fix(snyk): remediate medium-and-above vulnerabilities blocking feat/AG-387-trial-agentic-fix

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source quality gate blocked feat/AG-387-trial-agentic-fix. This branch was produced by snyk fix --agentic, working on vulnerabilities at or above medium severity — the same threshold that gate is configured with.

6 of 9 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
Medium	Regular Expression Denial of Service (ReDoS)	package.json	Low — This is a patch version upgrade from 5.2.0 to 5.2.2. According to the official release notes, the only change in this range is a backported security fix. No breaking API changes or other modifications are included in this upgrade. Source: GitHub release notes
Medium	Open Redirect	package.json	Low — This is a patch version upgrade that addresses a security vulnerability. - got@11.8.5: This version patches a vulnerability where got could be manipulated to follow a redirect to a UNIX socket. This upgrade is recommended to ensure security. There are no documented breaking API changes in this version range. The update hardens redirect behavior without altering the public API. Source: Package documentation and security advisories.
Medium	Regular Expression Denial of Service (ReDoS)	package.json	Low — This is a patch version upgrade for marked from 4.0.1 to 4.0.10. This range of patch releases includes bug fixes and security vulnerability patches. No breaking changes are expected in this upgrade. Source: Release notes
Medium	Regular Expression Denial of Service (ReDoS)	package.json	Low — This is a patch version upgrade for marked from 4.0.1 to 4.0.10. This range of patch releases includes bug fixes and security vulnerability patches. No breaking changes are expected in this upgrade. Source: Release notes
Medium	Uncontrolled Recursion	package.json	Low — This is a patch version upgrade from 7.5.19 to 7.5.21. While a detailed changelog for these specific patch versions is not available in the search results, patch releases for the tar package are generally limited to bug fixes and security patches. No breaking changes are expected. Source: Package documentation
Medium	Uncontrolled Recursion	package.json	Low — This is a patch version upgrade from 1.10.2 to 1.10.3. According to the package's semantic versioning policy, patch releases are intended for bug fixes and should not contain breaking changes. No specific release notes detailing breaking changes for this version were found. The upgrade is considered safe. Source: Package documentation

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
Medium	Cross-site Scripting (XSS)	ts-binary-wrapper/package.json	Yes	Medium — This is a minor version upgrade for @sentry/node within the v7 series. While there are no direct breaking API removals in this range, there is a significant behavioral change related to OpenTelemetry and numerous deprecations in preparation for the next major version. Key Changes: - Default OpenTelemetry Tracer: The SDK now defaults to a minimal, Sentry-specific tracer provider instead of the full OpenTelemetry BasicTracerProvider to reduce performance overhead. This is a behavioral change that could impact users with advanced OpenTelemetry setups. [1, 2] - Deprecations: Many functions and patterns were deprecated in later versions of v7 in preparation for v8. This includes the deprecation of addGlobalEventProcessor in favor of addEventProcessor (v7.85.0) and changes to how spans are accessed on the scope (v7.93.0). [10] Recommendation: - If you rely on specific OpenTelemetry SDK features (like custom span processors), you may need to opt-out of the new minimal tracer. You can restore the previous behavior by setting openTelemetryBasicTracerProvider: true in your Sentry.init() options. [1] - Review the code for usage of deprecated functions to prepare for future upgrades to v8. A migration tool, @sentry/migr8, is available to help automate some of these changes. [10] Source: Sentry JavaScript SDK Changelog, Sentry v7 Deprecations
Medium	Missing Release of Resource after Effective Lifetime	package.json	Yes	High — This is a very significant major version upgrade from v7 to v12, which includes a complete rewrite of the library and introduces numerous breaking changes. Code modifications are required for this upgrade. Key Breaking Changes: * Promise-Based API: The most critical change is the move from a callback-based API to a modern Promise-based API starting in v9.0. Asynchronous operations now return Promises, and the old callback pattern is no longer supported. * Node.js Requirement: Support for older Node.js versions has been dropped. Version 9 and higher require Node.js v16 or newer. * Path Separators (Windows): Backslashes (\) are no longer treated as path separators in glob patterns; they are now exclusively used for escaping characters. All patterns, including on Windows, must use forward-slashes (/). * Module Exports: The package no longer has a default export. You must use named imports, for example: const { glob } = require('glob');. * Removed Options: Many options from v7 have been removed in v8.0, including silent, strict, nonull, nounique, and nosort. The behavior associated with these options (like ensuring unique results) is now standard. Recommendation: Due to the complete API rewrite, this upgrade requires careful code refactoring. You must update all glob calls to use the new Promise-based syntax and ensure your patterns use forward-slashes. Thorough testing is essential. Source: GitHub Changelog
Medium	Inefficient Algorithmic Complexity	package.json	Yes	High — The upgrade of js-yaml from version 3.x to 4.x is a major update with significant breaking changes focused on improving security and adhering more closely to the YAML 1.2 specification. Key Breaking Changes: * Safe by Default: The primary breaking change is that the main functions are now safe by default. The safeLoad(), safeLoadAll(), and safeDump() methods have been removed. You must replace them with load(), loadAll(), and dump() respectively. * Unsafe Operations Removed: Unsafe tags like !!js/function and !!js/regexp are no longer supported in the default configuration and have been moved to a separate package (js-yaml-js-types). Using them requires explicit schema configuration. * Stricter Parsing: * load() will now throw an error on empty input instead of returning undefined. * Number parsing now follows the YAML 1.2 standard, meaning octal numbers require an 0o prefix (e.g., 0o1234) and time-like strings (e.g., 1:23) are parsed as strings, not numbers. * Extra commas within flow collections (e.g., [foo,,bar]) will now cause an exception. * API and Schema Changes: * DEFAULT_SAFE_SCHEMA and DEFAULT_FULL_SCHEMA have been removed in favor of DEFAULT_SCHEMA. * The !!binary tag now consistently decodes to a Uint8Array. Recommendation: This upgrade requires code modifications. Review all usages of js-yaml and update calls from safeLoad/safeDump to load/dump. Thoroughly test your YAML parsing logic, especially if you handle different number formats or rely on the previous loose parsing behavior. If you require the old unsafe functionality, you will need to add the js-yaml-js-types package and create a custom schema. Source: GitHub CHANGELOG

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same quality gate that blocked feat/AG-387-trial-agentic-fix, so its result — not this description — is the verdict on what is left.

Changes

 package-lock.json | 52 ++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 36 insertions(+), 16 deletions(-)

_{Snyk ProdSec orb · build 626519 · model claude-opus-4-8}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 7 relevant code sections from 1 files (average relevance: 0.61) package-lock.json (7 segments, lines 17504-17828)

🤖 Repository instructions applied (from AGENTS.md)