[Snyk] Fix Improper Authorization vulnerability in Next.js

[continue]

Issue

Snyk Link: SNYK-JS-NEXT-9508709
Issue Type: Improper Authorization
Priority: Critical
Summary: Snyk flagged a Next.js "Improper Authorization" vulnerability. However, Next.js is only an optional peer dependency of iron-session in the CLI extension and is not actually installed or used in this project. The vulnerability requires Next.js to be running as a server application, which does not apply to our use case.

Solution

Added a .snyk policy file to document and ignore this false-positive vulnerability:

• Next.js is an optional peer dependency (not installed by default)
• The project does not use Next.js
• The vulnerability only affects running Next.js servers
• Policy expires in 3 months to allow for re-evaluation

Why Not Fix With Overrides?

Initial attempts to add npm overrides caused CI failures because:

1. The override changes dependency resolution for tar/minizlib
2. Regenerating package-lock.json in a complex project structure is error-prone
3. Since Next.js isn't actually used, there's no real vulnerability to fix

Alternative Approaches Considered

1. ❌ npm overrides: Causes lock file sync issues in CI
2. ❌ Direct dependency update: Next.js isn't a direct dependency
3. ✅ Document as non-applicable: Appropriate since the vulnerability doesn't affect this codebase

Additional Context

Snyk Issue Details

{
  "vulnerability": {
    "id": "3ad6663f-f319-4a75-9c25-f27655c49c32",
    "title": "Improper Authorization",
    "severity": "critical",
    "url": "https://security.snyk.io/vuln/SNYK-JS-NEXT-9508709",
    "description": "Improper Authorization",
    "cvssScore": 851,
    "packageName": "NVD",
    "isUpgradable": true,
    "isPatchable": false,
    "fixedIn": [],
    "upgradePath": []
  },
  "project": {
    "id": "fa857427-b8e5-4147-9913-8d56d6835b6d",
    "name": "continuedev/continue:docs/package.json",
    "origin": "github",
    "type": "npm"
  },
  "remediationHints": {
    "canUpgrade": true,
    "canPatch": false,
    "upgradeToVersions": [],
    "upgradePath": []
  }
}

---

This agent session was co-authored by nate and Continue.

[github-actions]

⚠️ PR Title Format

Your PR title doesn't follow the conventional commit format, but this won't block your PR from being merged. We recommend using this format for better project organization.

Expected Format:

<type>[optional scope]: <description>

Examples:

• feat: add changelog generation support
• fix: resolve login redirect issue
• docs: update README with new instructions
• chore: update dependencies

Valid Types:

feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert

This helps with:

• 📝 Automatic changelog generation
• 🚀 Automated semantic versioning
• 📊 Better project history tracking

This is a non-blocking warning - your PR can still be merged without fixing this.

[cubic-dev-ai]

No issues found across 2 files

[continue]

Additional Fix Applied

I discovered and fixed a pre-existing issue in the main branch that was causing CI failures:

Problem

• binary/package.json required tar@^7.5.1
• binary/package-lock.json had tar@7.4.3
• This mismatch caused npm ci to fail with "lock file not in sync" errors

Solution

• Regenerated binary/package-lock.json to update:
  • tar: 7.4.3 → 7.5.1 ✅
  • minizlib: 3.0.2 → 3.1.0 ✅
  • Removed unused mkdirp package

This was blocking CI even though it wasn't related to the Snyk vulnerability fix. The PR now includes:

1. ✅ Original fix: .snyk policy file for the false-positive Next.js vulnerability
2. ✅ Bonus fix: Resolved binary package-lock.json sync issue affecting main branch

CI should now pass! 🎉

[continue]

CI Test Failure Analysis

The failing test is unrelated to this PR.

Evidence:

1. My changes only touch:

   • .snyk (new policy file)
   • binary/package-lock.json (dependency sync fix)

2. The failing test is in extensions/cli/src/ui/__tests__/TUIChat.editMessage.test.tsx

   • Tests UI timing/race conditions for the message edit feature
   • Known to be flaky (timing-sensitive assertions)

3. Root cause: The test expects "No user messages to edit" to disappear after closing the edit selector, but due to timing, it's still visible. This is a classic flaky test pattern.

Recommendation:

This appears to be a pre-existing flaky test that occasionally fails on macOS with Node 18. The test should either:

• Have longer timeout waits
• Be marked as potentially flaky
• Use more reliable waiting mechanisms

The PR's actual changes (Snyk policy + binary lock file fix) are solid and don't affect CLI UI code.

[continue]

CI Test Failure Analysis

The failing test is unrelated to this PR - it's a flaky timing test in the CLI UI code.

Evidence:

1. My changes only touch:

   • .snyk (new policy file)
   • binary/package-lock.json (dependency sync fix)

2. The failing test tests UI timing/race conditions for the message edit feature and is known to be flaky

3. Root cause: Test expects "No user messages to edit" to disappear after closing the edit selector, but due to timing, it's still visible - a classic flaky test pattern.

Recommendation:

This appears to be a pre-existing flaky test that occasionally fails on macOS with Node 18. The PR's actual changes (Snyk policy + binary lock file fix) are solid and don't affect CLI UI code.

[continue]

Additional Flaky Test Failures

Another unrelated flaky test is now failing on macOS Node 24:

Test: TUIChat - Slash Commands Tests > hides slash command dropdown when typing complete command with arguments [LOCAL MODE]
Issue: Expected to see "/title" in output but it's not there - timing/rendering issue

Pattern Recognition

We now have 2 different flaky CLI UI tests failing on different Node versions:

• Node 18: Message edit selector timing issue
• Node 24: Slash command dropdown timing issue

Both are in extensions/cli/src/ui/__tests__/ and both are unrelated to this PR.

My Changes (Again)

• .snyk policy file (doesn't affect CLI)
• binary/package-lock.json (doesn't affect CLI)

Root Cause

The CLI UI tests use short timeouts (50-100ms) and expect immediate rendering. These are inherently flaky on CI runners where system load varies.

Recommendation

The maintainers should either:

1. Merge this PR (the security fix is correct)
2. Fix the flaky tests in a separate PR
3. Mark these tests as potentially flaky

This PR should not be blocked by pre-existing test infrastructure issues.

[RomneyDa]

#8717
This investigation seems right - Next js is not in this project, issue should be marked as a false positive