[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-11-09.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
golang.org/x/net	Go	Minor (transitive via x/tools 0.49.0)	0.50.0 → 0.58.0	Critical (Wiz) / Medium (Dependabot)	129d	Dependabot, Wiz	GHSA-5cv4-jp36-h3mw / CVE-2026-25680, CVE-2026-39821
golang.org/x/mod	Go	Minor	0.33.0 → 0.40.0	High	60d	Wiz	CVE-2026-56864, CVE-2026-56865
react-router (nested under react-router-dom 6)	npm	Patch (override react-router-dom 6.30.1 → 6.30.4)	6.30.1 → 6.30.4	Medium	305d (oldest)	Dependabot, Wiz	GHSA-2j2x-hqr9-3h42, GHSA-9jcx-v3wj-wh4m

Notes:

• main now has the earlier UI fixes of this PR (vite 6.4.5, dompurify 3.4.17, js-yaml, browserslist, source-map-js, brace-expansion, launchdarkly-js-client-sdk 3.9.6). This PR drops them.
• go get golang.org/x/mod@v0.40.0 plus go mod tidy also moves golang.org/x/{tools,net,sync,sys,term,text}.
• This PR conflicts on one line with fix: override react-router-dom to 7.18.2 in dev-server UI #825, the overrides.react-router-dom entry (6.30.4 here, 7.18.2 there). If you accept fix: override react-router-dom to 7.18.2 in dev-server UI #825, keep 7.18.2.

Deferred / excluded findings

• Handled in the other PRs of this set — github.com/getkin/kin-openapi 0.144.0 → 0.149.0 in fix: bump kin-openapi to 0.149.0 #824. The react-router-dom override → 7.18.2 for GHSA-337j-9hxr-rhxg and GHSA-wrjc-x8rr-h8h6 in fix: override react-router-dom to 7.18.2 in dev-server UI #825.
• Still within the 7-day hold — None at Medium or higher.
• No fix version available yet — github.com/oapi-codegen/oapi-codegen/v2 2.7.1 (Medium, Wiz, GHSA-q4jc-cx6x-3rqw). Wiz "End-of-Life Version of Library" Mediums on transitive @launchpad-ui/* packages and whatwg-encoding with no fixed version.
• Excluded — requires a source/code change to build — @launchpad-ui/core 0.49.22 → 0.56.8 (Wiz EOL, Medium, 60d). Re-checked on 2026-11-09: 0.56.8 removes Box, Alert, Stack, Inline, Pagination, and CopyToClipboard, so tsc fails in 9 files. The owning team must move from @launchpad-ui/core to @launchpad-ui/components (see Dependabot chore(deps): bump @launchpad-ui/components from 0.4.4 to 0.25.0 in /internal/dev_server/ui #1013 and chore(deps): bump @launchpad-ui/icons from 0.18.13 to 0.26.7 in /internal/dev_server/ui #1015).
• Ignored (Low) — deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, no fix).
• Deferred this run — per-repo new-PR cap reached — None.

Verification

Re-run on 2026-11-09 after a merge of current main. Local tools: Node v24.22.2, npm 11.21.2, Go 1.26.10 (the toolchain in go.mod).

• Install: ✅ (npm ci in internal/dev_server/ui, go mod tidy makes no changes)
• Build: ✅ (npm run build with no dist/ change, go build ./...)
• Tests: ✅ (npm test, go test ./... with the sandbox LD_* env vars unset)
• Lint: ✅ (npm run lint, go vet, pre-commit hooks passed)

Written by Devin

---

Note

Overview
Security-focused dependency-only updates with no application source changes.

Go: Bumps the golang.org/x/* toolchain stack pulled in via go mod tidy—notably golang.org/x/net (0.50.0 → 0.58.0), golang.org/x/mod (0.33.0 → 0.40.0), plus aligned x/term, x/sys, x/sync, x/text, and x/tools—with matching go.sum checksums.

Dev server UI: Raises the npm overrides pin for nested react-router-dom from 6.30.1 → 6.30.4 (and @remix-run/router 1.23.3) in package.json / package-lock.json to clear router advisories without changing direct react-router 7.x usage.

^{Reviewed by Cursor Bugbot for commit 3f08f8c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[ld-ahartmann]

i suppose