[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-11-02.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
handlebars (direct devDependency)	npm	Patch	4.7.9 → 4.7.10	Critical	16d	Dependabot, Wiz	GHSA-8r5x-fm3f-whwj, GHSA-p8wg-vrv2-v86f, GHSA-xw65-4hp5-5hc7
proxy-addr (transitive via express)	npm	Patch	2.0.7 → 2.0.8	Critical	30d	Dependabot, Wiz	CVE-2026-90711 / GHSA-jqcg-44mw-7w3h
js-yaml	npm	Minor	3.13.1 → 3.15.2	High	349d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
glob	npm	Minor	10.3.0 → 10.5.0	High	348d	Dependabot, Wiz	GHSA-5j98-mcp5-4vw2 (CVE-2025-64756)
minimatch	npm	Patch	3.1.2 → 3.1.5, 9.0.1 → 9.0.9	High	247d	Dependabot, Wiz	GHSA-7r86-cg39-jmmj (CVE-2026-27903)
brace-expansion	npm	Patch	1.1.11 → 1.1.21, 2.0.1 → 2.1.7	High	105d	Dependabot, Wiz	GHSA-3jxr-9vmj-r5cp, GHSA-q2hr-2g5m-vwhr
browserslist	npm	Minor	4.24.0 → 4.29.0	High	60d	Dependabot, Wiz	GHSA-73wf-gq98-2v4g
qs	npm	Minor	6.15.2 → 6.16.0	Medium	60d	Dependabot, Wiz	GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx

package.json: only the handlebars devDependency floor moved from ^4.7.9 to ^4.7.10. Everything else is a lockfile-only change within existing semver ranges. handlebars 4.7.10 also moves its minimist dependency from 1.2.6 to 1.2.8. The branch is up to date with main. Dependabot and Wiz were re-queried on 2026-11-02.

Deferred / excluded findings

• Still within the 7-day hold: body-parser (transitive via express) 2.2.2 → 2.4.0, High, 6d (GHSA-27r3-jxmh-p828 / CVE-2026-111181; Wiz first seen 2026-10-27). It will be added to this PR on the next run. Dependabot Bump body-parser from 2.2.2 to 2.3.0 in the npm_and_yarn group across 1 directory #135 (→ 2.3.0) fixes only the Low GHSA-v422-hmwv-36x6 and does not reach 2.4.0.
• Low-severity alerts (@babel/core GHSA-4x5r-pxfx-6jf8, body-parser GHSA-v422-hmwv-36x6) are out of scope for this automation.

Verification

Re-run on 2026-11-02 with Node 24.19 and npm 10.8.3:

• Install: ✅ npm ci
• Build: ✅ npm run build (no generated-file changes), npm run build:server
• Tests: ✅ npx jest --ci: 6 suites, 2489 tests passed
• Lint: ✅ npm run prettier:check

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring