[devin-ai-integration]

Summary

Fixes Snyk finding SNYK-JS-AUTH0JS-565004 / CVE-2020-5263 (CWE-522, medium; code-scan finding sfind-171928c8). In auth0-js versions >=8.0.0 and <9.13.2, the error object from a failed authentication carries the original request, which can include the user's plaintext password.

 // AdminPortal/package.json
-    "auth0-js": "^8.8.0",
+    "auth0-js": "^9.13.2",

• This is a major bump (8 → 9). 9.13.2 is the smallest version that fixes the issue (no 8.x release has the fix), and it matches Snyk's upgrade path auth0-js@9.13.2.
• Low risk: nothing in AdminPortal/src imports auth0-js (rg auth0 matches only package.json), so no app code touches the 8 → 9 API changes. package-lock.json isn't committed for AdminPortal, so the manifest is the only file that changes. UserFront and the Java version are untouched.
• Duplicate: open PR bug: bump auth0-js to ^9.13.2 in AdminPortal (CVE-2020-5263) #237 makes the identical change for an earlier trigger of this same finding. Only one of the two should land. This new PR exists because of the one-PR-per-ticket rule. ^9.13.2 also covers bug: upgrade auth0-js to ^9.3.0 in AdminPortal (CVE-2018-7307) #167 (^9.3.0, CVE-2018-7307).

Verification

• ng build (Node 12.22.12, JIT, per the repo blueprint) passes: main 35.8 kB, vendor 2.73 MB. Caveat: this build used the existing local node_modules, which still has auth0-js 8.12.3, because the npm registry is blocked in this session. Since nothing imports auth0-js, the version can't affect the bundle.
• ng lint reports only errors that already exist on master (spacing and prefer-const in src/app/**). No files under src were changed.
• ng test could not run: Karma 1.7.1 aborts with ERROR [karma]: { inspect: [Function: inspect] } before any spec runs. That's an environment problem with the old CLI/Karma and modern Node/Chrome, not something this change causes.
• No Snyk before/after count. snyk test --file=AdminPortal/package.json fails with SNYK-CLI-0000 because api.snyk.io is unreachable. I requested access to registry.npmjs.org and api.snyk.io, but it hadn't been approved. Expected result: SNYK-JS-AUTH0JS-565004 goes from 1 to 0 for this project, because the declared range now starts at the fixed version 9.13.2. This still needs to be confirmed by a Snyk re-scan.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/f1fd59cbf55945918c4d74e7d0418f74
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/f1fd59cbf55945918c4d74e7d0418f74?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.