fix(security): adm-zip >=0.6.0 + exact host matching in mitm DNS test

changelog.d/fixes/sec-adm-zip-codeql-host-match.md

@@ -0,0 +1 @@
+- fix(security): bump adm-zip to ^0.6.0 (dev transitive via promptfoo/onnxruntime-node) to clear the crafted-ZIP 4GB-allocation advisory, and tighten mitm DNS test host assertions to exact/suffix matching (CodeQL js/incomplete-url-substring-sanitization)

package.json

@@ -406,6 +406,7 @@
     },
     "node-gyp": {
       "undici": "^6.27.0"
-    }
+    },
+    "adm-zip": "^0.6.0"
   }
 }

tests/unit/mitm-dns-graceful-degrade-6127.test.ts

@@ -80,7 +80,7 @@ test("provisionDnsEntries: a failing agent/custom step does not stop the others
     },
     addHostsDns: async (hosts: string[]) => {
       // Custom-hosts call must still happen even after default + agent errors.
-      if (hosts.includes("custom.example.com")) customCalled = true;
+      if (hosts.some((h) => h === "custom.example.com")) customCalled = true;
     },
     getAgentStates: () => [{ dns_enabled: true, agent_id: "__nonexistent_agent__" }] as never,
     listEnabledCustomHosts: () => [{ host: "custom.example.com" }] as never,
@@ -205,8 +205,8 @@ test("provisionDnsEntries: canElevate() returning true proceeds with DNS provisi
     },
     addHostsDns: async (hosts: string[], sudoPassword: string) => {
       capturedPasswords.push(sudoPassword);
-      if (hosts.some((h) => h.includes("googleapis.com"))) agentCalled = true;
-      if (hosts.includes("custom.example.com")) customCalled = true;
+      if (hosts.some((h) => h.endsWith(".googleapis.com"))) agentCalled = true;
+      if (hosts.some((h) => h === "custom.example.com")) customCalled = true;
     },
     canElevate: () => true,
     getAgentStates: () => [{ dns_enabled: true, agent_id: "antigravity" }] as never,