fix(deps): declare tslib as a runtime dependency

[cs-raj]

Problem

Twelve packages compile with importHelpers: true, so their emitted output calls require("tslib") at runtime, but none declares tslib as a runtime dependency. Consumers do not install devDependencies, so a global install fails with Cannot find module 'tslib'.

Masked locally because .npmrc sets shamefully-hoist=true, which is not published.

Same defect as contentstack/cli#2629, which was filed against 1.64.0 — a v1 release.

Evidence

Each published v1-x tarball was downloaded from npm and its shipped lib/ output grepped for require("tslib"), then compared against that tarball's own package.json.

Package	Published	Files requiring tslib	Declared
cli-cm-import	1.35.1	32	—
cli-cm-export	1.27.1	26	—
cli-external-migrate	1.0.0-alpha.8	25	—
cli-audit	1.21.1	16	—
cli-bulk-operations	1.2.5	16	devDependencies
cli-migration	1.12.7	15	—
cli-cm-import-setup	1.8.9	13	—
apps-cli	1.7.5	10	devDependencies
cli-cm-branches	1.8.6	8	—
cli-cm-export-to-csv	1.12.9	7	—
cli-cm-seed	1.15.11	5	—
cli-cm-clone	1.21.12	3	—

Deliberately unchanged

cli-cm-bulk-publish, cli-cm-migrate-rte, cli-variants, cli-cm-bootstrap and tsgen emit zero tslib references, verified against published tarballs containing real compiled output. content-type and cli-cm-export-query already declare it correctly.

Dependency upgrades

The pre-commit Snyk gate blocked on four pre-existing High-severity findings unrelated to tslib. Rather than bypass the gate, they are fixed here:

Package	From	To	Cleared
adm-zip	0.6.0	0.6.1	Symlink Attack, Data Amplification, Excessive Memory Allocation
moment	2.30.1	2.31.0	Directory Traversal

Carried along in the same resolution:

Package	From	To
axios	1.16.1 / 1.18.1	1.20.0
@contentstack/management	1.30.3 / 1.30.4	1.31.1
@contentstack/delivery-sdk	5.4.0	5.6.0
@contentstack/marketplace-sdk	1.5.3	1.5.4
@contentstack/cli-launch	1.11.1	1.11.3
uuid	14.0.0 / 14.0.1	14.0.2

snyk test --all-projects --fail-on=all now reports 21 projects with no vulnerable paths.

Reviewer note: axios, @contentstack/management and @contentstack/delivery-sdk are minor-version upgrades, not patches, and account for most of the 4,182-line lockfile diff. They deserve more scrutiny than the tslib change itself.

Verification

• pnpm install --frozen-lockfile passes — lockfile and manifests agree
• pnpm build passes across all packages
• pnpm pack of cli-cm-import produces an artifact with 33 files requiring tslib and dependencies.tslib: ^2.8.1 present
• Talisman and Snyk both pass

Also included

.talismanrc's pnpm-lock.yaml entry moves from a checksum pin to ignore_detectors, which was already stale and blocked committing any lockfile change.

Notes

• Pairs with fix(deps): declare tslib as a runtime dependency cli#2724, which fixes the same defect in the cli repo.
• Version bumps are not included and will be handled separately.
• Not intended for merge yet.

Refs: contentstack/cli#2629

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	272	25	✅ Passed
🟡 Medium Severity	0	109	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 272
• Medium without fixes: 109
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	7	25	✅ Passed
🟡 Medium Severity	0	56	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 7
• Medium without fixes: 56
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed