Skip to content

Bump the nuget group with 4 updates - #513

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/e2e/dotnet4/cs/nuget-f8e0ab8369
Open

Bump the nuget group with 4 updates#513
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/e2e/dotnet4/cs/nuget-f8e0ab8369

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Updated OpenTelemetry from 1.11.2 to 1.15.3.

Release notes

Sourced from OpenTelemetry's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

  • NuGet: OpenTelemetry v1.15.3

    • Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
      (#​7069)

    • Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
      unspecified or out-of-range severities without returning invalid enum values.
      (#​7092)

    • Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
      infinite values as invalid and fall back to the default ratio when using
      traceidratio and parentbased_traceidratio samplers.
      (#​7103)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.3

    • Fix baggage and trace headers not respecting the maximum length in some cases.
      (#​7061)

    • Improve efficiency of parsing of baggage and B3 propagation headers.
      (#​7061)

    • Breaking change: Fixed tracestate parsing to reject keys that do not
      begin with a lowercase letter, including keys beginning with digits, to
      align with the W3C Trace Context specification.
      (#​7065)

    • Fixed BaggagePropagator to trim optional whitespace (OWS) around =
      separators when parsing the baggage header, as required by the
      W3C Baggage specification.
      (#​7009)

    • Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
      from values when parsing the baggage header.
      (#​7009)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

1.15.2

For highlights and announcements pertaining to this release see: Release Notes > 1.15.2.

The following changes are from the previous release 1.15.1.

... (truncated)

1.15.2-beta.1

The following changes are from the previous release 1.15.1-beta.1.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

1.15.0

For highlights and announcements pertaining to this release see: Release Notes > 1.15.0.

The following changes are from the previous release 1.14.0.

  • NuGet: OpenTelemetry v1.15.0

    • Added support for the OTEL_SDK_DISABLED environment variable in TracerProvider,
      MeterProvider, and LoggerProvider. When OTEL_SDK_DISABLED=true,
      the SDK returns no-op implementations for all telemetry signals.
      The OTEL_SDK_DISABLED environment variable is only evaluated upon application
      startup, later changes have no effect.
      (#​6568)

    • Added LowMemory temporality as an option in the OTLP metrics exporter.
      (#​6648)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    • Improve performance and reduce memory consumption for metrics histograms.
      (#​6715)

    • Decode value in OTEL_RESOURCE_ATTRIBUTES environment variable.
      (#​6737)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.0

    • Added a new overload for TracerProvider.GetTracer which accepts an optional
      string? schemaUrl parameter, allowing a schema URL to be set on the Tracer.
      (#​6736)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.15.0

    • Added support for ActivitySource.TelemetrySchemaUrl property.
      (#​6713)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    See CHANGELOG for details.
    ... (truncated)

1.15.0-beta.1

The following changes are from the previous release 1.14.0-beta.1.

1.14.0

For highlights and announcements pertaining to this release see: Release Notes > 1.14.0.

The following changes are from the previous release 1.14.0-rc.1.

  • NuGet: OpenTelemetry v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      and .NET Standard.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update System.Diagnostics.DiagnosticSource dependency to 10.0.0
      for all target frameworks.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      ... (truncated)

1.14.0-rc.1

The following changes are from the previous release 1.13.1.

... (truncated)

1.14.0-beta.1

The following changes are from the previous release 1.13.1-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.14.0-beta.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      Microsoft.Extensions.Logging.Configuration NuGet packages.
      (#​6327)

    • Add support for .NET 10.0.
      (#​6307)

    • Added the possibility to disable timestamps via the PrometheusAspNetCoreOptions.
      (#​6600)

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Updated OpenTelemetry core component version(s) to 1.14.0.
      (#​6689)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.14.0-beta.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      Microsoft.Extensions.Logging.Configuration NuGet packages.
      (#​6327)

    • Add support for .NET 10.0.
      (#​6307)

    • Added the possibility to disable timestamps via the PrometheusHttpListenerOptions.
      (#​6600)

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Updated OpenTelemetry core component version(s) to 1.14.0.
      ... (truncated)

1.13.1

For highlights and announcements pertaining to this release see: Release Notes > 1.13.1.

The following changes are from the previous release 1.13.0.

... (truncated)

1.13.1-beta.1

The following changes are from the previous release 1.13.0-beta.1.

1.13.0

For highlights and announcements pertaining to this release see: Release Notes > 1.13.0.

The following changes are from the previous release 1.12.0.

  • NuGet: OpenTelemetry v1.13.0

    • Added a verification to ensure that a MetricReader can only be registered
      to a single MeterProvider, as required by the OpenTelemetry specification.
      (#​6458)

    • Added FormatMessage configuration option to self-diagnostics feature. When
      set to true (default is false), log messages will be formatted by replacing
      placeholders with actual parameter values for improved readability.

      Example OTEL_DIAGNOSTICS.json:

      {
    "LogDirectory": ".",
    "FileSize": 32768,
    "LogLevel": "Warning",
    "FormatMessage": true
}

    • Fixed parsing of OTEL_TRACES_SAMPLER_ARG decimal values to always use .
      as the delimiter when using the traceidratio sampler, preventing
      locale-specific parsing issues.
      (#​6444)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.13.0

    • Added AddLink(SpanContext, SpanAttributes?) to TelemetrySpan to support
      linking spans and associating optional attributes for advanced trace relationships.
      (#​6305)

    • Experimental (only in pre-release versions): Added the EventName property
      to LogRecordData
      (#​6306)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.13.0

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.13.0-beta.1

The following changes are from the previous release 1.12.0-beta.1.

1.12.0

For highlights and announcements pertaining to this release see: Release Notes > 1.12.0.

The following changes are from the previous release 1.11.2.

1.12.0-beta.1

The following changes are from the previous release 1.11.2-beta.1.

Commits viewable in compare view.

Updated OpenTelemetry from 1.12.0 to 1.15.3.

Release notes

Sourced from OpenTelemetry's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

  • NuGet: OpenTelemetry v1.15.3

    • Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
      (#​7069)

    • Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
      unspecified or out-of-range severities without returning invalid enum values.
      (#​7092)

    • Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
      infinite values as invalid and fall back to the default ratio when using
      traceidratio and parentbased_traceidratio samplers.
      (#​7103)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.3

    • Fix baggage and trace headers not respecting the maximum length in some cases.
      (#​7061)

    • Improve efficiency of parsing of baggage and B3 propagation headers.
      (#​7061)

    • Breaking change: Fixed tracestate parsing to reject keys that do not
      begin with a lowercase letter, including keys beginning with digits, to
      align with the W3C Trace Context specification.
      (#​7065)

    • Fixed BaggagePropagator to trim optional whitespace (OWS) around =
      separators when parsing the baggage header, as required by the
      W3C Baggage specification.
      (#​7009)

    • Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
      from values when parsing the baggage header.
      (#​7009)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

1.15.2

For highlights and announcements pertaining to this release see: Release Notes > 1.15.2.

The following changes are from the previous release 1.15.1.

... (truncated)

1.15.2-beta.1

The following changes are from the previous release 1.15.1-beta.1.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

1.15.0

For highlights and announcements pertaining to this release see: Release Notes > 1.15.0.

The following changes are from the previous release 1.14.0.

  • NuGet: OpenTelemetry v1.15.0

    • Added support for the OTEL_SDK_DISABLED environment variable in TracerProvider,
      MeterProvider, and LoggerProvider. When OTEL_SDK_DISABLED=true,
      the SDK returns no-op implementations for all telemetry signals.
      The OTEL_SDK_DISABLED environment variable is only evaluated upon application
      startup, later changes have no effect.
      (#​6568)

    • Added LowMemory temporality as an option in the OTLP metrics exporter.
      (#​6648)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    • Improve performance and reduce memory consumption for metrics histograms.
      (#​6715)

    • Decode value in OTEL_RESOURCE_ATTRIBUTES environment variable.
      (#​6737)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.0

    • Added a new overload for TracerProvider.GetTracer which accepts an optional
      string? schemaUrl parameter, allowing a schema URL to be set on the Tracer.
      (#​6736)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.15.0

    • Added support for ActivitySource.TelemetrySchemaUrl property.
      (#​6713)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    See CHANGELOG for details.
    ... (truncated)

1.15.0-beta.1

The following changes are from the previous release 1.14.0-beta.1.

1.14.0

For highlights and announcements pertaining to this release see: Release Notes > 1.14.0.

The following changes are from the previous release 1.14.0-rc.1.

  • NuGet: OpenTelemetry v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      and .NET Standard.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update System.Diagnostics.DiagnosticSource dependency to 10.0.0
      for all target frameworks.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      ... (truncated)

1.14.0-rc.1

The following changes are from the previous release 1.13.1.

  • NuGet: OpenTelemetry v1.14.0-rc.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      `Microsoft.Exte...

Description has been truncated

[!NOTE]
Medium Risk
Primarily dependency/version bumps (notably OpenTelemetry to 1.15.3 and Microsoft.Extensions.*/System.* libs) which can change runtime behavior and binding resolution in .NET Framework apps.

Overview
Updates .NET OpenTelemetry dependencies to 1.15.3 across the SDK projects (including OpenTelemetry.Exporter.OpenTelemetryProtocol).

Refreshes the .NET Framework e2e app’s NuGet graph and assembly binding redirects: bumps Microsoft.Extensions.*/System.Diagnostics.DiagnosticSource/System.* packages, updates Newtonsoft.Json redirect to 13.0.0.0, adds an OpenTelemetry.Exporter.OpenTelemetryProtocol bindingRedirect, and wires System.ValueTuple build targets into the legacy cs.csproj/packages.config.

Reviewed by Cursor Bugbot for commit be7bae1. Bugbot is set up for automated code reviews on this repo. Configure here.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump the nuget group with 4 updates
be7bae1 
Bumps OpenTelemetry to 1.15.3
Bumps OpenTelemetry.Api from 1.11.2 to 1.15.3
Bumps OpenTelemetry.Api.ProviderBuilderExtensions from 1.11.2 to 1.15.3
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol to 1.15.3

---
updated-dependencies:
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry.Api
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry.Api.ProviderBuilderExtensions
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner April 30, 2026 18:41
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Apr 30, 2026
@dependabot dependabot Bot mentioned this pull request Apr 30, 2026
Closed
cursor[bot]
cursor Bot reviewed Apr 30, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit be7bae1. Configure here.

Comment thread e2e/dotnet4/cs/Web.config
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="OpenTelemetry.Exporter.OpenTelemetryProtocol" publicKeyToken="7bd6737fe5b67e3c" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-1.0.0.0" newVersion="1.0.0.0" />

@cursor cursor Bot Apr 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing binding redirects for upgraded assemblies in Web.config

High Severity

The Web.config is missing binding redirects for numerous assemblies whose versions were bumped across major assembly versions. For example, System.Diagnostics.DiagnosticSource went from assembly version 9.0.0.0 to 10.0.0.7, and all Microsoft.Extensions.* assemblies went from 9.0.0.0 to 10.0.0.7, yet no redirects were added. Non-updated assemblies like OpenTelemetry.Extensions.Hosting 1.11.2, OpenTelemetry.Exporter.Console 1.9.0, and Microsoft.Extensions.Hosting.Abstractions 9.0.0 were compiled against the old versions and will fail to load them at runtime, causing FileLoadException. This packages.config-style .NET Framework project has no AutoGenerateBindingRedirects setting, so redirects must be added manually.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit be7bae1. Configure here.

@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 14, 2026
Merged
osm6495 pushed a commit that referenced this pull request Aug 18, 2026
@devin-ai-integration
fix: remediate dependency vulnerabilities across npm, go, pip, and ru…
9cbe8d5 
…bygems (#732)

## Summary

Automated dependency-vulnerability remediation for findings reported by
GitHub Dependabot and Wiz. Only findings that are actionable under the
severity/age policy (critical immediately; high/moderate after a 7-day
hold; low ignored; must have a published fixed version) and that are
still present in the manifests/lockfiles are included. Stale alerts
(already patched in the lockfile, e.g. `next`, `vite`, `django` in
`sdk/highlight-py` after this change) were verified against the
lockfiles rather than trusted blindly.

Fixed:

| Ecosystem | Package | Change | Severity | Advisory |
|---|---|---|---|---|
| go | `github.com/gofiber/fiber/v2` | 2.52.13 → 2.52.14 (3 modules) |
moderate | GHSA-gcfq-8gqf-4876 |
| npm | `turbo` | 2.8.7 → 2.9.14 | moderate | GHSA-hcf7-66rw-9f5r |
| npm | `hono` | resolution → ^4.12.34 (4.13.2) | moderate |
GHSA-8j4g-w8fx-2239, GHSA-f23p-vx2j-j53r, GHSA-54fx-42gc-7vw4 |
| npm | `valibot` | 1.2.0 → 1.4.2 | moderate | GHSA-5qjj-4xww-7phc |
| npm | `@remix-run/router` | 1.23.2 → 1.23.3 | moderate |
GHSA-2j2x-hqr9-3h42 |
| npm | `markdown-it` | 14.1.1 → 14.3.0 | moderate | GHSA-6v5v-wf23-fmfq
|
| npm | `uuid` | 11.1.0 → 11.1.1 | moderate | GHSA-w5hq-g745-h8pq |
| npm | `@remix-run/node` (e2e/react-native) | 2.15.2 → 2.17.5 |
critical (Wiz) | CVE-2025-61686 |
| npm | `ajv` (e2e/react-native) | 8.17.1 → 8.20.0 | moderate |
GHSA-2g4f-4pwh-qvx6 |
| npm | `yaml` (e2e/react-native) | 1.10.2 → 1.10.3 | moderate |
GHSA-48c2-rrv3-qjmp |
| npm | `js-yaml` | resolutions → ^3.15.1 / ^4.3.1 | high |
GHSA-5p4m-2wfm-xmqj |
| pip | `django` (sdk/highlight-py dev dep) | 4.2.30 → 5.2.17 | moderate
| GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w |
| pip | `django` (e2e/python) | 5.2.14 → 5.2.17 | moderate |
GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w |
| pip | `pytest` (e2e/tests) | 7.4.4 → 9.1.1 | moderate |
GHSA-6w46-j5rx-g56g |
| pip | `loguru` (e2e/python) | constraint `^0` → `^0.7.3` | moderate |
GHSA-39ph-wr67-j4xq |
| rubygems | `activesupport` (RN example Gemfiles) | `>= 6.1.7.5` → `>=
7.2.3.1` | moderate | GHSA-2j26-frm8-cmj9, GHSA-89vf-4333-qx8v,
GHSA-cg4j-q9v8-6v38 |

Deferred, with reasons:

- **Critical `org.bouncycastle:bcprov-jdk18on` 1.77 → 1.80.2** (Wiz,
CVE-2025-14813) in `sdk/@launchdarkly/flutter/.../android/build.gradle`
and
`sdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle`.
It is a build-time-only transitive of the
`com.android.tools.build:gradle` 8.7.2 buildscript classpath (not
shipped in artifacts); the real fix is an AGP upgrade. No Android SDK
and no Maven Central access in this environment, so the change could not
be built or verified — left for a dedicated PR.
- **No published fix**: `@angular/*`, `apollo-server-core`,
`extract-zip`, `image-size`, `react-router-dom`.
- **Major upgrades requiring code changes** (kept out of this bump-only
PR): `@nestjs/core` 10 → 11, `svelte` 4 → 5, `react-router` 6 → 7,
`@opentelemetry/core` 1.30 → 2.x, `file-type` 20 → 21, `fast-xml-parser`
4 → 5, `ts-deepmerge` 2 → 8, transitive `nanoid` 4 → 5 and `markdown-it`
12 → 14.
- **Under the 7-day hold**: `@hono/node-server` 1.19.15, plus the newest
`image-size` advisories.
- **`nanoid`**: the 3.x line is already at 3.3.18 in the lockfile
(patched); the remaining alert covers the transitive `nanoid@4.0.2`,
whose fix is the ESM-only 5.x major, so it stays in the major-upgrade
bucket.
- **Blocked by a peer constraint**: `pytest` 9 in `e2e/python` —
`pytest-asyncio` 0.25.3 requires `pytest <9`, so that manifest stays on
`^8.2.0`.
- **NuGet OpenTelemetry packages** (`e2e/dotnet4/cs/packages.config`):
already covered by open Dependabot PRs (#513, #509, #496) and nuget.org
is not reachable here, so no duplicate change.
- **Low severity** findings are out of policy scope (`webpack`,
`body-parser`, `@babel/core`, `json`, `msgpack`, `sqlite3`, `flask`,
`@tootallnate/once`).

Excluded because it did not build: none — but see the environment
caveats below.

## How did you test this change?

Dependency-only change, no runtime behavior change, so no screenshots or
staging link apply.

- `yarn install` + `yarn dedupe --check` — clean (Puppeteer's
Chrome-download postinstall fails in this sandbox because its CDN is
blocked; unrelated to these bumps).
- `yarn build:sdk` — 20/20 tasks pass. `yarn build` — 49/53; only
`angular.io-example#build` fails, because font inlining needs
`fonts.googleapis.com`, which is blocked in this sandbox.
- `yarn lint` — 49/49 pass.
- `yarn test` — 76/77 pass. `@highlight-run/next#test` fails because the
test boots a Next app whose corepack step downloads yarn from
`repo.yarnpkg.com` (blocked here). `aws-lambda#build` needs the `sam`
CLI, which is not installed.
- Re-validated after the `js-yaml` bump: `yarn build:sdk` 20/20 pass and
`yarn test` 57/61, with `angular.io-example#build` the only failure
(blocked Google Fonts, as above).
- `yarn format-check` — the only warnings are local build artifacts
under `lib/` (not tracked); all changed manifests pass Prettier.
- Go: `go build ./...`, `go vet ./...`, `go mod verify` pass in
`sdk/highlight-go` and `e2e/go-plugin`. `sdk/highlight-go` tests pass
except a pre-existing `log.TestParseConsoleMessages` failure (reproduced
on the unmodified module), and `e2e/go` has a pre-existing duplicate
`main` in `fiber.go`/`echo.go`.
- Python: `sdk/highlight-py` suite passes on Django 5.2.17 (259 tests);
`e2e/tests` installs and collects on pytest 9; `e2e/python` imports
Django/loguru/Flask cleanly.
- Not validated in this environment: the Android/Gradle and Ruby/Bundler
paths (no Android SDK, Maven Central and RubyGems not reachable).
Pre-commit hooks could not run because their hook environments clone
from GitHub directly; the equivalent checks were run manually.

## Are there any deployment considerations?

No migrations or backfills. Notes for reviewers:

- `sdk/highlight-py` moves its **dev** dependency Django from 4.x to
5.2.17 (the advisories have no 4.x fix); the shipped package is
unaffected and the Django integration tests pass.
- The React Native example Gemfiles now require `activesupport >=
7.2.3.1`, which needs Ruby >= 3.1. The Gemfiles still declare `ruby ">=
2.6.10"`; CI runners use modern Ruby, but this is worth a look if anyone
builds those examples on an old Ruby.
- `turbo` moves 2.8.7 → 2.9.14. Note `yarn build` cannot parse
`rrweb/turbo.json` (missing `extends`) on **either** version in a fresh
checkout of this branch's base, so the build was validated with that
submodule file locally patched; the submodule itself is untouched by
this PR.
- Lockfile churn (`yarn.lock`, `poetry.lock`, `package-lock.json`,
`go.sum`) is expected from these bumps; the React Native lockfile was
regenerated and reformatted back to the repo's tab indentation to keep
the diff readable.


Previous session:
https://app.devin.ai/sessions/142c0a5e060144ec97c9177f692e8cb9

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Bumps **dependency versions and lockfiles** across e2e, SDK, and root
tooling to clear Dependabot/Wiz findings, without changing application
logic.
> 
> **Go:** `github.com/gofiber/fiber/v2` **2.52.13 → 2.52.14** in
`sdk/highlight-go`, `e2e/go`, and `e2e/go-plugin` (with `go.sum`
updates).
> 
> **npm/yarn:** Root `package.json` raises **`turbo` to 2.9.14** and
adds/updates **resolutions** for `hono`, `valibot`, `@remix-run/router`,
`markdown-it`, and `uuid`; `yarn.lock` follows. **`e2e/react-native`**
adds overrides for `@remix-run/node`, `ajv@8`, and `yaml@1` and
refreshes `package-lock.json`.
> 
> **Python:** **`django` → 5.2.17** in `e2e/python` and
`sdk/highlight-py` (dev); **`e2e/python`** pins **`loguru` to ^0.7.3**;
**`e2e/tests`** upgrades **`pytest` to ^9** (lockfile includes
**pygments**).
> 
> **Ruby:** React Native example **Gemfiles** require **`activesupport
>= 7.2.3.1`** instead of the older minimum/exclusion pattern.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
92b9ed3. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->


Link to Devin session:
https://app.devin.ai/sessions/52f99250d37f411190c5f723b21ab8b7

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 24, 2026
Merged
osm6495 pushed a commit that referenced this pull request Aug 28, 2026
@devin-ai-integration
fix(deps): pin image-size to 1.2.1 in the react-native e2e app (#747)
ddcfece 
## Summary

Automated dependency-vulnerability remediation run for this repo. Only
one finding was actionable this run; everything else was either already
remediated on `main`, has no fix, or needs a major bump.

- Pins `image-size` to `^1.2.1` via npm `overrides` in the React Native
e2e app, closing a High Wiz finding (CVE-2025-71319) against
`e2e/react-native/package-lock.json`
- Manifest + lockfile only (3 lockfile lines); no source changes, no
major bumps
- The root `yarn.lock` was already on `image-size` 1.2.1 via root
`resolutions`, so only the standalone npm lockfile needed the pin
- Most open Dependabot alerts for this repo are stale (already fixed by
the resolutions on `main`); the rest require major upgrades or have no
patched version

## How did you test this change?

Backend/tooling change, no UI. `npm install` in the react-native e2e app
resolves `image-size@1.2.1`, and the monorepo yarn install + `yarn
build:sdk` were unaffected (20/20 packages build).

## Are there any deployment considerations?

No — the change is limited to an e2e example app's dev dependency tree.

<details>
<summary>Implementation details</summary>

### Findings addressed
| Package | Ecosystem | Current → Target | Severity | Age | Source(s) |
Advisory |
|---|---|---|---|---|---|---|
| image-size (in `e2e/react-native`) | npm | 1.2.0 → 1.2.1 | High | ~2.5
months | Wiz | CVE-2025-71319 |

### Not addressed (require a major version bump)
- `nanoid` 4.0.2 → 5.1.16 (5.x is ESM-only)
- `react-router` 6.30.4 → 7.18.0; `@opentelemetry/core` 1.30.1 → 2.8.0;
`svelte` 4.2.19 → 5.55.7; `@nestjs/core` 10.4.22 → 11.1.18; `file-type`
20.4.1 → 21.3.2; `ts-deepmerge` 2.0.7 → 8.0.0; `markdown-it` 12.3.2 →
14.2.0; `fast-xml-parser` 4.5.6 → 5.7.0; `uuid` (legacy 3.x/7.x/8.x/9.x
copies) → 11.1.1; `@angular/*` 19.2.x → 20.3.27; `pytest` 8.3.5 → 9.0.3
- Java/Android build-time transitives from the Gradle toolchain
(`bcprov-jdk18on` — the only Critical, `netty-*`, `jackson-*`,
`wire-runtime`, `jose4j`, `jdom2`, `grpc-netty`, `commons-io`,
`protobuf-java`): not declared in any manifest here and Maven Central is
not reachable from the automation environment.

### Not addressed (no patched version)
`extract-zip`, `image-size` CVE-2025-71329/71330 (affect all versions
incl. 2.x), `@angular/*` advisories with no fix, `apollo-server-core`,
`react-router-dom` 6.30.4.

### Stale alerts (already fixed on `main`)
`vite` (6.4.3), `next` (15.5.22/16.2.12), `sqlparse` (0.6.0),
`image-size` in root `yarn.lock` (1.2.1), `markdown-it` 14.3.0,
`@opentelemetry/core` 2.10.0 — all pinned by root `resolutions` /
lockfiles already.

### Deferred: NuGet OTel bumps in `e2e/dotnet4/cs/packages.config`
`OpenTelemetry.Api`/`Exporter.OpenTelemetryProtocol` 1.11.2,
`Exporter.Zipkin`/`Extensions.Propagators` 1.9.0 → 1.15.3 and
`Resources.Azure` beta → 1.15.1-beta.1 are in-major bumps, but nuget.org
is not reachable from the automation environment so a restore/build
could not be validated; Dependabot PRs #513 / #509 / #496 already target
them.

### Verification
- Install: npm (react-native e2e app) ✅ / yarn (monorepo) ✅ — only the
known `@highlight-run/rrvideo` puppeteer postinstall failure (Chrome CDN
unreachable)
- Build: `yarn build:sdk` ✅ 20/20
- Tests: unchanged by this diff; the react-native e2e app is not part of
`yarn test` or CI
- Lint/format: `prettier --check` ✅ on both changed files

Note: the `Require additional human oversight on bot PRs` check is
`action_required` by design on bot-authored PRs and needs a human
approval.
</details>


Link to Devin session:
https://app.devin.ai/sessions/4f3892ef6ba94c30abfeafe43b95a6e9

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Addresses **CVE-2025-71319** by forcing transitive **`image-size`**
from **1.2.0 → 1.2.1** in the React Native e2e example, which uses its
own npm lockfile instead of the monorepo yarn resolutions.
> 
> Adds an **`overrides`** entry in `e2e/react-native/package.json` and
updates **`package-lock.json`** accordingly. No application source
changes.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
7870763. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 31, 2026
Merged
kparkinson-ld pushed a commit that referenced this pull request Aug 31, 2026
@devin-ai-integration
fix: bump next to 15.5.24 / 16.3.3 for Critical GHSA-2xp9-vwfh-vxw4 (#…
8916f41 
…751)

## Summary

Bumps `next` past the Critical
[GHSA-2xp9-vwfh-vxw4](GHSA-2xp9-vwfh-vxw4)
/ CVE-2026-75604 advisory (Wiz, first detected 2026-08-26). Root
`resolutions` only; `yarn.lock` regenerated.

- `next` 15.5.22 → **15.5.24** and 16.2.12 → **16.3.3** — patch-level,
no major crossing
- Both fix versions were published 2026-08-25, i.e. 6 days old, so they
are still quarantined by this repo's `npmMinimalAgeGate: 7d`. The gate
is resolution-time only, so the committed lockfile pins install cleanly
(`yarn install --immutable` is green) and **`.yarnrc.yml` is
deliberately left untouched** — no `npmPreapprovedPackages` exemption,
no gate lowering. The pins were computed with a local, uncommitted
`YARN_NPM_MINIMAL_AGE_GATE=0` override. From 2026-09-01 the versions
clear the gate on their own.
- Everything else in this run was deferred, not fixed — see below.

<details>
<summary>Findings: fixed, deferred, and why</summary>

### Fixed

| Package | From | To | Severity | Advisory | Source |
| --- | --- | --- | --- | --- | --- |
| `next` | 15.5.22 | 15.5.24 | Critical | GHSA-2xp9-vwfh-vxw4 /
CVE-2026-75604 | Wiz |
| `next` | 16.2.12 | 16.3.3 | Critical | GHSA-2xp9-vwfh-vxw4 /
CVE-2026-75604 | Wiz |

Dependabot's `next` alerts (High/Moderate, 2026-06-18 and 2026-07-23)
ask for older patched versions (14.2.3x, 15.0.8, 15.5.16, 15.5.21) and
are subsumed by these bumps.

### Deferred — inside the 7-day hold

| Package | Current → required | Severity | Oldest first-seen |
| --- | --- | --- | --- |
| `pacote` | 21.0.0 → 21.5.1 | High | 2026-08-28 (3d) |
| `django` (e2e/python) | 5.2.16 → 5.2.17 | High/Moderate | 2026-08-25
(6d) |
| `django` (e2e/python) | 6.0.7 → 6.0.8 | Moderate | 2026-08-25 (6d) |

### Deferred — would require a major bump (not permitted; pinning a
transitive across a major counts as one)

`svelte` 4.2.19 → 5.51.5, `react-router` 6.30.4 → 7.x, `@nestjs/core`
10.4.22 → 11.x, `@opentelemetry/core` 1.30.1 → 2.x, `@angular/*` →
20.3.27, `nanoid` 4.0.2 → 5.x (5.x is ESM-only), `pacote` 20.0.0 →
21.5.1, `uuid` 3.4.0/7.0.3/8.3.2 in `e2e/react-native/package-lock.json`
→ 11.x, `file-type` 20.4.1 → 21.x, `fast-xml-parser` 4.5.6 → 5.x.

### Deferred — no actionable manifest entry / blocked registry

- Java/Gradle toolchain transitives (`bcprov-jdk18on`, `netty-*`,
`jackson-*`, `wire-runtime`, `jose4j`, `jdom2`, `grpc-netty`,
`commons-io`, `protobuf-java`): pulled in by the Android/Java toolchain,
no declared manifest entry to bump.
- `e2e/dotnet4/cs/packages.config` OpenTelemetry 1.11 → 1.15: nuget.org
is blocked in this environment; Dependabot #513/#509/#496 already cover
it.
- Root `resolutions` already fix `vite`, `markdown-it`, `image-size`,
`@opentelemetry/core`, `uuid` — several Dependabot alerts here lag a
scan behind and are already remediated on `main` (`image-size` via
merged #747).

Nothing was excluded for failing to build.

</details>

## How did you test this change?

- `node .yarn/releases/yarn-4.13.0.cjs install --immutable` — resolution
clean, no lockfile churn, no quarantine error (only the pre-existing
`rrvideo` puppeteer postinstall failure, caused by a blocked Chrome CDN
in this environment)
- `yarn dedupe --check` — no packages can be deduped
- `yarn format-check` — clean
- `yarn build:sdk` — 20/20 tasks pass
- `yarn lint` — 49/49 tasks pass

## Are there any deployment considerations?

No. Dependency manifest + lockfile only; no source or published-artifact
change.


Link to Devin session:
https://app.devin.ai/sessions/62467b8f5f3f4b9ab820356b42af5efa
Open in Devin Desktop:
https://app.devin.ai/desktop/session/62467b8f5f3f4b9ab820356b42af5efa?variant=devin

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Addresses **Critical**
[GHSA-2xp9-vwfh-vxw4](GHSA-2xp9-vwfh-vxw4)
/ CVE-2026-75604 by raising root Yarn **`resolutions`** for `next` and
regenerating **`yarn.lock`**. Patched lines are **15.5.22 → 15.5.24**
and **16.2.12 → 16.3.3** (no major version jumps).
> 
> The lockfile refresh pulls matching **`@next/env`** / platform
**`@next/swc-*`** binaries. For the 16.x line, transitive updates
include **`@swc/helpers` 0.5.23**, **`postcss` 8.5.23**, and a broader
**`sharp`** range on 15.x (`^0.34.3 || ^0.35.3`) plus **`^0.35.3`** on
16.x. No application or SDK source changes—only how the monorepo pins
Next for e2e (`e2e/nextjs`, `e2e/nextjs-ld`) and peers on
`@launchdarkly/observability-next`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
0a7a0cf. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Sep 7, 2026
Open

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants