fix: [npm] Upgrade adm-zip from 0.4.7 to 0.5.18 to resolve CVE-2018-1002204

[hannahhuh-cog]

Summary

Snyk SCA (scheduled scan) flagged adm-zip@0.4.7 with a Critical Zip Slip vulnerability: npm:adm-zip:20180415 / CVE-2018-1002204 (CWE-29, Arbitrary File Write via Archive Extraction). routes/index.js calls AdmZip(importFile.data).extractAllTo(...) on user-uploaded archives, so a crafted ../ entry can write outside the extraction directory.

Change: package.json "adm-zip": "0.4.7" → "0.5.18" plus lockfile relock. Snyk's minimum fixed version for this CVE is 0.4.11; 0.5.18 was chosen because it also clears the two remaining High adm-zip findings (SNYK-JS-ADMZIP-1065796 directory traversal, SNYK-JS-ADMZIP-17954277 / CVE-2026-39244 resource exhaustion). The AdmZip(buffer) / extractAllTo API used here is unchanged in 0.5.x.

Snyk reference: npm:adm-zip:20180415, severity critical, direct dependency, manifest package.json.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/178f11f2b5e94e8f93f691287e1f1d60
Open in Devin Desktop: https://app.devin.ai/desktop/session/178f11f2b5e94e8f93f691287e1f1d60?variant=devin
Requested by: @hannahhuh-cog

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.