[devin-ai-integration]

Summary

Fixes code-scan finding sfind-cfb2a2f1 (Snyk SNYK-JS-CRYPTOJS-6028119 / CVE-2023-46233, high): crypto-js@3.3.0 PBKDF2 defaults to SHA1 with 1 iteration. It reaches AdminPortal through auth0-js@8.12.3 > idtoken-verifier@1.5.1 > crypto-js@3.3.0.

-    "auth0-js": "^8.8.0",
+    "auth0-js": "^9.12.0",

This is the smallest upgrade Snyk lists for this path: auth0-js@9.12.0 > idtoken-verifier@2.2.4 > crypto-js@4.2.0.

• Major bump (8 -> 9): auth0-js is not imported anywhere in AdminPortal/src (grep -rn auth0 src returns nothing), so no app code calls it.
• Why not an overrides block (the approach in bug: override vulnerable crypto-js 3.3.0 with ^4.2.0 in AdminPortal (CVE-2023-46233) #145 / bug: override transitive crypto-js 3.3.0 with 4.2.0 in AdminPortal (SNYK-JS-CRYPTOJS-18599395) #264): the repo blueprint pins Node 12, which ships npm 6.14.16. npm only supports overrides from 8.3, so npm 6 ignores the block and still installs crypto-js 3.3.0. Raising the direct dependency fixes it on any npm version.
• Duplicates: bug: override vulnerable crypto-js 3.3.0 with ^4.2.0 in AdminPortal (CVE-2023-46233) #145 and bug: override transitive crypto-js 3.3.0 with 4.2.0 in AdminPortal (SNYK-JS-CRYPTOJS-18599395) #264 target the same CVE, and bug: bump auth0-js to ^9.0.0 in AdminPortal (CVE-2018-6874) #287 / bug: upgrade auth0-js to ^9.3.0 in AdminPortal (CVE-2018-7307) #167 / bug: upgrade auth0-js to ^10.0.0 in AdminPortal (CVE-2026-42280) #269 also bump auth0-js. Only one of them should land.
• No lockfile is committed (the repo has none). No Java changes.

Verification

• ng build (Node 12.22.12, CLI 1.1.2): passes. auth0-js isn't in the bundle graph, so the output matches before and after.
• ng lint: 3 errors (prefer-const in login, primary-transaction and savings-transaction *.component.spec.ts). They are already on master and not in files this PR touches.
• ng test: Karma 1.7.1 with headless Chrome fails at startup in this VM with ERROR [karma]: { inspect: [Function: inspect] }, the same on master. Unit tests did not run.
• Not done: npm install of the new tree and the Snyk before/after re-scan. registry.npmjs.org and api.snyk.io are blocked in this session (access requested), so snyk test errors out. So I have no measured before/after issue count. The finding reports 1 issue on this path (crypto-js@3.3.0 via auth0-js@8.12.3). The fix depends on Snyk's stated upgrade path, which resolves crypto-js@4.2.0 (the fixed version). Please run cd AdminPortal && rm -rf node_modules package-lock.json && npm install && snyk test on Node 12 to confirm.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/271527ec18194ee0947717900e37c0d8
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/271527ec18194ee0947717900e37c0d8?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)