[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26.
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
react-router (nested under react-router-dom 6)	npm	Major (override react-router-dom 6.30.1 → 7.18.2)	6.30.1 → 7.18.2	Medium	95d	Dependabot, Wiz	GHSA-337j-9hxr-rhxg, GHSA-wrjc-x8rr-h8h6

Notes:

• Only @launchpad-ui/components@0.4.4 and @launchpad-ui/navigation@0.12.46 pull in react-router-dom 6.x. The app already uses react-router 7.18.2. GHSA-337j and GHSA-wrjc have no fix on the 6.x line, so the overrides.react-router-dom entry moves the transitive copy across a major.
• The built dist/ does not change. Please do a check of navigation in the dev-server UI.
• This PR conflicts on one line with fix: bump vulnerable minor/patch dependencies (x/net, x/mod, js-yaml, browserslist, source-map-js, dompurify, uuid, react-router, brace-expansion) #823 (the same overrides.react-router-dom line, which is 6.30.4 there). If you accept this PR, keep 7.18.2.

Deferred / excluded findings

• Handled in the other PRs of this set — the minor/patch batch fix: bump vulnerable minor/patch dependencies (x/net, x/mod, js-yaml, browserslist, source-map-js, dompurify, uuid, react-router, brace-expansion) #823 and vitest 3.2.7 → 4.1.11 plus kin-openapi 0.149.0 in fix: bump vitest to 4.1.11 (drops Critical tinypool) and kin-openapi to 0.149.0 #824 (which also removes the Critical tinypool 1.1.1).
• Still within the 7-day hold (first seen on or after 2026-10-19):
  • vite 6.4.3 → 6.4.4, High/Medium, 5–6d (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22). Dependabot, Wiz.
  • @vitest/mocker / vitest < 4.1.12, Medium, 5d (GHSA-qxg6-89mg-rqv8). Dependabot.
  • dompurify → 3.4.17, High, 3d (Wiz, first seen 2026-10-23).
• No fix version available yet — Wiz "End-of-Life Version of Library" Mediums on transitive @launchpad-ui/* packages under @launchpad-ui/core 0.49.22, and whatwg-encoding. dompurify GHSA-x4vx-rjvf-j5p4 (Low) has no fix.
• Excluded — requires a source/code change to build — @launchpad-ui/core 0.49.22 → 0.56.8 (a 0.x major, imported in 13 places). The real fix is for the owning team to move from @launchpad-ui/core to @launchpad-ui/components.
• Ignored (Low) — @babel/core 7.29.0 (GHSA-4x5r-pxfx-6jf8), vite GHSA-9jrq-w75r-8gcw, and the Low-only dompurify advisories.

Verification

Re-run on 2026-10-26 after a merge of current main. Local tools: Node v24.19.0, npm 11.21.1, Go 1.26.10 (the toolchain in go.mod).

• Install: ✅ (npm ci in internal/dev_server/ui, go mod tidy makes no changes)
• Build: ✅ (npm run build, go build ./...)
• Tests: ✅ (npm test, go test ./... with the sandbox LD_* env vars unset)
• Lint: ✅ (npm run lint, go vet ./..., pre-commit hooks passed on the merge commit)

Written by Devin

Open in Devin Desktop: https://app.devin.ai/desktop/session/db4ffaacfbb14aa99a113cf588967538?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[ld-ahartmann]

sure