Security: Multiple known vulnerable dependencies (CVE-2022-23529, CVE-2023-3696, CVE-2024-43796, CVE-2022-31129)

## Security Advisory

This project includes four dependencies with known critical and high-severity vulnerabilities.

### 1. jsonwebtoken@^8.5.1 — CVE-2022-23529 (Critical)

JWT verification bypass allowing token forgery.

- **Fix:** Upgrade to jsonwebtoken >= 9.0.0
- **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2022-23529

### 2. mongoose@^5.7.7 — CVE-2023-3696 (Critical)

Prototype pollution via crafted query objects.

- **Fix:** Upgrade to mongoose >= 6.9.1
- **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2023-3696

### 3. express@^4.17.1 — CVE-2024-43796 (Medium)

XSS via response.redirect() with unsanitized user input.

- **Fix:** Upgrade to express >= 4.21.1
- **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2024-43796

### 4. moment@^2.24.0 — CVE-2022-31129 (High)

ReDoS when parsing user-supplied date strings.

- **Fix:** Upgrade to moment >= 2.29.4
- **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2022-31129

### Recommendation

Update affected dependencies in package.json to their patched versions.

Start with package.json and inspect the four affected dependency entries: jsonwebtoken, mongoose, express, and moment. Update them to the patched versions named in the issue, then verify dependency resolution and run the project's existing tests. Done means all four vulnerable version requirements are addressed without breaking the application.

Written by the indexing model from the issue text.