[Snyk] Fix for 3 vulnerabilities

[sauravraw]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• upload-api/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-AXIOS-15252993	828
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AJV-15274295	803
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-15268416	708

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Snyk has automatically assigned this pull request, set who gets assigned.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
👩‍💻 Set who automatically gets assigned
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Allocation of Resources Without Limits or Throttling

[Copilot]

Pull request overview

This is an automated Snyk security PR that attempts to fix 3 high/medium severity vulnerabilities by upgrading three npm packages in the upload-api directory: axios (Prototype Pollution), eslint (ReDoS via ajv), and qs (Resource allocation issue).

Changes:

• Upgrade axios from ^1.12.0 to ^1.13.5 to fix SNYK-JS-AXIOS-15252993 (Prototype Pollution vulnerability)
• Upgrade eslint from ^9.0.0 to ^10.0.0 to fix SNYK-JS-AJV-15274295 (ReDoS vulnerability in ajv dependency)
• Upgrade qs from ^6.14.1 to ^6.14.2 to fix SNYK-JS-QS-15268416 (Resource allocation vulnerability)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The upgrade to eslint version 10.0.0 is problematic because the current @typescript-eslint packages (version 8.x) only support eslint versions ^8.57.0 || ^9.0.0, which does not include version 10.x. This will cause peer dependency conflicts and the TypeScript ESLint parser and plugins will not work correctly. Additionally, eslint version 10.0.0 may not exist yet as of the current date. The latest stable eslint version as of January 2025 was 9.x. Consider updating to a version that is compatible with the @typescript-eslint packages or wait for updated @typescript-eslint packages that support eslint 10.x.

Suggested change

	"eslint": "^10.0.0",
	"eslint": "^9.0.0",

[Copilot]

The package-lock.json file has not been updated to reflect the changes made to package.json. When dependency versions in package.json are updated, the package-lock.json must also be regenerated by running npm install to ensure that the exact versions and their transitive dependencies are locked. Without updating the package-lock.json, the actual installed versions may not match what is specified in package.json, and the security vulnerabilities may not be properly addressed.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.