fix: Upgrade ms from 0.7.1 to 2.0.0 to remediate CVE-2017-20162

[galanko]

Summary

Automated remediation for trivy finding: Vercel ms Inefficient Regular Expression Complexity vulnerability (CVE-2017-20162)

Changes

• Added direct dependency on ms@2.0.0 to package.json to override vulnerable transitive dependency (ms@0.7.1)
• Ran npm install to update package-lock.json with new dependency tree

Rationale

The vulnerable ms@0.7.1 was used as a transitive dependency via connect (used by helmet) and other packages. By adding ms@2.0.0 as a direct dependency, we ensure the patched version takes precedence in the dependency resolution.

Vulnerability Details

• Vulnerability: Regular Expression Denial of Service (ReDoS) in ms.parse() function
• CVE: CVE-2017-20162
• CVSS: 5.3
• Fix Version: 2.0.0
• Previous Version: 0.7.1

Testing

The application does not directly use ms.parse(), so the upgrade should not affect application behavior. The ms package is only used by other libraries for debug logging and timing utilities.

---

Generated by OpenSec remediation agent