[Snyk] Fix for 2 vulnerabilities

[TheRedHatter]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	710
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[TheRedHatter]

This update includes major version upgrades for rimraf, fastify-swagger, and bcrypt, each introducing significant breaking changes that require developer action.

High-Impact Upgrades

• rimraf (3.0.2 → 6.1.1): HIGH RISK
  This upgrade spans multiple major versions (v3 → v6) and introduces several critical breaking changes that will require code modification.

  • Promise-Based API: The function no longer accepts a callback and now returns a Promise. Asynchronous calls must be updated (e.g., using await).
  • No Default Export (v5+): Imports must be changed from const rimraf = require('rimraf') to named imports like const { rimraf } = require('rimraf').
  • Opt-in Glob Support (v4+): Glob patterns are no longer supported by default. You must use the { glob: true } option for glob patterns to work.
  • Node.js Version: This version requires Node.js v20 or higher.
    Recommendation: Review all usages of rimraf to switch to the Promise-based API, update import statements, and explicitly enable glob support where needed.

• fastify-swagger (4.7.0 → 5.2.0): HIGH RISK
  The fastify-swagger package is deprecated and has been replaced. While this minor version bump itself has few direct breaking changes, continued use of this package is a risk.

  • Package Deprecated: The package is no longer maintained and has been split into @fastify/swagger and @fastify/swagger-ui.
    Recommendation: Plan a migration from the deprecated fastify-swagger to the new @fastify/swagger package to ensure continued support and compatibility with future Fastify versions.

Medium-Impact Upgrades

• bcrypt (5.0.1 → 6.0.0): MEDIUM RISK
  This major version upgrade introduces a breaking change related to the supported Node.js runtime.
  • Node.js Support: Support for Node.js versions 16 and below has been dropped.
  • Build System Changes: The package switched from node-pre-gyp to prebuildify, which could affect environments with custom build or deployment tooling.
    Recommendation: Ensure your runtime environment is Node.js v18 or higher before upgrading.

Low-Impact Upgrades

• **lib

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[TheRedHatter]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[TheRedHatter]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	libxmljs@​0.19.7 ⏵ 0.19.8	+1		+1		+11
	fastify-swagger@​4.7.0 ⏵ 5.2.0	+12		-48	-33
	rimraf@​6.1.1
	bcrypt@​5.0.1 ⏵ 6.0.0	+9

View full report