- Express 4 → 5.2.1 - Remove method-override (unused with Angular HttpClient) and errorhandler (superseded by exceptions.handler.js) - Remove asyncHandler wrapper from all controllers — Express 5 propagates async rejections natively - Remove body-parser (redundant, Express 5 includes it internally) - Patch/minor updates: cors, dotenv, ejs, express-jwt, express-session, jsonwebtoken, morgan, mysql2, sequelize, underscore - Dev updates: eslint 9.0→9.39, nodemon 2→3, globals, sequelize-cli - Fix getUser endpoint to include SkydiverProfile data in response - docs: add ADR 0013, update README
Accepting authorId from the request body allowed any authenticated user to create comments impersonating another user. The author is now always the authenticated user from req.payload.
julien