[Snyk] Fix for 18 vulnerabilities

[snyk-io]

Snyk has created this PR to fix 18 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• frontend/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Resources Downloaded over Insecure Protocol SNYK-JS-ESBUILD-17750822	243
	Server-side Request Forgery (SSRF) SNYK-JS-ANGULARSSR-15357314	217
	Insufficient Verification of Data Authenticity SNYK-JS-ANGULARCOMMON-18550632	216
	Modification of Assumed-Immutable Data SNYK-JS-ANGULARCORE-17353317	187
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280	170
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	169
	Denial of Service (DoS) SNYK-JS-PACOTE-8225084	169
	Directory Traversal SNYK-JS-EXTRACTZIP-17660777	141
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759	124
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-16755174	124
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650	124
	Cross-site Scripting (XSS) SNYK-JS-ECHARTS-16874133	86
	Cross-site Scripting (XSS) SNYK-JS-ANGULARCOMPILER-18550631	85
	Cross-site Request Forgery (CSRF) SNYK-JS-WEBPACKDEVSERVER-17812733	81
	Partial String Comparison SNYK-JS-HTTPPROXYMIDDLEWARE-17375053	67
	Server-side Request Forgery (SSRF) SNYK-JS-ANGULARPLATFORMSERVER-16097942	65
	Improper Input Validation SNYK-JS-WEBPACKDEVSERVER-17812743	49
	Directory Traversal SNYK-JS-BABELCORE-17342497	33

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Server-side Request Forgery (SSRF)
🦉 Directory Traversal
🦉 More lessons are available in Snyk Learn

[snyk-io]

This is a massive upgrade across multiple major versions of several core dependencies, introducing significant breaking changes. Manual intervention and a careful, staged upgrade are required.

1. Angular Framework (@angular/* from v17/18 to v20/v22)

This is a multi-version jump with numerous breaking changes. Key changes across these versions include:

• Control Flow: The legacy *ngIf, *ngFor directives are replaced by a new built-in control flow syntax (@if, @for).
• Reactivity: Signals, introduced in v16, are now stable and are the recommended approach for state management. This includes signal-based inputs, outputs, and queries, moving away from traditional decorator-based I/O.
• Zoneless by Default: Starting in v21, new projects are created without zone.js, making zoneless change detection the default. While existing projects can keep zone.js, this marks a fundamental shift in Angular's architecture.
• SSR and Hydration: Server-Side Rendering has seen significant evolution, with incremental hydration becoming a key feature in v19 and stable in v20.
• Tooling: The Angular CLI has removed support for the Angular Compatibility Compiler (ngcc) in v16. The ng update command is the recommended tool for migrating, but jumping this many versions will likely require a manual, version-by-version upgrade.

Recommendation: A direct jump is not feasible. Follow the official Angular Update Guide (update.angular.io) to upgrade one major version at a time (17 -> 18 -> 19 -> ...). This will be a significant refactoring effort.

2. Cypress (cypress@13.17.0 → cypress@15.16.0)

This upgrade spans two major versions (v14 and v15) and includes several breaking changes:

• Node.js Support: Support for Node.js 16 was removed in v14, and support for Node.js 18 was removed in v15.
• Cross-Origin Tests: Chrome's deprecation of document.domain requires tests navigating across different domains (even subdomains) to use cy.origin().
• API Changes: cy.exec() results now use exitCode instead of code. The three-argument form of cy.stub() has been removed.
• Framework Support: Support for older versions of frameworks like Angular 17, Webpack 4, and bundlers like @vue/cli-service and Create React App has been removed.

Recommendation: Review the Cypress v14 and v15 migration guides. Update Node.js version, refactor cross-origin tests to use cy.origin(), and update assertions for cy.exec().

3. @typescript-eslint (@typescript-eslint/*@7.6.0 → @typescript-eslint/*@8.56.1)

The upgrade to v8 introduces breaking changes to rules and configuration:

• ESLint v9 Support: v8 is designed to work with ESLint v9 and its "flat" config format.
• Rule Changes: Several rules have been removed or deprecated. Notably, many formatting/layout rules have been removed. no-throw-literal was removed, and no-var-requires is deprecated in favor of no-require-imports.
• Configuration: Recommended rule sets (recommended, strict, stylistic) have been updated, which may introduce new linting errors.

Recommendation: Update your ESLint configuration to be compatible with the new recommended rule sets in v8 and address any new linting errors from changed or removed rules.

Other Notable Upgrades:

• echarts (5.6.0 → 6.1.0): High risk. The default theme has changed, affecting colors and component positions (e.g., the legend is now at the bottom). A compatibility theme (echarts/theme/v5.js) is available to restore the old look. Some API callback signatures, like tooltip.valueFormatter, have also changed.
• Angular Packages: All other Angular-related packages (@angular-devkit/build-angular, @angular/ssr, @angular/platform-server) are part of the main framework upgrade and carry the same high risk and recommendations.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mempool-10	Error		Aug 25, 2026 8:53pm

[snyk-io]

⚠️ Snyk checks are incomplete.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.