[Snyk] Security upgrade patch-package from 6.4.7 to 8.0.1

[DmitriyStoyanov]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• frontend/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[DmitriyStoyanov]

This major version upgrade of patch-package from v6.4.7 to v8.0.1 introduces a minor breaking change in v7 and lacks clear release notes for v8, increasing uncertainty.

Breaking Changes:

• v7.0.0: Support for a legacy patch file naming format (pre-2019) has been removed. This is unlikely to impact most projects unless you have very old, un-migrated patch files.

Assessment:

• The upgrade to v7 is considered low risk as the breaking change is minimal.
• The upgrade from v7 to v8 carries uncertainty as there are no official release notes for v8.0.0. Due to this lack of documentation, the risk level is elevated to medium.

Contextual Information:

• It's worth noting that modern versions of package managers like pnpm and Yarn (v2+) have built-in, native support for patching dependencies, which can be an alternative to using patch-package.

Recommendation:

• Verify that your existing patch files do not use the old, pre-2019 naming convention.
• After upgrading, test the patch application process thoroughly in a non-production environment to ensure compatibility with v8, given the absence of official release notes.

Source: patch-package CHANGELOG.md, GitHub Issue #481

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Gradle Unit and Integration Test Results

523 tests  ±0   521 ✔️ ±0   33s ⏱️ -5s
116 suites ±0       2 💤 ±0 
116 files   ±0       0 ❌ ±0 

Results for commit e168648. ± Comparison against base commit 12f9226.