[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
golang.org/x/net	Go	Minor (transitive via x/tools 0.49.0)	0.50.0 → 0.58.0	Critical (Wiz) / Medium (Dependabot)	115d	Dependabot, Wiz	GHSA-5cv4-jp36-h3mw / CVE-2026-25680
golang.org/x/mod	Go	Minor	0.33.0 → 0.40.0	High	46d	Wiz	CVE-2026-56864, CVE-2026-56865
browserslist	npm	Minor (lockfile)	4.24.5 → 4.28.7	High	50d	Dependabot, Wiz	GHSA-73wf-gq98-2v4g
js-yaml	npm	Patch (lockfile)	4.3.1 → 4.3.2	High	43d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
source-map-js	npm	Patch (lockfile)	1.2.1 → 1.2.2	High	20d	Dependabot	GHSA-68fv-2mgg-jv7q
dompurify	npm	Minor (lockfile)	3.2.4 → 3.4.13	Medium	236d (oldest)	Dependabot, Wiz	GHSA-55q2-fjhq-7xh7, GHSA-cmwh-pvxp-8882, GHSA-76mc-f452-cxcm, GHSA-rp9w-3fw7-7cwq, GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676, GHSA-39q2-94rc-95cp, GHSA-crv5-9vww-q3g8, GHSA-h7mw-gpvr-xq4m, GHSA-v9jr-rg53-9pgp, GHSA-cj63-jhhr-wcxv, GHSA-cjmm-f4jc-qw8r, GHSA-h8r8-wccr-v5f2, GHSA-v2wj-7wpq-c8vv, GHSA-v8jm-5vwx-cfxm
uuid	npm	Removed (via launchdarkly-js-client-sdk 3.4.0 → 3.9.2, minor)	8.3.2 → not in tree	Medium	157d	Dependabot, Wiz	GHSA-w5hq-g745-h8pq
react-router (nested under react-router-dom 6)	npm	Patch (override react-router-dom 6.30.1 → 6.30.4)	6.30.1 → 6.30.4	Medium	291d (oldest)	Dependabot, Wiz	GHSA-2j2x-hqr9-3h42, GHSA-9jcx-v3wj-wh4m
brace-expansion	npm	Patch (lockfile, two lines)	1.1.18 → 1.1.21, 2.1.4 → 2.1.7	Medium	20d	Dependabot	GHSA-q2hr-2g5m-vwhr

Notes:

• go get golang.org/x/mod@v0.40.0 plus go mod tidy also moves golang.org/x/{tools,net,sync,sys,term,text}.
• launchdarkly-js-client-sdk is used only for types in the UI.
• This PR conflicts on one line with fix: override react-router-dom to 7.18.2 in dev-server UI #825, the overrides.react-router-dom entry (6.30.4 here, 7.18.2 there). If you accept fix: override react-router-dom to 7.18.2 in dev-server UI #825, keep 7.18.2.

Deferred / excluded findings

• Handled in the other PRs of this set — vitest 3.2.7 → 4.1.11 (removes the Critical tinypool 1.1.1) and github.com/getkin/kin-openapi 0.144.0 → 0.149.0 in fix: bump vitest to 4.1.11 (drops Critical tinypool) and kin-openapi to 0.149.0 #824. react-router-dom override → 7.18.2 for GHSA-337j-9hxr-rhxg and GHSA-wrjc-x8rr-h8h6 in fix: override react-router-dom to 7.18.2 in dev-server UI #825.
• Still within the 7-day hold (first seen on or after 2026-10-19):
  • vite 6.4.3 → 6.4.4, High/Medium, 5–6d (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22). Dependabot, Wiz.
  • @vitest/mocker / vitest < 4.1.12, Medium, 5d (GHSA-qxg6-89mg-rqv8). Dependabot.
  • dompurify → 3.4.17, High, 3d (Wiz, first seen 2026-10-23).
• No fix version available yet — Wiz "End-of-Life Version of Library" Mediums on transitive @launchpad-ui/* packages under @launchpad-ui/core 0.49.22, and whatwg-encoding. dompurify GHSA-x4vx-rjvf-j5p4 (Low) has no fix.
• Excluded — requires a source/code change to build — @launchpad-ui/core 0.49.22 → 0.56.8 (a 0.x major, imported in 13 places). The real fix is for the owning team to move from @launchpad-ui/core to @launchpad-ui/components.
• Ignored (Low) — @babel/core 7.29.0 (GHSA-4x5r-pxfx-6jf8), vite GHSA-9jrq-w75r-8gcw, and the Low-only dompurify advisories.

Verification

Re-run on 2026-10-26 after a merge of current main. Local tools: Node v24.19.0, npm 11.21.1, Go 1.26.10 (the toolchain in go.mod).

• Install: ✅ (npm ci in internal/dev_server/ui, go mod tidy makes no changes)
• Build: ✅ (npm run build, go build ./...)
• Tests: ✅ (npm test, go test ./... with the sandbox LD_* env vars unset)
• Lint: ✅ (npm run lint, go vet ./..., pre-commit hooks passed on the merge commit)

Written by Devin

Open in Devin Desktop: https://app.devin.ai/desktop/session/db4ffaacfbb14aa99a113cf588967538?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[ld-ahartmann]

i suppose