[Cycode] Fix for vulnerable manifest file dependency - express updated to version 4.22.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
internal/cli/cmd/plugin/build/testdata/tempo/package.json	1

📂 internal/cli/cmd/plugin/build/testdata/tempo/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
express	4.21.2	4.22.0

---

Note

Low Risk
Test-only devDependency bump in build testdata; no application or security-sensitive runtime paths change.

Overview
Bumps the express devDependency in internal/cli/cmd/plugin/build/testdata/tempo/package.json from 4.21.2 to ^4.22.0 (with matching lockfile updates) to clear a reported vulnerable dependency in that manifest.

This only affects the Tempo sample plugin used by plugin build tests, not production runtime code.

^{Reviewed by Cursor Bugbot for commit 8332cea. Configure here.}

[cycode-security]

❗Cycode: Security vulnerability found in newly introduced dependency.

Severity	High
Issue	adm-zip: Crafted ZIP file triggers 4GB memory allocation: CVE-2026-39244
Ecosystem	NPM
Dependency	adm-zip
Dependency Paths	@module-federation/enhanced 0.16.0 -> @module-federation/dts-plugin 0.16.0 -> adm-zip 0.5.18
Direct Dependency	No
Development Dependency	No
Upgrade	0.6.0

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_ignore_manifest_here <reason>	Applies to this manifest in this request only
#cycode_ignore_package_here <reason>	Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.