fix: remediate npm dependency vulnerabilities in evals and tests workspaces

[devin-ai-integration]

Remediates the eligible npm dependency vulnerabilities in the dev-only evals/ and tests/ eval-harness workspaces (manifest + lockfile only, no source edits).

• fast-uri 3.1.5 → 3.1.7 in both workspaces (clears 8 High Dependabot alerts).
• js-yaml 4.3.1 → 4.3.2 in both workspaces (High).
• sharp 0.35.3 → 0.35.4 in both workspaces (High).
• hono 4.13.2 → 4.13.8 and csv-parse 7.0.1 → 7.0.2 via workspace overrides (Moderate; both transitive through promptfoo).
• Supersedes Dependabot PRs chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /evals #166, chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /tests #167, chore(deps-dev): bump csv-parse from 7.0.1 to 7.0.2 in /evals #169, chore(deps): bump hono from 4.13.2 to 4.13.7 in /evals #171, chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /tests #172, chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /evals #175, chore(deps-dev): bump sharp from 0.35.3 to 0.35.4 in /evals #176 — the Evaluate * eval jobs cannot pass on Dependabot-authored runs (no access to the eval provider secrets).

Implementation details

Dependency vulnerability fixes (automated)

Generated by the dependency-vuln-remediation run on 2026-09-21.
Change type: Minor/patch version bumps only — manifest and lockfile changes, no source edits.

Findings addressed

Package	Ecosystem	Current → Target	Severity	Age	Source(s)	Advisory
fast-uri	npm	3.1.5 → 3.1.7	High	18d	Dependabot, Wiz	GHSA-5jgf-p345-68v8, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-f65p-4m7j-42xc
js-yaml	npm	4.3.1 → 4.3.2	High	8d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
sharp	npm	0.35.3 → 0.35.4	High	10d	Dependabot, Wiz	GHSA-rgj7-g3m4-5g8c
hono	npm	4.13.2 → 4.13.8	Moderate	11d	Dependabot, Wiz	GHSA-gqvv-2mrq-wpjv, GHSA-crvj-82cr-hjcx
csv-parse	npm	7.0.1 → 7.0.2	Moderate	12d	Dependabot, Wiz	GHSA-8cw4-87c7-c6xx

All findings are DEVELOPMENT-scope in evals/package-lock.json and tests/package-lock.json (csv-parse only in evals/; the override was added to both for consistency). hono and csv-parse are transitive through promptfoo, so they are pinned with npm overrides; js-yaml is a direct devDependency in evals/ and an override in tests/. Caret overrides resolve to the newest patch within the same minor (^4.13.5 → 4.13.8, ^3.1.6 → 3.1.7).

Deferred this run

• adm-zip <= 0.6.0 → 0.6.1 (High, GHSA-7q85-xj36-vmfc): alert first seen 2026-09-19, inside the 7-day hold; eligible 2026-09-26 (Dependabot PR chore(deps-dev): bump adm-zip from 0.6.0 to 0.6.1 in /tests #178 tracks it).
• adm-zip 0.5.9–0.6.0 (Moderate, GHSA-vwc7-r8mq-g2x9): no patched version exists.
• esbuild < 0.28.1 (Low, GHSA-g7r4-m6w7-qqqr): Low severity, out of scope.

Not addressed here (require a major version bump)

None.

Verification

• Install: ✅ npm install --legacy-peer-deps in evals/ and tests/ (matches CI)
• Build: n/a (no build step)
• Tests: ✅ python3 scripts/validate_skills.py (49 skills), python3 -m unittest discover -s tests (9 tests), python3 scripts/generate_catalog.py --check, cd evals && npm test (92 pass / 0 fail)
• Lint: n/a

Require additional human oversight on bot PRs is the org-wide human gate on bot PRs and is expected to be red until a human approves.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	75/100 (3/4)	-25
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	80/100 (4/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	100/100 (17/17)	new
onboarding	-	75/100 (3/4)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.