Merge pre_prod into APS-9999-cypress-cli-security-omnibus-sep2026

Resolve package-lock.json conflict by taking pre_prod's baseline and
re-running `npm install --package-lock-only` so my security overrides
re-apply on top of pre_prod's newer package.json (adm-zip added, version
bumped to 1.37.1, decompress removed).

Verified post-merge tree:
  js-yaml:         4.1.x → 4.3.2, 3.14.x → 3.15.2 (my overrides)
  brace-expansion: 1.1.x → 1.1.18, 2.1.x → 2.1.4  (my overrides)
  adm-zip:         0.6.1 (from pre_prod)
  axios:           1.16.1 (unchanged)
  form-data:       4.0.5 (unchanged)

Target CVEs (GHSA-52cp-r559-cp3m js-yaml, GHSA-3jxr-9vmj-r5cp
brace-expansion) absent from `npm audit`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jasbir-browserstack

.github/workflows/Semgrep.yml

@@ -27,7 +27,10 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep:1.166.0
+      # Pinned to a digest for supply-chain integrity (APS-19017 / INF-007).                                                                                                                                                                                                                                                
+      # returntocorp/semgrep:1.166.0 resolved 2026-09-16.                                                                                                                                                                                                                                                                 
+      image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068
+
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')
 

.npmrc

@@ -1,2 +1,5 @@
+min-release-age=7
 package-lock=true
 lockfile-version=1
+strict-ssl=true
+save-exact=true

bin/helpers/buildArtifacts.js

@@ -11,7 +11,7 @@ const logger = require('./logger').winstonLogger,
 const { default: axios } = require('axios');
 const { HttpsProxyAgent = require('https-proxy-agent') } = require('https-proxy-agent');
 const FormData = require('form-data');
-const decompress = require('decompress');
+const AdmZip = require('adm-zip');
 const unzipper = require("unzipper");
 const { setAxiosProxy } = require('./helper');
 
@@ -154,10 +154,11 @@ const downloadAndUnzip = async (filePath, fileName, url) => {
 const unzipFile = async (filePath, fileName) => {
   return new Promise( async (resolve, reject) => {
     try {
-      await decompress(path.join(filePath, fileName), filePath);
+      const zip = new AdmZip(path.join(filePath, fileName));
+      await zip.extractAllToAsync(filePath, /* overwrite */ true);
       resolve();
     } catch (error) {
-      logger.debug(`Error unzipping with decompress, trying with unzipper. Stacktrace: ${error}.`);
+      logger.debug(`Error unzipping with adm-zip, trying with unzipper. Stacktrace: ${error}.`);
       try {
         fs.createReadStream(path.join(filePath, fileName))
           .pipe(unzipper.Extract({ path: filePath }))

bin/helpers/reporterHTML.js

@@ -6,7 +6,7 @@ const fs = require('fs'),
       utils = require("./utils"),
       Constants = require('./constants'),
       config = require("./config"),
-      decompress = require('decompress');
+      AdmZip = require('adm-zip');
 const { isTurboScaleSession } = require('../helpers/atsHelper');
 
 const { setAxiosProxy } = require('./helper');
@@ -171,15 +171,14 @@ function getReportResponse(filePath, fileName, reportJsonUrl) {
 
 const unzipFile = async (filePath, fileName) => {
   return new Promise( async (resolve, reject) => {
-    await decompress(path.join(filePath, fileName), filePath)
-    .then((files) => {
-      let message = "Unzipped the json and html successfully."
-      resolve(message);
-    })
-    .catch((error) => {
+    try {
+      const zip = new AdmZip(path.join(filePath, fileName));
+      await zip.extractAllToAsync(filePath, /* overwrite */ true);
+      resolve("Unzipped the json and html successfully.");
+    } catch (error) {
       reject(error);
       process.exitCode = Constants.ERROR_EXIT_CODE;
-    });
+    }
   });
 }