fix(deps): bump undici in tests/ and @hono/node-server in evals/

[devin-ai-integration]

Summary

Automated dependency-vulnerability remediation run (2026-08-24). Simple version bumps only, both in dev-only eval workspaces.

• tests/: pin the nested undici under @ai-sdk/provider-utils from 5.29.0 → 6.28.0 via an undici@5 override (7 Dependabot alerts + 1 Wiz finding, Moderate/Medium, ~10d old)
• evals/: pin @hono/node-server 1.19.14 → 1.19.17 via a @hono/node-server@1 override (GHSA-frvp-7c67-39w9, Moderate/Medium, ~12d old); minimum patched is 1.19.15, so this stays on the 1.x line instead of the major bump in chore(deps): bump @hono/node-server from 1.19.14 to 2.1.1 in /evals #162
• No source changes; lockfiles regenerated with npm install --legacy-peer-deps (matches CI)

Testing

• Manual (describe below)

python3 scripts/validate_skills.py (50 files OK), python3 -m unittest discover -s tests (9 pass), python3 scripts/generate_catalog.py --check (up to date), cd evals && npm test (92 pass). Promptfoo eval runs call paid providers and were not run.

Notes

Findings addressed

Package	Ecosystem	Manifest	Current → Target	Severity	Age	Source(s)	Advisory
undici	npm	tests/package-lock.json	5.29.0 → 6.28.0	Moderate	10d	Dependabot (#233, #234, #239, #241, #242, #243, #237, #240), Wiz	GHSA-2mjp-6q6p-2qxm, GHSA-4992-7rv2-5pvq, GHSA-p88m-4jfj-68fv, GHSA-8xcm-r25x-g524, GHSA-v3r7-h72x-cjcm, GHSA-m8rv-5g2x-5cg5 (+ 2 Low)
@hono/node-server	npm	evals/package-lock.json	1.19.14 → 1.19.17	Moderate	12d	Dependabot (#229), Wiz	GHSA-frvp-7c67-39w9

Both are transitive through promptfoo (and @modelcontextprotocol/sdk) in workspaces that only run the LLM eval harness, so there is no production exposure. undici 6.28.0 was published 2026-07-24 and @hono/node-server 1.19.17 on 2026-07-27, both well outside the 7-day publish hold.

Deferred / not addressed

• esbuild GHSA-g7r4-m6w7-qqqr in tests/ and evals/ — Low severity, out of scope for this automation. Dependabot PRs chore(deps): bump esbuild and tsx in /tests #77/chore(deps-dev): bump esbuild from 0.28.0 to 0.28.2 in /evals #78 already cover it.
• Dependabot chore(deps): bump @hono/node-server from 1.19.14 to 2.1.1 in /evals #162 bumps @hono/node-server to 2.1.1 (major) in evals/. This PR takes the minimum patched 1.x instead; chore(deps): bump @hono/node-server from 1.19.14 to 2.1.1 in /evals #162 can be closed or merged independently as a non-security upgrade.
• Reconciliation: Wiz and Dependabot agreed exactly on the finding set (undici, @hono/node-server, esbuild). No Critical/High findings, no Go or Python findings.
• The CI check "Require additional human oversight on bot PRs" is action_required by design on bot-authored PRs and needs a human approval.

Link to Devin session: https://app.devin.ai/sessions/6d39249c94e649688dd3642316cddbbe

---

Note

Overview
Patches moderate Dependabot/Wiz findings in dev-only eval workspaces via npm overrides. No application source changes.

In tests/, an undici@5 override lifts the nested copy under @ai-sdk/provider-utils from 5.29.0 to 6.28.0 (and drops @fastify/busboy). In evals/, an @hono/node-server@1 override moves 1.19.14 → 1.19.17, staying on the 1.x line rather than a major bump.

^{Reviewed by Cursor Bugbot for commit 034fe1c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	75/100 (3/4)	-25
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	100/100 (5/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	94/100 (16/17)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.