[Snyk] Fix for 1 vulnerabilities

[TheRedHatter]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280	710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[TheRedHatter]

This upgrade includes multiple major versions with significant breaking changes, requiring code modifications and environment updates. The most critical changes are in rimraf, mercurius, and fastify-swagger, which necessitate immediate developer attention.

Top 3 Most Impactful Upgrades:

• rimraf 3.0.2 → 6.1.1 (HIGH): This upgrade introduces several breaking changes. The API is now Promise-based instead of using callbacks, the default export has been removed in favor of named exports (import { rimraf } from 'rimraf'), and version 6 requires Node.js 20 or higher. [2, 5]

  • Recommendation: Update all rimraf calls to use Promises (await rimraf(...)) and change imports from require('rimraf') to import { rimraf } from 'rimraf'. Ensure your environment uses Node.js 20+.

• mercurius 12.2.0 → 16.7.0 (HIGH): This is a significant upgrade that requires updating the core framework. Version 16 is compatible with Fastify v5, which in turn requires Node.js v20 or higher. [4, 24, 25] This upgrade will likely have cascading effects on other Fastify plugins.

  • Recommendation: This upgrade must be done in conjunction with a migration to Fastify v5 and Node.js v20+. Review the Fastify v5 migration guide for extensive changes to schema validation and other APIs. [24]

• fastify-swagger 4.17.1 → 5.2.0 (HIGH): The fastify-swagger package is deprecated and has been replaced by @fastify/swagger for schema generation and @fastify/swagger-ui for the user interface. [11, 18] Continuing to use fastify-swagger is not recommended.

  • Recommendation: Replace fastify-swagger with @fastify/swagger and @fastify/swagger-ui. This will require changing the package name in your dependencies and updating the registration and configuration code to match the new API.

Other Major Upgrades:

• @mercuriusjs/gateway 1.2.0 → 5.0.0 (High): This large version jump aligns with the breaking changes in mercurius, including the requirement for Fastify v5 and Node.js v20+.
• @fastify/static 7.0.1 → 9.0.0 (Medium):

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[TheRedHatter]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
⛔	Open Source Security	0	1	1	0	2 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[TheRedHatter]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
⛔	Open Source Security	0	1	1	0	2 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	fastify-swagger@​4.17.1 ⏵ 5.2.0			-48	-35
	@​mercuriusjs/​gateway@​1.2.0 ⏵ 5.0.0	-1			-1
	@​fastify/​static@​6.12.0 ⏵ 9.0.0	+1	-2
	rimraf@​6.1.1
	bcrypt@​5.1.0 ⏵ 6.0.0	+9		+1
	mercurius@​12.2.0 ⏵ 16.7.0		+2		-3

View full report