[Snyk] Fix for 1 vulnerabilities

[lholmquist]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[lholmquist]

This update involves significant major version jumps for both eslint and @npmcli/arborist, introducing substantial breaking changes that require developer action.

eslint 7.32.0 → 10.0.0 (HIGH RISK)

This upgrade spans three major versions (v8, v9, v10) and completely overhauls ESLint's configuration and core functionality. Manual intervention is required.

Key Breaking Changes:

• Flat Config is Mandatory: The traditional .eslintrc.js format is no longer supported as of v10.0.0. You must migrate to the new eslint.config.js (flat config) format. ESLint provides a migration tool (npx @eslint/migrate-config) to assist with this conversion.
• Node.js Version: Support for Node.js versions below v20.19.0 has been dropped.
• Core Rule Changes: Many stylistic rules were removed from the core in v8 and moved to the @stylistic/eslint-plugin package. The eslint:recommended ruleset has also been updated across versions.
• Removed CLI Options & Features: Several CLI flags related to the old config system (--env, --rulesdir, etc.) and the CLIEngine class have been removed.

Recommendation:
This is a high-effort migration. Developers must:

1. Upgrade the project's Node.js version to a supported release (20.19.0+).
2. Run the configuration migrator and manually adapt the new eslint.config.js file.
3. Update all ESLint plugins to versions compatible with ESLint v9/v10 and the flat config format.
4. Replace deprecated core rules with their counterparts from plugins like @stylistic/eslint-plugin.

@npmcli/arborist 6.2.10 → 9.1.5 (MEDIUM RISK)

This is a major upgrade for the dependency tree management library used by npm. While many changes are internal to the npm CLI, programmatic users will be impacted.

Key Breaking Changes:

• Node.js Version: The npm CLI, which bundles arborist, has progressively dropped support for older Node.js versions. npm v8 requires Node 12.13+, v9 requires Node 16.14+, and v10 requires Node 18.17+. The target version 9.1.5 falls under npm v10+, which requires Node.js ^18.17.0 || >=20.5.0.
• API Changes: As a core component of npm, Arborist's API has evolved significantly between v7 and v9. The release notes for npm v7, v8, and v9 detail numerous internal refactors and changes to how dependency trees are built and managed, which could affect direct programmatic usage.

Recommendation:
If you are only using npm via the command line, the primary action is to ensure your Node.js runtime is up-to-date. If you are using @npmcli/arborist programmatically, a thorough review of its API documentation and the npm CLI changelogs is necessary to adapt to the new interfaces and behaviors.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[lholmquist]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.