[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
proxy-addr (via express ^4.22.3)	npm	Patch	2.0.7 → 2.0.8	Critical	~25d (Wiz) / 5d (Dependabot)	Dependabot, Wiz	GHSA-jqcg-44mw-7w3h (CVE-2026-90711)
@modelcontextprotocol/sdk (direct, ^1.26.0 → ^1.31.0)	npm	Minor	1.27.1 → 1.31.0	High	13d	Dependabot, Wiz	GHSA-6qxp-vccf-f47h (CVE-2026-104850)
fast-uri	npm	Patch	3.1.5 → 3.1.8	High	53d	Dependabot, Wiz	GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-qw65-cvwx-89v3, GHSA-hrr3-gc8f-f4qj
js-yaml	npm	Patch	4.3.1 → 4.3.2	High	43d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
hono	npm	Patch	4.13.2 → 4.13.7	Medium	46d	Dependabot, Wiz	GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv
qs	npm	Minor	6.15.3 → 6.16.0	Medium	53d	Dependabot, Wiz	GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx
ip-address	npm	Minor	10.5.0 → 10.7.1	Medium	27d	Dependabot, Wiz	GHSA-2vr4-cq9g-pvrc, GHSA-rpw4-54j3-4h4q, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv
@humanfs/node	npm	Patch	0.16.6 → 0.16.8	Medium	53d	Dependabot, Wiz	GHSA-p498-v437-472g
brace-expansion (dev-only)	npm	Patch	1.1.18 → 1.1.21, 2.1.4 → 2.1.7	Medium	21d	Dependabot, Wiz	GHSA-q2hr-2g5m-vwhr

@modelcontextprotocol/sdk is pinned to 1.31.0 (smallest version clearing the actionable advisory), not 1.32.x, because the 1.32.0 advisories are still within the 7-day hold. The manifest floor moves to ^1.31.0 so consumers of the published package also resolve a patched SDK.

Deferred / excluded findings

• Still within the 7-day hold (first seen on/after 2026-10-21; eligible on a later run):
  • @modelcontextprotocol/sdk 1.31.0 → 1.32.0 (High/Medium, first seen 2026-10-21; GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-rvq5-wwqv-78pq)
  • hono 4.13.7 → 4.13.11 (Medium, 2026-10-21; GHSA-5r4p-p66f-jhc7)
  • body-parser 2.3.0 → 2.4.0 (under the SDK's express 5) and 1.20.8 → 1.20.9 (High, Wiz-only, 2026-10-22; CVE-2026-111181)
  • zod 4.3.6 → 4.6.6 (High, Wiz-only, 2026-10-25; CVE-2023-54404)
  • fast-uri 3.1.8 → 3.1.9 (Medium, Wiz-only, 2026-10-22/25; CVE-2026-110180, CVE-2026-110306)
  • ip-address 10.7.1 → 10.7.4 (Medium, Wiz-only, 2026-10-25; CVE-2026-111997)
• Low-severity findings (fast-uri CVE-2026-110095, CVE-2026-110725) are out of scope.

Verification

• Install: ✅ (npm ci --ignore-scripts)
• Build: ✅ (bun src/mcp-server/build.mts && tshy, same as npm run build). Smoke test: mcp-server start --transport sse → /sse returns 200 text/event-stream
• Tests: ✅ (npm run test:sse-security 17/17, npm run test:tls-blocklist 51/51)
• Lint: ✅ (npm run lint)

Link to Devin session: https://app.devin.ai/sessions/e4bfef2c80b34f44b53c9acd72dd1926
Open in Devin Desktop: https://app.devin.ai/desktop/session/e4bfef2c80b34f44b53c9acd72dd1926?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring