fix(deps): override hono, js-yaml and socket.io-parser to patched versions

[abhishek-ezhava-cstk]

Summary

Clears 6 of the 7 vulnerabilities Snyk reports against this project's install tree. Version bumped 5.4.9 → 5.4.10 to match what semantic-release computes for a fix: commit.

Approach: all six have patched upstream releases, so they are fixed by forcing the patched version through the existing overrides block. No .snyk ignore added, and no ignore is needed. Confirmed with npm ls that each override actually resolved rather than just being declared:

Package	Before	After	Advisories cleared
hono	4.12.32	4.13.1	SNYK-JS-HONO-18517010 ReDoS, -18592332 data exposure to wrong session, -18592333 HTTP request smuggling, -18593786 inefficient algorithmic complexity
js-yaml	4.3.0	4.3.1	SNYK-JS-JSYAML-18593780 inefficient algorithmic complexity (High)
socket.io-parser	4.2.6	4.2.7	SNYK-JS-SOCKETIOPARSER-18517008 improper check for unusual conditions (High)

All three are patch bumps inside the same major, so no API surface moves. hono is only present because ESLint 9.26 ships an MCP server that pulls @modelcontextprotocol/sdk; nothing in this plugin touches it.

Left unfixed, deliberately: react-dev-utils@12.0.1 — Critical command injection, SNYK-JS-REACTDEVUTILS-17890708. 12.0.1 is the latest stable release, with only 12.1.0-next prereleases beyond it, and it is a direct dependency of gatsby@5.16.1, itself the latest stable gatsby. There is no version to override to. Snyk's own output says "No upgrade or patch available". This clears when gatsby moves off it.

Scope note: every package here arrives through gatsby, which is a peerDependency. None of them are published with this plugin — the published tarball carries only the 9 runtime dependencies, and a consuming project supplies its own Gatsby tree, which these overrides do not reach. This change makes the project's own scan honest; it does not change what consumers install.

Test plan

• snyk test before: 7 vulnerabilities (1 critical, 2 high, 4 medium). After: 1 (the react-dev-utils critical above).
• npm ls hono js-yaml socket.io-parser — each reports overridden at the patched version, not the declared one.
• npx jest — 6 suites, 16 tests, all pass.
• npm run build — 25 files compiled, no change to committed build output.
• git status clean apart from package.json and package-lock.json (3 lines and 9 lines respectively).

Not covered: no live verification against a real Contentstack stack, since no plugin source changed — this is dependency resolution only. The 11 remaining Snyk license findings (MPL-2.0 in axe-core, LGPL-3.0 in the sharp-libvips platform binaries) are pre-existing and untouched by this change.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	1	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	41	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 0
• Medium without fixes: 41
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.