From 69f01c76250b082238ea24b84be32313175aaa8f Mon Sep 17 00:00:00 2001 From: Dhruv Parekh Date: Thu, 3 Sep 2026 11:53:05 +0530 Subject: [PATCH 1/4] fix(deps): resolve serialize-javascript RCE, uuid + fast-uri advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm advisories 11 -> 4. Overrides added (transitive, no direct upgrade reaches them): serialize-javascript ^7.1.1 RCE via RegExp.flags/Date + CPU-exhaustion DoS (was 6.0.2, high) uuid ^11.1.1 missing buffer bounds check in v3/v5/v6 (stale 8.3.2 copy) Raised stale override: fast-uri ^3.1.5 -> ^3.1.7 SNYK-JS-FASTURI-19502739 / -19502854 (both high, newly published by Snyk during this run) NOT fixed - see PR body: adm-zip (high) needs 0.6.0, which changes writeZipPromise from Promise to Promise; src/adapters/file-upload.ts uses that return value as a success flag, so the bump breaks the build and adapting it is a behavior decision. Reverted to ^0.5.18. Validation: build green; 129 tests + 8 suites passing. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- package-lock.json | 71 +++++++++++++++++++++-------------------------- package.json | 8 ++++-- 2 files changed, 37 insertions(+), 42 deletions(-) diff --git a/package-lock.json b/package-lock.json index 834ff99..5e2b28f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1032,6 +1032,19 @@ "xdg-basedir": "^4.0.0" } }, + "node_modules/@contentstack/cli-utilities/node_modules/uuid": { + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], + "license": "MIT", + "bin": { + "uuid": "dist/esm/bin/uuid" + } + }, "node_modules/@contentstack/management": { "version": "1.30.4", "resolved": "https://registry.npmjs.org/@contentstack/management/-/management-1.30.4.tgz", @@ -8618,9 +8631,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz", - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", @@ -11096,14 +11109,17 @@ } }, "node_modules/istanbul-lib-processinfo/node_modules/uuid": { - "version": "8.3.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", - "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", - "deprecated": "uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).", + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", "dev": true, + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], "license": "MIT", "bin": { - "uuid": "dist/bin/uuid" + "uuid": "dist/esm/bin/uuid" } }, "node_modules/istanbul-lib-report": { @@ -14413,9 +14429,9 @@ "license": "MIT" }, "node_modules/qs": { - "version": "6.15.3", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", - "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -14448,16 +14464,6 @@ "dev": true, "license": "MIT" }, - "node_modules/randombytes": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz", - "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "safe-buffer": "^5.1.0" - } - }, "node_modules/range-parser": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz", @@ -15251,13 +15257,13 @@ } }, "node_modules/serialize-javascript": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz", - "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.1.tgz", + "integrity": "sha512-k3CMsaIvvdSwm8oLB4MXSl0wH2/cwlH7xGcnRd2DaeRmBkbzYmyT8j0tsX60DwD1eRwHTpNpH8ljKu9oUT1MeQ==", "dev": true, "license": "BSD-3-Clause", - "dependencies": { - "randombytes": "^2.1.0" + "engines": { + "node": ">=20.0.0" } }, "node_modules/serve-static": { @@ -16988,19 +16994,6 @@ "node": ">= 0.4.0" } }, - "node_modules/uuid": { - "version": "14.0.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz", - "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==", - "funding": [ - "https://github.com/sponsors/broofa", - "https://github.com/sponsors/ctavan" - ], - "license": "MIT", - "bin": { - "uuid": "dist-node/bin/uuid" - } - }, "node_modules/v8-compile-cache-lib": { "version": "3.0.1", "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz", diff --git a/package.json b/package.json index a120374..49c108a 100755 --- a/package.json +++ b/package.json @@ -117,7 +117,7 @@ }, "qs": "^6.15.2", "tmp": "^0.2.4", - "fast-uri": "^3.1.5", + "fast-uri": "^3.1.7", "js-yaml": "^4.3.1", "minimatch@10.2.5": { "brace-expansion": "^5.0.9" @@ -127,7 +127,9 @@ }, "minimatch@5.1.9": { "brace-expansion": "^2.1.4" - } + }, + "serialize-javascript": "^7.1.1", + "uuid": "^11.1.1" }, "engines": { "node": ">=22.0.0" @@ -152,4 +154,4 @@ "launch:deployments": "LNCH-DPLMNT" } } -} \ No newline at end of file +} From b0f0add4b2a0396fe02b96eccb84723e58b7ce36 Mon Sep 17 00:00:00 2001 From: Dhruv Parekh Date: Thu, 3 Sep 2026 11:53:18 +0530 Subject: [PATCH 2/4] fix(deps): refresh package-lock.json talisman checksum MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dependency fix in the previous commit changed package-lock.json, so its pinned .talismanrc checksum went stale and the secrets-scan check fails. Talisman flags npm's standard sha512- integrity fields as base64 'secrets'; this repo's existing convention is a checksum-pinned allowlist entry, so this refreshes that value rather than reworking the lockfile. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .talismanrc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.talismanrc b/.talismanrc index d56f082..70efc5c 100644 --- a/.talismanrc +++ b/.talismanrc @@ -9,7 +9,7 @@ fileignoreconfig: - filename: test/unit/commands/rollback.test.ts checksum: d1f931f2d9a397131409399ad6463653e28b5a2224e870b641d9ba57c4418f18 - filename: package-lock.json - checksum: 36459c67c22b67c7255935e31ec8eda5c4483a702afbcbd0c1ff6f3d969cfbe4 + checksum: 16446727efd8a16417343fe853d4c927d58a32f35907c019866fa428f454c83b - filename: src/adapters/github.test.ts checksum: b3d3d3a3c14adde103152d2ac4e1c4b7121a5f7533a87c3cc600f6d25fb59d1b - filename: src/adapters/file-upload.test.ts From a558af5069aba9baf48d25e78bd9d51c427ee772 Mon Sep 17 00:00:00 2001 From: Dhruv Parekh Date: Thu, 3 Sep 2026 14:40:09 +0530 Subject: [PATCH 3/4] fix(deps): scope serialize-javascript + uuid overrides to their parents MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses Copilot review on PR #230. The global "uuid": "^11.1.1" override was a real regression: the root copy was already uuid@14.0.2 (SAFE - the advisory is uuid <11.1.1), and only istanbul-lib-processinfo's nested 8.3.2 was vulnerable. The global override therefore DOWNGRADED the safe root copy three majors, against @contentstack/cli-utilities' declared uuid ^14.0.0. Scoped both to the actual parents, matching this file's existing convention (eslint > ajv, minimatch@N > brace-expansion): "mocha": { "serialize-javascript": "^7.1.1" } "istanbul-lib-processinfo": { "uuid": "^11.1.1" } Resolved tree now: root uuid@14.0.2 (restored), istanbul's nested uuid@11.1.1 (patched), serialize-javascript@7.1.1 (patched). Same security posture as the global form - npm audit 4, snyk 1 high (adm-zip) - with no downgrade. Validation: build green; 129 tests + 8 suites passing. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- package-lock.json | 26 +++++++++++++------------- package.json | 8 ++++++-- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5e2b28f..3944871 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1032,19 +1032,6 @@ "xdg-basedir": "^4.0.0" } }, - "node_modules/@contentstack/cli-utilities/node_modules/uuid": { - "version": "11.1.1", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", - "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", - "funding": [ - "https://github.com/sponsors/broofa", - "https://github.com/sponsors/ctavan" - ], - "license": "MIT", - "bin": { - "uuid": "dist/esm/bin/uuid" - } - }, "node_modules/@contentstack/management": { "version": "1.30.4", "resolved": "https://registry.npmjs.org/@contentstack/management/-/management-1.30.4.tgz", @@ -16994,6 +16981,19 @@ "node": ">= 0.4.0" } }, + "node_modules/uuid": { + "version": "14.0.2", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz", + "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], + "license": "MIT", + "bin": { + "uuid": "dist-node/bin/uuid" + } + }, "node_modules/v8-compile-cache-lib": { "version": "3.0.1", "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz", diff --git a/package.json b/package.json index 49c108a..469a87f 100755 --- a/package.json +++ b/package.json @@ -128,8 +128,12 @@ "minimatch@5.1.9": { "brace-expansion": "^2.1.4" }, - "serialize-javascript": "^7.1.1", - "uuid": "^11.1.1" + "mocha": { + "serialize-javascript": "^7.1.1" + }, + "istanbul-lib-processinfo": { + "uuid": "^11.1.1" + } }, "engines": { "node": ">=22.0.0" From 01904575c5b6381c52bc066963137e59203b5860 Mon Sep 17 00:00:00 2001 From: Dhruv Parekh Date: Thu, 3 Sep 2026 14:40:20 +0530 Subject: [PATCH 4/4] fix(deps): refresh package-lock.json talisman checksum MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scoping the overrides changed package-lock.json again, so the pinned checksum from the earlier commit is stale. Same false-positive/allowlist convention as before (Talisman reads npm's sha512- integrity fields as base64 secrets). #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .talismanrc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.talismanrc b/.talismanrc index 70efc5c..2c3d5da 100644 --- a/.talismanrc +++ b/.talismanrc @@ -9,7 +9,7 @@ fileignoreconfig: - filename: test/unit/commands/rollback.test.ts checksum: d1f931f2d9a397131409399ad6463653e28b5a2224e870b641d9ba57c4418f18 - filename: package-lock.json - checksum: 16446727efd8a16417343fe853d4c927d58a32f35907c019866fa428f454c83b + checksum: c9f4aca9f8f295736cad854305bd2b68b28cf320da92f925b1ccfd70f7224c19 - filename: src/adapters/github.test.ts checksum: b3d3d3a3c14adde103152d2ac4e1c4b7121a5f7533a87c3cc600f6d25fb59d1b - filename: src/adapters/file-upload.test.ts