Fix CI type check and resolve security vulnerabilities

[jdalton]

Summary

Fixes CI pipeline failures and resolves 2 high-severity Dependabot security alerts.

Changes

CI Fix:

• Remove unused silence parameter from getDefaultOrgSlug() call in cmd-fix.mts
• Completes the parameter removal started in commit 2b6d61a

Security Updates:

• Update qs from 6.14.0 to 6.14.1
  • Fixes CVE-2025-15284: arrayLimit bypass DoS vulnerability
  • Closes Dependabot alert Handle dist tags / no version argument when running the info command #92
• Update glob from 10.4.5/11.0.3 to 13.0.0
  • Fixes CVE-2025-64756: CLI command injection vulnerability
  • Closes Dependabot alert Bump actions/checkout from 3 to 4 #85

Test Plan

• ✅ TypeScript type checks pass
• ✅ ESLint checks pass
• ✅ All unit tests pass
• ✅ Pre-commit hooks pass

---

Note

Resolves CI/type-check issues and addresses dependency updates.

• Updates packages/cli/src/commands/fix/cmd-fix.mts to call getDefaultOrgSlug() without the silence parameter
• Bumps dependencies: glob → 13.0.0 and qs → 6.14.1 via package.json overrides and pnpm-lock.yaml (removing older transitive variants)

^{Written by Cursor Bugbot for commit 11ce67d. Configure here.}

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm glob under BlueOak-1.0.0 License: BlueOak-1.0.0 - the applicable license policy does not allow this license (4) (npm metadata) License: BlueOak-1.0.0 - the applicable license policy does not allow this license (4) (package/LICENSE.md) License: BlueOak-1.0.0 - the applicable license policy does not allow this license (4) (package/package.json) From: pnpm-lock.yaml → npm/@npmcli/[email protected] → npm/@npmcli/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​socketbin/​cli-linux-x64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+43		+62	+7
	npm/​@​socketbin/​cli-win32-arm64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+47		+62	+7
	npm/​@​socketbin/​cli-win32-x64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7
	npm/​@​socketbin/​cli-darwin-arm64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7
	npm/​@​socketbin/​cli-darwin-x64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+47		+62	+7
	npm/​@​socketbin/​cli-linux-arm64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+47		+62	+7

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​socketbin/​cli-darwin-x64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7
	npm/​@​socketbin/​cli-win32-arm64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7
	npm/​@​socketbin/​cli-win32-x64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7
	npm/​@​socketbin/​cli-linux-x64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+43		+62	+7
	npm/​@​socketbin/​cli-linux-arm64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7
	npm/​@​socketbin/​cli-darwin-arm64@​0.0.0-20251103.61247 ⏵ 0.0.0-replaced-by-provenance	+46		+62	+7

View full report