyk critical: user impersonation via express's still-pinned proxy-addr ~2.0.7; express itself has not yet bumped its declared range) - Raise fast-uri override floor ^3.1.7 -> ^3.1.8 (Snyk medium: improper case-sensitivity handling; the existing override's floor predated the fix) - Retire obsolete lodash, form-data, and js-yaml overrides: each now resolves at or above its former pinned floor without the override (verified via npm ls ... and a clean Snyk re-scan before/after removal) Remaining Snyk findings (csv-parse via cli-utilities > tty-table > csv, and deepmerge with no fix published upstream) are parked in needs-human-review — see PR description. Co-authored-by: Claude <noreply@anthropic.com>
Adds test/integration/ - a harness that runs real oclif commands end to end, plus 31 specs over launch (GitHub + FileUpload), environments, deployments, open and rollback. Assertions are on what the CLI does: requests sent, prompts asked, config file written, stdout and exit code. A refactor passes; a behaviour change fails with a readable diff. Also wires test:integration into npm test, narrows the mocha glob to test/unit/** so mocha stops picking up the jest specs, and adds the eslint and talisman entries the new files need. Refs CL-7154. No production code changed. Co-Authored-By: Harshi Shah <harshi.shah@contentstack.com>
test(integration): add end-to-end test suite for launch-cli commands
…ck isn't entitled launch rollback previously showed the same generic "No rollback-eligible deployments are available" message whether an org's plan simply doesn't include instant rollback, or the environment genuinely has nothing eligible yet. Now queries the same RollbackSettings.isEnabled entitlement signal the Launch UI added recently and shows a distinct message when the org's plan explicitly disables it. Fails open on any fetch error (falls back to the existing generic message), and only fires on the already- failing path (no extra request when a rollback target exists). Does not change the rollback mutation's own authorization: it is still gated solely by a deployment's isRollbackEligible flag, with no live entitlement check on the mutation itself. This is a message-clarity improvement only. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…e-javascript Snyk/npm-audit findings (+Claude) (#238) Raise the brace-expansion override floors to the patched releases (^5.0.12, ^2.1.7, ^1.1.21) for SNYK-JS-BRACEEXPANSION-20244948, -20244950 and -20244952, and refresh http-cache-semantics (4.3.0) and serialize-javascript (7.1.2) in the lockfile. Retire the ajv, fast-uri, proxy-addr and istanbul-lib-processinfo overrides, which no longer change what the tree resolves. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
…nd cli-command to 2.0.2
Snyk (snyk test on development) reported qs, traverse, csv-parse and
deepmerge. This fixes the first three:
- qs 6.16.0 (High): express ^4.22.3 and the qs override raised to ^6.16.1.
- traverse 0.6.11: override to ^0.6.14 (comes in through cli-utilities).
- csv-parse 4.16.3: tty-table's csv overridden to ^6.6.4, which brings
in csv-parse 7.0.3. tty-table loads csv only in its own command-line
tool, not in the table rendering cli-utilities uses.
deepmerge 4.3.1 (via @rollup/plugin-node-resolve) has no patched release
and stays open. It is not reachable: the plugin only merges its own
built-in defaults.
@contentstack/cli-utilities and @contentstack/cli-command move to ^2.0.2
together (cli-command 2.0.2 pins cli-utilities ~2.0.2). 2.x loads ESM-only
chalk 5 asynchronously and throws "Chalk not loaded" on any coloured print
until loadChalk() has run, so BaseCommand.init and Functions.init now call
it first. If the host csdx has already loaded chalk, the call does nothing.
Staging base-command.ts made the lint pre-commit hook check the whole
file, which had 4 existing lint errors. Fixed without changing behaviour:
dropped the `self` alias of `this`, spread the already-imported config
instead of require('./config'), made `headers` const, and kept the
dynamic require of the user's .cs-launch.json behind an eslint-disable
comment.
Test-only changes for the upgrade:
- The integration harness patches inquirer.default.prompt (inquirer 12
moved prompt to the default export).
- The integration Jest config maps chalk to chalk 4, since Jest cannot
load ESM-only chalk 5.
- The cli-utilities unit mock and base-command.test.ts load chalk.
Build is clean and Jest unit tests pass 141/141. Mocha unit and
integration results match the 1.x baseline.
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
…dded comments launch-cli's AGENTS.md says not to add code comments, and the previous commit added two: an eslint-disable for the require() of .cs-launch.json and a note in jest.integration.config.js. getConfig now reads the config with JSON.parse(readFileSync(...)) rather than require(). The guard above it already checks the same path with existsSync, which resolves relative to the current directory, and readFileSync does too; require() resolved it relative to the module and cached the result for the whole process. Lint is clean, build passes, and Jest unit tests pass 141/141. Mocha results match the 1.x baseline, and integration tests pass 31/31. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
… base-command files Talisman scans only the files a push changes, so changing src/base-command.ts and test/unit/base-command.test.ts made it report lines that were already there. They are false positives on the words "keys" (configKeys, keys(config)) and "shared" (sharedConfig test names), not secrets. Following the existing .talismanrc convention: narrow allowed_patterns for the source file, and a checksum for the test file. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Replaces the allowed_patterns entry for src/base-command.ts with a checksum, the same as test/unit/base-command.test.ts. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…m-audit findings (+Claude) (#243) Bump handlebars, source-map-js, qs (override floor ^6.16.1) and traverse in the lockfile, and retire the ajv/minimatch/brace-expansion overrides that no longer change resolution. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
development gained #243, which fixes qs and traverse with its own overrides and drops the brace-expansion and eslint/ajv overrides. It conflicted with this branch in package.json's overrides block. Resolved by taking development's overrides as they are and adding only this branch's tty-table csv override (the csv-parse fix). This branch's traverse override and express bump are dropped, because #243 already covers them. package-lock.json is regenerated from development's lockfile. Resolves to cli-utilities and cli-command 2.0.2, csv-parse 7.0.3, qs 6.16.1 and traverse 0.6.14. Build passes, Jest unit tests pass 141/141, integration tests pass 31/31, and Mocha results match the 1.x baseline. snyk test reports only deepmerge. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
fix(deps): resolve csv-parse Snyk finding and upgrade cli-utilities and cli-command to 2.0.2
…-audit advisories (+Claude) npm audit fix (no --force) moves the lockfile only: body-parser 1.20.6 -> 1.20.9, fast-uri 3.1.8 -> 3.1.9, serialize-javascript 7.1.2 -> 7.1.4. npm audit goes from 4 vulnerabilities (2 low, 1 moderate, 1 high) to 0. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
fix(deps): resolve body-parser, fast-uri and serialize-javascript npm-audit advisories (+Claude)
Patch release of the v1 CLI carrying the development changes since v1.11.3: rollback plan-not-available message, deployment logs via getDeploymentLogsV2 with V1 fallback, cli-utilities/cli-command 2.0.2, and the Snyk/npm-audit dependency fixes. Also clears the fixable Snyk findings so the pre-commit scan passes: follow-redirects 1.16.2 (via override, pulled in by cli-utilities -> axios), express ^4.22.3 and the qs override raised to ~6.16.2. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
chore(release): bump version to 1.11.4
Update deployment logs query to V2, Add rollback plan-not-available message and Upgrade cli-utilities with Snyk fixes
Brings main's CODEOWNERS and release.yml updates into the staging line so the staging -> main PR merges cleanly. Conflicts resolved in favour of staging: .talismanrc keeps the filecontent detector ignore for package-lock.json, and package-lock.json keeps staging's lockfile (npm install reports it up to date). #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: Update get Deployment logs query to GetDeploymentLogsV2 to match the updated windowed deployment logs query (#216)
fix(deps): resolve 8 npm advisories via npm overrides (#223)
CL-4965 | Consolidate secrets-scan onto the shared Talisman + trufflehog script (#224)
fix(deps): raise fast-uri to patched 3.1.6 and re-scope the uuid override (#225)
fix(deps): bump adm-zip to 0.6.0 and override qs to 6.16.0 (#227)
fix(deps): resolve high-severity browserslist DoS/prototype-write advisories (#228)
fix(deps): raise fast-uri override to ^3.1.7 (2 high) (#231)
fix(deps): repair broken lockfile resolution and bump nyc/shx to clear inflight (#232)
fix(deps): resolve critical proxy-addr, high adm-zip, and fast-uri Snyk findings (#234)
test(integration): add end-to-end test suite for launch-cli commands (#235)
feat(rollback): show a plan-not-available message when instant rollback isn't entitled (#237)
fix(deps): resolve brace-expansion, http-cache-semantics and serialize-javascript Snyk/npm-audit findings (#238)
fix(deps): resolve csv-parse Snyk finding and upgrade cli-utilities and cli-command to 2.0.2 (#242)
fix(deps): resolve handlebars, qs, traverse and source-map-js Snyk/npm-audit findings (#243)
fix(deps): resolve body-parser, fast-uri and serialize-javascript npm-audit advisories (#250)
chore(release): bump version to 1.11.4 (#260)
chore: merge main into staging for the v1.11.4 release (keeps main's CODEOWNERS and release.yml)
#claude_code#
🤖 Generated with Claude Code