Security: Known vulnerable dependencies (CVE-2022-23529, CVE-2023-3696, CVE-2021-23337, CVE-2024-45590)

## Security Advisory

This project includes five dependencies with known critical and high-severity vulnerabilities.

### 1. jsonwebtoken@^8.5.1 — CVE-2022-23529 (Critical)
JWT verification bypass allowing token forgery.
- **Fix:** Upgrade to >= 9.0.0
- **Ref:** https://nvd.nist.gov/vuln/detail/CVE-2022-23529

### 2. mongoose@^5.9.4 — CVE-2023-3696 (Critical)
Prototype pollution via crafted query objects.
- **Fix:** Upgrade to >= 6.9.1
- **Ref:** https://nvd.nist.gov/vuln/detail/CVE-2023-3696

### 3. lodash@^4.15.0 — CVE-2021-23337 (High)
Command injection via template function.
- **Fix:** Upgrade to >= 4.17.21
- **Ref:** https://nvd.nist.gov/vuln/detail/CVE-2021-23337

### 4. body-parser@^1.19.0 — CVE-2024-45590 (High)
Denial of service via malformed URL-encoded payload.
- **Fix:** Upgrade to >= 1.20.3
- **Ref:** https://nvd.nist.gov/vuln/detail/CVE-2024-45590

### 5. express@^4.17.1 — CVE-2024-43796 (Medium)
XSS via response.redirect() with unsanitized input.
- **Fix:** Upgrade to >= 4.21.1
- **Ref:** https://nvd.nist.gov/vuln/detail/CVE-2024-43796

### Recommendation
Update affected dependencies in package.json to their patched versions.

Start in package.json and locate the five affected dependency ranges: jsonwebtoken, mongoose, lodash, body-parser, and express. Update them to the patched minimum versions listed in the issue, then run the project’s tests and confirm the dependency audit no longer reports these CVEs.

Written by the indexing model from the issue text.