[Snyk] Security upgrade express from 4.19.2 to 4.22.0

[Vivelis]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• back/package.json
• back/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-EXPRESS-14157151	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[Copilot]

Pull request overview

This PR addresses a medium-severity Prototype Pollution vulnerability (SNYK-JS-EXPRESS-14157151) by upgrading the Express framework from version 4.19.2 to 4.22.0 in the backend dependencies.

• Upgrades Express to fix Prototype Pollution security vulnerability (score: 631/1000)
• Updates numerous transitive dependencies including body-parser, cookie, encodeurl, finalhandler, send, serve-static, and related packages
• Adds new utility packages (call-bind-apply-helpers, call-bound, dunder-proto, get-proto, math-intrinsics, es-object-atoms) and updates introspection utilities

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
back/package.json	Updates express version specifier from ~4.19.2 to ~4.22.0
back/package-lock.json	Locks express to 4.22.0 and updates all transitive dependencies, with version specifier changed from tilde to caret

Files not reviewed (1)

• back/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Version specifier inconsistency: package.json uses ~4.22.0 (tilde) while package-lock.json uses ^4.22.0 (caret). These have different semantic meanings:

• ~4.22.0 allows patch updates (4.22.x)
• ^4.22.0 allows minor and patch updates (4.x.x)

The version specifiers should match between files to ensure consistent dependency resolution. Recommend updating package-lock.json to use ~4.22.0 to match package.json, or vice versa for consistency.

Suggested change

	"express": "^4.22.0",
	"express": "~4.22.0",