[Snyk] Fix for 10 vulnerabilities

[jhamot]

Snyk has created this PR to fix 10 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• script/package.json
• script/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Code Injection SNYK-JS-LODASH-1040724	413
	Command Injection SNYK-JS-SIMPLEGIT-16032290	341
	Prototype Pollution SNYK-JS-LODASH-567746	320
	Prototype Pollution SNYK-JS-LODASH-6139239	267
	Prototype Pollution SNYK-JS-LODASH-450202	256
	Prototype Pollution SNYK-JS-LODASH-608086	250
	Arbitrary Code Injection SNYK-JS-LODASH-15869625	180
	Prototype Pollution SNYK-JS-LODASH-15053838	144
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	104
	Prototype Pollution SNYK-JS-LODASH-15869619	87

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Code Injection
🦉 Prototype Pollution

[jhamot]

This upgrade includes a major version update for simple-git which introduces significant breaking changes. The update to babel-eslint is minor but involves a deprecated package.

simple-git@2.11.0 → simple-git@3.32.0

Risk: HIGH

This is a major version upgrade from v2 to v3 with several breaking changes.

• Node.js Support: Support for Node.js versions 10 and below has been dropped.
• API and Usage:
  • The library now natively supports Promises and can be imported as an ES or CommonJS module. Usages of the deprecated simple-git/promise import must be updated.
  • APIs that were marked as deprecated in v2 have been removed.
  • The git.commit command is stricter and now only accepts a string or an array of strings as its first argument.

Recommendation:
Developers should verify their Node.js environment is v12 or higher. Review code that uses simple-git to ensure it aligns with the new promise-based API and that no deprecated v2 functions are in use.

Source: simple-git changelog

babel-eslint@10.0.1 → babel-eslint@10.1.0

Risk: LOW

This is a minor update, but the package itself is deprecated.

• Deprecation: The babel-eslint package is deprecated and has been replaced by @babel/eslint-parser. This version upgrade introduces the npm WARN deprecated message.

Recommendation:
While this upgrade itself introduces no breaking changes, it is strongly recommended to plan a migration from babel-eslint to @babel/eslint-parser to continue receiving updates and support.

Source: Package documentation

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.