From 26af2dd8a7b05f9879af32ed12857906694ef678 Mon Sep 17 00:00:00 2001
From: Abhishek Ezhava <abhishek.ezhava@contentstack.com>
Date: Mon, 10 Aug 2026 17:33:45 +0530
Subject: [PATCH] fix(deps): override hono, js-yaml and socket.io-parser to
 patched versions

Snyk reported 7 vulnerabilities in the install tree. Six have patched
releases upstream and are resolved by forcing them through the existing
overrides block. All three packages confirmed as "overridden" by npm ls,
not just declared.

- hono 4.12.32 -> 4.13.1 (patched in 4.12.34): SNYK-JS-HONO-18517010
  ReDoS, SNYK-JS-HONO-18592332 data exposure to wrong session,
  SNYK-JS-HONO-18592333 HTTP request smuggling, SNYK-JS-HONO-18593786
  inefficient algorithmic complexity
- js-yaml 4.3.0 -> 4.3.1: SNYK-JS-JSYAML-18593780 inefficient
  algorithmic complexity
- socket.io-parser 4.2.6 -> 4.2.7: SNYK-JS-SOCKETIOPARSER-18517008
  improper check for unusual conditions

Left unfixed because no supported fix exists:

- react-dev-utils 12.0.1, Critical command injection
  (SNYK-JS-REACTDEVUTILS-17890708). 12.0.1 is the latest stable release;
  only 12.1.0-next prereleases exist beyond it. It is a direct dependency
  of gatsby 5.16.1, itself the latest stable gatsby, so there is no
  version to override to. No .snyk ignore added.

Every affected package arrives through gatsby, a peerDependency, so none
of them ship with this plugin. A consuming project supplies its own
Gatsby tree and these overrides do not reach it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 package-lock.json | 22 +++++++++++-----------
 package.json      |  6 ++++--
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d4793f0..2da2126 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "gatsby-source-contentstack",
-  "version": "5.4.9",
+  "version": "5.4.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "gatsby-source-contentstack",
-      "version": "5.4.9",
+      "version": "5.4.10",
       "license": "MIT",
       "dependencies": {
         "@contentstack/utils": "^1.9.1",
@@ -18174,9 +18174,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.32",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.32.tgz",
-      "integrity": "sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==",
+      "version": "4.13.1",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz",
+      "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==",
       "license": "MIT",
       "peer": true,
       "engines": {
@@ -21007,9 +21007,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "funding": [
         {
           "type": "github",
@@ -29180,9 +29180,9 @@
       }
     },
     "node_modules/socket.io-parser": {
-      "version": "4.2.6",
-      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
-      "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==",
+      "version": "4.2.7",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz",
+      "integrity": "sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
diff --git a/package.json b/package.json
index 3eaf592..051ecb7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gatsby-source-contentstack",
-  "version": "5.4.9",
+  "version": "5.4.10",
   "description": "Gatsby source plugin for building websites using Contentstack as a data source",
   "scripts": {
     "prepublish": "npm run build",
@@ -97,7 +97,9 @@
     "gatsby": {
       "eslint": "9.26.0"
     },
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.1",
+    "hono": "^4.12.34",
+    "socket.io-parser": "^4.2.7",
     "@eslint/plugin-kit": "^0.3.4",
     "@semantic-release/npm": "^13.1.5"
   },