fix(deps): clear the October osv advisories

agent/osv-scanner.toml

@@ -0,0 +1,14 @@
+# Advisories accepted temporarily for agent/uv.lock. osv-scanner reads this file
+# for lockfiles in this directory. Each entry expires so the scan fails again and
+# the finding is re-reviewed; remove an entry once aws-opentelemetry-distro
+# allows the fixed OpenTelemetry versions.
+
+[[IgnoredVulns]]
+id = "GHSA-xcq7-p3pf-p88h"
+ignoreUntil = 2026-11-28
+reason = "opentelemetry-api tracestate parsing DoS (fixed in 1.45.1). aws-opentelemetry-distro pins opentelemetry-api exactly; the latest release (0.21.0) still pins 1.44.0."
+
+[[IgnoredVulns]]
+id = "GHSA-f5m9-jfrj-jjj7"
+ignoreUntil = 2026-11-28
+reason = "opentelemetry-propagator-jaeger baggage allocation (fixed in 1.45.0). Pinned exactly by aws-opentelemetry-distro; only affects services that enable the optional Jaeger propagator."

integrations/jira-forge-app/package.json

@@ -11,7 +11,7 @@
   },
   "overrides": {
     "brace-expansion": "^5.0.12",
-    "fast-uri": "^3.1.8",
-    "undici": "^7.29.0"
+    "fast-uri": "^3.1.9",
+    "undici": "^7.30.1"
   }
 }

osv-scanner.toml

@@ -0,0 +1,8 @@
+# Advisories accepted temporarily for yarn.lock. osv-scanner reads this file for
+# lockfiles in this directory. Each entry expires so the scan fails again and the
+# finding is re-reviewed; remove an entry as soon as a fixed release is available.
+
+[[IgnoredVulns]]
+id = "GHSA-gcqx-w48m-w2h4"
+ignoreUntil = 2026-11-28
+reason = "deepmerge 4.3.1 prototype poisoning: no fixed release exists. Reached only via jest-config (test tooling), never deployed."