[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: aws-smithy-json 0.62.5 → 0.62.7, with aws-smithy-runtime-api 1.12.3, aws-smithy-types 1.5.0, and new aws-smithy-schema 0.1.0
• Advisory: GHSA-8ffr-xgwf-xj56 (CVE-2026-18140)
• Dependabot alert: https://github.com/warpdotdev/warp/security/dependabot/40
• Verification: cargo metadata --locked succeeded and resolved aws-smithy-json 0.62.7. cargo-audit was not installed. Full cargo check -p warp was not run (GUI/native deps in this sandbox).

Highlight the risky code / where the dependency was used

Transitive through aws-config / aws-sdk-sts used by app/src/ai/aws_credentials.rs (BYO LLM credentials).

Special instructions for this PR — e.g. if it's a Stainless thing

Retry of closed #16295. Keep aws-smithy-types at 1.5.0; 1.6+ needs Rust 1.94.1 and the repo toolchain is 1.92.0.

AFTER YOU MERGE

None.

CHANGELOG-NONE

[warp-for-oss]

@independabot-soc2[bot]

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /warp-agent-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[independabot-soc2]

This PR was generated with Warp.

Comment @warp-staging-factory on this PR to send it follow-up work.

  View origin

[warp-for-oss]

Overview

This PR updates aws-smithy-json to the patched 0.62.7 release and pulls in the associated Smithy runtime/type/schema lockfile changes for CVE-2026-18140. No approved spec context was provided, and the diff adds no comments or tests.

Concerns

• The lockfile update includes unrelated transitive dependency downgrades outside the AWS Smithy dependency chain, including socket2 and multiple windows-sys consumers. For a security patch, this extra lockfile churn should be removed or justified before merge.

Security

• The dependency-resolution change downgrades unrelated transitive dependencies while attempting to fix a CVE. Regenerate the lockfile so the CVE fix is scoped to the required AWS Smithy updates, or document why each downgrade is necessary and safe.

Verdict

Found: 0 critical, 1 important, 0 suggestions

Request changes

Comment /warp-agent-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz