[Snyk] Security upgrade @thoughtspot/ts-chart-sdk from 0.0.2-alpha.23 to 1.0.0

[mnk-blr]

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• example/custom-bar-chart/package.json
• example/custom-bar-chart/pnpm-lock.yaml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-ROLLUP-15340920	234

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[github-actions]

File	Coverage
All files	88%	✅
src/main/custom-chart-context.ts	86%	✅
src/main/logger.ts	88%	✅
src/main/post-message-event-bridge.ts	77%	✅
src/react/use-custom-chart-context.tsx	86%	✅
src/react/mocks/custom-chart-context-mock.ts	96%	✅
src/utils/chart-config.ts	82%	✅
src/utils/date-formatting.ts	82%	✅
src/utils/formatting-util.ts	89%	✅
src/utils/conditional-formatting/conditional-formatting.ts	92%	✅
src/utils/globalize-Initializer/globalize-utils.ts	95%	✅
src/utils/number-formatting/number-formatting-utils.ts	98%	✅
src/utils/number-formatting/number-formatting.ts	90%	✅

Minimum allowed coverage is 0%

Generated by 🐒 cobertura-action against e361ab7

[claude]

🚨 Critical Version Inconsistency: This line shows version "1.0.0" but the previous package.json had "2.7.6". Going from 2.7.6 → 1.0.0 appears to be a version downgrade, which is unusual for a security fix.

Issues:

1. This violates semantic versioning expectations (major version should increment, not decrement)
2. Could introduce breaking changes moving to an older major version
3. Needs verification that 1.0.0 actually contains the security fix for SNYK-JS-ROLLUP-15340920

Recommendation: Verify the correct target version with Snyk. Security fixes typically move forward to newer versions, not backwards.

[claude]

⚠️ Lock File Inconsistency: The lock file shows the previous version was 0.0.2-alpha.23 but the PR description and package.json suggest different versions were involved.

Timeline appears to be:

• Lock file had: 0.0.2-alpha.23
• Package.json had: 2.7.6
• Now updating to: 1.0.0

This suggests the lock file was out of sync with package.json, which could indicate dependency management issues in the example project.

[claude]

📦 Significant Dependency Changes: Version 1.0.0 introduces many new dependencies (cldr-data, globalize, various utility packages) that weren't present in the alpha version.

New dependencies include:

• cldr-data@36.0.5 - Large internationalization data package
• globalize@1.7.1 - Internationalization library
• Various utility packages (abbrev, axios, cross-spawn, etc.)

Concerns:

1. Bundle size impact on the example application
2. Potential security surface area increase
3. Need to verify these dependencies don't introduce new vulnerabilities

Recommendation: Test the example application thoroughly to ensure it still works correctly with the new dependency tree.

[claude]

PR Review Summary 🔍

Status: ❌ NOT READY FOR MERGE

This Snyk security fix PR has critical version consistency issues that must be resolved before merging.

🚨 Critical Issues Found

1. Version Downgrade Anomaly: Package.json shows downgrade from 2.7.6 → 1.0.0, which violates semantic versioning expectations for security fixes
2. Lock File Inconsistency: Previous lock file had 0.0.2-alpha.23 while package.json had 2.7.6, indicating dependency management issues
3. Missing Security Details: No documentation of what specific security vulnerability was fixed or validation that 1.0.0 contains the fix

📋 Required Actions Before Merge

• Verify target version: Confirm with Snyk that 1.0.0 is the correct security-patched version
• Test breaking changes: Verify example application still functions with version 1.0.0
• Update documentation: Add details about the security fix and any migration steps needed
• Validate fix: Ensure the Directory Traversal vulnerability (SNYK-JS-ROLLUP-15340920) is actually resolved

💡 Recommendation

The version inconsistencies suggest this may be an incorrect automated fix. Please manually verify the intended target version and regenerate the dependency updates to ensure consistency across package.json and lock files.

---

Review completed with specialized subagents for code quality, documentation accuracy, and test coverage.