fix(deps): upgrade snyk devDependency to ^1.1307.0 to remove parse-url 5.0.1 — CVE-2022-2216 (SSRF)

[devin-ai-integration]

Summary

Remediates Server-side Request Forgery (SSRF) in parse-url@5.0.1 (SNYK-JS-PARSEURL-2936249 / CVE-2022-2216, severity Critical, CVSS 9.4). The vulnerable package is reachable only through the dev dependency snyk@1.278.1 > git-url-parse@11.1.2 > git-up@4.0.1 > parse-url@5.0.1; no in-range parse-url update is available for that chain, so the fix is to move the snyk CLI to a modern release, which no longer depends on git-url-parse at all.

- "snyk": "^1.244.0"
+ "snyk": "^1.1307.0"

• Affected: parse-url < 6.0.1 — Fixed in: 6.0.1. After this change parse-url, git-up and git-url-parse are no longer in the dependency graph.
• snyk@1.1307.0 was published 2026-08-26 (>7 days ago). The current CLI is a thin npm wrapper around a downloaded binary, so this also shrinks node_modules by ~600 packages (removes several other outdated transitive deps).
• Advisory: https://security.snyk.io/vuln/SNYK-JS-PARSEURL-2936249 · https://nvd.nist.gov/vuln/detail/CVE-2022-2216
• npm test (snyk test) keeps working with the new CLI; the old 1.278.1 also triggered a Snyk CLI self-update warning.

Files changed: package.json, package-lock.json (snyk subtree swap; 78 added / 674 removed packages).

Verification: npm ci clean; npx snyk --version → 1.1307.0; 30/30 end-to-end regression checks pass (app runtime code untouched — dev dependency only).

Scan reference: Snyk MCP snyk_sca_scan (org 9e26acce-22c7-4efc-b470-21d9587f49fe) on main@d240896, 2026-09-10.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/0b602fbece0246d2a263a9d20b275733
Open in Devin Desktop: https://app.devin.ai/desktop/session/0b602fbece0246d2a263a9d20b275733?variant=devin
Requested by: @sumitshatwara

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring