fix: [adm-zip] Upgrade adm-zip from 0.4.7 to 0.4.11 to resolve CVE-2018-1002204 (Zip Slip)

[devin-ai-integration]

Summary

Fixes the Arbitrary File Write via Archive Extraction (Zip Slip) vulnerability in adm-zip@0.4.7 (CVSS 9.4, CVE-2018-1002204). adm-zip is a direct dependency used in routes/index.js to extract uploaded zip archives, so a malicious archive with ../ entries could write files outside the extraction directory.

-"adm-zip": "0.4.7",
+"adm-zip": "0.4.11",

0.4.11 is the Snyk-recommended patched release for this CVE and stays within the 0.4.x line (no API changes to the AdmZip(buffer) / extractAllTo usage in routes/index.js). package-lock.json regenerated so node_modules/adm-zip resolves to 0.4.11.

• Severity: Critical (CVSS 9.4) · CWE-22 (Path Traversal)
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-1002204
• Advisory: https://security.snyk.io/vuln/npm:adm-zip:20180415
• Snyk scan: org 9e26acce-22c7-4efc-b470-21d9587f49fe, project goof (npm)

One vulnerability per PR; part of a set of 5 fix PRs for the top Critical/High findings.

Link to Devin session: https://app.devin.ai/sessions/d6b18d8e5ad94506b760971485ceb694
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring