fix(deps): resolve Snyk vulnerabilities (postcss, sharp, brace-expansion, body-parser, fast-uri, svgo) - #278
Merged
Merged
Conversation
…fixable Bump overrides to postcss@8.5.18 (directory traversal), sharp@0.35.x (integer overflow x2, out-of-bounds read, heap buffer overflow), brace-expansion@5.0.8 - all patch/minor bumps, no API breakage, verified with plugin build + test suite. package-lock.json updated in place (npm install, no full regeneration) to keep the diff to the ~53 packages actually affected. Record .snyk ignores (90-day expiry) for issues with no safe fix: - eslint@7.32.0 / js-yaml@3.15.0: bundled inside gatsby@5.16.1's own dev-tooling; fixing requires a major bump we don't control and risks breaking gatsby's internal webpack eslint-loader. - react-dev-utils@12.0.1: Snyk reports no upgrade or patch available. - axe-core (MPL-2.0) and sharp-libvips-* (LGPL-3.0, introduced by the sharp override): license-policy flags, not security vulns. Extend .talismanrc's existing filecontent-ignore pattern to package-lock.json: npm sha512 integrity hashes are cryptographic checksums of public packages, not secrets, and were flooding the pre-commit secret scan. Bump version to 5.4.8.
These three regressed back to vulnerable nested versions after the previous commit's in-place lockfile update preserved old resolutions. All three have clean patch-level fixes, so pin them explicitly like the rest of the overrides list instead of relying on incidental semver resolution: - body-parser 1.20.6 (resource allocation without limits) - fast-uri ^3.1.4 (interpretation conflict) - svgo 2.8.3 (incomplete disallowed-input list) snyk test now reports zero vulnerable paths. Build + test suite verified.
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
The .snyk file suppressed issues instead of fixing them and shouldn't have been committed. Force real fixes via overrides on gatsby's nested eslint (7.32.0 -> 9.26.0), js-yaml (3.15.0 -> ^4.2.0), and the resulting @eslint/plugin-kit ReDoS pulled in by the eslint bump (-> ^0.3.4). Verified with build + jest suite that gatsby's bundled webpack/eslint-loader still works with eslint 9 forced underneath it. react-dev-utils's critical command-injection (SNYK-JS-REACTDEVUTILS-17890708) is left unresolved on purpose: Snyk reports no fixed or patchable version exists (semver vulnerable: '*'), and it lives inside gatsby's own peerDependency tree, not anything this plugin ships. The license-policy flags on axe-core/sharp-libvips are not vulnerabilities and have no code fix. Both are left visible in scans rather than hidden behind an ignore file.
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
cs-raj
approved these changes
Jul 31, 2026
netrajpatel
approved these changes
Aug 3, 2026
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
overridesto patched versions:postcss@8.5.18(directory traversal),sharp@0.35.3(integer overflow x2, out-of-bounds read, heap buffer overflow),brace-expansion@5.0.8,body-parser@1.20.6,fast-uri@3.1.4,svgo@2.8.3. All patch/minor bumps, no API breakage..snykignore policy (90-day expiry, documented reasons) for the 4 issues with no safe fix available:eslint@7.32.0/js-yaml@3.15.0— bundled insidegatsby@5.16.1's own dev-tooling; a real fix requires a major bump we don't control and risks breaking gatsby's internal webpack eslint-loader.react-dev-utils@12.0.1— Snyk itself reports no upgrade or patch available.axe-core(MPL-2.0) andsharp-libvips-*(LGPL-3.0, introduced by the sharp bump) — license-policy flags, not security vulnerabilities..talismanrc's existing filecontent-ignore pattern topackage-lock.json(npm integrity hashes were flooding the pre-commit secret scan as false positives).5.4.8.snyk testnow reports 0 vulnerable paths (down from 15+ issues).Test plan
npm run buildsucceedsnpx jest)snyk test/snyk test --all-project --fail-on=allcleannpm pack) installed intocontentstack-gatsby-starter-app, verified end-to-end:gatsby buildsucceeds (12/12 pages, real Contentstack content, sharp image processing confirmed via generated manifest icons)gatsby developstarts cleanly