Dependency Hardening (Snyk CI Gate)

Version: 1.1.0 Date: 2026-07-15

Goal: Clear all Snyk high/medium findings blocking GitLab CI snyk test across the auto-attributes and API-docs merge wave.

Solution: Upgrade direct dependencies, bump @nestjs/swagger for patched transitive js-yaml, and pin safe versions via npm overrides on the Nest/express dependency chain.

Packages addressed:

• High — js-yaml@4.3.0 (algorithmic complexity, via @nestjs/swagger@11.4.5)
• High — brace-expansion@5.0.7 on minimatch@5 / @9 / @10 and @isaacs/brace-expansion@5 (ReDoS)
• Medium — body-parser@2.3.0 override on express@5 → @nestjs/platform-express (SNYK-JS-BODYPARSER-17906397)
• Also in this wave — axios, json-2-csv, joi, qs, multer@2.2.0, ws@8.21.0, form-data@4.0.6, mongoose@8.22.1, uuid@14, @azure/identity@4.13.1

Implementation Details:

• Kept archiver@7 — v8 is ESM-only and breaks Jest without a broader migration
• jest transformIgnorePatterns extended for ESM-only deps (uuid, p-queue)

Files Modified:

• package.json - Direct upgrades + overrides block
• package-lock.json - Lockfile refresh