fix: remediate handlebars, shell-quote, axios, undici, urllib3 and dependency advisories

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-12; continues the 2026-09-07, 09-14, 09-21, 09-23, 09-28, 10-01 and 10-05 updates on this branch.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
piscina	npm	Patch	4.9.3 → 4.9.4	Critical	3d; no hold	Dependabot, Wiz	GHSA-67c8-pqhq-4rmx (CVE-2026-102992)
proxy-addr	npm	Patch	2.0.7 → 2.0.8	Critical	no hold	Wiz	CVE-2026-90711
rubyzip (e2e/ruby/rails/demo)	rubygems	Minor	3.3.0 → 3.4.0	High	9d	Dependabot	GHSA-47m2-wp7j-p9vc (CVE-2026-85396)
next	npm	Patch	16.3.3 → 16.3.6	Critical	<1d; no hold	Wiz	CVE-2026-94545
anyio (3 Poetry locks)	pip	Minor	4.9.0 → 4.14.2	Critical	4d; no hold	Dependabot, Wiz	GHSA-82r6-8w77-94w6
js-yaml (3.x / 4.x)	npm	Patch	3.15.1 / 4.3.1 → 3.15.2 / 4.3.2	High	14d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
multer	npm	Minor	2.2.0 → 2.4.0	High	14d	Dependabot, Wiz	GHSA-wc9g-mqfw-jrwm; GHSA-535w-7cp7-47q4; GHSA-qfvm-cv95-jqjf
sharp	npm	Patch	0.35.3 → 0.35.4	High	14d	Dependabot	GHSA-rgj7-g3m4-5g8c
smol-toml	npm	Minor	1.6.1 → 1.8.0	High	13d	Dependabot	GHSA-7w5x-hrqm-74c2
hono	npm	Patch	4.13.2 → 4.13.7	Medium	14d	Dependabot	GHSA-gqvv-2mrq-wpjv; GHSA-g6gw-c38x-mqfc; GHSA-crvj-82cr-hjcx
morgan	npm	Minor	1.11.0 → 1.12.1	Medium	14d	Dependabot	GHSA-jxfw-x594-9x9m
react-router / react-router-dom (6.x)	npm	Patch	6.30.4 → 6.30.6	Medium	15d	Dependabot	GHSA-jjmj-jmhj-qwj2
vitest / @vitest/mocker	npm	Patch	4.1.8 → 4.1.11	Medium	14d	Dependabot	GHSA-82fw-gwwq-j7x9
google.golang.org/grpc (6 Go modules)	go	Patch	≤1.83.0 → 1.83.1	High	21d	Dependabot	GHSA-vp52-pcj8-j9qc; GHSA-2v4p-qf9q-27wj
pacote (21.x), browserslist, fast-uri, @xmldom/xmldom	npm	Patch	vulnerable copies → 21.5.1 / 4.28.9 / 3.1.7 / 0.8.15	High	≥14d	Dependabot, Wiz	GHSA-w4pp-8pjf-rmxw; GHSA-c83g-rgw3-j3cx; GHSA-f65p-4m7j-42xc; GHSA-c7q8-3ch8-vqpv
qs, fflate, @humanfs/node, Django	npm, pip	Patch	vulnerable copies → 6.16.0 / 0.4.9, 0.6.11, 0.8.3 / 0.16.8 / 5.2.17, 6.1.1	Medium	≥20d at fix	Dependabot, Wiz	GHSA-x5fp-wj9c-mxmx; GHSA-px8p-9vwx-vf98; GHSA-p498-v437-472g
mail (two Rails locks)	rubygems	Patch	2.9.0 → 2.9.1	Medium	20d	Dependabot	GHSA-mvxr-6m87-mv2q
adm-zip	npm	Patch	0.6.0 → 0.6.1	High	9d	Dependabot, Wiz	GHSA-7q85-xj36-vmfc (CVE-2026-77301)
devalue	npm	Minor	5.8.1 → 5.9.4	Medium	11d	Dependabot, Wiz	GHSA-9rgm-9g3h-6x36 (CVE-2026-81176)
handlebars	npm	Patch	4.7.9 → 4.7.10	Critical	4d; no hold	Dependabot	Dependabot alerts #1586, #1587
shell-quote (root + React Native lock)	npm	Minor	1.10.0 → 1.11.0 (root) / 1.12.0 (RN)	Critical	6d; no hold	Dependabot	Dependabot alerts #1544, #1576
axios	npm	Minor	1.19.0 → 1.20.0	High	12d	Dependabot	Dependabot alerts #1509–#1520
undici (5.x/6.x/7.x copies, root + RN)	npm	Patch	6.28.0 / 7.29.0 → 6.28.1 (root), 6.29.0 (RN) / 7.29.1	High	13d	Dependabot	Dependabot alerts #1440–#1468
brace-expansion (1.x/2.x/5.x, root + RN)	npm	Patch	1.1.18 / 2.1.4 / 5.0.9 → 1.1.21 / 2.1.7 / 5.0.12	High	12d	Dependabot	Dependabot alerts #1474–#1479, #1495–#1503
@grpc/grpc-js	npm	Patch / Minor	1.14.4 → 1.14.5; 1.9.16 → 1.13.6	High	12d	Dependabot	Dependabot alerts #1523, #1524
engine.io	npm	Patch	6.6.9 → 6.6.10	High	12d	Dependabot	Dependabot alert #1494
webpack-dev-middleware	npm	Patch	7.4.2 → 7.4.6	High	13d	Dependabot	Dependabot alert #1455
urllib3 (4 Poetry locks)	pip	Minor	2.7.0 → 2.8.0	High	11d	Dependabot	Dependabot alerts (e2e/python, e2e/tests, observability-python, highlight-py)
ip-address	npm	Minor	10.4.0 → 10.7.3	Medium	13d	Dependabot	Dependabot alerts #1443, #1452, #1505, #1506
markdown-it (14.x copy)	npm	Patch	14.3.0 → 14.3.1	Medium	13d	Dependabot	Dependabot alert #1456
moment	npm	Minor	2.30.1 → 2.31.0	Medium	12d	Dependabot	Dependabot alert #1504
fast-uri (React Native lock)	npm	Patch	3.1.7 → 3.1.8	Medium	12d	Dependabot	Dependabot alert #1480
baseline-browser-mapping	npm	Minor	2.10.37 → 2.11.x	Medium	34d	Dependabot	Dependabot alert #1379

The next change updates both root resolutions and the observability-next workspace dev dependency, plus its @next/env and platform-specific SWC lock entries. The Rails locks were regenerated with Bundler 2.5.11 under Ruby 3.3.4 using bundle lock --update mail --conservative; only mail moved. The React Native example has an independent npm lockfile; its js-yaml fix is in that lockfile and its manifest overrides. The adm-zip and devalue rows were added in this run (root resolutions raised to ^0.6.1 / ^5.9.2; Yarn resolved devalue 5.9.4, published 2026-09-18, within the repo's 7-day age gate); other rows carry existing branch fixes. Other already-satisfied alerts on this branch include baseline-browser-mapping 2.11.21, the Vite 6.x descriptor at 6.4.3, and the patched 11.x uuid copy; older parallel copies remain listed below.

Rows from handlebars through baseline-browser-mapping were added in the 2026-10-12 run (root resolutions / React Native overrides raised, lockfiles regenerated; urllib3 via poetry update urllib3 --lock with Poetry 2.2.1, matching the existing lock headers).

Deferred / excluded findings

Package	Reason
image-size 1.2.1 → 2.0.3 (High, GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr)	No patched 1.x release; the only fix is 2.0.3, a major bump past the ^1.2.1 ranges declared by metro 0.81–0.83 and less (root yarn.lock and e2e/react-native). Needs parent upgrades / owner review.
adm-zip GHSA-vwc7-r8mq-g2x9 (Medium)	No patched version published.
OpenTelemetry.Resources.Host 0.1.0-beta.2 → 1.16.0-beta.2 (High, GHSA-v8pv-4842-x354)	Requires OpenTelemetry core ≥ 1.16.0, i.e. moving the whole .NET Framework 4.8 OTel stack (1.9–1.11 → 1.16) in e2e/dotnet4/cs plus csproj HintPaths; overlaps Dependabot #513, #509, #496. Needs owner-led stack upgrade; can't be built on this Linux machine.
@angular/* 20.3.27, puppeteer 24.x, @grpc/grpc-js "12.0.0" (Wiz)	Angular 19→20 and puppeteer 9/17/20→24 are major framework migrations; Wiz's grpc-js fix version does not exist on npm (latest 1.14.5).
OpenTelemetry.* (.NET Framework 4.8)	Already covered by Dependabot #513, #509, and #496; .NET/NuGet tooling is unavailable on this machine.
github.com/labstack/echo/v4	Already covered by Dependabot #748.
golang.org/x/crypto 0.56.0	Wiz High; 0.x major-version upgrade requires Go 1.26, beyond the repository's current toolchain.
pacote 20.x, toml 3.x, decode-uri-component 0.2.x, file-type 20.x, ts-deepmerge 2.x	Remaining vulnerable transitive versions are pinned by Angular CLI, remark-mdx-frontmatter, query-string/React Navigation, NestJS 10, or firebase-functions-test; a direct cross-major override would bypass those parents' compatibility ranges.
Vite 5.x, nanoid 4.x, Svelte 4.x, React Router 6.x (7.x advisory), NestJS 10.x, OpenTelemetry core 1.x	Require major source/config or parent-framework migration; Svelte is also in the separate rrweb submodule. Do not mix breaking migrations into a manifest-only fix.
fast-xml-parser 4.x, markdown-it 12.x, legacy uuid 3.x–9.x, pytest 8.x	Remaining major upgrades require parent or consumer migration; separate owner review needed.
io.netty:* (AGP 8.7.2 buildscript transitives)	Fixed on main by #788 (netty-bom 4.1.137.Final); not duplicated here.
Other Gradle-toolchain Java transitives (jackson-*, wire-runtime, jose4j, jdom2, commons-io, protobuf-java, bcprov)	Not part of this PR; same AGP 8.7.2 buildscript classpath, can be pinned the same way in a follow-up.
go.opentelemetry.io/otel/sdk/log 0.19.0 → 0.21.0 (Medium, 5 Go modules)	0.21.0 removes log.KeyValue/log.Value used by go/internal/otel/custom_sampler.go, sdk/highlight-go/otel.go and the otelslog/otellogrus contrib bridges; needs source changes and coordinated contrib upgrades by the owning team.
basic-ftp 5.3.1 → 6.2.1 (High)	Only fix is a major bump past the ^5 range declared by get-uri (puppeteer proxy chain).
Findings newer than 7 days (e.g. compression, source-map-js, @graphql-tools/executor-legacy-ws, fast-copy, handlebars Medium #1588)	Within the 7-day hold; several are already in Dependabot #826.
Wiz reconciliation	Wiz MCP (mcp.app.wiz.io) was unreachable from this run, so the 2026-10-12 update is based on Dependabot only.
Findings without a fixed version, Low/Informational findings	Excluded under the severity/fix-availability policy.

No new PR group was deferred solely by the three-new-PR cap; this PR is an update to an existing security dependency PR.

Verification

Re-run on 2026-10-12 after merging main (conflicts in package.json, e2e/react-native/package.json, yarn.lock resolved keeping the higher of both sides' pins):

• Install: ✅ PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build (default 7-day age gate); ✅ yarn dedupe --check.
• Build: ✅ yarn build:sdk (22/22).
• Tests: ✅ yarn turbo run test --filter './sdk/*' --filter './sdk/@launchdarkly/*' (52/52 tasks).
• Lint: ✅ yarn lint (50/50); ✅ prettier --check on changed manifests/lockfiles (Husky pretty-quick --staged also ran on each commit).
• handlebars 4.7.10 was published 2026-10-05 (6.6 days before this run); it is a Critical fix, so the lock was resolved with a 6-day local age gate. Other new lock entries are ≥7 days old.

Re-run on 2026-10-05 after merging main (clean merge) and adding the piscina/proxy-addr/rubyzip bumps:

• piscina and proxy-addr are fixed via root resolutions ("piscina": "^4.9.4", "proxy-addr": "^2.0.8"); the lockfile diff is limited to those two entries (proxy-addr is a transitive of express 4.22 / 5.x).
• rubyzip in e2e/ruby/rails/demo/Gemfile.lock was moved to 3.4.0 (no runtime deps; same version already in demo-rails70). Ruby 3.3.4 isn't available here (Docker Hub blob CDN blocked), so the edit was cross-checked with a Bundler 2.4 bundle lock re-resolve, which kept rubyzip at 3.4.0 and changed nothing else apart from Bundler-version platform naming. CI's Rails E2E, Rails Example App, and Dockerized Ruby jobs all pass on this head.
• Install: ✅ PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build (no age-gate override needed).
• Build: ✅ yarn build:sdk (20/20).
• Tests: ✅ yarn turbo run test --filter './sdk/*' --filter './sdk/@launchdarkly/*' (50/50 tasks).
• Lint: ✅ yarn lint (49/49); ✅ prettier --check package.json (equivalent of the Husky pretty-quick --staged hook).

2026-10-01: merged main (includes #788). The Netty pin briefly added here was removed because it duplicated #788; this PR no longer touches any build.gradle file.

Re-run on 2026-09-28 after merging main (clean merge) and adding the adm-zip/devalue bump:

• Install: ✅ PUPPETEER_SKIP_DOWNLOAD=1 YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org node .yarn/releases/yarn-4.13.0.cjs install --immutable --mode=skip-build (no age-gate override needed this run).
• Build: ✅ yarn build:sdk (20/20 SDK packages).
• Tests: ✅ yarn turbo run test --filter '@launchdarkly/*' --filter highlight.run (27/27 tasks).
• Lint: ✅ yarn lint (49/49 tasks); ✅ prettier --check package.json (equivalent of the Husky pretty-quick --staged hook).
• Earlier runs on this branch (unchanged areas): Rails bundle exec rails test (API-only 3 tests/5 assertions), React Native 111 tests, @highlight-run/next 15/15; root yarn test still stops on Angular's blocked fonts.googleapis.com.

Previous CI on head 2be2bd1e7: 36/37 checks pass. The only red check, Require additional human oversight on bot PRs, is an expected action_required human approval gate, not a code failure. Reviewers: team-observability (CODEOWNERS) and team-product-security.

Link to Devin session: https://app.devin.ai/sessions/4a98d40b0c594f6ebb281f63d1be41ea
Open in Devin Desktop: https://app.devin.ai/desktop/session/4a98d40b0c594f6ebb281f63d1be41ea?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
628	551	88%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 94175d5 by action🐍