[Snyk] Fix for 9 vulnerabilities

[snyk-io-us]

Snyk has created this PR to fix 9 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• app/package.json
• app/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	666
	Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	624
	Exposed Dangerous Method or Function SNYK-JS-NX-17660796	586
	Arbitrary Code Injection SNYK-JS-NESTJSCOMMON-9538801	561
	Prototype Pollution SNYK-JS-LODASH-15053838	559
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	529
	Cross-site Scripting SNYK-JS-EXPRESS-7926867	469
	Cross-site Scripting SNYK-JS-SEND-7926862	319
	Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	319

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Prototype Pollution
🦉 Arbitrary Code Injection
🦉 More lessons are available in Snyk Learn

[snyk-io-us]

This set of upgrades includes two major version bumps with significant breaking changes, requiring developer action and verification.

Top 3 Most Impactful Upgrades:

• @nx/nest 19.3.2 → 20.0.0 (HIGH RISK)
  This major upgrade introduces a fundamental breaking change by deprecating the @nrwl scope in favor of the @nx scope for all packages. [3, 6] This migration is manual and requires developers to update all imports and configuration files (e.g., changing @nrwl/nest to @nx/nest). [3] Automatic migration for this scope change is not provided. [3] Additionally, generators no longer use derived directories and now require explicit directory paths. [3]

  Recommendation: Before merging, manually search and replace all instances of @nrwl/ with @nx/ in your repository's configuration and source files. Review any custom scripts that use Nx generators.

• @nestjs/config 3.2.3 → 4.0.3 (MEDIUM RISK)
  This major upgrade alters the precedence of configuration sources. Previously, environment variables (process.env) would override values from custom configuration files. In v4, the order is reversed: internal configuration (e.g., custom config files) now takes precedence over environment variables. [2, 4] This could silently alter your application's behavior in different environments if you rely on .env files to override settings from config files.

  Recommendation: Verify your application's configuration loading strategy, especially in production-like environments, to ensure variables are loaded with the correct precedence.

• @nestjs/common, @nestjs/core, @nestjs/platform-express (LOW RISK)
  These minor upgrades from 10.3.10 to 10.4.x are part of the NestJS v10 ecosystem and primarily include feature enhancements and bug fixes. No significant breaking changes are documented for this minor version span.

Other Upgrades:

• lodash 4.17.21 → 4.17.23 (low): This patch update includes security fixes. [4]
• @nestjs/swagger 7.4.0 → 7.4.1 (low): A patch release, likely containing minor bug fixes.
• express-session 1.18.0 → 1.18.1 (low): A patch release with no documented breaking changes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[amazon-inspector-ohio]

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

[snyk-io-us]

⛔ Snyk checks have failed. 4 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (4)
⛔	Open Source Security	0	1	3	0	4 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[amazon-inspector-ohio]

✅ I finished the code review, and didn't find any security or code quality issues.

[edandylytics]

Package-by-package analysis, updated as I go:

• @nx/nest 19.3.2 → 20.0.0
  • AK: decided to remove as we're not using generators any more.
• @nestjs/config 3.2.3 → 4.0.3
  • AK: we use it, needs to stay. release notes
    • we don't use config files, so .get precedence changes don't impact runway
    • we don't use deprecated ignoreEnvVars
• @nestjs/common, @nestjs/core. @nestjs/platform-express
  • Snyk upgraded these to different versions, but I think it'd be better to use the same version for each package -- I expect nest folks actually test packages all on the same version and not across different combos. 10.4.22 looks good.
  • The upgrade to 10.4.22 introduced 4 issues that cannot be fixed without an upgrade to nest v11. Runway isn't impacted by them and we do resolve a number of other issues with the upgrades to 10.4.22, so I think that's worth it..
• lodash 4.17.21 → 4.17.23 (low)
  • not seeing docs on the patches, but it's just a couple patches and lodash
  • should we go to 4.18.1? Looks like _.template (which we don't use) has a vulnerability still.
  • We'll do 4.18.1, but will also need to bump @nestjs/config to 4.0.4 :/
  • @nestjs/swagger will continue to use an older pinned version, but we'll be doing a major version upgrade of that in a separate pr anyway.
• @nestjs/swagger 7.4.0 → 7.4.1 (low)
  • AK: fine. We just use @ApiTag and similar decorators and in dev envs build Swagger docs. Looks like [Snyk] Fix for 1 vulnerabilities #93 will have us looking at this package again, though. It (unhelpfully) pins lodash 4.17.21.
• express-session 1.18.0 → 1.18.1 (low)
  • AK: use it, single patch that fixes a CVE.

[edandylytics]

@rtavernaea I made enough updates here that I really shouldn't be the reviewer. Could you take a look?

[rtavernaea]

• The upgrade to 10.4.22 introduced 4 issues that cannot be fixed without an upgrade to nest v11

Will these be addressed in the same upgrade you mentioned we'll be doing a separate PR for (referring to @nestjs/swagger)?

[edandylytics]

Will these be addressed in the same upgrade you mentioned we'll be doing a separate PR for (referring to @nestjs/swagger)?

@rtavernaea I'm not sure yet. I think taking the upgrade in this PR is good as it resolves more issues than it introduces and Runway's not impacted by any of the newly introduced issues. An upgrade of Nest to v11 would be a big undertaking and we'd need to determine whether/when it's worth it. I don't think resolving these specific new issues is worth it, but there could be other reasons.