[Snyk] Fix for 1 vulnerabilities

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Removal of Sensitive Information Before Storage or Transfer SNYK-JS-FOLLOWREDIRECTS-16032162	50

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[ryanmcmorrowsnyk]

This upgrade includes a major version update for log4js which introduces significant breaking changes. The axios upgrade is minor and primarily for security.

log4js@2.5.3 → log4js@6.0.0

Risk: HIGH

This is a major version upgrade with several breaking changes across versions 3.x, 4.x, 5.x, and 6.x. Careful migration is required.

Breaking Changes:

• Node.js Version Support: Support for Node.js versions older than v6 was dropped in log4js v3, and support for v6 was dropped in v5. You must be on a modern, supported version of Node.js.
• Removed Appenders: In v3, several appenders were removed from the core library and moved to their own packages (e.g., smtp, logstashUDP, slack). If you use any of these, you must now install them as separate dependencies (e.g., @log4js-node/smtp) and update your configuration.
• Configuration: Programmatic configuration methods like addAppender() and clearAppenders() were removed in v2 in favor of a single log4js.configure() method. While your starting version is 2.5.3, you should verify that your configuration is compatible with v6, as there may be structural changes.
• File Permissions: Version 6.4.0 introduced a change to default file permissions, which may prevent external applications from reading log files. You may need to explicitly set the mode in your file appender configuration.

Recommendation:

1. Verify your Node.js version is compatible.
2. Review your log4js configuration for any appenders that are now external packages and add the new dependencies.
3. Test your logging configuration thoroughly in a non-production environment, paying close attention to file-based logging and permissions.

Source: log4js Changelog, Changes in version 3.x

axios@0.18.0 → axios@0.21.1

Risk: LOW

This is a minor version upgrade that primarily addresses a critical security vulnerability (SSRF). There are no significant breaking API changes documented between these versions.

Recommendation:

This is a safe and recommended security update. No code changes are expected to be required.

Source: axios Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.