[Snyk] Fix for 3 vulnerabilities

[nirw-snyk]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• set4get/package.json
• set4get/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	828
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	828
	Prototype Pollution SNYK-JS-MONGOOSE-18319533	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Prototype Pollution

[nirw-snyk]

This upgrade includes multiple high-risk major version updates for critical packages. Mongoose, TypeORM, and tap all introduce significant breaking changes that will require code modifications and thorough testing.

Top 3 Most Impactful Upgrades

• mongoose 4.2.4 → 6.13.10 (HIGH): This upgrade spans two major versions (v5 and v6) with numerous breaking changes. Key changes include the removal of callback support for mongoose.connect(), stricter query and boolean casting behavior, and an upgrade to the underlying MongoDB driver to v4.0. [1, 3, 5]
• typeorm 0.2.24 → 1.0.0 (HIGH): This is a major update to a stable v1.0 release, introducing significant API and behavioral changes. Connection is renamed to DataSource, global connection functions are removed, and find options have a new object-based syntax. It also requires Node.js 20+. A codemod is available to assist with migration. [2, 9, 12]
• tap 11.1.5 → 18.0.0 (HIGH): This is a massive version jump for the testing framework, which was completely rewritten in TypeScript for v18. It introduces first-class support for ESM and changes the underlying coverage engine from nyc to c8. Expect significant effort to update test files and configurations. [16, 17, 19]

Other Major Upgrades

• express-fileupload 0.0.5 → 1.1.10 (MEDIUM): This upgrade stabilizes the API from a pre-1.0 version. The behavior of the md5 property changed in v1.0.0 but was reverted in v1.1.1. Verification is recommended to ensure file upload handling is unaffected. [8]

Recommendation: These upgrades, particularly for mongoose and typeorm, are substantial and will likely require significant refactoring. It is strongly advised to tackle each major upgrade in a separate, dedicated effort. Use the official migration guides and the typeorm codemod to assist in the process.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.