Only the latest minor release of @avasapp/agent-bridge gets security fixes. agent-bridge is a development tool: release builds compile every entry point to an empty stub, so it should never run in a shipped app (details).

Please don't open a public issue. Report it privately through GitHub: Report a vulnerability. We aim to reply within a week.