Repository navigation
fix: resolve Snyk vulnerabilities across all extension roots - #718
Merged
Merged
Conversation
Lock files regenerated in 14 roots (fixed most findings on their own). Direct upgrades: @contentstack/venus-components 3.0.2 -> 3.0.6 (variable-app) Overrides: none Not touched: youtube/youtube-extension and youtube/youtube-extension-popup (build already fails on master: terser missing) Vuln count: snyk 293 -> 86, npm audit 248 -> 150. Builds verified passing in the 12 roots that have one. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
🔴 Critical Severity - SLA Breached Issues (with fixes)Showing 6 issue(s) that have exceeded the 15-day SLA threshold:
🟠 High Severity - SLA Breached Issues (with fixes)Showing 16 issue(s) that have exceeded the 30-day SLA threshold:
🟡 Medium Severity - SLA Breached Issues (with fixes)Showing 20 issue(s) that have exceeded the 90-day SLA threshold:
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
❌ BUILD FAILED - Security checks failed Please review and fix the security vulnerabilities before merging. |
…r SLA breaches youtube/youtube-extension, youtube/youtube-extension-popup: vite ^7.3.0, @vitejs/plugin-react ^5.1.2, terser ^5.51.2 (the build was already failing on master: terser missing), lock files regenerated (axios 1.13.5 -> 1.20.0). youtube-extension-popup: moment 2.29.4 -> 2.31.0. variable-app: react-router-dom ^6.3.0 -> ^7.18.0 (declared but not imported in src). Vuln count: snyk 86 -> 3, npm audit 150 -> 127. Builds verified passing in all 14 roots with a build script. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
cs-raj
changed the title
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
aniket-shikhare-cstk
approved these changes
Oct 15, 2026
rahul-contentstack
approved these changes
Oct 16, 2026
pritesh-jain-cstk
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Clears the security findings Snyk and npm audit report for this repo, and the SLA breaches the
security-scacheck was failing on. It mostly regenerates each app'spackage-lock.json(so dependencies move to their newest allowed patched versions) and makes a handful of smallpackage.jsonchanges.Overall: Snyk issues 293 → 3 (0 critical, 2 high, 1 medium), npm audit 248 → 127. All 14 apps that have a build script build successfully. CI is green, including
security-sca.Per app
brightcove/brightcovebrightcove/brightcove-popupbrightcove/lambdadashboard-widget-google-analytics.../lambdagoogle-analytics.../lambdaexternal-api-lookup-templatejson-editormarketo-formsoptimizelyoptimizely-experimentstext-intelligencevariable-apppackage.jsonyoutube/youtube-extensionpackage.jsonyoutube/youtube-extension-popuppackage.json"n/a (dev tooling only)" means those apps only declare devDependencies (gulp, webpack and similar), which Snyk does not scan; npm audit does cover them.
The
package.jsonchanges (everything else is lock file only)@contentstack/venus-components3.0.2 → 3.0.6, andreact-router-dom^6→^7.18.0. The app declaresreact-router-dombut never imports it, so the major bump has no runtime effect. It clears the open-redirect finding that breached its SLA.viteis pinned to^7.3.0and@vitejs/plugin-reactto^5.1.2(both werelatest, and a fresh install pulled vite 8, which can't build these apps).terseris added as a dev dependency: both builds already failed onmasterbecause the config asks for terser and it wasn't installed. In the popup,momentgoes 2.29.4 → 2.31.0. This also movesaxiosfrom 1.13.5 to 1.20.0, which was behind the critical SLA breaches..talismanrcnow ignores the lock-file hashes so the secret scan doesn't flag them.What is left, and why
braces(high) in the two Brightcove apps andjs-beautify(medium) in the variable app. There is no patched version yet.How it was checked
Fresh
npm installandnpm run buildin every app that has a build script. Snyk and npm audit were re-run on the final lock files. Worth a quick click through the YouTube extension and the variable app, since theirpackage.jsonchanged.🤖 Generated with Claude Code