From 698b6eb00d0a3f589c9ae8828edc7b23002270e0 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Sun, 19 Jul 2026 11:15:24 -0300
Subject: [PATCH] fix(security): bump adm-zip >=0.6.0 + exact host matching in
 mitm DNS test (#7733)

---
 changelog.d/fixes/sec-adm-zip-codeql-host-match.md | 1 +
 package-lock.json                                  | 8 ++++----
 package.json                                       | 3 ++-
 tests/unit/mitm-dns-graceful-degrade-6127.test.ts  | 2 +-
 4 files changed, 8 insertions(+), 6 deletions(-)
 create mode 100644 changelog.d/fixes/sec-adm-zip-codeql-host-match.md

diff --git a/changelog.d/fixes/sec-adm-zip-codeql-host-match.md b/changelog.d/fixes/sec-adm-zip-codeql-host-match.md
new file mode 100644
index 0000000000..9f53074eb2
--- /dev/null
+++ b/changelog.d/fixes/sec-adm-zip-codeql-host-match.md
@@ -0,0 +1 @@
+- fix(security): bump adm-zip to ^0.6.0 (dev transitive via promptfoo/onnxruntime-node) to clear the crafted-ZIP 4GB-allocation advisory, and tighten mitm DNS test host assertion to exact matching (CodeQL js/incomplete-url-substring-sanitization)
diff --git a/package-lock.json b/package-lock.json
index a678e41868..48a94c2a90 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13121,14 +13121,14 @@
       }
     },
     "node_modules/adm-zip": {
-      "version": "0.5.18",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.18.tgz",
-      "integrity": "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "engines": {
-        "node": ">=12.0"
+        "node": ">=14.0"
       }
     },
     "node_modules/afinn-165": {
diff --git a/package.json b/package.json
index 937d70363d..7a38ff3f00 100644
--- a/package.json
+++ b/package.json
@@ -398,6 +398,7 @@
     },
     "node-gyp": {
       "undici": "^6.27.0"
-    }
+    },
+    "adm-zip": "^0.6.0"
   }
 }
diff --git a/tests/unit/mitm-dns-graceful-degrade-6127.test.ts b/tests/unit/mitm-dns-graceful-degrade-6127.test.ts
index b82f6ab740..a46a14c0c1 100644
--- a/tests/unit/mitm-dns-graceful-degrade-6127.test.ts
+++ b/tests/unit/mitm-dns-graceful-degrade-6127.test.ts
@@ -81,7 +81,7 @@ test("provisionDnsEntries: a failing agent/custom step does not stop the others
     },
     addHostsDns: async (hosts: string[]) => {
       // Custom-hosts call must still happen even after default + agent errors.
-      if (hosts.includes("custom.example.com")) customCalled = true;
+      if (hosts.some((h) => h === "custom.example.com")) customCalled = true;
     },
     getAgentStates: () =>
       [{ dns_enabled: true, agent_id: "__nonexistent_agent__" }] as never,