Skip to main content
Version: 1.1.0

fix-deps-snyk-high

🔒 Security​

Clear new Snyk high findings (js-yaml, brace-expansion)​

Goal: Fix two new high-severity Snyk findings introduced after the earlier dependency hardening wave, so CI snyk test passes again on feat/auto-attributes.

Solution: Upgrade @nestjs/swagger to pull a patched js-yaml, and bump brace-expansion overrides to 5.0.7 (including minimatch@5 for the archiver → readdir-glob path). Kept archiver@7 — v8 is ESM-only and breaks Jest without a broader migration.

Features:

  • @nestjs/swagger@11.4.5 → js-yaml@4.3.0 (algorithmic complexity, SNYK-JS-JSYAML-17900054)
  • brace-expansion@5.0.7 on minimatch@5 / @9 / @10 and @isaacs/brace-expansion@5 (SNYK-JS-BRACEEXPANSION-17706650)
  • js-yaml override aligned to 4.3.0

Preexisting (unchanged): body-parser@2.2.2 medium via express@5 — no direct upgrade path until Nest ships body-parser@2.3.0.

Files Modified:

  • package.json - @nestjs/swagger@11.4.5, overrides js-yaml, brace-expansion, minimatch@5
  • package-lock.json - Lockfile refresh