fix: [adm-zip] Upgrade adm-zip from 0.4.7 to 0.5.18 to resolve CVE-2018-1002204

[hannahhuh-cog]

Summary

Fixes the Zip Slip (arbitrary file write via archive extraction) vulnerability in the direct adm-zip dependency, found by the scheduled Snyk MCP scan.

• Vulnerability: Arbitrary File Write via Archive Extraction (Zip Slip) — npm:adm-zip:20180415
• CVE: CVE-2018-1002204
• Severity: Critical, CVSS 9.4
• Affected: adm-zip@0.4.7 (direct dependency, used in routes/index.js to extract uploaded archives)
• Fixed in: >=0.4.11; upgraded to 0.5.18 (latest 0.5.x) to also clear later fixes in the 0.5 line
• Risk: A crafted zip entry with ../ path traversal can write files outside the extraction directory (/tmp/extracted_files), enabling remote file overwrite and potential code execution.

Change is limited to the version bump in package.json plus the corresponding package-lock.json entry. The AdmZip(buffer) call site remains valid in 0.5.x (the export is still callable without new).

Snyk scan reference: snyk test --all-projects --dev / snyk_sca_scan (unmanaged: true), Snyk org 9e26acce-22c7-4efc-b470-21d9587f49fe.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/fc1965e7d98f4966bea1c7aa64a929b0
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 0 potential issues.