Skip to content

[Snyk] Fix for 1 vulnerabilities#45

Open
gierschv wants to merge 2 commits intomasterfrom
snyk-fix-6bbe2da1cfb7f0024d3b1c4e6b4cc805
Open

[Snyk] Fix for 1 vulnerabilities#45
gierschv wants to merge 2 commits intomasterfrom
snyk-fix-6bbe2da1cfb7f0024d3b1c4e6b4cc805

Conversation

@gierschv
Copy link
Copy Markdown
Member

@gierschv gierschv commented Apr 7, 2026

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • pnpm-lock.yaml

Vulnerabilities that will be fixed with an upgrade:

Issue
high severity Infinite loop
SNYK-JS-BRACEEXPANSION-15789759

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

gierschv and others added 2 commits April 7, 2026 23:13
* Score Import & Export - 15+ import formats documented, new `.flat` export:
  * `POST /scores`: Expanded the list of supported import formats with detailed documentation. **MusicXML** and **MIDI** are the preferred formats; also supported via conversion: Guitar Pro, MuseScore, ABC notation, PowerTab, Capella, MEI, Overture, TablEdit, Band-in-a-Box, Karaoke MIDI, MuseData, Score Writer, Bagpipe Music Writer, and Encore.
  * `GET /scores/{score}/revisions/{revision}/{format}`: Added `flat` export format for native Flat compressed files (`.flat`).
  * `ScoreDetails`: Added `me` property with information about the authenticated user's relationship to the score.

* Collections - Simplified library navigation with virtual collections replacing the legacy folder hierarchy ([blog: Library Design Revamp](https://blog.flat.io/library-design-revamp-elevating-your-music-composition-experience/)):
  * New virtual collections: `allScores`, `collaborations`, and `likes` replace the deprecated `root` and `sharedWithMe` collection types.
  * `GET /collections` (`listCollections`): New default `parent=user` returns all user collections including virtual ones. Added `modificationDate` sort option.
  * `Collection`: Added `isPinned`, `labelKey`, and `modificationDate` properties.
  * `POST /collections/{collection}/untrash`: **Deprecated.** Collections untrashing is no longer supported.
  * Updated collection parameter descriptions across all endpoints to document the new virtual collections and deprecate `root`/`sharedWithMe`.

* Flat for Education:
  * Assignments & Rubrics - Rubric grading, video/audio performance recordings, and group submissions ([blog: Performance Assignments upgrade](https://blog.flat.io/performance-assignments-just-got-an-upgrade-more-tools-flexibility/), [Grading Composition Assignments](https://blog.flat.io/how-to-grade-music-composition-assignments-without-losing-your-weekends/)):
    * Performance assignments: Added `recordingType` (`audio`/`video`), `allowBackingTrack`, `allowMetronome`, and `allowSpeedChange` options.
    * Group submissions: Added `submissionStudentsMode` (`single`/`group`) for shared writing assignments, with `assignedGroups` on `ClassAssignment`. See [blog: Introducing Shared Writing](https://blog.flat.io/collaborative-composition-flat-for-education-music-education/).
    * Rich text: Added `descriptionHtml` and `teacherInstructionsHtml` on assignments, `sharingDescriptionHtml` on education resources.
    * `ClassAttachmentCreation`: Added `partUuid`, `revision`, and `teacherOnly` properties.
  * Student Groups - Manage student sub-groups for shared writing and group submissions ([blog: Back to School updates](https://blog.flat.io/back-to-school-flat-for-education-updates/)):
    * New CRUD endpoints for student sub-groups: `GET /groups` (`listGroups`), `POST /groups` (`createGroup`), `PUT /groups/{group}` (`renameGroup`), `DELETE /groups/{group}` (`deleteGroup`).
    * New membership endpoints: `POST /groups/{group}/users` (`addGroupUser`), `DELETE /groups/{group}/users/{user}` (`removeGroupUser`).
    * Groups can be filtered by classroom or assignment, and support test student tagging (`edu:testing-students`).
    * New group types: `classStudentsSubGroup` and `assignmentStudentsSubGroup`.
  * LTI Configuration - Unified LTI 1.1 and 1.3 configuration management, replacing the previous credentials-only API ([blog: LTI 1.3 Integration](https://blog.flat.io/flat-for-education-upgrades-to-lti-1-3-for-canvas-schoology-moodle-and-blackboard/)):
    * New CRUD endpoints under `/organizations/lti/configurations`.
    * Supports LTI 1.1 manual, LTI 1.3 manual, LTI 1.3 dynamic registration, and LTI 1.3 deployment-based configurations.
    * Added `enableEmailMatching` option to control email-based user matching during LTI authentication.
    * Previous LTI 1.1 credentials endpoints (`/organizations/lti/credentials`) are now **deprecated**. LTI 1.1 configurations can now be managed through the new unified endpoints.
  * Score Tracks:
    * `GET /scores/{score}/tracks` (`listScoreTracks`): Added documentation for access control on performance submission tracks (student vs. teacher visibility).
  * Organization & Users - Test account management, email verification, and improved class metadata:
    * `GET /organizations/users` and `GET /organizations/users/count`: Added `testAccounts` filter to include/exclude test student accounts.
    * `UserDetailsAdmin`: Added `isEduTestingStudent` property.
    * `UserDetails`: Added `isEmailVerified` property.
    * `OrganizationInvitation`: Added `htmlUrl` with a direct join URL.
    * `ClassDetails`: Added `modificationDate`, and now requires `creationDate`, `name`, `state`. Updated `lti` property to cover LTI 1.1 and 1.3 context with `hasNrpsService`.
  * Resource Library - Rich text descriptions and assignment type selection on resource creation:
    * `EduResource` and `EduResourceCreation`: Added `sharingDescriptionHtml` for rich text sharing descriptions.
    * `EduResourceCreation`: Added `resource` property for assignment-specific creation options (e.g., assignment type).
    * `EduLibrary`: Renamed library type from `flatEduSamples` to `flatEduContent`.
  * Microsoft Teams Integration - Scheduled assignments and individual student targeting:
    * `MicrosoftGraphAssignment`: Added `assignDateTime` for scheduled assignments, `assignToType` (`class`/`individual`) and `assignedStudentsMsIds` for individual assignment targeting. Expanded `state` enum with `scheduled` and `inactive` statuses.

* Accounts & Profiles:
  * `UserPublic`: Added `allPublicScoresCount` property. Removed deprecated `instruments` property.
  * `UserCreation`: Locale is now a free-form string (auto-normalized) instead of a strict enum.
  * Improved `TutteoProduct` descriptions with links to each product.

* Statistics:
  * Added `yearly` counts to `ScoreCommentsCounts`, `ScoreLikesCounts`, `ScorePlaysCounts`, and `ScoreViewsCounts`.

* Deprecations & Removals:
  * **Removed** `Task` tag section from the specification. The `GET /tasks/{task}` endpoint remains available under the Score section.
  * **Removed** `FlatLocales` enum schema, replaced by `FlatLocalesString` with auto-normalization.
  * **Removed** unused `billing` role from `OrganizationRoles`.
  * **Deprecated** `POST /collections/{collection}/untrash` (`untrashCollection`).
  * **Deprecated** LTI credentials endpoints in favor of the new unified configuration API.
  * **Deprecated** `root` and `sharedWithMe` collection parent aliases (use `user` instead).
  * **Deprecated** `staffIdx` on `ScoreCommentContext`.
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages bot commented Apr 7, 2026

Deploying flat-api-reference with  Cloudflare Pages  Cloudflare Pages

Latest commit: a80ba29
Status:🚫  Build failed.

View logs

@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgulp@​4.0.2 ⏵ 5.0.0100 +1100100 +183100
Updatedshelljs@​0.8.5 ⏵ 0.9.097 -210010083100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants