[Jeremip11]

Snyk has created this PR to fix 32 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• script/package.json
• script/package-lock.json
• script/.snyk

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	****
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	****
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280	****
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-17900054	****
	Allocation of Resources Without Limits or Throttling SNYK-JS-JSYAML-19496768	****
	Prototype Pollution SNYK-JS-LODASH-567746	****
	Information Exposure SNYK-JS-SIMPLEGET-2361683	****
	Remote Code Execution (RCE) SNYK-JS-SIMPLEGIT-15456078	****
	Command Injection SNYK-JS-SIMPLEGIT-16032290	****
	Command Injection SNYK-JS-SIMPLEGIT-2421199	****
	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') SNYK-JS-SIMPLEGIT-2434306	****
	Remote Code Execution (RCE) SNYK-JS-SIMPLEGIT-3112221	****
	Remote Code Execution (RCE) SNYK-JS-SIMPLEGIT-3177391	****
	Symlink Attack SNYK-JS-TARFS-9535930	****
	Predictable Value Range from Previous Values SNYK-JS-FORMDATA-10841150	791
	Prototype Pollution SNYK-JS-FLATTED-15700433	786
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	756
	Uncontrolled Recursion SNYK-JS-FLATTED-15518041	756
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-15309438	756
	Inefficient Algorithmic Complexity SNYK-JS-MINIMATCH-15353389	756
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-14724253	756
	Infinite loop SNYK-JS-TAR-17909068	756
	Allocation of Resources Without Limits or Throttling SNYK-JS-TAR-17909152	756
	Directory Traversal SNYK-JS-TMP-16881240	756
	Directory Traversal SNYK-JS-TMP-17315641	756
	Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	751
	Directory Traversal SNYK-JS-TAR-15307072	741
	Uncaught Exception SNYK-JS-QS-19432019	738
	Symlink Attack SNYK-JS-TAR-15456201	731
	Server-side Request Forgery (SSRF) SNYK-JS-IP-12704893	716
	Server-side Request Forgery (SSRF) SNYK-JS-IP-12761655	716
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AJV-15274295	517

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncontrolled Recursion
🦉 More lessons are available in Snyk Learn

[Jeremip11]

This is a massive upgrade involving multiple high-impact, breaking changes across critical development and build tools. Significant migration effort is required.

Top Breaking Changes:

• eslint@5.16.0 → eslint@10.0.0: This is an exceptionally large jump across 5 major versions (v6-v10). Key breaking changes include:

  • Configuration Overhaul: The legacy .eslintrc.* config format is completely removed in v10 and deprecated in v9 in favor of the new eslint.config.js (flat config) format. Your entire ESLint configuration must be migrated.
  • Node.js Versions: Support for older Node.js versions has been progressively dropped. v10 requires Node.js ^20.19.0 or >=22.13.0.
  • Rule and Plugin APIs: APIs for custom rules and plugins have changed significantly. The CLIEngine class was removed in v8, and function-style rules were removed in v9.
  • Recommendation: A staged migration is required. Use the official codemods (@eslint/migrate-config) to assist with the configuration file migration. This upgrade must be handled as a separate, dedicated effort.

• npm@6.14.16 → npm@11.0.0: Upgrading the package manager itself across 5 major versions introduces fundamental changes to dependency management.

  • Peer Dependencies: Starting with v7, peer dependencies are installed automatically by default, which can introduce new conflicts or unexpected packages.
  • package-lock.json: v7 introduced a new lockfile format (v2) and now supports yarn.lock. The existing lockfile will be updated and may not be backward-compatible.
  • npm audit: The output format for npm audit changed significantly in v7, which will break any scripts or tools that parse its JSON output.
  • Node.js Versions: Support for older Node.js versions has been dropped. v10 dropped Node 14/16, and v11 requires Node ^20.17.0 or >=22.9.0.

• glob@7.0.3 → glob@12.0.0: This library, used for file matching, underwent a complete rewrite.

  • API Rewrite: Starting in v8/v9, the API is now Promise-based. Synchronous methods like glob.sync() have been removed from the main export and must be imported directly (e.g., glob/sync). This requires a full refactoring of all glob calls.
  • Windows Paths: Handling of back-slashes on Windows has been made more consistent, which can be a breaking change for path matching.

Other Major Breaking Upgrades:

• babel-core@5.8.38 → babel-core@6.10.4: The v5 to v6 transition was a massive breaking change for the entire Babel ecosystem, requiring a complete overhaul of configuration (.babelrc) and packages (e.g., babel-preset-es2015).
• simple-git@2.11.0 → simple-git@3.36.0: The API was rewritten to be Promise-based in v3, breaking all previous callback-based usage.
• stylelint@9.3.0 → stylelint@13.0.0: Similar to ESLint, this involves numerous breaking changes to rules, configurations, and dropped Node.js versions.
• webdriverio@5.9.2 → webdriverio@6.0.0: Dropped support for Node.js v8 and consolidated command parameters.

Recommendation: These upgrades are highly complex and will require significant, dedicated developer effort to migrate configurations, update code to new APIs, and resolve dependency conflicts. A full regression test is mandatory. It is strongly advised to tackle these upgrades in smaller, separate pull requests rather than all at once.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.