[devin-ai-integration]

Summary

Fixes Snyk npm:auth0-js:20180226 / CVE-2018-7307 (CSRF: authorization response with no state was accepted; high, CVSS 7.5), code-scan finding sfind-2256ec41, in AdminPortal/package.json:24.

-    "auth0-js": "^8.8.0",
+    "auth0-js": "^9.3.0",

• 9.3.0 is the smallest fixed version, as Snyk recommends. This is a major bump (8 -> 9). auth0-js isn't imported anywhere in AdminPortal/src or the CLI config, so no app code needs to change.
• No lockfile is committed for AdminPortal, so this only changes the declared range. ^8.8.0 can resolve to a vulnerable version (<9.3.0); ^9.3.0 cannot.

Duplicates: open PR #167 makes the same change for an earlier ticket (sfind-1a21a3aa). PR #237 (^9.13.2, which also clears CVE-2020-5263) and #269 (^10.0.0) cover this CVE too. This PR was opened for the new finding, as the one-PR-per-ticket rule requires. Only one of them should land.

Verification

• ng build (Angular CLI 1.1.2, Node 12.22.12) passes with the existing node_modules. ng lint reports 3 errors (prefer-const in *.component.spec.ts). They are on master already and unrelated to this change.
• Before: installed auth0-js is 8.12.3, so the finding count is 1. Checked with semver.satisfies("8.12.3", "<9.3.0") === true.
• After: semver.intersects("^9.3.0", "<9.3.0") === false, so the expected count is 0.
• Not done: npm install of 9.x and the Snyk rescan. registry.npmjs.org and api.snyk.io are blocked in this session; access was requested but not granted. The before/after counts above are worked out from semver, not taken from a Snyk run.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/9867c3c9d54f4c3d8dd1fc466557f7f2
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/9867c3c9d54f4c3d8dd1fc466557f7f2?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring