[Snyk] Fix for 6 vulnerabilities

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 6 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803084	370
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803082	341
	Prototype Pollution SNYK-JS-CONVICT-15182994	266
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803086	243
	Improper Check for Unusual or Exceptional Conditions SNYK-JS-HANDLEBARS-15807042	227
	Improper Encoding or Escaping of Output SNYK-JS-HANDLEBARS-15807040	223

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Access of Resource Using Incompatible Type ('Type Confusion')
🦉 Improper Encoding or Escaping of Output

[ryanmcmorrowsnyk]

This upgrade includes a major version increase for convict which introduces significant breaking changes. The handlebars upgrade, while minor, includes important security-related behavioral changes that require verification.

convict: 4.2.0 → 6.2.3 (HIGH RISK)

This is a major version upgrade with significant breaking changes introduced in v6.0.0.

Breaking Changes:

• Package Splitting: The original convict package has been split. The core package remains, but formats for validator and moment have been moved to separate packages (convict-format-with-validator and convict-format-with-moment). If you use these formats, you must add the new packages as dependencies.
• Optional JSON5 Parser: Support for JSON5 configuration files (which allow comments) is no longer built-in. If you use commented config files, you must now explicitly add json5 as a dependency.

Recommendation:

• Add convict-format-with-validator and/or convict-format-with-moment to your package.json if your schema uses formats like ipaddress, email, or date.
• Add json5 to your package.json if your configuration files contain comments.

Source: CHANGELOG.md

handlebars: 4.0.11 → 4.7.9 (MEDIUM RISK)

This upgrade contains security fixes that alter behavior and may require verification.

Behavioral Changes:

• Prototype Access Control: To address security vulnerabilities, access to object prototype properties from within templates is now forbidden by default. While the maintainers state this should not affect applications using documented features, it could break templates that rely on accessing prototype properties or methods.

Recommendation:

• Verify that your templates do not rely on accessing prototype properties. If they do, you may need to refactor them or explicitly allow access via runtime options as described in the library's documentation.

Source: Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.