fix: bump next, shell-quote, @xmldom/xmldom, browserslist, js-yaml, qs, ip-address, undici and brace-expansion to patched versions

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
next (examples/hello-nextjs)	npm	Patch	16.3.3 → 16.3.6 (+ eslint-config-next to match)	Critical	15d	Dependabot, Wiz	GHSA-vcvr-r3jv-pc5j, CVE-2026-94545
shell-quote (examples/React-Native) — new this run	npm	Minor	1.10.0 → 1.11.0	Critical	5d	Dependabot	GHSA-pqg4-j6r4-53mv
@xmldom/xmldom (examples/React-Native)	npm	Patch	0.8.13 → 0.8.15	High	46d	Dependabot, Wiz	GHSA-4w3w-2rp5-g8jm, GHSA-w2rr-34g9-rvrj, GHSA-27p8-2357-5qqv, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59, GHSA-8344-3jmq-59r6, GHSA-93r5-fhx6-vmg9, GHSA-965w-775f-mr7g, GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4
browserslist (examples/React-Native)	npm	Minor	4.24.4 → 4.28.7	High	43d	Dependabot, Wiz	GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
js-yaml (examples/React-Native)	npm	Patch	3.15.1 → 3.15.2, 4.3.1 → 4.3.2	High	36d	Dependabot, Wiz	GHSA-2883-xcg3-v3hh
ip-address (examples/React-Native)	npm	Patch on parent socks 2.8.4 → 2.8.7 (moves transitive ip-address 9 → 10, which socks ≥2.8.7 itself requires)	9.0.5 → 10.7.2	High	166d	Dependabot, Wiz	GHSA-mwp4-54f8-5fhr, GHSA-v2v4-37r5-5v8g, GHSA-rpw4-54j3-4h4q, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv
undici (examples/React-Native)	npm	Patch	6.28.0 → 6.28.1	High	20d	Dependabot, Wiz	GHSA-rfgv-xxqx-mfg5, GHSA-3wwx-pv8p-q78v
brace-expansion (examples/React-Native)	npm	Patch	1.1.18 → 1.1.21, 2.1.4 → 2.1.7	High	15d	Dependabot, Wiz	GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr (CVE-2026-102276/7/8)
qs (examples/React-Native)	npm	Minor	6.15.3 → 6.16.0	Medium	46d	Dependabot, Wiz	GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g

All React-Native changes are yarn resolutions entries (matching the existing pattern in that package.json) plus the regenerated yarn.lock. The previous brace-expansion@^2.0.1 resolution key no longer matched anything (the lockfile descriptor is ^2.0.2), so a brace-expansion@^2.0.2 key was added. hello-nextjs has no committed lockfile, so only package.json changes there.

Note: the Wiz MCP server failed every call in the 2026-10-19 run, so this run is Dependabot-only (Wiz sources/IDs above come from earlier runs). Dependabot data is current as of 2026-10-19.

Deferred / excluded findings

• Still within the 7-day hold
  • next 16.3.6 → 16.3.8 (examples/hello-nextjs): High, 4d (GHSA-cjq9-62q9-8jv4, GHSA-4jqv-mc3x-m676, GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7). Eligible 2026-10-23; the 16.3.6 bump here already clears the Critical.
  • compression 1.8.0 → 1.8.2 (examples/React-Native): High, 2d (GHSA-vc2v-76pw-4v95). Eligible 2026-10-25.
• Major bumps, handled outside this PR
  • uuid 7.0.3 / 8.3.2 → 11.1.1 (Medium, GHSA-w5hq-g745-h8pq) is fixed in the major-batch PR fix: resolve uuid to 11.1.1 in React-Native example #23.
  • image-size 1.2.1 → 2.0.3 (High, 25d, GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) needs owning-team work. There's no 1.x fix, and metro 0.81 calls the 1.x function export, which 2.x removed, so the fix requires an Expo/RN upgrade (React Native example: Expo 57 / TS 7 / Babel 8 upgrade + Observability + funnel experiment + CI #18).
• No fix version available yet: node-forge 1.4.0 (GHSA-86w9-cpqp-85rv), braces 3.0.3 (GHSA-vfj7-8cjw-p6xm), sprintf-js 1.1.3 (GHSA-hp3w-g68c-fv3c); earlier Wiz http-cache-semantics and end-of-life library findings (glob, rimraf, inflight, @babel/plugin-proposal-*).
• Low severity, out of scope: @babel/core (GHSA-4x5r-pxfx-6jf8) and other Low alerts.

Verification

Re-run 2026-10-19 on this branch (0 commits behind main):

• Install: ✅ yarn install (Yarn 3.4.1, Node 24) in examples/React-Native; npm install in examples/hello-nextjs (resolves next/eslint-config-next 16.3.6)
• Build: ✅ npx tsc --noEmit and npx expo export --platform android (with a placeholder MOBILE_KEY in an uncommitted .env) in examples/React-Native; ✅ next build in examples/hello-nextjs
• Tests: n/a (no test suites in these examples)
• Lint: ✅ npm run lint (eslint) in examples/hello-nextjs; n/a for React-Native (no lint config)

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring