[snyk-io]

Snyk has created this PR to fix 12 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• packages/world-postgres/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Certificate Validation SNYK-JS-UNDICI-19635218	159
	Use of Persistent Cookies Containing Sensitive Information SNYK-JS-UNDICI-19635216	130
	Uncaught Exception SNYK-JS-UNDICI-19635210	124
	Missing Release of Resource after Effective Lifetime SNYK-JS-UNDICI-19635206	111
	Allocation of Resources Without Limits or Throttling SNYK-JS-UNDICI-19635208	111
	Uncaught Exception SNYK-JS-UNDICI-19635222	111
	Uncaught Exception SNYK-JS-UNDICI-19635226	111
	Directory Traversal SNYK-JS-VITESTMOCKER-19497933	111
	Improper Validation of Specified Index, Position, or Offset in Input SNYK-JS-UUID-16133035	62
	HTTP Request Smuggling SNYK-JS-UNDICI-19635212	61
	Numeric Truncation Error SNYK-JS-UNDICI-19635214	44
	Insufficient Verification of Data Authenticity SNYK-JS-UNDICI-19635220	44

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncaught Exception
🦉 Directory Traversal

[snyk-io]

This set of upgrades includes a major version bump for @testcontainers/postgresql which introduces significant breaking changes requiring developer action.

@testcontainers/postgresql 11.12.0 → 12.0.0 (HIGH RISK)

This is a major version upgrade with two breaking changes:

• Node.js Version: The minimum required Node.js version has been increased to >= 22.22. [3]
• Default Wait Strategy: The default wait strategy has changed. It now prioritizes Docker healthchecks over the previous default of Wait.forListeningPorts(). This can cause tests to fail if they rely on the old behavior. [3]

Recommendation:

1. Ensure your runtime environment meets the new Node.js v22.22+ requirement.
2. To preserve the previous behavior and avoid unexpected test failures, explicitly configure the wait strategy in your code: container.withWaitStrategy(Wait.forListeningPorts()).

Source: GitHub Release Notes v12.0.0

Other Upgrades

• undici 7.29.0 → 7.29.1 (Medium Risk): This patch release contains several security fixes that alter behavior around caching, decompression, and response handling. [1, 5] While intended to fix bugs, these changes could impact applications relying on the previous, less strict behavior. Verification is recommended.
• vitest 4.1.10 → 4.1.11 (Low Risk): This is a patch release containing only bug fixes with no documented breaking changes. [4]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Sim World

Simulated world deterministic testing for races. Traces

🟠 The run produced no summary — see the job log.

[github-actions]

📊 Workflow Benchmarks

❌ The benchmark run for 1ea3417 failed. See the run logs for details.

No benchmark results were produced.

ℹ️ Metric definitions & methodology

_{Metrics —}

_{All timestamps are deployment-side; runs are triggered in-deployment, so the CI runner and api.vercel.com sit outside every measured window. TTFS = start() → first step body (includes dispatch + any cold start); Fan-out TTFS/TTLS = first/last step completion of one Promise.all from the same anchor (the gap is the runtime’s fan-out spread); STSO/WO between step bodies; CRTT inside the workflow (excludes the api.vercel.com read path).}

_{Cold starts stay in the numbers (real bursty-workload latency, inflates P75+); Best is the warm floor.}

[github-actions]

🧪 E2E Test Results

No test result files found.

[github-actions]

No measurements were produced. See the run log.