[Bug]: browser tools still fail npm audit after audit fix because agent-browser is pinned to 0.13.0

[Deyniellll]

Bug Description

On current main, npm audit fix in the Hermes repo does not clear all browser-tools vulnerabilities.

After running npm audit fix, hermes doctor still reports browser tool vulnerabilities, and npm audit still shows:

• @appium/logger
• nested lodash vulnerability under node_modules/@appium/logger/node_modules/lodash

The remaining vulnerable path appears to come from the pinned browser dependency tree.

Evidence

package.json currently pins:

"agent-browser": "^0.13.0"

npm outdated --json shows:

{
  "agent-browser": {
    "current": "0.13.0",
    "wanted": "0.13.0",
    "latest": "0.25.4"
  }
}

npm audit still reports the remaining lodash vulnerability through @appium/logger after npm audit fix has already been run.

Steps to Reproduce

1. Clone current main.
2. Run npm install.
3. Run npm audit fix.
4. Run npm audit or hermes doctor.

Expected Behavior

Either:

• browser tools pass npm audit after the documented fix flow, or
• Hermes is updated to a newer agent-browser version that removes the vulnerable transitive dependency chain, or
• doctor gives a more precise message that the remaining issue requires a dependency bump rather than another npm audit fix.

Actual Behavior

doctor continues to recommend npm audit fix, but the remaining browser vulnerability persists after doing exactly that.

Environment

• Hermes repo: main
• Observed on local install at commit 33ee7741

[teknium1]

This bug has been resolved on main — automated hermes-sweeper review.

The root cause (pinned agent-browser@^0.13.0) was addressed in commit 284e084bc, shipped in v2026.4.23:

• agent-browser bumped from ^0.13.0 → ^0.26.0, picking up 13 releases of fixes including the vulnerable @appium/logger/lodash transitive chain.
• package.json also now includes an "overrides": { "lodash": "4.18.1" } stanza to suppress nested lodash vulnerabilities.

Running npm audit against current main will no longer surface the paths described in the report.