Update high priority vulnerable dependencies to secure versions

[devin-ai-integration]

Update high priority vulnerable dependencies to secure versions

Summary

Updated 4 vulnerable dependencies to their latest secure versions to address critical security vulnerabilities:

• adm-zip: 0.4.7 → 0.5.16 (fixes directory traversal/Zip Slip attacks)
• ejs: 1.0.0 → 3.1.10 (fixes arbitrary code execution)
• dustjs-linkedin: 2.5.0 → 3.0.1 (fixes code injection)
• express-fileupload: 0.0.5 → 1.5.2 (fixes prototype pollution)

The application startup, login functionality, and file upload features were tested successfully with MongoDB 3.x compatibility maintained.

Review & Testing Checklist for Human

⚠️ 4 critical items to verify:

• Test comprehensive application functionality - Both EJS (1.x→3.x) and dustjs-linkedin (2.x→3.x) are major version upgrades that could have breaking changes. Test all template rendering, form submissions, and user flows thoroughly.
• Verify legacy Node.js compatibility - Confirm NODE_OPTIONS=--openssl-legacy-provider still works correctly and the app runs without compatibility issues.
• Test MongoDB 3.x integration - Verify database operations (CRUD operations, user authentication, todo management) work correctly with the updated dependencies.
• Validate educational value preservation - Since this is Snyk's vulnerable demo app for security training, ensure it still serves its educational purpose with remaining intentional vulnerabilities intact.

Test Plan Recommendations

1. Run full application suite: npm start and test all user journeys
2. Test admin login: [email protected] / SuperSecretPassword
3. Test file upload functionality (express-fileupload dependency)
4. Verify template rendering works (EJS and Dust.js templates)
5. Test NoSQL injection, XSS, and other intentional vulnerabilities still exist for training purposes

Notes

• handlebars (4.0.11) remains vulnerable as it's a transitive dependency via tap→nyc→istanbul-reports. This will require a separate effort to update the tap dependency.
• Many other intentional vulnerabilities remain for the app's educational purpose
• Package-lock.json shows extensive transitive dependency updates beyond the 4 target packages

Link to Devin run: https://app.devin.ai/sessions/7c36b3a006ff470f91d0ebfb6e6de08e
Requested by: @bnob-ship-it

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud