fix(deps): update dependency canonicalize to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
canonicalize	4.0.0 → 5.0.0

---

Release Notes

erdtman/canonicalize (canonicalize)

v5.0.0

Compare Source

Breaking Changes

• Output that was not valid JSON is fixed. Properties whose value has no JSON
  representation emitted the bare token undefined, and sparse arrays emitted
  holes — neither parses:
  • { key: undefined } produced {"key":undefined}, now {}
  • [ , , 1] produced [,,1], now [null,null,1]
  • [function () {}] produced [] — losing an element — now [null]
• Boxed primitives now serialize as their primitive value, as JSON.stringify
  does: new Number(5) was {} and is now 5; new String('x') was {"0":"x"}
  and is now "x".
• toJSON() returning undefined now drops the property instead of emitting
  {"k":undefined}.
• Node.js 22 or later is required. The previous >=18 floor was already
  broken, since String.prototype.isWellFormed() needs Node 20+.

Any of these change the canonical form, and therefore any signature over it. If
you have stored signatures produced by 4.0.0 over documents in these shapes, they
will not verify against 5.0.0 output.

Fixes

• Deep nesting no longer overflows the stack. The serializer is now iterative,
  so nesting depth is bounded by heap rather than call stack. 4.0.0 threw above
  ~1,000 levels; 50,000+ now works. This closes a denial-of-service vector for
  untrusted input.

Performance

~1.3x faster than 4.0.0 depending on payload

Documentation

• New README section: best practices for signw
  duplicate property names are resolved before canonicalize() sees the data.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Pull request overview

Updates the backend canonicalize dependency from v4 to v5 for improved JSON canonicalization and Node.js 22 compatibility.

Changes:

• Bumps canonicalize from 4.0.0 to 5.0.0.
• Refreshes the Yarn lockfile resolution and checksum.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
opencti-platform/opencti-graphql/yarn.lock	Locks canonicalize v5.0.0 and its checksum.
opencti-platform/opencti-graphql/package.json	Updates the dependency version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 36.75%. Comparing base (8829bab) to head (afb0405).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #18236      +/-   ##
==========================================
- Coverage   36.76%   36.75%   -0.02%     
==========================================
  Files        3470     3470              
  Lines      141349   141349              
  Branches    38175    38175              
==========================================
- Hits        51962    51946      -16     
- Misses      89387    89403      +16     

Flag	Coverage Δ
opencti-client-python	49.85% <ø> (ø)
opencti-front	13.14% <ø> (ø)
opencti-graphql	71.70% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.