Repository navigation
fix: remediate next, react-server-dom-webpack, bouncycastle, anyio, handlebars and dependency advisories - #757
devin-ai-integration[bot] wants to merge 25 commits into
Conversation
…visories Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
devin-ai-integration
Bot
added
automated-security-deps
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
…manfs/node for security advisories Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…ities Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…erabilities Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
…rity-deps Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> # Conflicts: # e2e/react-native/package.json # package.json # yarn.lock
…pc-js and other transitive deps for security advisories Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
devin-ai-integration
Bot
changed the title
…legacy-ws, fast-copy, postcss-selector-parser, jsdoc, Werkzeug for security advisories Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…jango and RN example transitives Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…astle, Jackson, protobuf, commons-io/compress, jose4j, jdom2) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
![semgrep-code-launchdarkly[bot]](https://avatars.githubusercontent.com/u/8039656?s=60&v=4){kind=small}
| @@ -35017,7 +35462,7 @@ __metadata: | |||
| languageName: node | |||
| linkType: hard | |||
|
|
|||
| "markdown-it@npm:12.3.2, markdown-it@npm:^12.3.2": | |||
| "markdown-it@npm:12.3.2": | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 35465 lists a dependency (markdown-it) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of markdown-it are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. markdown-it is vulnerable to Denial of Service when the typographer option is enabled: the smartquotes rule has quadratic complexity on input with many opening quotes followed by unmatched closing quotes of the other kind, so rendering crafted Markdown can exhaust CPU.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104538, GHSA, CVE
To resolve this comment:
Check if you run markdown-it with -t or --typographer flag via the CLI.
- If you're affected, upgrade this dependency to at least version 14.3.2 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
There was a problem hiding this comment.
Tracked, not fixed in this update: the markdown-it 14.3.2 → 14.3.3 advisories (GHSA-gfr2-rv44-r23c / GHSA-vfgh-jcmw-g37q) were first reported on 2026-10-20, so they are inside the 7-day hold for this 2026-10-26 run and will be picked up next run. The 12.3.2 copy comes from markdownlint ~0.25 (dev tooling) and needs a parent major upgrade, so it is listed under deferred findings in the PR description.
| "markdown-it@npm:^14.2.0": | ||
| version: 14.3.0 | ||
| resolution: "markdown-it@npm:14.3.0" | ||
| "markdown-it@npm:^14.3.1": |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 35480 lists a dependency (markdown-it) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of markdown-it are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. markdown-it processes link reference definitions with an unclosed, multi-line label or title in quadratic time in its block "reference" rule. Passing attacker-controlled Markdown to render() or parse() with default options can block the Node.js event loop (or browser main thread) for many seconds (denial of service). renderInline()/parseInline() do not run the block parser and are not affected; the "zero" preset or md.disable("reference") also avoid the vulnerable rule.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105358, GHSA
To resolve this comment:
Check if you run markdown-it via the CLI.
- If you're affected, upgrade this dependency to at least version 14.3.3 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
There was a problem hiding this comment.
Tracked, not fixed in this update: the markdown-it 14.3.2 → 14.3.3 advisories (GHSA-gfr2-rv44-r23c / GHSA-vfgh-jcmw-g37q) were first reported on 2026-10-20, so they are inside the 7-day hold for this 2026-10-26 run and will be picked up next run. The 12.3.2 copy comes from markdownlint ~0.25 (dev tooling) and needs a parent major upgrade, so it is listed under deferred findings in the PR description.
devin-ai-integration
Bot
changed the title
Dependency vulnerability fixes (automated)
Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26; continues the 2026-09-07, 09-14, 09-21, 09-23, 09-28, 10-01, 10-05, 10-12 and 10-19 updates on this branch.
Change type: Minor/patch version bumps — manifest, lockfile and Gradle
buildscriptconstraint changes, no source edits.Warning
We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging.
Findings addressed
e2e/nextjs-ldexact pin) / 16.4.2~19.2.9, stays on React 19.2)bcprov/bcpkix/bcutil-jdk18on(AGP 8.7.2buildscriptclasspath, RN session-replay + Flutter Android)android/build.gradle(bcprov/bcutil/bcpkix)buildscriptclasspath)android/build.gradlee2e/python-plugin-flask)e2e/python-plugin-flask)e2e/python,sdk/highlight-py)e2e/react-nativelock, npmoverrides)e2e/ruby/rails/demo)e2e/react-native)e2e/react-native)jsdoc4.0.2 → 4.0.5, whose own range is^14.1.0)sdk/highlight-py,sdk/@launchdarkly/observability-python,e2e/python)The
nextchange updates both root resolutions and the observability-next workspace dev dependency, plus its@next/envand platform-specific SWC lock entries. The Rails locks were regenerated with Bundler 2.5.11 under Ruby 3.3.4 usingbundle lock --update mail --conservative; onlymailmoved. The React Native example has an independent npm lockfile; itsjs-yamlfix is in that lockfile and its manifest overrides. Theadm-zipanddevaluerows were added in this run (rootresolutionsraised to^0.6.1/^5.9.2; Yarn resolved devalue 5.9.4, published 2026-09-18, within the repo's 7-day age gate); other rows carry existing branch fixes. Other already-satisfied alerts on this branch includebaseline-browser-mapping2.11.21, the Vite 6.x descriptor at 6.4.3, and the patched 11.xuuidcopy; older parallel copies remain listed below.Rows from
next (15.x / 16.x)through@remix-run/eslint-configwere added in the 2026-10-26 run (rootresolutionsfornext,react-server-dom-webpack,@ungap/structured-clone;next16.4.1 ine2e/nextjs-ldand theobservability-nextdev dependency;@remix-run/eslint-config^2.15.0ine2e/remix; React Nativeoverrides@babel/runtime,@babel/helpers,glob@10;poetry update ... --lockwith Poetry 2.3.4 for the Flask example and 2.2.1 for the others, matching each lock header; aconstraints {}block in the two Androidbuildscriptdependency blocks).Rows from
compressionthroughWerkzeugwere added in the 2026-10-19 run (rootresolutions:compression,source-map-js,fast-copy,@fastify/busboy@^3.1.1,@graphql-tools/executor-legacy-ws@^1.0.0/^1.1.27,postcss-selector-parser@^7.0.0,jsdoc@^4.0.0; React Nativeoverrides:compression,source-map-js; Werkzeug viapoetry update werkzeug --lockwith Poetry 2.2.1). All new lock entries are ≥7 days old (reponpmMinimalAgeGate: 7dhonoured, no override).Rows from
handlebarsthroughbaseline-browser-mappingwere added in the 2026-10-12 run (rootresolutions/ React Nativeoverridesraised, lockfiles regenerated; urllib3 viapoetry update urllib3 --lockwith Poetry 2.2.1, matching the existing lock headers).Deferred / excluded findings
^1.2.1ranges declared bymetro0.81–0.83 andless(rootyarn.lockande2e/react-native). Needs parent upgrades / owner review.OpenTelemetrycore ≥ 1.16.0, i.e. moving the whole .NET Framework 4.8 OTel stack (1.9–1.11 → 1.16) ine2e/dotnet4/csplus csproj HintPaths; overlaps Dependabot #513, #509, #496. Needs owner-led stack upgrade; can't be built on this Linux machine.go 1.26directive in published Go modules (toolchain is 1.26.10, but thegodirective is 1.25.0).^2.0.1); a direct cross-major override would bypass those parents' compatibility ranges.rrwebsubmodule. Do not mix breaking migrations into a manifest-only fix.mainby #788 (netty-bom 4.1.137.Final); not duplicated here.observability-android/lib,mobile-dotnet/.../LDObserve,e2e/androidbuild.gradle.kts); okio-jvm 3.0.0 → 3.4.0, opentelemetry-api 1.24.0 → 1.62.0 (sdk/highlight-javaPOMs)log.KeyValue/log.Valueused bygo/internal/otel/custom_sampler.go,sdk/highlight-go/otel.goand theotelslog/otellogruscontrib bridges; needs source changes and coordinated contrib upgrades by the owning team.e2e/nestjs), fsspec 2025.5.1 → 2026.9.0 (incl.e2e/python-plugin-flask), golang.org/x/crypto 0.55.0@graphql-codegen/cli7,eslint-plugin-sveltein therrwebsubmodule, the OTel JS 0.203 → 0.22x stack in the published Node SDKs, OTel JS 1.x → 2.x); owner-led.sqlite3 ~> 1.4(major bump); Ruby 3.3.4 images can't be pulled here (Docker blob CDN blocked) to verify.mainwere reconciled with 347 open Dependabot alerts.braces"11.0.6/30.x",node-forge"13.10.0",uuid"55.0.0",@grpc/grpc-js"12.0.0")No new PR group was deferred solely by the three-new-PR cap; this PR is an update to an existing security dependency PR.
Verification
Re-run on 2026-10-26 after merging
main(clean merge) and adding the 2026-10-26 rows:PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --mode=skip-build(repo 7-day npm age gate respected); ✅yarn dedupe --check; React Native lock regenerated withnpm@11 install --package-lock-only --ignore-scriptsin a temp copy (workspace dep removed) and re-indented with tabs.yarn build:sdk(22/22).yarn test --continue --filter='!aws-lambda'(79/79 tasks: build → lint → enforce-size → test; Prisma client generated first).aws-lambdaneeds the AWSsamCLI, not installed here.yarn test);yarn format-checkonly flags untracked build outputs (react-native-ld-session-replay/lib/*,e2e/functions/lib,next-env.d.ts); Huskypretty-quick --stagedran on each commit.buildEnvironmentfor both Androidbuildscriptblocks resolves every constrained module to the patched version (BC 1.86, protobuf-java 3.25.5, commons-io 2.15.1, commons-compress 1.26.0, jose4j 0.9.6, jdom2 2.0.6.1; jackson is not on the AGP 8.7.2 classpath, so that constraint is a no-op guard). ✅:plugin:assembleDebugof the Flutter pluginandroid/project under a root that applies AGP 8.13.2 / Kotlin 2.2.20 with Gradle 8.14.3 (the example app's versions) passes with and without the constraints. Maven Central rate-limited this machine (HTTP 429), so dependencies were resolved through the Google Cloud Storage Maven Central mirror.Build Example (Android)(Flutter): ❌ on this head. The job log is not downloadable from this machine, and the failure did not reproduce in the local Gradle build above. The workflow only runs whensdk/flutter/**changes; it last passed onmainon 2026-10-07, before Flutter stable 3.47.8 (2026-10-22) and theubuntu-latest→ Ubuntu 26 runner migration. A maintainer should check the job log; if the constraints are the cause, drop the Flutterconstraints {}block and keep the session-replay one (itsAndroid build (legacy arch, RN 0.78)job passed).Re-run on 2026-10-19 after merging
main(clean merge) and adding the rows above:PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build(default 7-day age gate); ✅yarn dedupe --check; ✅yarn format-check.yarn build:sdk.yarn test --continue --filter='!aws-lambda'(79/79 tasks: build → lint → enforce-size → test across the monorepo).aws-lambda#buildneeds the AWSsamCLI, which isn't installed here (unrelated to this change).yarn test); Huskypretty-quick --stagedran on the commit.Re-run on 2026-10-12 after merging
main(conflicts inpackage.json,e2e/react-native/package.json,yarn.lockresolved keeping the higher of both sides' pins):PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build(default 7-day age gate); ✅yarn dedupe --check.yarn build:sdk(22/22).yarn turbo run test --filter './sdk/*' --filter './sdk/@launchdarkly/*'(52/52 tasks).yarn lint(50/50); ✅prettier --checkon changed manifests/lockfiles (Huskypretty-quick --stagedalso ran on each commit).handlebars4.7.10 was published 2026-10-05 (6.6 days before this run); it is a Critical fix, so the lock was resolved with a 6-day local age gate. Other new lock entries are ≥7 days old.Re-run on 2026-10-05 after merging
main(clean merge) and adding the piscina/proxy-addr/rubyzip bumps:piscinaandproxy-addrare fixed via rootresolutions("piscina": "^4.9.4","proxy-addr": "^2.0.8"); the lockfile diff is limited to those two entries (proxy-addr is a transitive ofexpress4.22 / 5.x).rubyzipine2e/ruby/rails/demo/Gemfile.lockwas moved to 3.4.0 (no runtime deps; same version already indemo-rails70). Ruby 3.3.4 isn't available here (Docker Hub blob CDN blocked), so the edit was cross-checked with a Bundler 2.4bundle lockre-resolve, which kept rubyzip at 3.4.0 and changed nothing else apart from Bundler-version platform naming. CI's Rails E2E, Rails Example App, and Dockerized Ruby jobs all pass on this head.PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build(no age-gate override needed).yarn build:sdk(20/20).yarn turbo run test --filter './sdk/*' --filter './sdk/@launchdarkly/*'(50/50 tasks).yarn lint(49/49); ✅prettier --check package.json(equivalent of the Huskypretty-quick --stagedhook).2026-10-01: merged
main(includes #788). The Netty pin briefly added here was removed because it duplicated #788; this PR no longer touches anybuild.gradlefile.Re-run on 2026-09-28 after merging
main(clean merge) and adding the adm-zip/devalue bump:PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build(no age-gate override needed this run).yarn build:sdk(20/20 SDK packages).yarn turbo run test --filter '@launchdarkly/*' --filter highlight.run(27/27 tasks).yarn lint(49/49 tasks); ✅prettier --check package.json(equivalent of the Huskypretty-quick --stagedhook).bundle exec rails test(API-only 3 tests/5 assertions), React Native 111 tests,@highlight-run/next15/15; rootyarn teststill stops on Angular's blockedfonts.googleapis.com.Previous CI on head
2be2bd1e7: 36/37 checks pass. The only red check,Require additional human oversight on bot PRs, is an expectedaction_requiredhuman approval gate, not a code failure. Reviewers:team-observability(CODEOWNERS) andteam-product-security.