fix: remediate fast-uri dependency vulnerabilities in evals and tests workspaces

[devin-ai-integration]

Summary

Automated dependency-vulnerability remediation run for 2026-09-14.

• Bumps fast-uri to >= 3.1.6 (resolves to 3.1.7) in both dev-only workspaces (evals/, tests/), clearing 8 High Dependabot alerts (#244–#247, #251, #252, #254, #255) also reported by Wiz.
• Manifest + lockfile changes only, patch-level, no source edits. fast-uri is a transitive dev dependency of promptfoo, so it is pinned via each workspace's overrides.
• Everything else open this run is either inside the 7-day hold window, Low severity, or has no fix available — see details.

Testing

• Manual (describe below)

npm install --legacy-peer-deps in both workspaces, then python3 scripts/validate_skills.py, python3 -m unittest discover -s tests, python3 scripts/generate_catalog.py --check, and cd evals && npm test — all green (49 skills validated, 9 unit tests, 92 node tests).

Notes

Implementation details

Findings addressed

Package	Ecosystem	Current → Target	Severity	Age	Source(s)	Advisory
fast-uri (evals/, tests/)	npm	3.1.5 → 3.1.7	High	11d (first seen 2026-09-03)	Dependabot, Wiz	GHSA-5jgf-p345-68v8, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-f65p-4m7j-42xc

first_patched_version is 3.1.6; the caret override resolves to 3.1.7, the latest patch in the range. This matches the target of Dependabot PRs #166 / #167, which are superseded by this PR (their eval CI jobs fail because Dependabot-authored runs cannot access the eval provider secrets).

Deferred — inside the 7-day hold window

Package	Current → Target	Severity	First seen	Hold lifts
csv-parse (evals/)	7.0.1 → 7.0.2	Moderate	2026-09-09	2026-09-16
hono (evals/, tests/)	4.13.2 → 4.13.5	Moderate	2026-09-10	2026-09-17
sharp (evals/, tests/)	0.35.3 → 0.35.4	High	2026-09-11	2026-09-18
js-yaml (evals/, tests/)	4.3.1 → 4.3.2	High	2026-09-13	2026-09-20

Dependabot already has open PRs for csv-parse (#169), hono (#171), and js-yaml in /tests (#172); if those land before the next run they are resolved without further action here.

Not addressed — no fix available

• adm-zip >= 0.5.9, <= 0.6.0 (GHSA-vwc7-r8mq-g2x9, Moderate, both workspaces) — no patched version published.

Not addressed — Low severity (out of scope by policy)

• esbuild GHSA-g7r4-m6w7-qqqr (both workspaces).

Not addressed — require a major version bump

None this run. Previously recorded majors (@hono/node-server 2.x, @opentelemetry/core 2.x) are not among the currently open findings.

Reconciliation

Dependabot: 21 open alerts via GraphQL vulnerabilityAlerts. Wiz (launchdarkly/ai-tooling/main, REPOSITORY_BRANCH): 0 Critical; Highs = fast-uri, sharp, js-yaml; Mediums = hono, adm-zip, csv-parse — a subset of the Dependabot set, so Dependabot createdAt drove all ages. No Critical findings this run.

Verification

• Install: ✅ (npm install --legacy-peer-deps in evals/ and tests/)
• Build: n/a (no build step)
• Tests: ✅
• Lint: n/a

Link to Devin session: https://app.devin.ai/sessions/b237531747344cfa90068f97d2898fab
Open in Devin Desktop: https://app.devin.ai/desktop/session/b237531747344cfa90068f97d2898fab?variant=devin

---

Note

Overview
Pins the transitive fast-uri dependency to ^3.1.6 (lockfiles resolve 3.1.7) in the evals/ and tests/ npm workspaces via overrides, replacing 3.1.5 to address high-severity advisories. evals/package.json bumps the existing override; tests/package.json adds the same override. Only package.json and package-lock.json change—no application source.

^{Reviewed by Cursor Bugbot for commit dc53527. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	75/100 (3/4)	-25
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	100/100 (5/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	94/100 (16/17)	new
onboarding	-	75/100 (3/4)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.