[Snyk] Fix for 22 vulnerabilities

[pcic-devops]

Snyk has created this PR to fix 22 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Prototype Pollution SNYK-JS-AXIOS-15252993
	HTTP Response Splitting SNYK-JS-AXIOS-16298058
	Uncontrolled Recursion SNYK-JS-AXIOS-16299923
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-17172681
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280
	Prototype Pollution SNYK-JS-BROWSERSLIST-18854715
	Allocation of Resources Without Limits or Throttling SNYK-JS-BROWSERSLIST-18856271
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-17900054
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18593780
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-15309438
	Inefficient Algorithmic Complexity SNYK-JS-MINIMATCH-15353389
	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-15789767
	Infinite loop SNYK-JS-NODEFORGE-15789769
	Improper Certificate Validation SNYK-JS-NODEFORGE-15789771
	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-15789773
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-14724253
	Arbitrary Command Injection SNYK-JS-SHELLQUOTE-16799355
	Inefficient Algorithmic Complexity SNYK-JS-SHELLQUOTE-17457810
	Directory Traversal SNYK-JS-TMP-16881240
	Directory Traversal SNYK-JS-TMP-17315641
	Arbitrary Code Injection SNYK-JS-SERIALIZEJAVASCRIPT-570062

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Uncontrolled Recursion
🦉 Allocation of Resources Without Limits or Throttling
🦉 More lessons are available in Snyk Learn

[pcic-devops]

This upgrade contains major breaking changes, primarily from the react-scripts package, and requires significant developer action.

react-scripts: 3.0.1 → 5.0.0 (HIGH RISK)

This is a two-step major version upgrade (v3 → v4 → v5) with significant breaking changes at each step. It introduces modern tooling but requires careful migration.

Key Breaking Changes:

• Webpack 5 Upgrade (in v5): This is the most critical change. Webpack 5 no longer provides automatic polyfills for Node.js core modules (crypto, stream, buffer, etc.). If your project or its dependencies rely on these in a browser environment, the build will fail with errors like Can't resolve 'fs'. You must find browser-friendly alternatives for these packages or use a tool like craco to add the polyfills back.
• Dropped Node.js Support (in v5): Support for Node.js versions 10 and 12 is dropped. Your development environment and CI/CD pipeline must use Node 14 or newer.
• Dependency Updates: The upgrade includes major bumps to core dependencies, each with its own breaking changes:
  • v4: ESLint 7, Jest 26, React 17 (with new JSX Transform).
  • v5: Webpack 5, Jest 27, ESLint 8, PostCSS 8.
• New JSX Transform (in v4): You no longer need to import React in every file just to use JSX. A codemod is available to help remove unnecessary imports.

Recommendation:

1. Address Webpack 5 Polyfills: Audit your dependencies for reliance on Node.js built-ins. This is the most common and difficult issue when upgrading.
2. Upgrade Node.js: Ensure your environment is running Node.js 14+.
3. Run Codemods: Use the update-react-imports codemod to clean up old React imports.
4. Delete node_modules: After updating package.json, delete your node_modules directory and package-lock.json or yarn.lock file before running npm install or yarn to prevent resolution issues.

axios: 0.21.4 → 0.32.0 (LOW RISK)

This is a minor version upgrade. While the version range is wide, the changes primarily consist of security fixes and patches. Version 0.32.0 specifically addresses several vulnerabilities related to proxy handling and regular expression denial of service. For most use cases, this upgrade should not introduce functional breaking changes.

Source: React Scripts v4 Changelog, React Scripts v5 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.