[notgitika]

Description

Fixes the failing bun run audit step in the verify workflow (https://github.com/aws/agentcore-cli/actions/runs/40371695677/job/121743823554).

• GHSA-mrhx-c7xc-m3w5 (high): lockfile now pins zod 4.6.7 (within the existing ^4.4.3). Added a scoped @ag-ui/core → zod ^4.6.6 override for the zod@3.25.76 that @aws/agent-inspector pulls in, since zod 3 has no patched release. That copy is never loaded at runtime: agent-inspector ships only a prebuilt browser bundle.
• fast-uri (4 advisories): lockfile now has 3.1.9 and 4.2.3, both within existing ranges.
• braces GHSA-vfj7-8cjw-p6xm: bun audit no longer reports it, so I dropped the --ignore and the src/techDebt.test.ts deadline (which would have started failing on 2026-10-27).

The lockfile diff is limited to the affected entries plus the override (13 lines), and bun install --frozen-lockfile accepts it.

Companion PR for main: #2708

Type of Change

• Bug fix

Testing

• bun run audit (no ignores): no vulnerabilities found
• bun install --frozen-lockfile
• bun run typecheck, bun run lint:check
• bun test: 4709 pass, 0 fail

[github-actions]

Package Tarball

aws-agentcore-1.0.0.tgz

How to install

gh release download pr-2709-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-1.0.0.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

I verified the substance of this change rather than just the diff shape:

• braces GHSA-vfj7-8cjw-p6xm is withdrawn (withdrawn_at: 2026-10-23), so removing the --ignore and the src/techDebt.test.ts deadline is correct — braces stays at 3.0.3 and audit won't flag it.
• zod GHSA-mrhx-c7xc-m3w5 is < 4.6.6 with patch 4.6.6, which also covers zod 3.x with no zod-3 fix, so the scoped @ag-ui/core → zod ^4.6.6 override is the only non-ignore way to clear it. Root zod@4.6.7 still satisfies the declared ^4.4.3.
• fast-uri 3.1.9 / 4.2.3 are the first patched versions for every active fast-uri advisory, and no other fast-uri entries remain in the lockfile.
• Lockfile looks genuinely regenerated: registry dist.integrity for zod@4.6.7, fast-uri@3.1.9 and fast-uri@4.2.3 match the hashes in the diff byte-for-byte, and the @ag-ui/core/zod@3.25.76 entry is gone with the override recorded in the lock's overrides block.
• The major-version override is safe. @ag-ui/core@0.0.52 declares zod ^3.22.4, so this override intentionally violates its range — but I unpacked @aws/agent-inspector@0.6.2 from the registry and it ships only dist-assets/ (prebuilt index.js/index.css/index.html) with no main, module, or exports. src/core/dev/inspectorAssets.ts and scripts/build.ts only ever read those files, so @ag-ui/core is never imported and the forced zod 4 can't affect runtime behavior.

No changes required. Two non-blocking follow-ups for whenever someone touches this area:

1. overrides only apply to the root project, so users installing the published package still resolve @aws/agent-inspector → @ag-ui/core → zod@3.25.76 and will see the advisory in their own npm audit. Since the inspector is consumed purely as build-time staged assets (the node_modules/.../dist-assets path in inspectorAssets.ts is only the run-from-source fallback), moving @aws/agent-inspector to devDependencies would drop that whole subtree — including the five eslint-plugin-* runtime deps it declares — from end-user installs.
2. The override is a workaround for an upstream dep that will presumably go away when agent-inspector updates @ag-ui/core; a techDebtTest deadline (the helper in src/testing/techDebt.ts is now unused) would make sure it gets revisited rather than lingering indefinitely.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.54%. Comparing base (9ab9ed9) to head (a3bb5b3).
⚠️ Report is 6 commits behind head on refactor.

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2709      +/-   ##
============================================
- Coverage     96.62%   96.54%   -0.08%     
============================================
  Files           706      706              
  Lines         58447    58561     +114     
============================================
+ Hits          56472    56540      +68     
- Misses         1975     2021      +46     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.