fix: remediate undici dependency vulnerabilities in tests workspace

[devin-ai-integration]

Summary

• Resolves the open undici advisories in the dev-only tests/ workspace by pinning the direct parent, @ai-sdk/provider-utils, to 4.0.46 (patch bump within the same major), which switched its undici dependency from ^5.29.0 to ^6.28.0.
• No source changes: manifest + lockfile only. No major version bumps, and no undici override (the previously rejected approach).
• Remaining open alerts in this repo are Low severity (esbuild) and out of policy scope; Dependabot PRs already cover them.

Testing

• Manual (describe below)

python3 scripts/validate_skills.py, python3 -m unittest discover -s tests, python3 scripts/generate_catalog.py --check, and (cd evals && npm test) all pass. tests/ install done with npm install --legacy-peer-deps (Node 24, npm 11), matching CI.

Notes

• The Require additional human oversight on bot PRs check is action_required by design on bot PRs — a human gate, not a failure.

Findings addressed

Package	Path	Current → Target	Severity	Source(s)	Advisories	Age
undici (via @ai-sdk/provider-utils 4.0.45 → 4.0.46)	tests/package.json	5.29.0 → 6.28.0	Moderate	Dependabot + Wiz	GHSA-2mjp-6q6p-2qxm, GHSA-4992-7rv2-5pvq, GHSA-p88m-4jfj-68fv, GHSA-8xcm-r25x-g524, GHSA-v3r7-h72x-cjcm, GHSA-m8rv-5g2x-5cg5 (+2 Low: GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m)	first seen 2026-08-14 (>7 days)

The nested undici is transitive through promptfoo → ai / @ai-sdk/gateway → @ai-sdk/provider-utils. Forcing undici@6 directly would be a major bump via an override, which is out of scope for this automation; bumping the parent achieves the same result within a patch bump. 4.0.46 is the oldest release that carries the fixed range (published 2026-08-14), pinned exactly rather than ^ to avoid pulling a release published in the last few days.

Deferred / not actionable

• esbuild 0.28.0 → 0.28.1 in tests/ and evals/ (GHSA-g7r4-m6w7-qqqr): Low severity → ignored per policy; Dependabot PRs chore(deps): bump esbuild and tsx in /tests #77 / chore(deps-dev): bump esbuild from 0.28.0 to 0.28.2 in /evals #78 cover it.
• @hono/node-server 1.19.14 → 2.1.1 (Dependabot chore(deps): bump @hono/node-server from 1.19.14 to 2.1.1 in /evals #162): major bump, out of scope.
• @opentelemetry/core < 2.8.0 (surfaced only by npm audit, not by Dependabot/Wiz): fix requires a major (1.x → 2.x).
• undici override approach from PR fix(deps): bump undici in tests/ and @hono/node-server in evals/ #163 was closed unmerged by a human (osm6495, 2026-08-24) because it forced a major; not recreated.

Link to Devin session: https://app.devin.ai/sessions/c9b967b43301447e8db5952938bb311f
Open in Devin Desktop: https://app.devin.ai/desktop/session/c9b967b43301447e8db5952938bb311f?variant=devin

---

Note

Overview
Addresses moderate undici security advisories in the dev-only tests/ workspace without touching application source.

Adds an npm overrides entry pinning @ai-sdk/provider-utils@4 to 4.0.46 (patch within v4). That release pulls undici ^6.28.0 instead of 5.29.0 on the promptfoo → ai / @ai-sdk/gateway path. The lockfile is regenerated so nested copies under @ai-sdk/gateway and ai use 4.0.46 and undici 6.28.0, and the old hoisted @ai-sdk/provider-utils 4.0.45 / @fastify/busboy (from undici 5) drop out.

This avoids a direct undici major override; only manifest + lockfile change.

^{Reviewed by Cursor Bugbot for commit 6a971c9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	100/100 (4/4)	no change
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	100/100 (5/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	100/100 (17/17)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.