[Snyk] Fix for 3 vulnerabilities

[aluca3]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	828
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	828
	Prototype Pollution SNYK-JS-MONGOOSE-18319533	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Prototype Pollution

[aluca3]

This set of upgrades includes multiple high-risk major version jumps that require significant developer attention and code modification. The upgrades for mongoose, typeorm, and tap introduce substantial breaking changes and will necessitate careful, staged migrations.

Top 3 Most Impactful Upgrades

1. mongoose 4.2.4 → 6.13.10 (HIGH RISK)

This is a double major version upgrade, spanning from v4 to v6, which introduces numerous significant breaking changes. A direct upgrade is not recommended; a staged migration from v4 → v5 → v6 is necessary.

• Migration to v5: Requires updating to Node.js >= 4.0. Code must be adapted for native Promises, as mpromise is removed. [4, 15] Connection logic changes, with useMongoClient being removed and its behavior becoming standard. [12] Query middleware is now compiled at model creation, which can affect how middleware is defined. [12]
• Migration to v6: Requires the MongoDB Node.js driver v4.x. The useNewUrlParser and useUnifiedTopology connection options are removed and are now the default behavior. [6, 9] The strictQuery option behavior is changed to filter out fields not in the schema by default. [9] Mongoose arrays now use proxies, enabling better change tracking without needing markModified(). [6]

Recommendation: This is a major refactoring effort. Follow the official migration guides for v4 to v5 and v5 to v6 sequentially. Allocate significant time for code changes and testing.

2. typeorm 0.2.24 → 1.0.0 (HIGH RISK)

This upgrade crosses two major breaking versions (0.3.x and 1.0.0) and requires a complete overhaul of how the ORM is initialized and used. The 1.0.0 release is a recent and very significant update. [3, 5, 8]

• Migration to v0.3: The primary breaking change is the move from ormconfig.json and global connection functions (createConnection, getConnection) to a DataSource-based configuration. [19]
• Migration to v1.0: This version finalizes the removal of all deprecated APIs. Connection and ConnectionOptions are completely replaced by DataSource. [3, 8] It also introduces a minimum Node.js version requirement of 20. [10] The mysql driver is dropped in favor of mysql2. [3] An automated codemod tool is available to assist with some of the syntax changes. [5]

Recommendation: This is a very high-effort migration. First, refactor the application to use the DataSource pattern from v0.3. Then, upgrade to v1.0, address the removed APIs, and ensure the Node.js runtime is updated. Use the official [v1.0 Release Notes](https://github.com/typeorm/typeorm/releases/tag/1.0.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.