fix(deps): override adm-zip to ^0.6.0 to clear the npm audit CI gate

[jonathanKingston]

Summary

The npm audit --audit-level=high precheck gate (landed with #903) is failing on main itself: GHSA-xcpc-8h2w-3j85 — adm-zip@0.5.18 pulled in via onnxruntime-node → @huggingface/transformers. Because the gate runs inside precheck, every open PR's CI is currently red, and all armed auto-merges are stuck behind it.

Change

Add "adm-zip": "^0.6.0" to the existing overrides block in package.json (alongside dompurify/serialize-javascript/tar) and refresh package-lock.json. This is the advisory's patched line; 0.6.0 keeps the same API surface onnxruntime-node uses for archive extraction.

Verified locally: npm ls adm-zip shows 0.6.0 overridden and npm audit --audit-level=high exits 0 with "found 0 vulnerabilities".

After merge

Open PRs need their branches updated (or CI re-run) to pick the fix up through the merge ref — their prechecks will keep failing until then.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KTABxrmLvrGWZe4JgDh8YC

---

Generated by Claude Code

---

Note

Low Risk
Dependency-only override with no application code changes; risk is limited to zip extraction behavior in optional ONNX/transformers paths, which the PR author expects to remain API-compatible.

Overview
Adds an adm-zip ^0.6.0 npm override next to the existing security overrides so the lockfile no longer resolves the vulnerable 0.5.18 copy pulled in transitively (e.g. onnxruntime-node under optional @huggingface/transformers). package-lock.json is refreshed to 0.6.0 (Node engine >=14.0 on that package).

This targets GHSA-xcpc-8h2w-3j85 so npm audit --audit-level=high in CI can pass again; branches that predate the fix need a merge or re-run to pick it up.

^{Reviewed by Cursor Bugbot for commit 5b26747. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b234fc0f-3d96-419a-ac7a-cfeed9410580)

[cursor]

Did not approve: Cursor Bugbot skipped (usage limit reached) and did not complete its review. Human review is needed for this dependency override; requested AutomatedTester as reviewer.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}