Skip to content

fix(deps): resolve Snyk vulnerabilities in transitive dependencies - #74

Merged
cs-raj merged 4 commits into
mainfrom
fix/snyk-vulnerability-resolution
Oct 29, 2026
Merged

fix(deps): resolve Snyk vulnerabilities in transitive dependencies#74
cs-raj merged 4 commits into
mainfrom
fix/snyk-vulnerability-resolution

Conversation

@cs-raj

@cs-raj cs-raj commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Snyk flags 20 findings on main's committed lock file (2 critical, 12 high), mostly undici 8.12.1, plus qs, nuxt / @nuxt/nitro-server 4.6.1, serialize-javascript and postcss-selector-parser. This is an APP (Nuxt SSR starter), so the lock file is what ships.

Fix

  • Merged main into this branch. Conflicting lines in package.json take main's values (version 1.1.7, nuxt ^4.6.0, vue ^3.5.43). The branch's qs and undici overrides stay.
  • Regenerated package-lock.json. That alone clears 15 findings: undici 8.12.3, qs 6.16.1, nuxt and @nuxt/nitro-server 4.6.2, serialize-javascript 7.1.4, postcss-selector-parser 6.1.5.
  • No direct bumps, no new overrides, no version bump.

Still open (5 Snyk, 9 npm audit), with no safe fix:

  • braces, picomatch, deepmerge, node-forge: no fixed version published
  • ioredis 5.11.1: fix only in 6.0.0-beta.1 (major, transitive)
  • nuxt / nitropack / listhen chain (npm audit): only npm audit fix --force, which downgrades nuxt; tailwindcss 3 / postcss-nested: no fix in this major
  • 12 lightningcss MPL-2.0 licence findings: not fixable by a dependency change

Verification: npm run build passes; Snyk 20 → 5, npm audit 11 → 9.

🤖 Generated with Claude Code

@cs-raj @claude
fix(deps): resolve Snyk vulnerabilities in transitive dependencies
8dd51e3 
Pin undici to 8.10.2 and qs to 6.16.0 via overrides, resolving 13 of 14
security findings (2 critical, 7 high, 5 medium -> 1 high remaining).

- undici 8.10.0 -> 8.10.2 (11 issues: improper certificate validation,
  origin validation error, resource leaks, request smuggling, cookie
  handling, uncaught exceptions)
- qs 6.15.3 -> 6.16.0 (2 issues: unbounded resource allocation,
  uncaught exception)
- vue 3.5.41 -> 3.5.42, vue-router 5.2.0 -> 5.3.1 (latest minor/patch)

node-forge 1.4.0 (high, improper cryptographic signature verification)
has no published fix; 1.4.0 is the latest release. Left unresolved.

npm audit: 3 moderate -> 0. Build verified with nuxt build.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@cs-raj
cs-raj requested a review from a team as a code owner September 10, 2026 12:59
@snyk-io

snyk-io Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 2 25 ✅ Passed
🟡 Medium Severity 0 24 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 2
  • Medium without fixes: 24
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

netrajpatel
netrajpatel previously approved these changes Sep 10, 2026
View reviewed changes
amit-kanswal-cs
amit-kanswal-cs previously approved these changes Sep 11, 2026
View reviewed changes

@amit-kanswal-cs amit-kanswal-cs left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

cs-raj and others added 2 commits October 26, 2026 19:13
@cs-raj
Merge remote-tracking branch 'origin/main' into fix/snyk-vulnerabilit…
96209d1 
…y-resolution
@cs-raj @claude
fix: regenerate lock file to resolve Snyk vulnerabilities
46c81d7 
Lock file regenerated (fixed 15 on its own).
Direct upgrades: none (nuxt resolves 4.6.1 -> 4.6.2 within ^4.6.0)
Overrides: none added (existing qs ^6.16.0 and undici ^8.10.2 kept; now resolve to qs 6.16.1, undici 8.12.3)
Vuln count: snyk 20 → 5, npm audit 11 → 9. Build verified passing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 80 25 ✅ Passed
🟡 Medium Severity 0 25 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 80
  • Medium without fixes: 25
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj @claude
fix: regenerate lock file to resolve Snyk vulnerabilities
4eddbd1 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 79 25 ✅ Passed
🟡 Medium Severity 0 25 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 79
  • Medium without fixes: 25
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj
cs-raj merged commit ac63ae7 into main Oct 29, 2026
7 checks passed
@cs-raj
cs-raj deleted the fix/snyk-vulnerability-resolution branch October 29, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@netrajpatel netrajpatel netrajpatel approved these changes
@aniket-shikhare-cstk aniket-shikhare-cstk aniket-shikhare-cstk left review comments
@amit-kanswal-cs amit-kanswal-cs amit-kanswal-cs left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cs-raj @netrajpatel @aniket-shikhare-cstk @amit-kanswal-cs