[Kylejeong2]

Summary

Remediate dependency vulnerabilities reported by socket fix --all for GRO-2507. Update the root lockfile and Next.js, Puppeteer, adm-zip, and the pinned MCP SDK; add lockfiles for the three affected templates so Socket can apply and preserve transitive fixes.

Socket still reports GHSA-vfj7-8cjw-p6xm in braces, introduced by eslint-config-next, with no patched version available.

Validation

• Passed frozen-lockfile installs (lifecycle scripts disabled), TypeScript checks for the human-in-the-loop and Puppeteer templates, and an adm-zip round-trip smoke check.
• Passed template transpilation, README index validation, changed-file formatting, and git diff --check.
• Root lint fails because ESLint ignores all matching files. Live browser/API flows were not tested; the Git-pinned codemode package also lacks its built CLI artifact with lifecycle scripts disabled.

Refs https://linear.app/browserbase/issue/GRO-2507/fix-security-vulns-in-templates

---

Note

Low Risk
Changes are lockfile and semver dependency bumps for security remediation; no runtime or auth logic is modified.

Overview
Addresses Socket-reported vulnerabilities by refreshing dependency versions and lockfiles rather than changing application code.

The agent-with-human-in-loop template bumps Next.js and eslint-config-next from 16.2.1 to 16.4.1, raises the pnpm override for @modelcontextprotocol/sdk to 1.32.0, and adds a dedicated pnpm-lock.yaml so installs and transitive fixes are pinned for that package. extend-browserbase upgrades adm-zip from ^0.5.16 to ^0.6.1. The root pnpm-lock.yaml is updated with newer transitive packages in the ESLint/tooling graph (e.g. ajv, minimatch, js-yaml, @humanfs/*).

One known braces advisory via eslint-config-next remains without a patched upstream release, as noted in the PR description.

^{Reviewed by Cursor Bugbot for commit 746f37d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​eslint@​9.39.5
	npm/​next@​16.2.1 ⏵ 16.4.1	-2	+75	+1
	npm/​eslint-config-next@​16.2.1 ⏵ 16.4.1			+1
	npm/​puppeteer-core@​24.43.1 ⏵ 25.0.3	+9		+1	+1

View full report