[Snyk] Fix for 2 vulnerabilities

[MManke188]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• frontend/package.json
• frontend/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-TAR-15032660	693
	Prototype Pollution SNYK-JS-LODASH-15053838	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Directory Traversal

[Copilot]

Pull request overview

This is an automated Snyk security fix PR attempting to address 2 vulnerabilities: Directory Traversal in the tar package (SNYK-JS-TAR-15032660, score 693) and Prototype Pollution in lodash (SNYK-JS-LODASH-15053838, score 631). However, the proposed fixes have critical implementation issues that would break the application.

Changes:

• Upgrade @angular/cli from ^17.3.1 to ^20.3.15
• Upgrade @types/cypress from ^1.1.3 to ^1.1.6

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This @angular/cli version upgrade has multiple critical issues that will prevent the application from building:

1. Nonexistent version: Angular CLI version 20.3.15 does not exist in the npm registry. As of January 2025, the latest Angular CLI releases are versions 18.x and 19.x. Version 20 has not been released yet.

2. Breaking changes: The Snyk metadata indicates this is a breaking change (isBreakingChange: true), jumping 3 major versions from v17 to v20.

3. Peer dependency conflicts: All other Angular packages remain at version 17.3.1 (@angular-devkit/build-angular, @angular/core, @angular/common, etc.), while @angular/cli would be at v20. This creates incompatible peer dependencies that will cause installation and build failures.

Recommended solution: To address the tar and lodash vulnerabilities without breaking the application:

• Use npm overrides/resolutions to patch the specific vulnerable transitive dependencies
• OR upgrade all Angular packages together to a valid, compatible newer version (e.g., latest v18 or v19)
• OR check if Angular CLI v17.x has patch releases that address these vulnerabilities

Suggested change

	"@angular/cli": "^20.3.15",
	"@angular/cli": "^17.3.1",

[Copilot]

Critical inconsistency detected: @angular/cli has been upgraded to version 20.3.15 while @angular-devkit/build-angular remains at version 17.3.1. These packages must be kept in sync as @angular/cli has a peer dependency on a matching version of @angular-devkit/build-angular.

This mismatch will cause:

• Build failures
• Incompatibility errors during npm install
• Runtime errors if the installation somehow succeeds

All Angular packages (@angular/cli, @angular-devkit/build-angular, @angular/core, @angular/common, etc.) should be upgraded together to maintain compatibility.

Suggested change

	"@angular/cli": "^20.3.15",
	"@angular/cli": "^17.3.1",

[Copilot]

The @types/cypress package at version 1.1.x is extremely outdated. This package was deprecated years ago in favor of built-in TypeScript types provided directly by the cypress package itself (since Cypress 4.4.0).

Given that this project uses cypress version 13.15.0, the @types/cypress package is unnecessary and should be removed entirely rather than upgraded. Modern versions of Cypress include their own TypeScript definitions, making this separate types package obsolete.

Recommendation: Remove this dependency completely from optionalDependencies instead of upgrading it.

Suggested change

"@types/cypress": "^1.1.6",