fix: [adm-zip] Upgrade adm-zip from 0.4.7 to 0.5.16 to resolve CVE-2018-1002204 (Zip Slip)

[devin-ai-integration]

Summary

Resolves a Critical (CVSS 9.4) Zip Slip vulnerability surfaced by a Snyk SCA scan of this repo.

adm-zip@0.4.7 is vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) — CVE-2018-1002204 / npm:adm-zip:20180415. A crafted .zip with entry names like ../../evil can write files outside the intended extraction directory. This repo triggers it directly in routes/index.js:

var zip = AdmZip(importFile.data);
zip.extractAllTo("/tmp/extracted_files", true);

Fix = bump the direct dependency to a patched release:

- "adm-zip": "0.4.7"
+ "adm-zip": "0.5.16"

0.5.x adds path-traversal protection in extractAllTo. The AdmZip(buffer) / extractAllTo(path, overwrite) API used here is unchanged, so no code changes are required. This also clears the related High Directory Traversal (SNYK-JS-ADMZIP-1065796, fixed in 0.5.2).

Verification

snyk test after the upgrade reports 0 remaining adm-zip issues (previously 1 Critical + 1 High).

One vulnerability per PR (Scheduled Snyk MCP scan, remediation phase).

Link to Devin session: https://app.devin.ai/sessions/3de7e286bad14ebb88618cf08a9489ab
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring