[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-12.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
proxy-addr	npm	Patch	2.0.7 → 2.0.8	Critical	~11d (Wiz)	Wiz	CVE-2026-90711
fast-uri	npm	Patch	3.1.5 → 3.1.8	High	39d	Dependabot, Wiz	GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-qw65-cvwx-89v3, GHSA-hrr3-gc8f-f4qj
js-yaml	npm	Patch	4.3.1 → 4.3.2	High	29d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
hono	npm	Patch	4.13.2 → 4.13.5	Medium	32d	Dependabot	GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv
qs	npm	Minor	6.15.3 → 6.16.0	Medium	39d	Dependabot	GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx
ip-address	npm	Patch	10.5.0 → 10.5.1	Medium	13d	Dependabot	GHSA-2vr4-cq9g-pvrc
@humanfs/node	npm	Patch	0.16.6 → 0.16.8	Medium	39d	Dependabot	GHSA-p498-v437-472g

fast-uri 3.1.7/3.1.8 advisories (GHSA-qw65-cvwx-89v3 High, GHSA-hrr3-gc8f-f4qj Medium) are only 6d old on Dependabot, but Wiz first reported them ~2026-10-01 (11d), so the oldest first-seen date puts them past the 7-day hold. The Wiz MCP server was unreachable during this run, so Wiz ages come from the 2026-10-05 run.

Deferred / excluded findings

• Still within the 7-day hold (Dependabot first seen 2026-10-05T19:11Z, 6d; becomes eligible next run):
  • hono 4.13.5 → 4.13.7 (Medium, GHSA-hxh3-vqpv-xpqv)
  • ip-address 10.5.1 → 10.7.1 (Medium, GHSA-rpw4-54j3-4h4q, GHSA-j6r3-76f7-8jcv, GHSA-h3mg-xc3c-68pw)
  • brace-expansion 1.1.18 → 1.1.21 and 2.1.4 → 2.1.7 (Medium, dev-only, GHSA-q2hr-2g5m-vwhr)
• Wiz Go findings that match by name come from an unrelated basy-mcp-server-slop asset and are excluded.

Verification

• Install: ✅ (npm ci)
• Build: ✅ (npm run build: bun bundle + tshy). Smoke test: mcp-server start --transport sse → /sse returns 200 text/event-stream
• Tests: ✅ (npm run test:sse-security 17/17; CI test green)
• Lint: ✅ (npm run lint)

Link to Devin session: https://app.devin.ai/sessions/4a904dbc95ca4049877abd7b2c6f8af0
Open in Devin Desktop: https://app.devin.ai/desktop/session/4a904dbc95ca4049877abd7b2c6f8af0?variant=devin

---

Note

Overview
Security-focused dependency refresh with no application source changes—only package.json and package-lock.json.

The direct devDependency express is bumped from ^4.21.2 to ^4.22.3, which pulls in patched transitive packages used by the SSE CLI path (src/mcp-server/cli/start) and SSE security tests, including qs, body-parser, path-to-regexp, and proxy-addr.

The lockfile also updates other vulnerable transitive packages (fast-uri, js-yaml, hono, ip-address, @humanfs/*, brace-expansion, etc.) to versions referenced in the PR’s security findings.

^{Reviewed by Cursor Bugbot for commit e017262. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring