[Snyk] Fix for 2 vulnerabilities

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-15930944	209
	CRLF Injection SNYK-JS-NODEMAILER-15930946	209

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 CRLF Injection

[ryanmcmorrowsnyk]

This upgrade includes multiple major versions with significant breaking changes. Action is required to ensure compatibility, particularly for axios and log4js.

Top 3 Most Impactful Upgrades

• axios (0.18.0 → 1.13.2): HIGH RISK
  This major version upgrade introduces several breaking changes that require code modifications.

  • Import Syntax: The import statement has changed. You must now use the default export: import axios from "axios";.
  • Headers Object: The headers.common property has been removed. Headers should now be set directly on the headers object (e.g., request.headers.Authorization).
  • Form Data: The Content-Type header for multipart/form-data is now set automatically and should be removed from custom configurations.
  • Internals: Internal functions are no longer exported. Code should only rely on the public API.
  • Parameter Serialization: There are numerous breaking changes to parameter serialization that require review.
    Source: Upgrade guide
    Recommendation: Review all axios usage, update import statements, and adjust header and form data configurations according to the v1.x API.

• log4js (2.5.3 → 6.0.0): HIGH RISK
  This upgrade spans multiple major versions and includes significant breaking changes, primarily in version 3.x.

  • Appender Modules: Many appenders (e.g., smtp, gelf, logstash, loggly) have been removed from the core library and must now be installed as separate packages (e.g., @log4js-node/smtp).
  • Node.js Support: Support for Node.js versions below 6 was dropped in v3.0.0, and support for v6 was dropped in v5.0.0.
  • Multiprocess Appender: The multiprocess appender was replaced with a TCP client/server architecture.
    Source: log4js v3 Changes
    Recommendation: Identify all appenders used in your configuration. Install the required external appender packages from @log4js-node and update your log4js configuration accordingly.

• nodemailer (4.6.3 → 8.0.5): MEDIUM RISK
  This upgrade across several major versions contains potentially breaking changes that are environment-dependent.

  • DNS Resolution: Version 5.0.0 changed the DNS resolution from dns.lookup() to dns.resolve(). This could impact environments with custom host file configurations.
  • Node.js Support: Support for older Node.js versions has been dropped in major releases (e.g., Node < 12 in v5.0.0 of a related transport).
  • Error Codes: In v8.0.0, the error code NoAuth was renamed to ENOAUTH, which may affect error handling logic.
    Source: Nodemailer Changelog
    Recommendation: Verify email sending functionality in a test environment, especially if you rely on custom DNS resolution. Check any error handling logic that specifically looks for the 'NoAuth' error code.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.