[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-26.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
storybook (root + packages/toolbar devDependency)	npm	Minor	10.2.19 → 10.6.2 (^10.6.2; @storybook/addon-docs, addon-links, addon-onboarding, react, react-vite aligned to ^10.6.2; storybook-addon-rslib / storybook-react-rsbuild ^3.2.2 → ^3.6.1, the first builder line that supports Storybook 10.6)	Critical	2d	Dependabot, Wiz	GHSA-f2ph-cmg5-wxc8
proxy-addr	npm	Patch	2.0.7 → 2.0.8 (override ^2.0.8)	Critical	22d	Wiz	CVE-2026-90711
brace-expansion (2.x)	npm	Minor	2.0.2 → 2.1.7 (override brace-expansion@2: ^2.1.7)	High	73d	Dependabot, Wiz	GHSA-3jxr-9vmj-r5cp, GHSA-q2hr-2g5m-vwhr
fast-uri	npm	Patch	3.1.5 → 3.1.6 (override ^3.1.5 → ^3.1.6)	High	53d	Dependabot, Wiz	GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp
browserslist	npm	Minor	4.28.1 → 4.28.7	High	49d	Dependabot, Wiz	GHSA-73wf-gq98-2v4g
js-yaml	npm	Patch	4.3.1 → 4.3.2	High	43d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
brace-expansion (5.x)	npm	Patch	5.0.9 → 5.0.12 (override brace-expansion@>=4: ^5.0.9 → ^5.0.10)	High	20d	Dependabot, Wiz	GHSA-6j4f-fj2g-mc7p
source-map-js	npm	Patch	1.2.1 → 1.2.2 (new override source-map-js: ^1.2.2)	High	9d	Dependabot, Wiz	GHSA-68fv-2mgg-jv7q
ajv (6.x)	npm	Minor	6.12.6 → 6.14.0	Medium	245d	Dependabot, Wiz	GHSA-2g4f-4pwh-qvx6
picomatch	npm	Patch	2.3.1 → 2.3.2, 4.0.3 → 4.0.4	Medium	214d	Dependabot, Wiz	GHSA-3v7f-55p6-f55p
follow-redirects	npm	Minor	1.15.11 → 1.16.0	Medium	194d	Dependabot, Wiz	GHSA-r4q5-vmmm-2653
uuid	npm	Removed (via launchdarkly-js-client-sdk 3.9.0 → 3.9.3, whose common lib no longer depends on uuid)	8.3.2 → removed	Medium	156d	Dependabot, Wiz	GHSA-w5hq-g745-h8pq
@humanfs/node	npm	Patch	0.16.7 → 0.16.8	Medium	53d	Dependabot, Wiz	GHSA-p498-v437-472g
qs (root devDependency pin)	npm	Minor	6.15.2 → 6.16.0	Medium	52d	Wiz	CVE-2026-82417, CVE-2026-82562
@vitest/mocker (3.x copy)	npm	Removed (only storybook-builder-rsbuild@3.2.2 pulled it; 3.6.1 does not)	3.2.4 → removed	Medium	47d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9
@vitest/mocker (4.x copy)	npm	Patch	4.1.10 → 4.1.11	Medium	47d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9
baseline-browser-mapping	npm	Minor	2.9.5 → 2.11.0	Medium	47d	Dependabot, Wiz	GHSA-w5vr-8v7q-w6rv
vitest	npm	Patch	4.1.10 → 4.1.11	Medium	45d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9
brace-expansion (1.x)	npm	Patch	1.1.18 → 1.1.21 (override brace-expansion@1: ^1.1.16 → ^1.1.21)	Medium	8d	Dependabot, Wiz	GHSA-q2hr-2g5m-vwhr

Transitive versions are resolved with pnpm overrides (kept in package.json pnpm.overrides per repo convention; the lockfile records and applies them). No existing minimum was lowered.

New this run (2026-10-26): Storybook 10.2.19 → 10.6.2 (Critical). Moving to Storybook 10.6 also lets storybook-*-rsbuild go to 3.6.1, which removes the @vitest/mocker 3.x copy that the last runs deferred as owning-team work. Also added source-map-js 1.2.2 and brace-expansion 1.1.21, which were in the 7-day hold last run. The lockfile change is limited to Storybook/rsbuild packages and their new transitive deps (oxc-parser/oxc-resolver bindings, memfs, etc.). An earlier attempt on this PR re-resolved unrelated @react-aria/* packages and broke Playwright E2E; that was reverted in 6923100.

Deferred / excluded findings

• Still within the 7-day hold — vite 7.3.6 → 7.3.7, High + 2× Medium, 3d (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw; eligible after 2026-10-30); postcss-selector-parser 7.1.1 → 7.1.6, Medium, 7d (GHSA-rj75-hqrm-r3gf; eligible 2026-10-27); @vitest/mocker / vitest 4.1.11 → 4.1.12, Medium, 1d (GHSA-qxg6-89mg-rqv8). These will go into this PR on a later run.
• Low-severity alerts (@babel/core, body-parser, esbuild, postcss-selector-parser <7.1.3) are out of scope.
• Supersedes the security-relevant parts of Dependabot PRs chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates #641 (doesn't reach the current targets), chore(deps): bump launchdarkly-js-client-sdk from 3.9.0 to 3.9.3 in /packages/demo #649 (demo-only, leaves uuid in the lockfile) and chore(deps-dev): bump storybook from 10.2.19 to 10.4.6 #654 (storybook 10.4.6 is still inside the Critical range, which is < 10.6.2).
• Pre-existing peer warnings: @storybook/addon-essentials, addon-interactions, blocks and test are still on 9.0.0-alpha and warn about the storybook@^9 peer. They warned against 10.2.x too, and this PR doesn't touch them.

Verification

(Local, 2026-10-26 on head 6923100, Node 24 / pnpm 10.14.0.)

• Install: ✅ (pnpm install --frozen-lockfile)
• Build: ✅ (pnpm build, including the demo; pnpm build:storybook also succeeds on Storybook 10.6.2)
• Tests: ✅ (pnpm test: 55 files / 840 tests passed)
• Lint: ✅ (pnpm lint: 0 errors, same 41 pre-existing warnings as main; pnpm format:ci clean)
• CI: ✅ ci-build (unit + Playwright E2E) green on 6923100

Branch is up to date with main as of 2026-10-26.

---

Note

^{Cursor Bugbot is generating a summary for commit abc22f0. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

This PR is too large for Bugbot to review. It changes 2,906 lines and 295,896 characters. Split the change into smaller pull requests to get a review.

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session