[Snyk] Fix for 1 vulnerabilities

[s403o]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-AXIOS-15252993	828

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Snyk has automatically assigned this pull request, set who gets assigned.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
👩‍💻 Set who automatically gets assigned
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[Copilot]

Pull request overview

This Snyk-generated PR upgrades npm dependencies to remediate a high-severity Prototype Pollution vulnerability reported for axios.

Changes:

• Upgraded axios from ^0.21.3 to ^1.13.5.
• Upgraded mailgun.js from ^7.0.0 to ^8.1.0 and updated the lockfile dependency graph accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps axios and mailgun.js dependency ranges to newer versions that include the vulnerability fix.
package-lock.json	Locks updated resolved versions and transitive dependencies for the upgraded packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

mailgun.js is still listed as a direct dependency but I can’t find any runtime usage in src/ (only mailgun-js is required in src/services/send-mail.js). If the project isn’t actually using mailgun.js, consider removing it from dependencies to reduce install size and dependency attack surface; otherwise, please add/update the corresponding integration code so the major upgrade to v8 is verified in production paths.

Suggested change

"mailgun.js": "^8.1.0",