[pritesh-jain-cstk]

Public repo: needs CAB before merge to main. This PR targets development only.

Problem

development scans at 83 Snyk findings (6 critical, 40 high) and 105 npm audit findings on the committed lock file, plus 1 Snyk Code finding.

Fix (APP: the lock file is what ships, so regenerating it is a real fix)

• Lock file regenerated: cleared 35 findings on its own.
• Direct bumps (patch/minor only): axios 1.13.5 → 1.21.0 (clears 39 axios findings), @shopify/cli ^3.63.0 → ^3.63.2.
• Override, scoped: "@shopify/cli-kit": { "form-data": "^4.0.6" }. @shopify/cli-kit 3.94.3 pins form-data 4.0.4, and axios 1.21.0 already asks for ^4.0.6. cli-kit comes in through @shopify/cli (devDependency), so this fixes the dev tree, not the production bundle. Remove it once @shopify/cli-kit ships with form-data ≥ 4.0.6.
• Result: Snyk 83 → 10, npm audit 105 → 56.

Verification

• npm ci (strict, node 24 / npm 11.12, same as the Oxygen workflow's lts/*) followed by npm run build (shopify hydrogen build). The client and the Oxygen worker bundle (dist/server/index.js) both build.
• npm run typecheck reports the same 9 TypeScript errors as development. They are in app route code and existed before this PR.
• Not run: shopify hydrogen preview / an Oxygen deploy. Both need storefront env vars. Please smoke-test the storefront after the Oxygen deploy, because earlier Snyk fixes on this repo were reverted.

Note on installs

development already has a peer conflict: @graphql-codegen/cli 6.0.0 (pinned in 7b26097) vs @shopify/cli-hydrogen peer ^5.0.2. npm ci handles it (warnings only). A plain npm install on npm ≤ 11.6 fails with ERESOLVE. This PR does not change that. PR 2 deals with it.

What remains (10): needs major upgrades or has no fix

• @graphql-tools/url-loader 8 (critical) and @graphql-tools/utils 11 (2 high): need codegen-cli / graphql-tools majors
• react-router 6 (2), turbo-stream 2, @remix-run/server-runtime 2.17.4: need the Remix 2 → React Router 7 / Hydrogen 2025 migration (the server-runtime fix 2.17.5 is blocked by the existing overrides pin)
• braces, picomatch: no fixed version Snyk can map
• Snyk Code: 1 medium Open Redirect in app/entry.server.tsx (source fix in PR 2)

These go to a stacked "to-zero" PR.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[pritesh-jain-cstk]

Automated review (ponytail + DevEco dev-skill reviewer). Head 452526e.

Verified Snyk (head, --org): Open Source 10 unique / 105 paths (braces, picomatch, graphql-tools url-loader + 2x utils, react-router x2, remix server-runtime x2, turbo-stream). Snyk Code 1 (medium javascript/OR, app/entry.server.tsx:21). Matches the PR body.

Ponytail findings
Should fix

1. form-data override is global and an exact pin. The only parent that forces the old version is @shopify/cli-kit 3.94.3 (it pins form-data 4.0.4); axios 1.21.0 already asks for ^4.0.6. Scope it: "@shopify/cli-kit": { "form-data": "^4.0.6" }, and add the removal condition (drop when cli-kit stops pinning 4.0.4) to the body. cli-kit comes in through @shopify/cli, a devDependency, so the body's "production tree" wording is not right (inline).

No other issues in the two package.json changes; the lock regeneration is the bulk of the fix and is appropriate for an app.

Dev-skill reviewer verdict: pass with one note (finding 1 is an override-quality issue, not extra scope). No source changes, so checks 1 and 3 do not apply.

Not checked: npm ci && npm run build and the Oxygen preview (relied on the PR body).

🤖 Generated with Claude Code

[pritesh-jain-cstk]

Should fix. Only @shopify/cli-kit 3.94.3 forces the old version (it pins form-data 4.0.4); axios 1.21.0 already wants ^4.0.6. Suggest "@shopify/cli-kit": { "form-data": "^4.0.6" } instead of a global exact pin, plus a removal condition in the body. cli-kit is pulled in by @shopify/cli (devDependency), so this is dev tooling, not the production tree.

[pritesh-jain-cstk]

Fixed in ee05c39: the global exact pin is replaced by "@shopify/cli-kit": { "form-data": "^4.0.6" }. Lock regenerated; still resolves form-data 4.0.6 for both cli-kit and axios. Strict npm ci and shopify hydrogen build (client + Oxygen worker) pass; Snyk is still 10 unique. The PR body now says it is dev-tree only and gives the removal condition (cli-kit ships form-data >= 4.0.6).

[pritesh-jain-cstk]

Superseded by #180: the Snyk fix is redone from main (this PR was based on development, which is 50 commits behind main).