PL-598 [Vanta] Remediate "Critical vulnerabilities identified in packages are addressed (GitHub Repo)"

[anush]

No description provided.

[Copilot]

Pull Request Overview

This PR upgrades vulnerable packages and enhances the express-rate-limit module to guard against prototype pollution and invalid rate-limit keys.

• Upgraded devDependencies to patched versions
• Replaced Object.assign with a secure defaults merge excluding dangerous keys
• Added key validation and sanitization in the rate limiter

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumped eslint, express, husky, mocha, and supertest to safe versions
lib/express-rate-limit.js	Implemented secure defaults merging and validated/sanitized rate-limit keys

Comments suppressed due to low confidence (1)

lib/express-rate-limit.js:81

• The new key validation and sanitization branches (type checks, dangerous-key exclusion, length trimming) lack test coverage. Add unit tests for invalid key types, prohibited values ("__proto__", etc.), and boundary-length cases.

      if (typeof key !== "string" && typeof key !== "number") {

[Copilot]

The defaults object omits essential properties like skip, keyGenerator, statusCode, and handler, so calls to options.skip or options.keyGenerator will throw. Include these defaults to match the original behavior.