[Cycode] Fix for vulnerable manifest file dependency - express updated to version 5.1.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
internal/cli/cmd/plugin/build/testdata/tempo/package.json	1

📂 internal/cli/cmd/plugin/build/testdata/tempo/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
express	4.21.2	5.1.0

Important

This pull request updates the major version for one or more packages. Make sure changes are tested before merging.

---

Note

Low Risk
Test fixture dependency-only change with no production or auth paths affected; main caveat is Express 5 compatibility if tests hit Express APIs.

Overview
Addresses a Cycode-reported vulnerable dependency by upgrading the express devDependency in internal/cli/cmd/plugin/build/testdata/tempo/package.json from 4.21.2 to ^5.1.0, with the corresponding package-lock.json refresh for that test fixture.

This is a major Express release in testdata used by the plugin build CLI tests—not production runtime code—so behavior should only matter if those tests exercise Express directly.

^{Reviewed by Cursor Bugbot for commit e4546fc. Configure here.}

[cycode-security]

❗Cycode: Security vulnerability found in newly introduced dependency.

Risk Score	55 (MEDIUM)
Severity	High
Issue	adm-zip: Crafted ZIP file triggers 4GB memory allocation: CVE-2026-39244
Ecosystem	NPM
Dependency	adm-zip
Dependency Paths	@module-federation/enhanced 0.16.0 -> @module-federation/dts-plugin 0.16.0 -> adm-zip 0.5.18
Direct Dependency	No
Development Dependency	No
Upgrade	0.6.0

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_ignore_manifest_here <reason>	Applies to this manifest in this request only
#cycode_ignore_package_here <reason>	Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

⚠️ Due to API limitations, we can not comment on the exact line (5627)