[MihirR-BS]

Fixes three findings from the LTS-5442 security AI review of this sample.

Changes

Story	Fix
LTS-5507 (High)	simple-git OS command injection (GHSA-v5rq-49vh-5v5c, -858h-whjf-mvg5, -g4wm-2vf7-vfgr, -x6jw-m9v5-85vh) came in via browserstack-node-sdk@1.61.0 → simple-git ^3.28.0.
LTS-5513 (High)	@grpc/grpc-js@1.14.4 TLS validation bypass (GHSA-m9gg-hp2v-232j) via the same SDK → grpc-js ^1.14.4.
LTS-5519 (Medium)	Semgrep image pinned: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068.

The fix for both SDK stories: browserstack-node-sdk 1.61.0 → 1.73.4. That is the newest release that clears this repo's min-release-age=7 (published 2026-10-19), and it already requires simple-git ^4.0.2 and @grpc/grpc-js ^1.14.5. The SDK's own ranges fix both chains, so no overrides force a major version under it. 1.74.0, the version the review suggested, is still inside the 7-day window.

Runner impact: none. The WDIO runner pod doesn't use browserstack-node-sdk; it runs @wdio/browserstack-service. In this sample the SDK only provides the local browserstack-cli that starts the load test.

Verification

• npm ci --ignore-scripts resolves simple-git@4.0.2, @simple-git/argv-parser@2.0.1 and @grpc/grpc-js@1.14.6, each as the only copy in the lock.
• npx --no-install browserstack-cli --version → 1.73.4. wdio --version → 9.29.1, and wdio.conf.js loads.
• npm audit, before → after: 33 → 25 issues, Critical 2 → 0, High 22 → 21. Cleared: simple-git, @simple-git/argv-parser, @grpc/grpc-js, googleapis, googleapis-common, gaxios, qs, uuid. Nothing new appears.

Not in scope

The 21 remaining Highs are already on main, in the WDIO / Percy / proxy-agent tree. The review did not raise them.

The load-testing-backend copy of this sample (sample/sample-webdriverio-repo.zip) is updated in load-testing-backend#3604.

Part of LTS-5442.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: a42337f1-52a7-42be-be60-b8b1e77cec4f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}