build(deps): Bump path-to-regexp from 8.3.0 to 8.4.0 in /packages/agent-os/extensions/copilot

[dependabot]

Bumps path-to-regexp from 8.3.0 to 8.4.0.

Release notes

Sourced from path-to-regexp's releases.

8.4.0

Important

• Fix CVE-2026-4926 (GHSA-j3q9-mxjg-w52f)
• Fix CVE-2026-4923 (GHSA-27v5-c462-wpq7)

Fixed

• Restricts wildcard backtracking when using more than 1 in a path (pillarjs/path-to-regexp#421)

Changed

• Dedupes regex prefixes (pillarjs/path-to-regexp#422)
  • This will result in shorter regular expressions for some cases using optional groups
• Rejects large optional route combinations (pillarjs/path-to-regexp#424)
  • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

Commits

• 34cb451 8.4.0
• 22a9679 Reject large optional route combinations (#424)
• 8881a88 Byte optimization (#423)
• 43669ac Dedupe regex prefixes (#422)
• 4864654 Restrict repeated wildcard backtracking (#421)
• 05a5a97 Remove dependabot config (#404)
• 5b635cd Remove package-lock.json (#407)
• See full diff in compare view

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for your first pull request.
Please ensure tests pass, code follows style (ruff check), and you have signed the CLA.
See our Contributing Guide.

[github-actions]

✅ PR Review Summary

Check	Status	Details
🔍 Code Review	⏳ Pending	Awaiting results
🛡️ Security Scan	⏳ Pending	Awaiting results
🔄 Breaking Changes	⏳ Pending	Awaiting results
📝 Docs Sync	⏳ Pending	Awaiting results
🧪 Test Coverage	⏳ Pending	Awaiting results

Verdict: ⏳ Still running — some checks have not completed yet

💡 Individual agent reports are collapsed below for reference.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a9eb11d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/path-to-regexp	8.4.0	🟢 7.3	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches CI-Tests 🟢 8 21 out of 24 merged PRs checked by a CI test -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 7 found 8 unreviewed changesets out of 29 -- score normalized to 7 Contributors 🟢 10 25 different organizations found -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 5 5 commit(s) out of 30 and 1 issue activity out of 30 found in the last 90 days -- score normalized to 5 Packaging ⚠️ -1 no published package detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 9 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 no vulnerabilities detected

Scanned Files

• packages/agent-os/extensions/copilot/package-lock.json

[github-actions]

🤖 AI Agent: security-scanner — Security Review for PR: Bump `path-to-regexp` from 8.3.0 to 8.4.0

Security Review for PR: Bump path-to-regexp from 8.3.0 to 8.4.0

Summary:

This PR updates the path-to-regexp dependency from version 8.3.0 to 8.4.0. The update addresses two critical CVEs and introduces changes to improve the security and performance of the library. Below is a detailed security analysis of the changes.

---

Findings:

1. Prompt Injection Defense Bypass

• Risk: None identified.
• Analysis: The path-to-regexp library is used for parsing and matching URL paths. It does not directly handle user input or prompts, so this update does not introduce any new risks related to prompt injection.
• Rating: 🔵 LOW

---

2. Policy Engine Circumvention

• Risk: None identified.
• Analysis: The changes in path-to-regexp do not affect the policy enforcement mechanisms of the agent-governance-toolkit. The library update restricts wildcard backtracking and rejects large optional route combinations, which reduces the risk of resource exhaustion but does not impact policy circumvention.
• Rating: 🔵 LOW

---

3. Trust Chain Weaknesses

• Risk: None identified.
• Analysis: The path-to-regexp library does not interact with trust chains, certificates, or SPIFFE/SVID validation. This update does not introduce any trust chain weaknesses.
• Rating: 🔵 LOW

---

4. Credential Exposure

• Risk: None identified.
• Analysis: The dependency update does not log or expose any credentials. No changes in the PR suggest a risk of credential leakage.
• Rating: 🔵 LOW

---

5. Sandbox Escape

• Risk: None identified.
• Analysis: The path-to-regexp library operates on strings and does not execute code or interact with the system in a way that could lead to a sandbox escape.
• Rating: 🔵 LOW

---

6. Deserialization Attacks

• Risk: None identified.
• Analysis: The path-to-regexp library does not perform deserialization of external data. The update does not introduce any deserialization vulnerabilities.
• Rating: 🔵 LOW

---

7. Race Conditions

• Risk: None identified.
• Analysis: The changes in path-to-regexp are related to regex parsing and do not involve concurrent operations. There is no evidence of race condition risks introduced by this update.
• Rating: 🔵 LOW

---

8. Supply Chain Risks

• Risk: 🟠 HIGH
• Analysis:
  • The update addresses two CVEs:
    • CVE-2026-4926: Exploitable backtracking in regex patterns due to unrestricted wildcards.
    • CVE-2026-4923: Denial of Service (DoS) via large optional route combinations causing regex explosion.
  • These vulnerabilities could have been exploited to cause performance degradation or DoS in applications using path-to-regexp.
  • The new version (8.4.0) mitigates these risks by restricting wildcard backtracking and rejecting large optional route combinations.
• Recommendation: Approve the update to 8.4.0 to mitigate these CVEs. Additionally, ensure that the project has a process to monitor and address future dependency vulnerabilities.
• Rating: 🟠 HIGH

---

Recommendations:

1. Approve the PR: The update to path-to-regexp 8.4.0 is necessary to address critical CVEs and improve the security of the library.
2. Monitor Dependencies: Implement automated dependency scanning tools (e.g., Dependabot, Snyk) to ensure timely updates for future vulnerabilities.
3. Test Thoroughly: Ensure that the updated library does not introduce regressions in functionality by running all relevant tests in the CI/CD pipeline.

---

Final Rating: 🟠 HIGH

This update addresses critical vulnerabilities in the path-to-regexp library. While the update itself does not introduce new security risks, the presence of previously unpatched CVEs makes this a high-priority update. Approving and merging this PR is strongly recommended.

[github-actions]

🤖 AI Agent: code-reviewer

Review of PR: build(deps): Bump path-to-regexp from 8.3.0 to 8.4.0

---

🔴 CRITICAL

1. Security Vulnerabilities Addressed:

   • This update addresses two critical CVEs:
     • CVE-2026-4926: Details not provided in the PR, but this CVE is mentioned in the release notes.
     • CVE-2026-4923: Details not provided in the PR, but this CVE is mentioned in the release notes.
   • Action: Ensure that the updated version (8.4.0) is thoroughly tested in your environment to confirm that the vulnerabilities have been mitigated. If the vulnerabilities are not addressed, this could lead to potential security risks in your application.

2. Wildcard Backtracking Restriction:

   • The update restricts wildcard backtracking when using more than one wildcard in a path. This change is critical for preventing potential denial-of-service (DoS) attacks caused by excessive backtracking in regular expressions.
   • Action: Verify that this change does not break any existing functionality in your application, especially if you use multiple wildcards in route definitions.

3. Rejection of Large Optional Route Combinations:

   • The update introduces a restriction on the number of generated combinations for optional route groups to avoid regex explosion. This is a breaking change for applications that rely on large optional route combinations.
   • Action: Test all routes in your application to ensure that none of them exceed the new limit of 256 combinations. If any routes are affected, refactor them to comply with the new restriction.

---

🟡 WARNING

1. Potential Breaking Change:
   • The restriction on large optional route combinations (e.g., /users{/delete}) could lead to breaking changes if your application uses routes with more than 8 top-level optional groups.
   • Action: Perform regression testing on all routes to identify any potential issues caused by this change.

---

💡 SUGGESTIONS

1. Update Documentation:

   • If your project documentation includes examples or references to path-to-regexp usage, ensure that it is updated to reflect the new behavior introduced in version 8.4.0 (e.g., restrictions on optional route combinations and wildcard backtracking).

2. Add Tests for Edge Cases:

   • Given the changes in path-to-regexp, add or update tests to cover edge cases such as:
     • Routes with multiple wildcards.
     • Routes with a high number of optional groups.
   • This will help ensure that your application behaves as expected with the updated library.

3. Monitor for Performance Changes:

   • The release notes mention optimizations such as deduplication of regex prefixes. While this is expected to improve performance, monitor your application's performance to ensure there are no regressions.

4. Audit Peer Dependencies:

   • The diff shows that some peer dependencies were removed in the package-lock.json. While this may not directly impact your application, it is worth verifying if any of these changes affect your dependency tree.

---

Summary

This PR addresses critical security vulnerabilities and introduces changes that could potentially break existing functionality. While the update is necessary to mitigate security risks, it is essential to thoroughly test your application to ensure compatibility with the new version of path-to-regexp. Additionally, update your documentation and test suite to reflect the changes introduced in this version.

Recommended Actions:

• Merge this PR after conducting thorough testing for route compatibility and performance.
• Update documentation and add tests for edge cases.
• Monitor for any unexpected behavior or performance regressions post-deployment.