[Snyk] Fix for 11 vulnerabilities

[Dargon789]

Snyk has created this PR to fix 11 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• backend/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18060165
	Uncontrolled Recursion SNYK-JS-AXIOS-18060167
	Prototype Pollution SNYK-JS-AXIOS-18060659
	Uncontrolled Recursion SNYK-JS-AXIOS-18060730
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18060804
	Prototype Pollution SNYK-JS-AXIOS-18065349
	Prototype Pollution SNYK-JS-AXIOS-18065351
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18065353
	Prototype Pollution SNYK-JS-AXIOS-18065355
	Permissive List of Allowed Inputs SNYK-JS-AXIOS-18065357
	Allocation of Resources Without Limits or Throttling SNYK-JS-WS-17988732

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncontrolled Recursion
🦉 Prototype Pollution

[Dargon789]

axios 1.16.1 → 1.18.0: Medium Risk

This is a minor version upgrade for axios that includes security hardening and bug fixes. While there are no major API removals, the changes introduce stricter behavior that could impact existing applications.

Key Changes:

• Redirect Header Safety: Custom sensitive headers (like authorization) will now be stripped during cross-origin redirects. If your application relies on passing these headers across different origins, this will break that functionality.
• URL and Request Hardening: The library will now reject malformed http: and https: URLs that are missing the // prefix. This stricter validation could cause requests to fail if your application constructs URLs improperly.
• validateStatus Behavior: A new transitional option has been added to manage how validateStatus: undefined is handled, but this is an opt-in feature.

Recommendation:
Review any application logic that involves cross-origin redirects with custom headers or manual URL construction to ensure compatibility with the new, stricter behavior.

Source: Axios v1.18.0 Release Notes

ws 8.21.0 → 8.21.1: Low Risk

This is a patch version upgrade. Patch releases are typically for bug fixes and are not expected to contain breaking changes. No specific release notes detailing breaking changes for this version were found.

Source: Package documentation

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mempool	Ready	Preview, Comment	Jul 21, 2026 1:45pm

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[gemini-code-assist]

Code Review

This pull request updates the dependencies in backend/package.json, upgrading axios from 1.16.1 to 1.18.0 and ws from ~8.21.0 to ~8.21.1. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.