Allow-list project PATCH fields and upgrade mongoose (CVE-2026-73562)

[achalc]

Summary

Fixes code scan finding sfind-9e0addb4633545f08b1d308280d160e3: the PATCH branch of POST /api/projects/[id] spread the entire request body into Project.findByIdAndUpdate, letting callers set any schema field (owner, createdAt) or inject raw update operators ($set, $unset, $rename). With mongoose 9.2.3 a body like {"$set":{"__proto__.x":1}} also triggers GHSA-664h-wqgq-64gw prototype pollution during update casting.

Changes:

• server/api/projects/[id].post.ts: replace {...updateData} with an explicit allow-list — only name (non-empty string), description (string), and members (array of valid ObjectId strings) are accepted; each is type-checked and rejected with 400 otherwise. The update is sent as { $set: update } so no client-controlled key can ever be an operator or reach the top level of the update document. owner is no longer client-writable; the manual updatedAt write was dropped since the schema uses timestamps: true.
• package.json / pnpm-lock.yaml: mongoose ^9.2.3 -> ^9.7.2 (resolves to 9.10.0), outside the vulnerable range (<9.7.2).

Note: the same body-spread pattern exists in server/api/users/[id].post.ts and server/api/test-cases/[id].post.ts; those are tracked as separate findings and not changed here.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/002e437d66ac43bd9a58364681c76a4c
Open in Devin Desktop: https://app.devin.ai/desktop/session/002e437d66ac43bd9a58364681c76a4c?variant=devin
Requested by: @achalc

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring