fix(deps): resolve all Snyk production vulnerabilities - #20
Merged
Conversation
Production scope goes from 23 issues / 50 vulnerable paths to 0. Dev scope goes from 30 issues to 2. - @fastify/swagger-ui ^5.2.5 to ^6.1.1, which brings @fastify/static 10.1.2. The entire 9.x line carries a High directory traversal, so no patch, minor or in-range bump could reach a fix. swagger-ui 6 still declares fastify 5.x and fastify has no 6.x line, so nothing cascades. Our only option to it is routePrefix, and the one documented v6 break removes useUnsafeMarkdown, which we never passed. - Drop the overrides block. Pinning @fastify/static at an exact 9.1.1 is what held it at a vulnerable version once 9.1.1 itself got flagged. minimatch no longer needs a pin either, and dropping it also unbreaks jest --coverage. - Lockfile only, each already inside its parent's declared range: fast-uri 3.1.5, find-my-way 9.7.0, brace-expansion 2.1.4, adm-zip 0.5.18, axios 1.19.0, liquidjs 10.28.0, body-parser 1.20.6, form-data 4.0.6, and dev-only esbuild 0.28.1 (clears a Critical), js-yaml and @babel/core. No source file changes. Verified with 15/15 tests passing, a clean tsc build, a boot check confirming /documentation and all seven of its static assets still serve under @fastify/static 10, and a Snyk re-scan reporting no vulnerable paths in production. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
contentstackMridul
added a commit
that referenced
this pull request
Aug 5, 2026
Conflict was package.json only, in the overrides block. stag (PR #20, the Snyk fix) deleted overrides entirely: the exact @fastify/static 9.1.1 pin was what held it at a vulnerable version, and swagger-ui ^6.1.1 brings @fastify/static 10 on its own. This branch had added test-exclude ^7.0.1 to that same block. Took stag's side. The test-exclude override existed only to work around the minimatch ^9 pin, which starved test-exclude@6 of a callable minimatch. With the pin gone, test-exclude@6 resolves its own minimatch@3 and --coverage works unaided, so the override is dead weight rather than something to carry forward. Scripts keep this branch's --experimental-vm-modules form; deps take stag's swagger-ui ^6.1.1. package-lock.json reset to stag verbatim; npm install reports up to date, confirming this branch introduced no dependency of its own. Verified on the merge result: 6 suites / 41 tests pass, --coverage reports the same per-file numbers as before the merge (controllers/index 96.96%, config 100%, app 90%, routes 83.33%), tsc build clean, and a boot check of dist/index.js serves /health, /documentation and all seven swagger assets under @fastify/static 10. Plugin registration order in app.ts still matches stag's index.ts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears every Snyk vulnerability in the production scope, 23 issues across 50 vulnerable paths down to zero. That is the set the
security-scagate scans, and it is green on this PR. The manifest change is two lines: one dependency major, and theoverridesblock deleted. It touches no source file.Type of Change
Changes Made
package.json:@fastify/swagger-ui^5.2.5to^6.1.1, which brings@fastify/static10.1.2. Theoverridesblock is removed, both entries.package-lock.json: regenerated. Nine packages move, each already inside its parent's declared range:fast-uri3.1.5,find-my-way9.7.0,brace-expansion2.1.4,adm-zip0.5.18,axios1.19.0,liquidjs10.28.0,body-parser1.20.6,form-data4.0.6, plus dev-onlyesbuild0.28.1,js-yamland@babel/core.Production goes 23 issues to 0. Dev goes 30 to 2, both dev-only mediums that need an eslint major. Snyk Code reports 0 open.
Why These Changes
security-scarunssnyk test --all-projects --fail-on=all, so it counts the whole tree rather than what a PR adds. It was red on 23 production issues, including a High directory traversal and seven other Highs.Most of it needed no manifest change. Whatever parent pulled each vulnerable child in already allowed its fixed version, so the lockfile reached all of them with no
overridesentry. That covers the 14 issues arriving through@contentstack/shopify-live-preview-sdk@1.1.3as well, which matters: the SDK declaresadm-zip ^0.5.10,axios ^1.15.2andliquidjs ^10.25.7, and the fixed versions all satisfy those. So this repo goes green on its own lockfile and does not wait on the SDK release in contentstack/shopify-live-preview-sdk#28.The
overridesblock was the one real problem. It pinned@fastify/staticto an exact9.1.1, which was the fix back in May, but once 9.1.1 itself got flagged the pin is what held us there. Removing the pin was not enough on its own, because every remaining 9.x carries the same two advisories, and 9.3.0 is the newest. Reaching a fix needs@fastify/static10, and the supported way there is swagger-ui 6.I checked the cascade before taking the major. swagger-ui 6.1.1 declares
fastify: '5.x'and so does static 10.1.2, and fastify has no 6.x line at all, so nothing propagates past this bump. The only documented consumer break in v6.0.0 drops the deprecateduseUnsafeMarkdownoption, and we pass exactly one option,routePrefix.JIRA: N/A. The branch carries no ticket key and there is no open Snyk ticket for this repo, see the note below.
Breaking Changes
No. Nothing in
src/changes, so the service surface is identical: same routes, same plugin order, same swagger config. The swagger-ui major is a dependency major, not an API one, and the option we pass survives it.Risk Level: MEDIUM
Dependency-only with no source changes, but it takes a major on the plugin serving a live route, and no automated test covers that route. A boot check is the only thing standing behind it.
Notes for Reviewer
All six checks pass,
security-scaincluded. Since that one is the absolute whole-tree gate rather than a PR-delta check, green means the production backlog is empty, not just free of new issues.Deleting the
overridesblock is the judgment call worth your attention. The@fastify/statichalf was forced, but I dropped theminimatch: ^9.0.7entry too, after confirming it is security-neutral, and that turned out to fixjest --coverage, which that pin has been breaking all along. Worth knowing on the test-coverage branch, where PR #19 addedtest-exclude: ^7.0.1to work around it. That override may now be removable. Happy to restore just the minimatch entry if you would rather keep this PR strictly to vulnerabilities.There are no Jira tickets to close. Four exist for this repo and all are archived against packages we are not touching,
fastify@4.29.1andlodash@4.17.21. Nothing filed tickets for the current backlog because commit 9e16132 deleted.github/workflows/issues-jira.yml. Onlysca-scan.ymlandpolicy-scan.ymlremain. Might be worth restoring separately.GitHub shows this branch as behind
stagby two commits. Both are merge commits andgit diff origin/main origin/stagis empty, so there is no content difference and nothing to resolve. I branched from a freshly pulledmain.Two dev-only mediums stay open,
SNYK-JS-ESLINT-15102420andSNYK-JS-INFLIGHT-6095116. They close together and only via an eslint major, which also drags in@typescript-eslint8 and a flat config migration. Neither fails the gate, sincesecurity-scadoes not scan dev dependencies. Notenpm run lintis already broken here for want of a config, so fixing that is the prerequisite. Tracked as a follow-up.Unrelated, spotted on the way past:
fastify-pluginis a declared dependency but nothing insrc/imports it.