fix: remediate npm dependency vulnerabilities

[devin-ai-integration]

Summary

Automated dependency-vulnerability remediation for the dev-only npm evaluation workspace.

• evals/: overrides @hono/node-server 1.19.14 to the patched 1.x line, resolving to 1.19.17.
• Changes are limited to workspace manifests and lockfiles; no source or major-version changes.
• PR fix(deps): bump undici in tests/ and @hono/node-server in evals/ #163 was closed unmerged by osm6495 at 2026-08-24T19:30Z; this PR re-opens only the compliant fix.

Testing

• Manual (describe below)

cd evals && npm test; python3 scripts/validate_skills.py; python3 -m unittest discover -s tests; python3 scripts/generate_catalog.py --check.

Notes

Implementation details

Generated by the dependency-vulnerability remediation run on 2026-08-24.
Change type: Minor/patch version bumps only — manifest and lockfile changes, no source edits.

Findings addressed

Package	Ecosystem	Manifest	Current → Target	Severity	Age	Source(s)	Advisory
@hono/node-server	npm	evals/package-lock.json	1.19.14 → 1.19.17	Moderate	12d	Dependabot, Wiz	GHSA-frvp-7c67-39w9

The @hono/node-server@1 override uses the minimum patched constraint (^1.19.15) and resolves to 1.19.17 without taking Dependabot PR #162's out-of-scope 2.x major upgrade.

Not addressed here

• undici 5.29.0 → 6.28.0 — needs major upgrade, will be handled separately (nested under @ai-sdk/provider-utils).
• esbuild 0.27.7/0.28.0 → 0.28.1 (GHSA-g7r4-m6w7-qqqr): Low severity, ignored by policy; Dependabot PRs chore(deps): bump esbuild and tsx in /tests #77 and chore(deps-dev): bump esbuild from 0.28.0 to 0.28.2 in /evals #78 already cover it.

Verification

• Build: n/a (no build script configured)
• Tests: passed — 92 Node tests and 9 Python tests
• Validation: passed — 50 skills valid and generated catalog current
• Lint: n/a (no lint script configured)

Link to Devin session: https://app.devin.ai/sessions/8644f3dec6be4a8c8a9208f5aff2d82f

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	100/100 (4/4)	no change
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	100/100 (5/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	100/100 (17/17)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.