Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.
Please merge this PR yourself, if you approve.
BEFORE YOU MERGE
Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.
- Dependency: aws-smithy-json 0.62.5 → 0.62.7, with aws-smithy-runtime-api 1.12.3, aws-smithy-types 1.5.0, and new aws-smithy-schema 0.1.0
- Advisory: https://github.com/advisories/GHSA-8ffr-xgwf-xj56 (CVE-2026-18140)
- Dependabot alert: https://github.com/warpdotdev/warp/security/dependabot/40
- Verification:
cargo metadata --lockedsucceeded and resolved aws-smithy-json 0.62.7. cargo-audit was not installed. Fullcargo check -p warpwas not run (GUI/native deps in this sandbox).
Highlight the risky code / where the dependency was used
Transitive through aws-config / aws-sdk-sts used by app/src/ai/aws_credentials.rs (BYO LLM credentials).
Special instructions for this PR — e.g. if it's a Stainless thing
Retry of closed #16295. Keep aws-smithy-types at 1.5.0; 1.6+ needs Rust 1.94.1 and the repo toolchain is 1.92.0.
AFTER YOU MERGE
None.
CHANGELOG-NONE
Activity
6
independabot-soc2[bot]7d agoThis PR was generated with Warp.
Comment @warp-staging-factory on this PR to send it follow-up work.
warp-for-oss[bot]7d agoOverview
This PR updates aws-smithy-json to the patched 0.62.7 release and pulls in the associated Smithy runtime/type/schema lockfile changes for CVE-2026-18140. No approved spec context was provided, and the diff adds no comments or tests.
Concerns
- The lockfile update includes unrelated transitive dependency downgrades outside the AWS Smithy dependency chain, including
socket2and multiplewindows-sysconsumers. For a security patch, this extra lockfile churn should be removed or justified before merge.
Security
- The dependency-resolution change downgrades unrelated transitive dependencies while attempting to fix a CVE. Regenerate the lockfile so the CVE fix is scoped to the required AWS Smithy updates, or document why each downgrade is necessary and safe.
Verdict
Found: 0 critical, 1 important, 0 suggestions
Request changes
Comment /warp-agent-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
@independabot-soc2[bot]
I'm starting a first review of this pull request.
You can view the conversation on Warp.
I completed the review and no human review was requested for this pull request.
Comment
/warp-agent-reviewon this pull request to retrigger a review (up to 3 times on the same pull request).Powered by Oz