fix(deps): resolve critical proxy-addr, high adm-zip, and fast-uri Snyk findings (+Claude)

[dhruv-parekh-cs]

Snyk dependency remediation — launch-cli — 21-Sep-2026

Automated dependency-vulnerability remediation pass (snyk-fix). Single surface in scope: Node.js (package.json / package-lock.json). No Go surface, no Dockerfile in this repo.

Summary table

Issue	Severity	Package	Before → After	Fixable	Rationale
SNYK-JS-ADMZIP-19276676 / 19846655 / 19963965	High	adm-zip (direct dep)	0.6.0 → 0.6.1	Fixable	Direct semver-compatible bump (^0.6.0 → ^0.6.1); symlink attack, decompression amplification, excessive memory allocation. Verified writeZipPromise runtime behavior unchanged between versions (no application-code change needed on this branch — development already refactored the call site to try/catch).
SNYK-JS-PROXYADDR-19812342	Critical	proxy-addr (transitive via express)	2.0.7 → 2.0.8 (override)	Fixable via override	express@4.22.2's own package.json still declares proxy-addr: ~2.0.7; no express release yet raises this. Forced via a new overrides entry, ^2.0.8.
SNYK-JS-FASTURI-19846649	Medium	fast-uri (transitive via cli-utilities > conf > ajv)	3.1.7 → 3.1.8 (override)	Fixable via override	Existing fast-uri override floor (^3.1.7) predated this fix; raised to ^3.1.8.

Overrides retired (step 2.5)

Tested each for obsolescence by removing it, running npm install, and confirming (a) the dependency still resolves at/above its former floor and (b) a full snyk test --all-projects re-scan stays clean at that resolution:

• lodash (^4.18.1) — redundant with the direct dependencies entry of the same range; resolves to 4.18.1 naturally without the override.
• form-data (4.0.6) — same reasoning; resolves to 4.0.6 naturally via the direct dependency's exact pin.
• js-yaml (^4.3.1) — the main resolution path already reaches 4.3.2 on its own. Removing it does let nyc's own @istanbuljs/load-nyc-config dependency resolve a nested js-yaml@3.15.2 (well past the known js-yaml 3.x CVEs, all fixed by 3.13.1) instead of being forced to the deduped 4.3.2 — confirmed via Snyk re-scan that this introduces no new finding.

All three were pre-existing (no snyk-fix breadcrumb, predate this convention) — removed with no tombstone comment; this paragraph is the rationale record.

Needs human review (not yet resolved)

Issue	Severity	Package	Why
SNYK-JS-CSVPARSE-19639017	Medium	csv-parse 4.16.3, via @contentstack/cli-utilities > tty-table@4.2.3 > csv@5.5.3 > csv-parse@4.16.3	Fix exists upstream (csv-parse@7.0.2) but only as a major-version jump (4.x → 7.x) forced via an override on a doubly-transitive dependency. csv@5.5.3 (tty-table's own dependency) declares csv-parse: ^4.16.3 and very likely relies on the v4 callback-based API; csv-parse's API shape changed materially across majors. This package's actual usage inside tty-table/csv isn't reachable from launch-cli's own code (launch-cli never imports tty-table directly — it's several levels down via @contentstack/cli-utilities), so there's no way to validate the override doesn't silently break csv's internal parsing. Forcing it is a behavior-changing guess, not a mechanical fix.
SNYK-JS-DEEPMERGE-19964053	High	deepmerge 4.3.1, via @rollup/plugin-node-resolve@16.0.3 > deepmerge@4.3.1 (also via jest's own dependency tree)	Snyk reports fixedIn: [] — genuinely no version anywhere resolves this advisory yet. Not upgradable, not patchable, no override target exists that would help.

Self code review (step 7.5)

One round. Reviewed the complete diff (package.json, package-lock.json) plus the lockfile's dependency-tree changes line by line. Zero High, zero Medium findings.

• Confirmed lockfile churn is fully explained: only the 3 packages bumped/overridden, plus nyc's newly-surfaced nested js-yaml@3.15.2 + its own deps (argparse, sprintf-js, esprima) as a direct, expected consequence of retiring the redundant js-yaml override.
• Confirmed version specificity follows the loosest-safe-range convention (^ floats throughout; no needlessly exact pins introduced).
• Confirmed no secrets, tokens, or credentials touched, printed, or baked in (repo's own Talisman + trufflehog pre-commit hook also ran clean: 0 secrets found).
• No .github/workflows sync needed — this run touched no Node/Go runtime version, only npm package versions.
• No application-code change was needed on this branch: development's existing try/catch around zip.writeZipPromise() already avoids the adm-zip@0.6.x bundled-.d.ts type mismatch (Promise<void> vs. @types/adm-zip's Promise<boolean>) that a main-based attempt at this same fix would have needed to work around.

Validation

• npm install: clean (no @contentstack/* scope touched by any version change in this PR).
• npm run build: passes.
• npm test (mocha + jest, this repo's own script): 137/137 jest tests pass; mocha exits 0 with the same 74 passing / 18 pre-existing pending items as an unmodified baseline (those 18 are gated on live ORG/PROJECT/ENVIRONMENT credentials via .env and are unrelated to this diff — verified identical on unmodified development).
• snyk test --all-projects: 1 project scanned (single package.json/package-lock.json, matches manifest — no workspaces monorepo here). Before this PR: 4 findings (csv-parse, deepmerge, fast-uri, proxy-addr). After: 2 findings (csv-parse, deepmerge — both needs-human-review above).
• npm audit: before 6 (1 high, 5 moderate) → after 5 (0 high, 5 moderate; remaining 5 are the same csv-parse/tty-table/csv chain surfaced a second way through npm's own advisory graph, not a separate issue).
• No snyk:lic:* license findings at any severity.
• No Go surface, no Dockerfile in this repo — nothing to report for either.

Note on scope

This PR is scoped to what a fresh Snyk scan on development's current head still shows (proxy-addr, fast-uri's stale floor, adm-zip's patch bump, plus the two needs-human-review items). development already carries substantial prior dependency remediation from earlier runs (adm-zip 0.5→0.6, qs, most of fast-uri, serialize-javascript, diff, brace-expansion, istanbul-lib-processinfo, uuid) — this PR only adds what that state was still missing, rather than re-doing already-merged work.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	1	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 1
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed