fix(snyk): remediate high-and-above vulnerabilities blocking chore/CLI-1737

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source quality gate blocked chore/CLI-1737. This branch was produced by snyk fix --agentic, working on vulnerabilities at or above high severity — the same threshold that gate is configured with.

0 of 1 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Inefficient Algorithmic Complexity	package.json	Yes	Medium — This is a patch version upgrade from 4.3.0 to 4.3.1. Specific release notes or changelog entries for the transition from version 4.3.0 to 4.3.1 were not found in the package's official documentation or GitHub repository. While patch releases are typically for bug fixes and are not expected to contain breaking changes, the absence of clear documentation introduces uncertainty. Recommendation: The risk is assessed as medium due to the lack of information. It is advisable to perform routine testing to ensure no unexpected behavior has been introduced. Source: Package documentation

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same quality gate that blocked chore/CLI-1737, so its result — not this description — is the verdict on what is left.

Changes

 package-lock.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

_{Snyk ProdSec orb · build 632213 · model claude-opus-4-8}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 1 files (average relevance: 0.55) package-lock.json (4 segments, lines 3665-3922)

🤖 Repository instructions applied (from AGENTS.md)

[github-actions]

	Warnings
⚠️	"fix: remediate high-and-above vulnerabilities blocking the Snyk Open Source gate" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 9029733