[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26; continues the 2026-10-19 update on this branch.
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency-Vulnerability-Remediation-with-Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
toml	npm	Major (forced transitive, root resolutions "toml@^3.0.0": "^4.2.0"; parent remark-mdx-frontmatter 1.1.1 via @remix-run/dev)	3.0.0 → 4.3.0	High	45d	Dependabot	GHSA-82x6-q7mm-w9cf, GHSA-v5mp-jgw5-2x6j
basic-ftp	npm	Major (existing root resolution "basic-ftp" raised ^5.3.1 → ^6.2.1; parent get-uri 6.0.1 in the puppeteer proxy chain)	5.3.1 → 6.2.3	High	17d	Dependabot	GHSA-c475-qrg2-pj4r
@fastify/busboy (1.x copy)	npm	Major (parent firebase-admin ^11.5.0 → ^12.7.0 and firebase-functions-test ^3.0.0 → ^3.2.0 in e2e/functions)	1.2.1 → 3.2.3	High	13d	Dependabot	GHSA-gxm5-99cw-xjw9, GHSA-x8mw-p69m-v3mx, GHSA-xjh9-v7x6-24jw
@nestjs/core	npm	Major (e2e/nestjs: @nestjs/common/core → ^11.1.18, platform-express → ^11.1.18, axios → ^4.0.1, cli → ^11.0.0, schedule → ^5.0.1, schematics → ^11.0.0, swagger → ^11.0.0; root resolution @nestjs/common → ^11.1.18; sdk/highlight-nest devDependency @nestjs/common → ^11.1.18, its peer range @nestjs/core >=10 is unchanged)	10.4.22 → 11.2.7	Medium	196d	Dependabot	GHSA-36xv-jgw5-4q75
file-type	npm	Major (via @nestjs/common 10 → 11, above)	20.4.1 → 21.3.4	Medium	222d	Dependabot	GHSA-5v7r-6r5c-r473, GHSA-j47w-4g3g-c36v
fsspec	pip	Major (CalVer year; transitive of huggingface-hub >=2023.5.0, poetry update fsspec --lock with Poetry 2.2.1)	2025.5.1 → 2026.9.0	High	13d	Dependabot	GHSA-27vj-qcqg-25rc
fsspec (e2e/python-plugin-flask)	pip	Major (CalVer year; poetry update fsspec --lock with Poetry 2.3.4, matching the lock header)	2025.5.1 → 2026.9.0	High	19d	Wiz	CVE-2026-104851
golang.org/x/crypto (e2e/go, e2e/go-plugin, sdk/highlight-go)	go	Major (0.x leading component; go get golang.org/x/crypto@v0.55.0 && go mod tidy, drags x/net 0.57.0, x/sys 0.47.0, x/text 0.41.0, x/sync 0.22.0; go directive stays 1.25.0)	0.52.0 → 0.55.0	High	47d	Wiz	CVE-2026-56854

No application or SDK source files are changed. sdk/highlight-nest (published as @highlight-run/nest) only has a devDependency change, so its runtime/peer contract is unchanged. All new lock entries are ≥7 days old (repo npmMinimalAgeGate: 7d honoured, no override).

Deferred / excluded findings

Minor/patch fixes from this run are in the existing security PR #757.

Package	Reason
pacote 20.0.0 → 21.5.1 (High)	Pinned exactly by @angular/cli 19.2.x; needs the e2e/angular Angular 19 → 20 migration (owner-led).
image-size 1.2.1 → 2.0.3 (High)	No 1.x fix; metro and less declare ^1 (root and e2e/react-native). Upstream-blocked.
@graphql-tools/utils 8.x–11.x (High)	Needs @graphql-codegen/cli 7 / codegen stack upgrade that regenerates SDK GraphQL types; owner-led.
go.opentelemetry.io/otel/sdk/log 0.21.0 (Medium, 5 Go modules)	Breaking API change; needs source changes in go/ and sdk/highlight-go.
@opentelemetry/instrumentation-* (pg, mysql, mysql2, knex, mongoose, oracledb, tedious, cassandra-driver), @opentelemetry/core 1.30.1 (Medium)	Fixed versions require moving the published Node SDKs' OTel JS stack (@opentelemetry/instrumentation/sdk-node 0.203 → 0.22x, OTel JS 1.x → 2.x); owner-led.
react-router 7.x (Medium), uuid, decode-uri-component, fast-xml-parser, ts-deepmerge, postcss-selector-parser 6.x, svelte 4.x, nanoid	Need parent-framework migrations (Remix → React Router 7, React Native CLI, query-string, firebase-functions-test latest still ^2.0.1) or live in the rrweb submodule.
sqlite3 gem 1.7.3 → 2.9.6 (Medium)	Gemfiles pin ~> 1.4; Ruby 3.3.4 images can't be pulled on this machine to verify.
github.com/labstack/echo/v4, pytest, OpenTelemetry .NET packages	Covered by Dependabot #748, #746, #513/#509/#496; OpenTelemetry.Resources.Host needs the whole .NET OTel stack ≥ 1.16.
golang.org/x/crypto 0.56.0 (High)	Requires a go 1.26 directive in the published Go modules; owner decision.
glob 12, rimraf 4, eslint 10, puppeteer 24, @graphql-tools/prisma-loader 9, com.squareup.wire:wire-runtime 6 (Wiz, Medium/High)	Parent-framework / tooling majors (React Native CLI, Remix, GraphQL codegen, AGP); owner-led.
Held (first seen on/after 2026-10-19, not Critical)	klauspost/compress 1.18.7, follow-redirects, launch-editor, markdown-it 14.3.3, vite 6/7/8, @vitest/mocker 4.1.12 — next run.
Wiz reconciliation	Wiz MCP worked on 2026-10-26; 913 open C/H/M Wiz findings reconciled with 347 Dependabot alerts.
Findings without a patched version, Low findings	Excluded by policy.

Verification

Re-run on 2026-10-26 after merging main (clean merge) and adding the x/crypto and Flask fsspec rows:

• Go: ✅ go build ./... + go vet ./... in e2e/go-plugin and sdk/highlight-go; e2e/go has two main packages in one directory (echo.go/fiber.go), so go build ./... fails identically on main (pre-existing). ✅ go test ./... in sdk/highlight-go except log.TestParseConsoleMessages, which fails identically on main (pre-existing).
• Python: ✅ poetry update fsspec --lock (Poetry 2.3.4) — only fsspec moved.
• npm manifests unchanged since the 2026-10-19 verification below; Husky pretty-quick --staged ran on the commit.

Re-run on 2026-10-19:

• Install: ✅ PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --mode=skip-build; ✅ yarn dedupe --check.
• Build: ✅ yarn turbo run build --filter @highlight-run/nest --filter nestjs --filter functions (17/17), plus remix#build inside the test run below.
• Tests: ✅ yarn test --continue --filter='!aws-lambda' (79/79 after generating the Prisma client for e2e-express-ts, which --mode=skip-build skips; aws-lambda#build needs the AWS sam CLI, not installed here).
• Lint: ✅ (part of yarn test, incl. nestjs#lint); Husky pretty-quick --staged ran on the commit.

Reviewer focus: e2e/nestjs (NestJS 11 example) and e2e/functions (firebase-admin 12) are example apps — please smoke-test them; the toml/basic-ftp overrides affect only dev tooling (Remix MDX frontmatter, puppeteer proxy agent).

---

Note

Overview
Manifest-only security remediation that bumps several high/medium advisory packages via direct dependencies, Yarn resolutions, and Poetry lock updates—no application or SDK source changes.

Root Yarn resolutions add toml@^3.0.0 → ^4.2.0 (Remix MDX tooling) and raise basic-ftp to ^6.2.1 (puppeteer proxy chain), plus align @nestjs/common to ^11.1.18 workspace-wide.

The e2e/nestjs example moves the Nest stack to v11 (common/core/platform-express, @nestjs/axios 4, cli/schematics 11, schedule 5, swagger 11). sdk/highlight-nest only updates the devDependency on @nestjs/common; published peer range (@nestjs/core >=10) is unchanged.

e2e/functions upgrades firebase-admin to ^12.7.0 and firebase-functions-test to ^3.2.0 (addresses vulnerable @fastify/busboy transitives). sdk/@launchdarkly/observability-python lockfile bumps fsspec to 2026.9.0.

Reviewer focus: smoke-test e2e/nestjs and e2e/functions; transitive tooling (toml, basic-ftp) affects dev/build paths only.

^{Reviewed by Cursor Bugbot for commit c903924. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
1731	1508	87%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 1e6968f by action🐍

[semgrep-code-launchdarkly]

High severity vulnerability may affect your project—review required:
Line 34792 lists a dependency (markdown-it) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of markdown-it are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. markdown-it is vulnerable to Denial of Service when the typographer option is enabled: the smartquotes rule has quadratic complexity on input with many opening quotes followed by unmatched closing quotes of the other kind, so rendering crafted Markdown can exhaust CPU.

References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104538, GHSA, CVE

To resolve this comment:
Check if you run markdown-it with -t or --typographer flag via the CLI.

• If you're affected, upgrade this dependency to at least version 14.3.2 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[devin-ai-integration]

Tracked, not fixed in this update: the markdown-it 14.3.2 → 14.3.3 advisories (GHSA-gfr2-rv44-r23c / GHSA-vfgh-jcmw-g37q) were first reported on 2026-10-20, so they are inside the 7-day hold for this 2026-10-26 run and will be picked up next run. The 12.3.2 copy comes from markdownlint ~0.25 (dev tooling) and needs a parent major upgrade, so it is listed under deferred findings in the PR description.

Written by Devin