[Snyk] Fix for 3 vulnerabilities

[papicella]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Arbitrary Code Injection SNYK-JS-LODASH-15869625	243
	Prototype Pollution SNYK-JS-LODASH-15053838	144
	Prototype Pollution SNYK-JS-LODASH-15869619	117

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary Code Injection

[papicella]

The upgrade of tap from version 11.1.5 to 18.0.0 is a HIGH risk operation due to numerous significant breaking changes across multiple major versions. The upgrade for hbs is low risk.

tap@11.1.5 → tap@18.0.0 (High Risk)

This is a major overhaul of the tap testing framework. Migration will require significant code and configuration changes. [3, 4]

Key Breaking Changes:

• Node.js Requirement: Support for Node.js versions below 12 has been dropped. [3]
• ES Modules: Version 15.0 switched to native ES Modules, dropping @std/esm. This may require substantial refactoring of test files. [3]
• Configuration: Configuration has been overhauled. It now uses a .taprc file or a "tap" object in package.json. Options like test-regexp have been replaced with include and exclude glob patterns. [4]
• Coverage: Coverage checking is now enabled by default with a 100% threshold, which could cause builds to fail if coverage is not met. [3, 4]
• API Changes:
  • Assertion aliases (e.g., t.is_not_equal()) have been moved to an optional @tapjs/synonyms plugin. [3, 4]
  • t.beforeEach and t.afterEach no longer accept callback arguments. [3]
  • The promise returned by t.test() now resolves to the child test results. [3]
• TypeScript/JSX: Support is no longer built-in and requires installing the @tapjs/typescript plugin. [3, 4]

Recommendation: This upgrade should be handled in a separate, dedicated effort. Developers must carefully review the official changelogs and the v18 upgrade guide to address the extensive breaking changes. [3, 4]

hbs@4.0.4 → hbs@4.0.5 (Low Risk)

This is a patch release that includes bug fixes for handling async helpers and exceptions when caching is enabled. No breaking changes are expected. [2]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[papicella]

⛔ Snyk checks have failed. 4 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (4)
⛔	Open Source Security	0	4	0	0	4 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[papicella]

⛔ Snyk checks have failed. 3 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (3)
⛔	Open Source Security	0	3	0	0	3 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.