fix: upgrade critical and high-severity dependencies per Snyk vulnerability report

[devin-ai-integration]

Summary

Addresses the top 10 vulnerabilities identified in the daily Snyk scan (2026-05-29). Upgrades 6 direct dependencies to resolve 8 critical and 2 high-severity vulnerabilities.

Critical fixes:

Package	Before	After	CVEs Resolved
adm-zip	0.4.7	0.4.11	CVE-2018-1002204 (Zip Slip)
hbs	^4.0.4	4.2.1	CVE-2026-33938, CVE-2026-33937, CVE-2026-33940, Prototype Pollution (handlebars 4.0.14 → 4.7.9)
tap	^11.1.3	^18.0.0	CVE-2025-7783 (form-data), CVE-2025-9288 (sha.js), CVE-2023-45133 (babel-traverse)

High fixes:

Package	Before	After	CVEs Resolved
body-parser	1.9.0	1.20.3	CVE-2024-45590 (DoS)
dustjs-linkedin	2.5.0	2.7.5	CVE-2021-4264 (Prototype Pollution)
dustjs-helpers	1.5.0	1.7.4	Updated for compatibility with dustjs-linkedin 2.7.x

Note on dustjs-linkedin: Snyk recommended upgrading to 3.0.0, but dustjs-helpers (latest 1.7.4) only supports dustjs-linkedin 2.7–2.8. Upgraded to 2.7.5 to maintain compatibility while still resolving the Prototype Pollution vulnerability.

Review & Testing Checklist for Human

• Verify the app starts correctly (npm start) and the todo list functionality works at http://localhost:3001
• Confirm Handlebars templates render correctly (account details page at /account_details)
• Verify Dust.js templates still render (the /about_new route uses dust templating)
• Run snyk test to confirm the targeted CVEs are resolved
• Check that file upload functionality still works (uses express-fileupload + adm-zip)

Notes

• dustjs-linkedin was upgraded to 2.7.5 instead of the recommended 3.0.0 due to dustjs-helpers peer dependency constraints (requires 2.7–2.8)
• tap major version bump (11→18) may affect test tooling if custom tap tests exist; currently the repo's test script just runs snyk test
• There are still ~127 remaining vulnerabilities from other intentionally vulnerable packages in this demo app (e.g., mongoose, ejs, lodash, marked, st)

Link to Devin session: https://app.devin.ai/sessions/53a15190735b484981990268967da278
Requested by: @jakejluo

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring