fix(deps): raise fast-uri to patched 3.1.6 and re-scope the uuid override (+Claude)

[dhruv-parekh-cs]

Snyk dependency remediation — 27-Aug-2026

Automated dependency-vulnerability remediation pass (/snyk-fix). Base: development (this repo's real integration branch per pr_base_branch, not main).

Summary

Ecosystem	Issue	Severity	Package	Before → After	Class	Rationale
Node	SNYK-JS-FASTURI-19256867/69/71/73 (4 CVEs)	High	fast-uri	^3.1.5 → ^3.1.6	non-fixable (override)	Existing override floor sat below the patched release. Transitive via @contentstack/cli-utilities > conf > ajv > fast-uri (+3 other paths). Fixed versions per Snyk: 2.4.5, 3.1.6, 4.1.3; ^3.1.6 is the smallest that resolves it without crossing a major.
Node	GHSA-w5hq-g745-h8pq	Moderate	uuid	global ^11.1.1 → scoped to istanbul-lib-processinfo	non-fixable (override, re-scoped)	See self code review — the pre-existing global override was silently downgrading a runtime dependency.

Scope note: development already carried overrides for serialize-javascript, diff, and brace-expansion@1, so those advisories were already resolved on this branch's real base and needed no further change here. Only the two rows above are new work.

Ecosystem-native audit pass (step 1.5)

• npm audit before: 9 vulnerabilities (2 low, 4 moderate, 3 high) — measured against main, before the rebase onto development.
• npm audit fix (non---force): resolved 0 — every advisory sat behind a parent's declared range cap, so npm reported a fix as available but could not apply one. Remediation is via scoped overrides instead.
• npm audit after (on the development base): 1 high — adm-zip, see needs human review.
• npm audit fix --force was not run (prohibited by the skill — it performs major-version upgrades).
• No Go surface, no in-scope Dockerfile in this repo.

Self code review (step 7.5)

4 rounds. Findings:

• High — the uuid override was downgrading a runtime dependency. development carries a global "uuid": "^11.1.1". But @contentstack/cli-utilities — a runtime dependency — declares uuid@^14.0.0, so that global override silently pulled it back three majors to v11. The vulnerable range is <11.1.1, so v14 was never affected; the override was giving up three majors of runtime code for nothing.
  • Fixed by scoping it to istanbul-lib-processinfo (the dev-only nyc path that actually resolves a vulnerable copy).
  • Verified: @contentstack/cli-utilities → uuid@14.0.2 and nyc → istanbul-lib-processinfo → uuid@11.1.1 overridden.
• High — this branch was originally cut from the wrong base. It was built on main, but this repo sets pr_base_branch: development and development was 4 commits ahead, with changes to both files this run touches. Left alone, the PR would have conflicted with the real integration branch and re-proposed overrides that already existed there.
  • Fixed by rebasing onto origin/development and reconciling. Three conflicts (package.json, .talismanrc, package-lock.json) resolved by keeping development's existing entries and layering only the two genuine changes on top; the lockfile was regenerated from the resolved manifest rather than hand-merged.
• Medium — stray file-mode change. The rebase recorded 100644 → 100755 on package.json (development had already normalised it to 644). Fixed — mode matches the base, so the diff is content-only.
• Medium — stray whitespace change. An earlier round added a trailing newline the file did not have. Fixed.
• Low: none left open.

Round 4 found no High/Medium issues, so the loop exited.

Repo config change

• .talismanrc — the package-lock.json entry used a checksum, which goes stale the instant the lockfile changes. The pre-commit Talisman hook then blocked the commit, flagging npm's own sha512- integrity hashes as "base64 encoded texts" (a false positive on lockfile checksums, not a secret).
• Switched that one entry to the checksum-free ignore_detectors: [filecontent] form already used elsewhere in this same file, so it stays valid across future lockfile updates instead of breaking on every dependency change.
• No entry was removed and no other file's ignore was touched. Independently corroborated: this repo's pre-commit TruffleHog pass reports 0 verified and 0 unverified secrets.

Needs human review — NOT yet resolved

• adm-zip — GHSA-xcpc-8h2w-3j85 (High): crafted ZIP triggers 4GB memory allocation. Direct runtime dependency at ^0.5.18; the only fix is 0.6.0, a breaking major.
  • Attempted and reverted. 0.6.0 fails the build: src/adapters/file-upload.ts(344,10): error TS1345: An expression of type 'void' cannot be tested for truthiness.
  • Cause: writeZipPromise() changed its return from Promise<boolean> to Promise<void>, and file-upload.ts:343 branches on it (if (!status) { … this.exit(1) }).
  • Needs a human decision on the new success semantics — whether "no error thrown" should count as success — which is a behavior change outside this skill's minimal-adaptation rule.

Warnings

None blocking.

Validation

• npm install — clean
• npm run build — pass
• npm test — 135 passed, 8 suites
• snyk test --all-projects — 1 project, 463 dependencies, no vulnerable paths found (was 4 issues / 16 vulnerable paths)
• The repo's own pre-commit gate (Talisman + TruffleHog + Snyk) passed on commit.

GitHub Actions

No workflow changes needed — no runtime version was bumped, and .github/workflows/release.yml is already on node-version: "22.x".

🤖 Generated with Claude Code

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Copilot]

Pull request overview

This PR updates Node dependency overrides to remediate reported vulnerabilities (notably fast-uri) and adjusts the prior uuid override to avoid inadvertently downgrading a runtime dependency, while also making the Talisman ignore for package-lock.json resilient to future lockfile updates.

Changes:

• Raised the fast-uri override from ^3.1.5 to ^3.1.6 (patched minor).
• Re-scoped the uuid override to istanbul-lib-processinfo so runtime uuid@^14 consumers are no longer forced down to v11.
• Updated .talismanrc to ignore package-lock.json via ignore_detectors: [filecontent] instead of a lockfile-specific checksum.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Updates overrides to bump fast-uri and scope the uuid override to istanbul-lib-processinfo.
package-lock.json	Reflects regenerated lockfile resolution: fast-uri@3.1.6, uuid@14.0.2 hoisted, and scoped uuid@11.1.1 under istanbul-lib-processinfo.
.talismanrc	Makes the package-lock.json ignore stable across lockfile changes by using ignore_detectors instead of a checksum.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.