Repository navigation
fix(deps): resolve csv-parse Snyk finding and upgrade cli-utilities and cli-command to 2.0.2 - #242
Open
SakshiKoli-CS wants to merge 5 commits into
Open
SakshiKoli-CS wants to merge 5 commits into
SakshiKoli-CS wants to merge 5 commits into
Conversation
…nd cli-command to 2.0.2
Snyk (snyk test on development) reported qs, traverse, csv-parse and
deepmerge. This fixes the first three:
- qs 6.16.0 (High): express ^4.22.3 and the qs override raised to ^6.16.1.
- traverse 0.6.11: override to ^0.6.14 (comes in through cli-utilities).
- csv-parse 4.16.3: tty-table's csv overridden to ^6.6.4, which brings
in csv-parse 7.0.3. tty-table loads csv only in its own command-line
tool, not in the table rendering cli-utilities uses.
deepmerge 4.3.1 (via @rollup/plugin-node-resolve) has no patched release
and stays open. It is not reachable: the plugin only merges its own
built-in defaults.
@contentstack/cli-utilities and @contentstack/cli-command move to ^2.0.2
together (cli-command 2.0.2 pins cli-utilities ~2.0.2). 2.x loads ESM-only
chalk 5 asynchronously and throws "Chalk not loaded" on any coloured print
until loadChalk() has run, so BaseCommand.init and Functions.init now call
it first. If the host csdx has already loaded chalk, the call does nothing.
Staging base-command.ts made the lint pre-commit hook check the whole
file, which had 4 existing lint errors. Fixed without changing behaviour:
dropped the `self` alias of `this`, spread the already-imported config
instead of require('./config'), made `headers` const, and kept the
dynamic require of the user's .cs-launch.json behind an eslint-disable
comment.
Test-only changes for the upgrade:
- The integration harness patches inquirer.default.prompt (inquirer 12
moved prompt to the default export).
- The integration Jest config maps chalk to chalk 4, since Jest cannot
load ESM-only chalk 5.
- The cli-utilities unit mock and base-command.test.ts load chalk.
Build is clean and Jest unit tests pass 141/141. Mocha unit and
integration results match the 1.x baseline.
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
…dded comments launch-cli's AGENTS.md says not to add code comments, and the previous commit added two: an eslint-disable for the require() of .cs-launch.json and a note in jest.integration.config.js. getConfig now reads the config with JSON.parse(readFileSync(...)) rather than require(). The guard above it already checks the same path with existsSync, which resolves relative to the current directory, and readFileSync does too; require() resolved it relative to the module and cached the result for the whole process. Lint is clean, build passes, and Jest unit tests pass 141/141. Mocha results match the 1.x baseline, and integration tests pass 31/31. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
… base-command files Talisman scans only the files a push changes, so changing src/base-command.ts and test/unit/base-command.test.ts made it report lines that were already there. They are false positives on the words "keys" (configKeys, keys(config)) and "shared" (sharedConfig test names), not secrets. Following the existing .talismanrc convention: narrow allowed_patterns for the source file, and a checksum for the test file. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
Replaces the allowed_patterns entry for src/base-command.ts with a checksum, the same as test/unit/base-command.test.ts. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
rohan-agrawal-cs
previously approved these changes
Oct 15, 2026
development gained #243, which fixes qs and traverse with its own overrides and drops the brace-expansion and eslint/ajv overrides. It conflicted with this branch in package.json's overrides block. Resolved by taking development's overrides as they are and adding only this branch's tty-table csv override (the csv-parse fix). This branch's traverse override and express bump are dropped, because #243 already covers them. package-lock.json is regenerated from development's lockfile. Resolves to cli-utilities and cli-command 2.0.2, csv-parse 7.0.3, qs 6.16.1 and traverse 0.6.14. Build passes, Jest unit tests pass 141/141, integration tests pass 31/31, and Mocha results match the 1.x baseline. snyk test reports only deepmerge. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
SakshiKoli-CS
changed the title
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
SakshiKoli-CS
changed the title
venkatesh-cstk
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira: CL-7796
What
Fixes the csv-parse Snyk finding and upgrades
@contentstack/cli-utilitiesand@contentstack/cli-commandto 2.0.2. qs and traverse were fixed separately by #243, which is merged into this branch.tty-table'scsvis overridden to ^6.6.4, which brings in csv-parse 7.0.3. tty-table loadscsvonly in its own command-line tool, not in the table rendering cli-utilities uses.developmentby #243@rollup/plugin-node-resolve, which only merges its own built-in defaults with it, so it can't be reached.cli-utilities / cli-command 2.0.2
~2.0.2.Chalk not loadeduntilloadChalk()has run.BaseCommand.initandFunctions.initnow call it first. If the hostcsdxhas already loaded chalk, the call does nothing.Side effects of changing
base-command.tsselfalias ofthis;configinstead ofrequire('./config');headersaconst..cs-launch.json:getConfignow reads it withJSON.parse(readFileSync(...))instead ofrequire(). This resolves the path from the current directory, the same as theexistsSynccheck before it, and doesn't cache the file.configKeysandsharedConfig). Added checksums to.talismanrcforsrc/base-command.tsandtest/unit/base-command.test.ts.Test-only changes
inquirer.default.prompt, because inquirer 12 movedpromptthere.chalkto chalk 4, since Jest can't load ESM-only chalk 5.base-command.test.tsnow load chalk.Tests
npm run buildis clean, and eslint is clean on the changed files.developmenton cli-utilities 1.x. 18 of those tests already fail ondevelopment, and nothing new fails.snyk testreports only deepmerge.Before release: run a real
launch:*command insidecsdx, both logged in and logged out.