[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-11-09.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
minimatch (transitive via @typescript-eslint/typescript-estree 6.21.0)	npm (yarn v1)	Patch	9.0.3 → 9.0.7	High	253d	Dependabot, Wiz	GHSA-7r86-cg39-jmmj

@typescript-eslint/typescript-estree@6.21.0 pins minimatch to exactly 9.0.3, so the fix is a nested yarn v1 resolution "**/@typescript-eslint/typescript-estree/minimatch": "9.0.7" in package.json plus the regenerated yarn.lock (dev-only tooling; no source edits).

Deferred / excluded findings

• Still within the 7-day hold (first seen on or after 2026-11-02, not Critical) — follow-redirects 1.16.1 → 1.16.2 (High, 6d, Wiz, CVE-2026-116689); minimatch 9.0.3/9.0.9/10.2.5 → 11.0.1 (Medium, 6d, Wiz, CVE-2026-118764, major); glob 10.5.0 → 14.0.2 (Medium, 6d, Wiz, CVE-2026-118773, major).
• No fix version available yet — sprintf-js 1.0.3 (Medium, GHSA-hp3w-g68c-fv3c); Wiz end-of-life library findings (e.g. eslint 8, sinon 17, glob, rimraf, npmlog) are not CVEs; clearing them needs major tooling upgrades (owning-team work).

2026-11-09 refresh: branch is current with main (0 commits behind). No code changes. Re-queried Dependabot and Wiz; the new Wiz findings are within the hold window.

Verification

• Install: ✅ (yarn install --frozen-lockfile; branch up to date with main as of 2026-11-09)
• Build: ✅ (yarn build:setup && yarn vscode:prepublish, tsc -p ./)
• Tests: ✅ (xvfb-run -a yarn test, 13 passing on 2026-10-26; tree unchanged since, CI build green)
• Lint: ✅ (yarn lint, yarn prettier:check)

pre-commit hooks passed on commit.

Link to Devin session: https://app.devin.ai/sessions/e6aaaba01ef64dc58f9731655e45e9ad
Open in Devin Desktop: https://app.devin.ai/desktop/session/e6aaaba01ef64dc58f9731655e45e9ad?variant=devin

Refreshed by Devin session: https://app.devin.ai/sessions/a88dd077654f427b8f36c720f89409a9

---

Note

Overview
Addresses GHSA-7r86-cg39-jmmj by forcing transitive minimatch from 9.0.3 to 9.0.7 for @typescript-eslint/typescript-estree (pinned at 9.0.3), using a nested Yarn v1 resolution in package.json and an updated yarn.lock.

brace-expansion entries in the lockfile shift so the resolved minimatch@9.0.7 uses brace-expansion@^5.0.2 instead of ^2.0.1. No application source changes—dev/lint tooling dependency only.

^{Reviewed by Cursor Bugbot for commit 6410be4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring