[devin-ai-integration]

Summary

Fixes code-scan finding sfind-db438260 (SNYK-JS-CRYPTOJS-18599395 / CVE-2026-71851, medium): crypto-js@3.3.0 has a weak PRNG in WordArray.random.

Vulnerable path: admin-portal > auth0-js@8.12.3 > idtoken-verifier@1.5.1 > crypto-js@3.3.0. idtoken-verifier@1.5.1 requires crypto-js: ^3.1.9-1, so no 3.x version fixes it. This PR follows Snyk's upgrade path: auth0-js@9.12.0 > idtoken-verifier@2.2.4 > crypto-js@4.2.0.

-    "auth0-js": "^8.8.0",
+    "auth0-js": "^9.12.0",

• Major bump (flagged): this moves the direct dependency auth0-js from 8.x to 9.x, and the transitive crypto-js from 3.x to 4.x. 9.12.0 is the smallest auth0-js version on Snyk's upgrade path. auth0-js is not imported anywhere under AdminPortal/src (it is only declared in package.json), so the app bundle and runtime behaviour are unchanged.
• Why not npm overrides (as in open PR bug: override transitive crypto-js 3.3.0 with 4.2.0 in AdminPortal (SNYK-JS-CRYPTOJS-18599395) #264): the repo's toolchain is Node 12 / npm 6.14.16 (see the environment blueprint). npm 6 ignores overrides, which needs npm >= 8.3. On this VM npm ls crypto-js still resolves crypto-js@3.3.0 under that toolchain. A direct-dependency bump works with any npm version.
• Duplicate notice: this overlaps open PR bug: override transitive crypto-js 3.3.0 with 4.2.0 in AdminPortal (SNYK-JS-CRYPTOJS-18599395) #264 (same Snyk issue, overrides approach) and the auth0-js 9.x/10.x bumps in bug: bump auth0-js to ^9.13.2 in AdminPortal (CVE-2020-5263) #237/bug: bump auth0-js to ^9.0.0 in AdminPortal (CVE-2018-6874) #287/bug: upgrade auth0-js to ^10.0.0 in AdminPortal (CVE-2026-42280) #269. Only one of them should land.
• No Java changes. No Snyk ignores. No lockfile (AdminPortal does not commit one).

Verification

• ng build (JIT, Node 12): passes on this branch.
• ng test: was already broken on master and is unaffected by this change. tsc -p src/tsconfig.spec.json reports TS2346 in 4 generated component specs (appointment, login, primary-transaction, savings-transaction), and karma aborts.
• Not run: fresh npm install and the Snyk re-scan. This session's network policy blocks registry.npmjs.org and api.snyk.io. Access was requested but had not been approved when this PR was opened, so the before/after Snyk issue count could not be measured.
  • Before (measured offline): npm ls crypto-js shows auth0-js@8.12.3 > idtoken-verifier@1.5.1 > crypto-js@3.3.0, which is 1 instance of SNYK-JS-CRYPTOJS-18599395.
  • After (expected, not measured): 0 instances, because Snyk's own upgrade path resolves crypto-js@4.2.0, which also clears CVE-2023-46233.
  • To confirm, a reviewer can run cd AdminPortal && npm install && snyk test.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/2ec40a516ac446d89459cefbe067af71
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/2ec40a516ac446d89459cefbe067af71?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.