fix(snyk): remediate high-and-above vulnerabilities blocking bg/fix-IANDT-27-contributor-capture

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source quality gate blocked bg/fix-IANDT-27-contributor-capture. This branch was produced by snyk fix --agentic, working on vulnerabilities at or above high severity — the same threshold that gate is configured with.

4 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Allocation of Resources Without Limits or Throttling	cliv2/go.mod	Low — This is a patch version upgrade for an internal package of google.golang.org/grpc. Patch releases in this library consist of bug fixes and minor improvements. The package in question is designated as internal, meaning it is not intended for public use, and changes to it are not expected to impact external users. No breaking changes were documented for the v1.83.1 release. Source: Release notes
High	Allocation of Resources Without Limits or Throttling	cliv2/go.mod	Low — This is a patch version upgrade for an internal package within the google.golang.org/grpc module. Packages under an internal directory are not part of the public API and cannot be directly imported by external projects. Therefore, changes within this package are not expected to cause breaking changes for consumers of the grpc library. The v1.83.1 release consists of bug fixes and minor behavior changes, with no documented breaking API changes. Source: Release notes
High	Allocation of Resources Without Limits or Throttling	cliv2/go.mod	Low — This is a patch version upgrade for an internal package within the google.golang.org/grpc module. - Internal Package: In Go, packages under a directory named internal are not part of the public API. They cannot be imported by external code, so changes to them do not directly impact end-users. - Patch Release: The upgrade from 1.83.0 to 1.83.1 is a patch release, which is intended for backward-compatible bug fixes and security updates. No breaking changes are expected, and no developer action is required. Source: Package documentation
High	Allocation of Resources Without Limits or Throttling	cliv2/go.mod	Low — This is a patch version upgrade for grpc-go, the module containing google.golang.org/grpc/mem. The update from v1.83.0 to v1.83.1 includes security fixes and performance improvements. Changes: - Security: Fixes bugs in xDS RBAC (Role-Based Access Control) that could cause DENY rules to fail open under certain conditions. - Performance: Restricts memory overhead from buffering small data frames in the transport layer. There are no documented API changes or removals in this version. The upgrade is considered safe and recommended. Source: GitHub Releases

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Allocation of Resources Without Limits or Throttling	package.json	Yes	Low — This is a patch version upgrade for js-yaml that addresses a security vulnerability. - The change backports a fix to limit resource consumption by capping the total number of keys processed by the merge (<<) feature, preventing potential denial-of-service attacks. - This update does not introduce any breaking API changes. Source: Package documentation and release notes.

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same quality gate that blocked bg/fix-IANDT-27-contributor-capture, so its result — not this description — is the verdict on what is left.

Changes

 cliv2/go.mod | 2 +-
 cliv2/go.sum | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

_{Snyk ProdSec orb · build 648673 · model claude-opus-4-8}

---

Note

Low Risk
Indirect patch-only grpc-go upgrade with no direct code changes; typical low-risk dependency security bump.

Overview
Bumps the indirect google.golang.org/grpc dependency in cliv2 from v1.83.0 to v1.83.1, with matching go.sum entries. This is a Snyk-driven patch to address high-severity “allocation of resources without limits or throttling” findings in grpc’s internal transport/memory paths.

There are no application or CLI source changes—only cliv2/go.mod and cliv2/go.sum. The PR description notes a separate js-yaml issue in package.json was not fixed on this branch.

^{Reviewed by Cursor Bugbot for commit d4b974d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 3 files (average relevance: 0.79) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) CLAUDE.md (2 segments, lines 65-152) package-lock.json (lines 3404-3668)

🤖 Repository instructions applied (from AGENTS.md)