[Snyk] Fix for 11 vulnerabilities

[snyk-io-us]

Snyk has created this PR to fix 11 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• app/package.json
• app/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18060165
	Uncontrolled Recursion SNYK-JS-AXIOS-18060167
	Prototype Pollution SNYK-JS-AXIOS-18060659
	Uncontrolled Recursion SNYK-JS-AXIOS-18060730
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18060804
	Prototype Pollution SNYK-JS-AXIOS-18065349
	Prototype Pollution SNYK-JS-AXIOS-18065351
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18065353
	Prototype Pollution SNYK-JS-AXIOS-18065355
	Permissive List of Allowed Inputs SNYK-JS-AXIOS-18065357
	Allocation of Resources Without Limits or Throttling SNYK-JS-FILETYPE-15609896

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncontrolled Recursion
🦉 Prototype Pollution

[snyk-io-us]

This update includes a major version upgrade for @nestjs/common and a minor version upgrade for axios, introducing significant changes.

@nestjs/common@10.4.22 → @nestjs/common@11.0.0

Risk: High

This is a major version upgrade with several breaking changes and new features that require developer attention.

Key Breaking Changes:

• Underlying Frameworks: Support for Express v5 and Fastify v5 has been added. Express v5 introduces breaking changes to its routing path algorithm, particularly how wildcards are handled (e.g., /* must now be named, like /*splat).
• Lifecycle Hooks: The execution order of termination lifecycle hooks (OnModuleDestroy, OnApplicationShutdown) has been reversed.
• CacheModule: The module now uses cache-manager v6. If you have custom caching implementations, they may need to be updated.
• ConfigService: The order in which ConfigService#get reads configuration values has changed, which could impact how environment variables are overridden.

Other Notable Changes:

• Compiler: SWC is now the default compiler, promising up to 20x faster build times.
• Standalone Applications: Applications can now be bootstrapped without a root AppModule, simplifying microservices.
• ESM: The framework now defaults to ECMAScript Modules.

Recommendation:
Due to the significance of these changes, a thorough review of the official NestJS v11 migration guide is required. Pay close attention to routing, lifecycle hook logic, and configuration management.

axios@1.16.1 → axios@1.18.0

Risk: Medium

This minor version upgrade includes security hardening that could introduce behavioral changes.

Key Changes:

• v1.18.0 Security Hardening:
  • Redirect Header Safety: Sensitive headers are now stripped during cross-origin redirects to prevent accidental leakage of credentials.
  • URL and Request Hardening: Stricter validation is now applied to URLs, and requests are hardened against prototype pollution. Malformed URLs may now be rejected.
• v1.17.0: This version introduced fixes for authentication, headers, and proxy handling.

Recommendation:
Verify that application logic does not rely on sensitive headers being passed during cross-origin redirects. Test areas of the application that may construct URLs dynamically to ensure they comply with the stricter validation.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[amazon-inspector-ohio]

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

[snyk-io-us]

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	0	0	1	0	1 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[amazon-inspector-ohio]

✅ I finished the code review, and didn't find any security or code quality issues.