fix(deps): resolve handlebars, qs, traverse and source-map-js Snyk/npm-audit findings (+Claude)

[dhruv-parekh-cs]

Summary

Automated Snyk/npm-audit remediation for launch-cli (Node, 1 Snyk project scanned: package-lock.json).

Ecosystem	Finding	Severity	Package	Before -> After	Bucket / rationale
npm	handlebars (3 advisories)	critical	handlebars	4.7.9 -> 4.7.10	native audit (lockfile-only)
npm	SNYK-JS-QS-20943482	high	qs (via express, body-parser, @contentstack/management)	6.16.0 -> 6.16.1	fixable; existing qs override floor raised to ^6.16.1
npm	SNYK-JS-TRAVERSE-20570510	medium	traverse (via cli-utilities)	0.6.11 -> 0.6.14	fixable; lockfile-only update within existing range
npm	source-map-js DoS	high	source-map-js	1.2.1 -> 1.2.2	native audit (lockfile-only)

Ecosystem-native audit (step 1.5)

npm audit: 48 (1 critical, 36 high, 11 moderate) -> 46 (35 high, 11 moderate). Plain npm audit fix resolved only handlebars and source-map-js, but also re-resolved ~25 unrelated packages (@oclif/core 4.11.14 -> 4.14.0, @contentstack/cli-command/utilities, oclif, ...), and that churn made 30 of 31 integration tests fail ("dynamic import callback was invoked without --experimental-vm-modules"; baseline passes). It was reverted and replaced with npm update handlebars source-map-js (lockfile diff: those two packages only). The remaining 46 are all behind major-version changes (jest 30, nyc 14, oclif 1.16, shx, lint-staged, cli-utilities 1.9) and are dev-tooling or csv-parse chains; left to Snyk classification, none touched.

Retired overrides (step 2.5)

Removed eslint > ajv, @eslint/eslintrc > ajv, minimatch@10.2.5/9.0.9/5.1.9 > brace-expansion and brace-expansion@1. With them removed, npm install against the existing lockfile leaves package-lock.json byte-identical, and a fresh no-lockfile resolution lands on ajv 6.15.0 and brace-expansion 1.1.21/2.1.7/5.0.12, all at or above the old floors. Kept: qs, tmp, serialize-javascript, diff (removal reintroduces qs 6.15.3, tmp 0.0.33, serialize-javascript 6.0.2, diff 7.0.0/4.0.4).

Needs human review (not resolved)

• SNYK-JS-CSVPARSE-19639017 (medium) csv-parse 4.16.3 via cli-utilities > tty-table > csv: only fix is 7.0.2 (three majors); csv 5 depends on it, an override is a breaking change.
• SNYK-JS-DEEPMERGE-19964053 (medium) deepmerge 4.3.1 via @rollup/plugin-node-resolve: no patched version exists.
• The 46 remaining npm audit advisories listed above require breaking major bumps of dev tooling.

Notes

• No application code, Dockerfile, or .github/workflows changes (no runtime versions moved).
• .npmrc injected by the workspace maps all @contentstack/* to GitHub Packages, but this repo's @contentstack/cli-* deps are public on npmjs; npm was run with --@contentstack:registry=https://registry.npmjs.org (repo file untouched).
• npm run lint reports 107 pre-existing errors in untouched files.

Self code review (step 7.5)

1 round: no High/Medium findings. Lockfile churn beyond the named packages is the traverse 0.6.14 dependency chain (typedarray/which-typed-array patch bumps).

Validation

npm install, npm run build, unit (139 jest) and integration (31) tests pass. Snyk re-scan (--all-projects): handlebars, qs, traverse, source-map-js clear; only the two parked medium findings remain.

#claude_code#
🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	3	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 3
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed