fix(snyk): remediate high-and-above vulnerabilities on main

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of chore/automatic-upgrade-of-ls reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

The fix itself was applied to main, not to chore/automatic-upgrade-of-ls, so this pull request stands on its own rather than stacking on the branch that triggered it. A vulnerability that exists only on chore/automatic-upgrade-of-ls is therefore not addressed here.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

2 of 2 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Prototype Pollution	package.json	Medium — This is a significant version upgrade for an internal Snyk package, @snyk/fix, which is a utility library for the Snyk CLI. There is no public, detailed changelog available for the version range from 1.0.0-monorepo to 1.471.0. Given the large number of incremental versions and the internal nature of this package, there is a possibility of undocumented breaking changes to its API or functionality. The 1.0.0-monorepo version suggests an early, potentially unstable release. Recommendation: This package is likely not intended for direct consumption outside of the Snyk CLI toolchain. If you are using this package directly, you should perform thorough integration testing to ensure your application is not affected by any internal changes. The risk is assessed as medium due to the lack of documentation and the high volume of updates. Source: Package documentation
High	Uncontrolled Recursion	package.json	Medium — This is a significant version upgrade for an internal Snyk package, @snyk/fix, which is a utility library for the Snyk CLI. There is no public, detailed changelog available for the version range from 1.0.0-monorepo to 1.471.0. Given the large number of incremental versions and the internal nature of this package, there is a possibility of undocumented breaking changes to its API or functionality. The 1.0.0-monorepo version suggests an early, potentially unstable release. Recommendation: This package is likely not intended for direct consumption outside of the Snyk CLI toolchain. If you are using this package directly, you should perform thorough integration testing to ensure your application is not affected by any internal changes. The risk is assessed as medium due to the lack of documentation and the high volume of updates. Source: Package documentation

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 package-lock.json              | 11 ++++++++---
 packages/snyk-fix/package.json |  2 +-
 2 files changed, 9 insertions(+), 4 deletions(-)

_{Snyk ProdSec orb · build 651126 · model claude-opus-4-8}

---

Note

Low Risk
Patch-level indirect dependency bump with no direct code changes; typical low-risk lockfile maintenance.

Overview
Bumps the indirect google.golang.org/grpc dependency from v1.83.1 to v1.83.2 in both cliv2 and cliv2-private, with matching go.sum checksum entries in each module.

No application or CLI source changes—only module lockfile updates, likely as part of a security or dependency remediation pass.

^{Reviewed by Cursor Bugbot for commit 34f1393. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	"fix: remediate high-and-above vulnerabilities reported by Snyk Open Source" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 99b47b1

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 6 relevant code sections from 2 files (average relevance: 0.40) package-lock.json (5 segments, lines 19450-19745) packages/snyk-fix/package.json (lines 1-60)

🤖 Repository instructions applied (from AGENTS.md)

[prodsec-github-automation]

Superseded: the fix branch has been rebuilt from main. A new pull request replaces this one.