[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-11-09.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

These are the alerts still open on main as of 2026-11-09. Each one is in both evals/package-lock.json and tests/package-lock.json unless noted.

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
js-yaml (4.x, evals/ direct dev dep)	npm	Patch	4.3.1 → 4.3.2	High	57d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
@azure/msal-node (nested under @azure/identity)	npm	Patch (via @azure/identity 4.14.0 → 4.14.1)	6.0.1 → 7.1.0	High	14d	Dependabot, Wiz	GHSA-xcx6-jx8p-x3h5
node-forge	npm	Patch	1.4.0 → ≥1.4.1 (resolves 1.4.3)	High	26d	Dependabot, Wiz	GHSA-5x38-2vff-x55p, GHSA-8hrf-8g6f-7xwp, GHSA-jc66-7q78-782g, GHSA-525v-9gp9-w22h, GHSA-5cwg-6vw7-rj6p, GHSA-6wvx-3r32-xmcg (plus the Low ones)
ip-address	npm	Minor	10.5.0 → ≥10.7.1 (resolves 10.7.4)	Moderate	41d	Dependabot, Wiz	GHSA-2vr4-cq9g-pvrc, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q
brace-expansion	npm	Patch	5.0.9 → 5.0.12	Moderate	26d	Dependabot, Wiz	GHSA-q2hr-2g5m-vwhr
fast-uri	npm	Patch	3.1.8 → 3.1.9	Moderate	14d	Dependabot, Wiz	GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr (plus Low GHSA-333x-w4r6-6crp, GHSA-xhq7-xmqj-769h)
@hono/node-server	npm	Patch	2.1.1 → ≥2.1.3 (resolves 2.1.6)	Moderate	11d	Dependabot, Wiz	GHSA-rmxm-3fg6-px4f

All findings are dev-only and come in transitively through promptfoo in the evals/ and tests/ eval harnesses. They are pinned with npm overrides, and the lockfiles were regenerated with npm install --legacy-peer-deps, the same flags CI uses.

Notes:

• @azure/msal-node is a major bump for the nested copy only. It is reached by moving @azure/identity (from @azure/ai-projects) from 4.14.0 to the 4.14.1 patch, which itself requires @azure/msal-node ^7.1.0. The top-level msal-node was already at 7.1.0.
• promptfoo 0.124.x pins @hono/node-server to exactly 2.1.1. The override lifts it within 2.x and avoids the promptfoo 0.125 bump in Dependabot chore(deps): bump @hono/node-server and promptfoo in /tests #232/chore(deps): bump @hono/node-server and promptfoo in /evals #233.
• The age for node-forge uses the oldest first-seen date for that package in each lockfile: 2026-10-14 (Dependabot) and 2026-10-15 (Wiz), from GHSA-86w9-cpqp-85rv, which has no fix yet. The advisories fixed in 1.4.1 were first seen on 2026-11-04 (Dependabot) and 2026-11-05 (Wiz).
• The earlier overrides on this branch (proxy-addr, adm-zip, axios, sharp, undici@7, hono, csv-parse, js-yaml@5) stay in place as floors. Their alerts are already closed.

Refreshed 2026-11-09: merged current main (9 commits) cleanly and added the @azure/identity, @hono/node-server, fast-uri and node-forge overrides. This PR supersedes Dependabot #175, #182, #191, #203, #217, #227, #232, #233, #236 and #239. Dependabot-authored PRs can't pass the Evaluate * jobs because they can't read the eval secrets.

Deferred / excluded findings

• Still within the 7-day hold: minimatch 10.2.5 → 11.0.1 (Moderate, GHSA-g3hv-75wg-m249, first seen 2026-11-04 by Dependabot and 2026-11-05 by Wiz). This is a major bump; promptfoo, glob and @modelcontextprotocol/server-filesystem all require minimatch ^10.
• No fix version available yet: node-forge GHSA-86w9-cpqp-85rv (High, <= 1.4.0, no patched version listed).
• Low severity (out of scope): the Low fast-uri and node-forge advisories are cleared by this PR anyway.

Verification

• Install: ✅ npm ci --legacy-peer-deps in evals/ and tests/
• Build: n/a (no build step). promptfoo --version loads cleanly in tests/.
• Tests: ✅ python3 scripts/validate_skills.py (56 skills), python3 -m unittest discover -s tests (10 tests), python3 scripts/generate_catalog.py --check, cd evals && npm test (157 pass, 0 fail)
• Lint: n/a (no lint configured)

---

Note

Overview
Bumps dev-only dependencies for the evals/ and tests/ promptfoo harnesses by raising direct js-yaml to 4.3.2 and expanding npm overrides so transitive packages resolve to patched versions: @azure/identity (pulls @azure/msal-node 7.x), @hono/node-server, node-forge, ip-address, brace-expansion, fast-uri, plus refreshed floors for several existing overrides.

Lockfiles in both packages were regenerated to match; there are no application source changes.

^{Reviewed by Cursor Bugbot for commit 2b541c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	100/100 (4/4)	no change
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
aws-devops-agent/experiment-orchestration	-	100/100 (9/9)	new
experiments/launchdarkly-experiment-guide	-	100/100 (5/5)	new
experiments/launchdarkly-experiment-hypothesis-builder	-	100/100 (13/13)	new
experiments/launchdarkly-experiment-setup	-	100/100 (8/8)	new
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	80/100 (4/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	94/100 (16/17)	new
onboarding	-	100/100 (7/7)	new
release-autopilot/launchdarkly-release-autopilot-onboarding	-	100/100 (25/25)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e0b854e. Configure here.}

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session