[Snyk] Fix for 1 vulnerabilities

[crew-security]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception

[crew-security]

This release includes major version upgrades for express, auth0, and body-parser, each introducing significant breaking changes that require developer action and thorough testing.

Top 3 Most Impactful Upgrades

• express@4.14.0 → express@5.1.0 (HIGH RISK)
  This upgrade introduces numerous breaking changes, as Express 5 modernizes its API and behavior after a long development cycle. Key changes include the removal of deprecated methods, stricter routing, and improved error handling.

  • Mandatory Code Changes:
    • app.del() has been removed; use app.delete() instead.
    • Deprecated res.send(status, body) and res.json(obj, status) signatures are removed. Use res.status(status).send(body) chaining.
    • req.param(name) is removed. Use req.params, req.body, or req.query directly.
    • The magic string 'back' for res.redirect() is no longer supported.
  • Behavioral & Environment Changes:
    • Node.js 18+ is now required.
    • Asynchronous middleware functions with rejected promises will now automatically forward errors to the error handler, which may change application control flow.
    • The req.query object is now a getter and is no longer writable.
    • Route path matching is stricter, and the syntax for regular expressions in routes has changed.
  • Recommendation: Use the official codemods (npx @expressjs/codemod upgrade) to automate many of the required changes and carefully review the official migration guide.

• auth0@2.17.0 → auth0@4.0.0 (HIGH RISK)
  This is a major upgrade from v2 to v4 of the Auth0 Node.js SDK, which was rewritten from the ground up in TypeScript. This introduces significant API changes and requires a newer Node.js runtime.

  • API & Structural Changes:
    • The library was rewritten in TypeScript, resulting in new method names, improved type safety, and a different error handling philosophy.
    • The v4 release introduced a new modular architecture and changes to how clients are initialized and used.
    • The jump from v2 to v4 will require a near-complete refactoring of how the Auth0 SDK is used. The official changelog for v4.0.0 highlights this as a major rewrite.
  • Environment Changes:
    • The minimum supported Node.js version was updated significantly. For example, v5 requires Node.js ^20.19.0. You must verify your runtime meets the new requirement.
  • Recommendation: This upgrade requires a careful and thorough migration. Review the official Auth0 v4 migration guide and changelogs, as code interacting with the SDK will need to be rewritten.

• body-parser@1.15.2 → body-parser@2.1.0 (HIGH RISK)
  This major version upgrade introduces a critical but subtle breaking change in how empty request bodies are handled.

  • Mandatory Code Changes & Behavior Changes:
    • The bodyParser() combined middleware function has been removed. You must now use the specific parsers like bodyParser.json() and bodyParser.urlencoded() individually.
    • For requests with an empty body, req.body will now be undefined instead of an empty object ({}). This is a critical change that can lead to TypeError exceptions in code that assumes req.body is always an object.
    • The extended option for urlencoded now defaults to false.
  • Recommendation: Audit all routes that use body-parser. Ensure that req.body is checked for undefined before being accessed. Update middleware initialization to use bodyParser.json() or bodyParser.urlencoded() directly.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.