fix(dependency): CVE-2026-45022

[j-luong]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Fixes CVE-2026-45022

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

Fix the CVE-2026-45022 vulnerability in the CLI

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 7 relevant code sections from 6 files (average relevance: 0.75) scripts/upgrade-snyk-go-dependencies.go (lines 1-135) CONTRIBUTING.md (2 segments, lines 218-387) dangerfile.js (lines 1-111) package-lock.json (lines 2932-3216) package.json (lines 1-224) README.md (lines 88-131)