[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26.
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
tinypool (transitive of vitest 3)	npm	Removed (vitest 4 does not use it)	1.1.1 → not in tree	Critical	20d	Dependabot	GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr
vitest (devDependency)	npm	Major	3.2.7 → 4.1.11	Medium	45d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9
@vitest/mocker	npm	Major (transitive of vitest)	3.2.7 → 4.1.11	Medium	46d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9
github.com/getkin/kin-openapi	Go	Major (0.x)	0.144.0 → 0.149.0	High	9d	Dependabot, Wiz	GHSA-23vg-4cjm-66q5, GHSA-74vm-87hj-r66f, GHSA-fh4f-47mf-f2gj, GHSA-g8cf-rcjf-c8cf, GHSA-mh7x-f8wq-4jhx, GHSA-rj39-cv6w-8wv7, GHSA-vrcc-3ch7-hppw

Notes:

• vitest is a dev and test dependency only. No test or config changes were necessary. vitest 4 requires Node ^20 || ^22 || >=24 and vite ^6 || ^7 || ^8.
• The tinypool advisories have no fix on the 1.x line that vitest 3 requires. vitest 4 drops tinypool, so this PR is the fix for the Critical alerts.
• kin-openapi 0.149.0 also moves github.com/santhosh-tekuri/jsonschema/v6 to 6.0.3. The generated file internal/dev_server/api/server.gen.go is not regenerated. It builds and its tests pass on 0.149.0. A full make generate with a newer oapi-codegen renames fields (for example Id, LastSyncedFromSource) and needs source changes, so this PR does not do it.

Deferred / excluded findings

• Handled in the other PRs of this set — the minor/patch batch fix: bump vulnerable minor/patch dependencies (x/net, x/mod, js-yaml, browserslist, source-map-js, dompurify, uuid, react-router, brace-expansion) #823 (x/net, x/mod, js-yaml, browserslist, source-map-js, dompurify, uuid, react-router 6.30.4, brace-expansion) and the react-router-dom override → 7.18.2 in fix: override react-router-dom to 7.18.2 in dev-server UI #825.
• Still within the 7-day hold (first seen on or after 2026-10-19):
  • vite 6.4.3 → 6.4.4, High/Medium, 5–6d (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22). Dependabot, Wiz.
  • @vitest/mocker / vitest < 4.1.12, Medium, 5d (GHSA-qxg6-89mg-rqv8). Dependabot.
  • dompurify → 3.4.17, High, 3d (Wiz, first seen 2026-10-23).
• No fix version available yet — Wiz "End-of-Life Version of Library" Mediums on transitive @launchpad-ui/* packages under @launchpad-ui/core 0.49.22, and whatwg-encoding. dompurify GHSA-x4vx-rjvf-j5p4 (Low) has no fix.
• Excluded — requires a source/code change to build — @launchpad-ui/core 0.49.22 → 0.56.8 (a 0.x major, imported in 13 places). The real fix is for the owning team to move from @launchpad-ui/core to @launchpad-ui/components.
• Ignored (Low) — @babel/core 7.29.0 (GHSA-4x5r-pxfx-6jf8), vite GHSA-9jrq-w75r-8gcw, and the Low-only dompurify advisories.

Verification

Re-run on 2026-10-26 after a merge of current main. Local tools: Node v24.19.0, npm 11.21.1, Go 1.26.10 (the toolchain in go.mod).

• Install: ✅ (npm ci in internal/dev_server/ui, go mod tidy makes no changes)
• Build: ✅ (npm run build, go build ./...)
• Tests: ✅ (npm test, go test ./... with the sandbox LD_* env vars unset)
• Lint: ✅ (npm run lint, go vet ./..., pre-commit hooks passed on the merge commit)

Written by Devin

Open in Devin Desktop: https://app.devin.ai/desktop/session/db4ffaacfbb14aa99a113cf588967538?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[ld-ahartmann]

why not