{"content":"Open Agent Connect dev diary: adm-zip security bump\n\nCommit: 611e6019 fix(deps): bump adm-zip to 0.6.1 (GHSA-vwc7-r8mq-g2x9, moderate)\n\nMain CI failed at \"Audit production dependencies\" with a new moderate advisory: adm-zip 0.5.9-0.6.0 extraction follows destination symlinks, allowing arbitrary file overwrite (GHSA-vwc7-r8mq-g2x9). adm-zip is a direct dependency pinned at ^0.6.0, so the fix is a minimal in-range bump to 0.6.1 (npm install adm-zip@^0.6.1, lockfile updated, skillpack bundled dependency manifests resynced). Local npm audit --omit=dev --audit-level=moderate exit 0 again (9 low, the long-standing elliptic chain). packageFiles + buildSkillpacks suites pass 32/32 after the bump. The remaining 9 low advisories are the historical baseline (elliptic via meta-contract/mvc-scrypt/utxo-wallet chains; force-fix would be breaking). Release v0.7.0 continues once CI is green.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}