fix(middlewareNode): downgrade node-nlp 4.27.0 -> 3.10.2 (Issue 4)

[Deepesh-Katudia]

Summary

Downgrade node-nlp 4.27.0 -> 3.10.2 in middlewareNode, isolated in its own PR so it can be reviewed and reverted on its own.

Part of a stacked series. Merge in order: audit-fix -> axios -> nodemailer -> googleapis -> uuid -> node-nlp. Each PR targets the previous branch, so its diff shows only its own bump; After merging each one, click "Delete branch" (this repo does not auto-delete merged branches). That makes GitHub retarget the next PR to main and run CI on it; if the branch is not deleted, the next PR must be retargeted to main by hand before merging, or it will merge into a dead branch. (6/6, stacked on #244)

Type of Change

• New feature
• Bug fix
• Refactor
• Documentation update
• Style/UI update
• Performance improvement
• Other (please specify): dependency / security update (Issue 4)

Key Changes

• middlewareNode/package.json: one-line range change; lockfile updated accordingly.
• This does NOT fix the vulnerability. node-nlp -> @nlpjs/xtables -> xlsx (ReDoS + prototype pollution) has no fix on npm. The vulnerable range covers 1.0.5-3.10.2 as well as >=4.0.0-rc.1; only 5.0.0-alpha.5 is clean, and an alpha is not production-viable. Taken because it is what npm audit fix --force proposes and behaves identically for our usage.
• chatService.js only uses NlpManager addDocument/train/process. No existing test covers it, so it was checked with a smoke test against the real nlpTrainingData: intent + sentiment output for 7 sample messages is identical on 4.27.0 and 3.10.2. Side effect: 3.10.2 no longer prints ~190 training-epoch lines to the server log at startup.
• Needs a team decision: record node-nlp/xlsx as an accepted exception until a stable node-nlp 5.x ships, or revert to 4.27.0 and document the same exception.

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed: plain node -e "require(...)" of the package (catches CommonJS/ESM breakage that Jest mocks can hide)
• All tests pass: 22/22 suites, 264/264 tests after clean npm ci

Bugs Fixed (if applicable)

• npm audit after this PR: 2 findings (0 critical, 2 high: node-nlp, xlsx). Does not close the node-nlp/xlsx finding.

TODO (Follow-up Work)

• Merge only after fix(middlewareNode): bump uuid 8.3.2 -> 11.1.1 (Issue 4) #244.

Additional Notes

Version vetted by @THRISHMA2424 on dependancyFix; regenerated fresh off current main.

[Copilot]

🟡 Changes recommended

The known high-severity findings remain unresolved; an approved and documented security exception is required before merging.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Downgrades node-nlp in middlewareNode from 4.27.0 to 3.10.2 while retaining the existing API usage.

Changes:

• Updates the direct dependency range.
• Regenerates the lockfile.
• Retains the unresolved high-severity node-nlp/xlsx findings.

File summaries

File	Description
middlewareNode/package.json	Updates the node-nlp dependency range.
middlewareNode/package-lock.json	Locks the downgraded dependency tree, including xlsx@0.15.6.

Review details

Files not reviewed (1)

• middlewareNode/package-lock.json: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.