[Snyk] Fix for 3 vulnerabilities

[snyk-io]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759	99
	Prototype Pollution SNYK-JS-HANDLEBARS-15789775	99
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-15789761	50

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)

[snyk-io]

This upgrade contains a significant number of breaking changes, primarily from the tap package, which is jumping from version 11 to 18.

tap@11.1.5 → tap@18.0.0 (HIGH RISK)

This is a major upgrade across multiple versions with significant breaking changes. Developer action is required.

Key Breaking Changes:

• Node.js Version: Support for Node.js versions below 12 has been dropped. Version 15+ requires Node.js 10+, and v16+ requires Node.js 12+.
• ESM & TypeScript: Native ES Modules are now used instead of @std/esm. The entire library was rewritten in TypeScript, and TypeScript is no longer included by default; it must be installed separately.
• Coverage: Coverage is now enabled by default and enforced at 100%. The underlying engine was switched from nyc to c8, and related command-line options like --cov, --no-cov, and --check-coverage have been removed. Missing coverage is now a test failure.
• CLI & Configuration: Many command-line flags have been removed or replaced. For example, test-regexp is now include/exclude globs, and tap --watch is replaced by tap repl.
• Assertions: Assertion synonyms (e.g., t.similar) have been deprecated and moved to an optional @tapjs/synonyms plugin in v18.

Recommendation: Developers must review the official tap changelogs for versions 12 through 18 to understand the full scope of changes. Significant refactoring of test scripts, CI/CD configurations, and local development workflows will be necessary.

express@4.12.4 → express@4.22.0 (LOW RISK)

This is a minor version upgrade within the same major version (v4). The changes consist of bug fixes, dependency updates, and performance improvements. No breaking API changes are documented within this range.

Source: tap changelog, express history

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

⛔ Snyk checks have failed. 6 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (6)
⛔	Open Source Security	0	3	3	0	6 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.