[Snyk] Security upgrade express from 4.18.3 to 4.22.0

[Vivelis]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• front/package.json
• front/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-14724253	828

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[Copilot]

Pull request overview

This PR upgrades Express from 4.18.3 to 4.22.0 in the front-end to address a high-severity security vulnerability (SNYK-JS-QS-14724253) related to resource allocation without limits in the qs package.

Key Changes:

• Express upgraded from 4.18.3 to 4.22.0 with updated dependencies
• qs package upgraded from 6.11.0 to 6.14.1 to fix the security vulnerability
• Multiple transitive dependencies updated, including cookie, encodeurl, finalhandler, merge-descriptors, send, and serve-static

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
front/package.json	Updates Express dependency from ^4.18.2 to ^4.22.0
front/package-lock.json	Locks Express to 4.22.0 and updates all transitive dependencies including the vulnerable qs package from 6.11.0 to 6.14.1

Files not reviewed (1)

• front/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This PR only updates the front-end Express dependency but leaves the back-end Express vulnerable. The back-end (in the /back directory) is using express 4.19.2 with qs 6.11.0, which is still vulnerable to the same SNYK-JS-QS-14724253 vulnerability this PR is attempting to fix.

The back-end should also be upgraded to use express 4.22.0 (or at least a version that includes the fixed qs dependency) to fully address the security vulnerability across the entire application.