v3.1.40

• VG953 now flags request bodies passed directly to Mongoose updates (findByIdAndUpdate(id, req.body), updateOne/findOneAndUpdate, etc.), not just the {...req.body} spread form; explicit-field updates are not flagged
• Test coverage raised to ~97% (24 new offline test files)