Repository navigation
fix: bump vulnerable npm dependencies (tar, axios, form-data, brace-expansion, js-yaml, fast-uri, ip-address, and more) - #172
Open
devin-ai-integration[bot] wants to merge 5 commits into
Conversation
…xpansion, js-yaml, fast-uri, ip-address, qs, browserslist, @xmldom/xmldom, baseline-browser-mapping) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Contributor
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…d brace-expansion to 1.1.21/2.1.7/5.0.12 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency vulnerability fixes (automated)
Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.
Warning
We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.
Findings addressed
How: direct deps
axios^1.20.0andform-data^4.0.6. The existingresolutionsfloors are raised:handlebars >=4.7.10,axios ^1.20.0,fast-uri >=4.1.5,@xmldom/xmldom >=0.9.12,tar >=7.5.21,qs >=6.16.0,ip-address >=10.7.1. The remaining transitives (brace-expansion,js-yaml,browserslist,baseline-browser-mapping) are moved within their existing semver ranges inyarn.lockonly. Each lockfile entry pins the smallest version that clears every eligible advisory, not the latest release (for exampleip-address10.7.1, not 10.7.4, andfast-uri4.1.5, not 4.2.2).browserslist4.28.7 needs newercaniuse-lite(1.0.30001806),electron-to-chromium(1.5.393) andnode-releases(2.0.51); those are also pinned to the minimum satisfying version.2026-10-12 update: the branch was already current with
main. Findings that were inside the 7-day hold on 2026-10-05 are now eligible and have been added:fast-uri4.1.3 → 4.1.5ip-address10.3.1 → 10.7.1axios1.18.0 → 1.20.0 (itsform-datadependency floor moves to^4.0.6, which is already locked)brace-expansion→ 1.1.21 / 2.1.7 / 5.0.12The Wiz MCP server returned errors for the whole of this run. The Wiz-sourced CVE IDs and fix versions above are therefore carried over from the 2026-10-05 Wiz reconcile and were not re-queried today. Those findings were already open on 2026-10-05, so each is now more than 7 days old.
2026-10-19 update: the branch was already current with
main(0 commits behind). Added the new Criticalhandlebars4.7.9 → 4.7.10 (resolution floor raised from>=4.7.9to>=4.7.10;handlebarscomes in through the@twbs/fantasticondevDependency). Every other alert in the table is already cleared on this branch. The Wiz MCP server failed again this run, so no new Wiz-only findings were checked.Deferred / excluded findings
uuid8.3.2 → 11.1.1 (Medium, GHSA-w5hq-g745-h8pq, transitive vianyc→istanbul-lib-processinfo, which pins^8.3.2) is in the major-batch PR fix: override transitive uuid 8.3.2 -> 11.1.1 (major, dev-only via nyc) #173.braces,http-cache-semantics.eslint8.55.0 → 10,sinon17.0.2 → 18,glob7.x/8.x/10.x → 12,rimraf2.x/3.x → 4.3.1 (transitive under@twbs/fantasticon,mocha, etc.). Each one needs a major upgrade of the repo's dev tooling (for example ESLint flat config) or of the parent package, so they're left for the owning team.@tootallnate/once< 2.0.1 (GHSA-vpq2-c234-7xj6),diff7.0.0 (Wiz CVE-2026-24001).Verification
yarn install --frozen-lockfile(Yarn 1.22.22, Node 24.19.0)yarn build:setup && yarn compile(webpack)xvfb-run -a yarn testlocally (VS Code test host, 13 passing)yarn lintandyarn prettier:check. The repo's pre-commit hooks (shellcheck, pre-commit-hooks, prettier, eslint) also ran on the 2026-10-19 commit and passed.