fix(deps): declare tslib as a runtime dependency

[cs-raj]

Problem

@contentstack/cli and @contentstack/cli-utilities compile with importHelpers: true, so their emitted output calls require("tslib") at runtime. Neither declares tslib as a runtime dependency — it sits in devDependencies for @contentstack/cli and is absent entirely from @contentstack/cli-utilities.

Consumers do not install devDependencies, so a global install fails:

pnpm add -g @contentstack/cli
csdx --help
# [MODULE_NOT_FOUND] ... /lib/help.js: Cannot find module 'tslib'

It is masked in local development because .npmrc sets shamefully-hoist=true, which hoists tslib somewhere resolvable. That setting is not published, so it does not help users.

Reported as #2629, filed against 1.64.0 — a v1 release.

Evidence

Each published v1-x tarball was downloaded from the npm registry and its shipped lib/ output grepped for require("tslib"), then compared against that tarball's own package.json. These are the artifacts users actually install, not source-tree inference.

Package	Published	Files requiring tslib	Declared
@contentstack/cli	1.68.0	3	devDependencies only
@contentstack/cli-utilities	1.19.2	26	not declared at all

cli-utilities is the more severe of the two: it is a runtime dependency of @contentstack/cli itself, so it reaches every user.

Deliberately unchanged

cli-auth, cli-command and cli-config emit zero tslib references of any form (require("tslib"), require('tslib'), from "tslib"), verified against their published tarballs, which contain real compiled output (13, 2 and 25 .js files respectively). All packages target es2017, where async/await is native, so only packages using spread/rest/decorators emit helpers.

This differs deliberately from #2722, which added tslib to all five packages on the v2 line.

---

Second commit: dependency upgrades

ef64d7269 upgrades dependencies and workspace overrides, independent of the tslib fix.

packages/contentstack-utilities

Package	From	To
@contentstack/management	~1.30.1	~1.31.1
@contentstack/marketplace-sdk	^1.5.1	^1.5.4
axios	^1.19.0	^1.20.0
js-yaml	^4.3.1	^4.3.2
picomatch (@oclif/core override)	^4.0.4	^4.0.7

pnpm-workspace.yaml overrides

Package	From	To
uuid	14.0.1	14.0.2
brace-expansion	5.0.9	5.0.12
js-yaml	5.2.3	5.4.2
fast-uri	4.1.2	4.2.1

Reviewer note: @contentstack/management and axios are minor-version upgrades rather than patches, and js-yaml moves across two majors at the override level (5.2.3 → 5.4.2). Those warrant more scrutiny than the tslib change itself.

Verification

• pnpm install --frozen-lockfile passes — lockfile and manifests agree
• pnpm build passes
• snyk test --all-projects --fail-on=all reports 6 projects, no vulnerable paths
• Talisman passes
• pnpm pack of cli-utilities produces an artifact with 28 files requiring tslib and dependencies.tslib: ^2.8.1 present — verified at the same level the bug was found
• tslib confirmed intact in both packages after the dependency upgrades

Also included

.talismanrc's pnpm-lock.yaml entry moves from a checksum pin to ignore_detectors. The pinned checksum was already stale and blocked committing any lockfile change; this stops it recurring.

Notes

• This is the v1 counterpart of fix(deps): declare tslib as a runtime dependency #2722, which fixed the same defect on development and was never backported.
• Pairs with fix(deps): declare tslib as a runtime dependency cli-plugins#370, which fixes the same defect in the cli-plugins repo.
• Version bumps for release are not included and will be handled separately.
• Not intended for merge yet.

Refs: #2629

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	0	169	25	✅ Passed
🟡 Medium Severity	67	71	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	1	90 / 365 days	⚠️ Warning
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 169
• Medium without fixes: 71
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	0	4	25	✅ Passed
🟡 Medium Severity	67	38	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	1	90 / 365 days	⚠️ Warning
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 4
• Medium without fixes: 38
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.