[Snyk] Fix for 2 vulnerabilities

[papicella]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-17900054	169
	Allocation of Resources Without Limits or Throttling SNYK-JS-BODYPARSER-17906397	59

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[papicella]

This update involves two major version upgrades with significant breaking changes. The tap upgrade is particularly extensive and will require careful migration.

tap 11.1.5 → 18.0.0 (High Risk)

This is a very large version jump for the tap testing framework, introducing numerous breaking changes across versions 12 through 18. Key changes include a complete rewrite in TypeScript, a new plugin-based architecture, and fundamental shifts in configuration and behavior.

Key Breaking Changes:

• Node.js Support: Support for Node.js versions below 14 has been dropped.
• Configuration: The configuration system has been overhauled. test-regexp is replaced by include/exclude globs, and many CLI flags related to coverage and execution have been removed or changed.
• Coverage: Coverage is now enabled and checked by default, with 100% coverage being the default minimum. Missing coverage is treated as a test failure. The nyc dependency has been replaced with c8.
• API & Behavior:
  • Many assertion aliases have been removed and moved to an optional @tapjs/synonyms plugin.
  • beforeEach/afterEach no longer accept a callback and must return a promise for async operations.
  • The entire system was rewritten in TypeScript for v18, improving ESM and CJS support but changing the internal architecture to be plugin-based.

Recommendation:
Due to the extensive nature of these changes, a dedicated effort will be required to migrate tests. Start by reviewing the official upgrade guide, updating your configuration files (.taprc), and addressing deprecated APIs. Expect to refactor test setup, especially around coverage and async hooks.

body-parser 1.9.0 → 1.20.6 (Medium Risk)

While this is also a major version jump, the breaking changes for body-parser are well-documented and primarily relate to changes that happened many years ago. Modern Express.js applications may not even need this package directly.

Key Breaking Changes:

• Express Integration: Since Express 4.16.0+, the functionality of body-parser is built-in via express.json() and express.urlencoded(). Direct use of the body-parser package is often no longer necessary.
• API Splitting: The generic bodyParser() middleware was deprecated and removed. You must now use specific middleware for the content type, such as bodyParser.json() or bodyParser.urlencoded().
• urlencoded extended Option: The extended option for urlencoded must be explicitly set to true or false, as it no longer has a default value.

Recommendation:
Review your application's Express version. If it is 4.16.0 or newer, consider removing the body-parser dependency entirely and replacing its usage with the built-in express.json() and express.urlencoded({ extended: true }) middleware. If you must keep it, ensure you are calling the specific parser functions and have explicitly set the extended option.

Source: body-parser HISTORY.md, tap Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[papicella]

⛔ Snyk checks have failed. 8 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (8)
⛔	Open Source Security	0	8	0	0	8 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[papicella]

⚠️ Snyk checks are incomplete.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details
⚠️	Licenses	0	0	0	0	See details
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.