[Snyk] Fix for 1 vulnerabilities

[TheRedHatter]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280	710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[TheRedHatter]

This upgrade includes several major version bumps with significant breaking changes, most notably requiring an upgrade to Fastify v5 and Node.js v20+, along with API changes in rimraf.

Top 3 Most Impactful Upgrades:

1. rimraf: 3.0.2 → 6.1.1 (High Risk)

This upgrade spans multiple major versions and introduces several critical breaking changes that will require code modifications.

• Asynchronous API: The main function no longer accepts a callback and now returns a Promise. Code using rimraf(path, callback) must be updated to await rimraf(path).
• ESM Syntax: v5 removed the default export. You must switch to named imports: import { rimraf } from 'rimraf' instead of import rimraf from 'rimraf'.
• Node.js Version: v4 dropped support for Node.js versions below 14. v6 now requires Node.js v20 or higher.
• Globbing: Automatic globbing was removed in v4. To remove files using a glob pattern, you must now explicitly enable it with an option: await rimraf('*.log', { glob: true }).

Recommendation: Review all rimraf usage to update for async/await, switch to named imports, and verify that glob patterns are handled correctly with the new options.

2. mercurius: 12.2.0 → 16.7.0 (High Risk)

The upgrade from Mercurius v12 to v16 is a significant jump that requires moving from Fastify v4 to Fastify v5.

• Fastify v5 Dependency: Mercurius v16 requires Fastify v5, which has its own set of breaking changes. This is a framework-level upgrade that will impact the entire application, not just GraphQL features.
• Subscription Hooks: The context for subscription hooks like onSubscriptionEnd has been modified.

Recommendation: This upgrade must be handled as part of a larger migration to Fastify v5. Carefully review the Mercurius and Fastify migration guides.

3. @mercuriusjs/gateway: 1.2.0 → 5.0.0 (High Risk)

This upgrade is directly tied to the mercurius and fastify upgrades. The breaking changes are inherited from its dependencies.

• Framework Upgrade: The major version jump is aligned with the shift to newer versions of mercurius and fastify. Upgrading this package necessitates the same Fastify v5 migration mentioned above.

Recommendation: Update this package in tandem with mercurius and fastify, ensuring that gateway service definitions and polling configurations are compatible with the new versions.

Other Major Upgrades:

• @fastify/static 7.0.1 → 9.0.0 (High Risk): This upgrade also requires migrating from Fastify v4 to v5. The plugin's major version is tied to the framework's major version.
• bcrypt 5.1.0 → 6.0.0 (Medium Risk): This upgrade drops support for Node.js 16 and older. The underlying build system changed from node-pre-gyp to prebuildify, which may affect deployment pipelines but does not change the API.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[TheRedHatter]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
⛔	Open Source Security	0	1	1	0	2 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[TheRedHatter]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
⛔	Open Source Security	0	1	1	0	2 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​mercuriusjs/​gateway@​1.2.0 ⏵ 5.0.0	-1			-1
	@​fastify/​static@​7.0.1 ⏵ 9.0.0	+1	-2
	rimraf@​6.1.1
	bcrypt@​5.1.0 ⏵ 6.0.0	+9		+1
	mercurius@​16.7.0

View full report