[devin-ai-integration]

Summary

Fixes code scan finding sfind-096c23bb / Snyk SNYK-JS-AUTH0JS-16438973 (CVE-2026-42280, CWE-863, medium). auth0-js >=8.11.0 <10.0.0 lets a crafted invalid ID token plus a valid access token reach user profile data.

-    "auth0-js": "^8.8.0",
+    "auth0-js": "^10.0.0",

• This is a major bump (8 -> 10), flagged as the remediation guidance requires. 10.0.0 is the first fixed version, so it is the smallest bump that clears the issue.
• Nothing in AdminPortal/src imports auth0-js (grep -rn auth0 AdminPortal/src finds nothing), so the bump needs no code changes and no 9.x/10.x API migration.
• AdminPortal has no committed lockfile, so this PR only changes package.json. No Snyk ignores and no threshold changes.

Verification

• ng build (Node 12.22.12, Angular CLI 1.1.2) passes. Caveat: it ran against the existing node_modules, which still has auth0-js@8.12.3, because the npm registry is blocked in this session. Since nothing imports the package, it is not in the bundle either way.
• ng lint: the only errors are 3 prefer-const errors in *.component.spec.ts files this PR doesn't touch. They are also on master.
• Snyk before/after issue counts: not available. snyk test fails with socket hang up because api.snyk.io is blocked, and registry.npmjs.org is blocked too, so auth0-js@10.0.0 could not be installed. Network access has been requested. The scanner-reported "before" is this one auth0-js@8.12.3 issue. The "after" count still needs to be confirmed by re-running Snyk / the code scan on this branch.

Duplicates

This duplicates open PR #269 (same ^10.0.0 bump for an earlier ticket on the same CVE, sfind-98d7eff4). It also overlaps with #167/#237/#287, which bump auth0-js to 9.x for other auth0-js CVEs. 9.x does not fix this one. Only one of these should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/241fe82beba044948b928f29db09f4ce
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/241fe82beba044948b928f29db09f4ce?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.