fix: remediate dependency vulnerabilities across npm, go, pip, and rubygems - #732
Merged
Merged
Conversation
…bygems Bump vulnerable direct and transitive dependencies flagged by Dependabot and Wiz. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
devin-ai-integration
Bot
added
devin-pr
automated-security-deps
Contributor
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
osm6495
approved these changes
Aug 17, 2026
Vadman97
approved these changes
Aug 18, 2026
Merged
abelonogov-ld
pushed a commit
that referenced
this pull request
Aug 19, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>launchdarkly-observability-android: 0.66.1</summary> ## [0.66.1](launchdarkly-observability-android-0.66.0...launchdarkly-observability-android-0.66.1) (2026-08-19) ### Bug Fixes * **android:** anchor session replay masks to the rendered frame and cover stretch overscroll (Rubber animation) ([#739](#739)) ([b2f151a](b2f151a)) </details> <details><summary>session-replay-react-native: 0.22.2</summary> ## [0.22.2](session-replay-react-native-0.22.1...session-replay-react-native-0.22.2) (2026-08-19) ### Bug Fixes * remediate dependency vulnerabilities across npm, go, pip, and rubygems ([#732](#732)) ([9cbe8d5](9cbe8d5)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > Release Please bumps **launchdarkly-observability-android** to **0.66.1** and **@launchdarkly/session-replay-react-native** to **0.22.2**, updating the release manifest, package metadata, and changelogs. > > **0.66.1** documents a session replay fix: privacy masks anchor to the rendered frame and cover stretch overscroll (“rubber band”) animation ([#739](#739)). **0.22.2** documents dependency vulnerability remediation across the repo ([#732](#732)). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7bf0a3e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
abelonogov-ld
added a commit
that referenced
this pull request
Aug 20, 2026
* main: chore: release main (#741) feat(react-native): fix lagging masks and imageQuality option (#734) chore: release main (#736) fix(android): anchor session replay masks to the rendered frame and cover stretch overscroll (Rubber animation) (#739) fix: remediate dependency vulnerabilities across npm, go, pip, and rubygems (#732) chore: release main (#735)
osm6495
pushed a commit
that referenced
this pull request
Aug 24, 2026
…#744) ## Summary Patches three actionable dependency vulnerability findings (Dependabot + Wiz) with lockfile/resolution-only changes — no source changes. - `nanoid` 3.3.8 → 3.3.18 in `e2e/react-native` (HIGH: GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8) via an npm `overrides` entry, since npm hoists a vulnerable copy alongside the already-patched `postcss` one - `@hono/node-server` root resolution `^1.19.13` → `^1.19.15`, resolving 1.19.17 (MODERATE: GHSA-frvp-7c67-39w9) - `sqlparse` 0.5.5 → 0.6.0 in `e2e/python`, `sdk/@launchdarkly/observability-python`, `sdk/highlight-py` poetry locks (HIGH: GHSA-f2ff-p2ww-7p4p, GHSA-pwgv-4x5q-6m9f, GHSA-prg7-hcfm-mfcr; MODERATE: GHSA-3496-9g83-7v6x) All target versions were published more than 7 days ago. <details> <summary>Triage, deferrals and testing</summary> ### Policy applied Critical fixed immediately; High/Moderate fixed when the alert is older than 7 days; Low and no-published-fix findings ignored. 103 open Dependabot alerts were reconciled against the current manifests/lockfiles (many were already remediated by PR #732 and are simply awaiting a Dependabot rescan — e.g. the `vite` alerts still report 5.4.21 while `yarn.lock` resolves 6.4.3 / 7.3.6 / 8.0.16). ### Deferred — needs a major upgrade with code changes - `nanoid` 4.0.2 (yarn.lock) — patched line is the ESM-only 5.x major - `svelte` 4.2.19 → 5.55.7, `react-router` 6.30.4 → 7.18.0, `@nestjs/core` → 11.1.18, `@opentelemetry/core` 1.30.1 → 2.8.0, `file-type` → 21.3.2, `fast-xml-parser` → 5.7.0, `ts-deepmerge` → 8.0.0, `markdown-it` 12.3.2 → 14.x, `uuid` 7.0.3 → 11.1.1, `pytest` 8.3.5 → 9.0.3 - These are e2e-example/transitive dev dependencies; each needs its own PR with test validation. ### Deferred — not buildable in this environment - `bcprov-jdk18on` (Wiz critical, build-time-only AGP transitive in `sdk/@launchdarkly/flutter/.../android/build.gradle` and `sdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle`) — needs Android SDK / Maven Central, both unreachable from the agent sandbox, so it cannot be changed safely or verified here. - NuGet OpenTelemetry findings in `e2e/dotnet4/cs/packages.config` — nuget.org is unreachable; Dependabot already has PRs open for these. ### Excluded — no published fix `@angular/common`, `@angular/core`, `@angular/compiler`, `image-size`, `extract-zip`, `react-router-dom`, `apollo-server-core`. ### Testing - `yarn dedupe --check` — clean - `yarn format-check` — clean - `yarn build:sdk` — 20/20 tasks pass - `yarn lint` — 49/49 tasks pass - `poetry update sqlparse --lock` run with Poetry 2.2.1 in each of the three projects (lock-only, no format churn) - npm lockfile for `e2e/react-native` regenerated with `npm install --package-lock-only` and re-formatted with the repo's Prettier config, so the diff is limited to the `nanoid` entries Known environment failures, not introduced by this PR: `yarn install` fails linking `@highlight-run/rrvideo` because its postinstall downloads Playwright Firefox from a blocked CDN (`playwright.download.prss.microsoft.com`), and puppeteer's postinstall fails on the blocked Chrome CDN. Neither affects dependency resolution or the lockfile. `yarn test` was not run to completion in the sandbox — `angular.io-example#build` requires `fonts.googleapis.com`, which is blocked; CI covers it. Note: the "Require additional human oversight on bot PRs" check is `action_required` by design on bot PRs and needs a human. </details> Link to Devin session: https://app.devin.ai/sessions/842a8045765a4ccb96a0bc7d13ffb2c5 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > Patches three known dependency CVEs with lockfile/resolution-only updates (no application source changes). > > Forces `nanoid@3` to **3.3.18** in the React Native e2e app so a hoisted 3.3.8 copy is no longer used. Tightens the root Yarn resolution for `@hono/node-server` to **^1.19.15** (lockfile lands on 1.19.17). Bumps transitive `sqlparse` **0.5.5 → 0.6.0** in the Python e2e and SDK poetry locks (requires Python ≥3.10, matching existing Django/dev extras). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 48fd991. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Automated dependency-vulnerability remediation for findings reported by GitHub Dependabot and Wiz. Only findings that are actionable under the severity/age policy (critical immediately; high/moderate after a 7-day hold; low ignored; must have a published fixed version) and that are still present in the manifests/lockfiles are included. Stale alerts (already patched in the lockfile, e.g.
next,vite,djangoinsdk/highlight-pyafter this change) were verified against the lockfiles rather than trusted blindly.Fixed:
github.com/gofiber/fiber/v2turbohonovalibot@remix-run/routermarkdown-ituuid@remix-run/node(e2e/react-native)ajv(e2e/react-native)yaml(e2e/react-native)js-yamldjango(sdk/highlight-py dev dep)django(e2e/python)pytest(e2e/tests)loguru(e2e/python)^0→^0.7.3activesupport(RN example Gemfiles)>= 6.1.7.5→>= 7.2.3.1Deferred, with reasons:
org.bouncycastle:bcprov-jdk18on1.77 → 1.80.2 (Wiz, CVE-2025-14813) insdk/@launchdarkly/flutter/.../android/build.gradleandsdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle. It is a build-time-only transitive of thecom.android.tools.build:gradle8.7.2 buildscript classpath (not shipped in artifacts); the real fix is an AGP upgrade. No Android SDK and no Maven Central access in this environment, so the change could not be built or verified — left for a dedicated PR.@angular/*,apollo-server-core,extract-zip,image-size,react-router-dom.@nestjs/core10 → 11,svelte4 → 5,react-router6 → 7,@opentelemetry/core1.30 → 2.x,file-type20 → 21,fast-xml-parser4 → 5,ts-deepmerge2 → 8, transitivenanoid4 → 5 andmarkdown-it12 → 14.@hono/node-server1.19.15, plus the newestimage-sizeadvisories.nanoid: the 3.x line is already at 3.3.18 in the lockfile (patched); the remaining alert covers the transitivenanoid@4.0.2, whose fix is the ESM-only 5.x major, so it stays in the major-upgrade bucket.pytest9 ine2e/python—pytest-asyncio0.25.3 requirespytest <9, so that manifest stays on^8.2.0.e2e/dotnet4/cs/packages.config): already covered by open Dependabot PRs (Bump the nuget group with 4 updates #513, Bump the nuget group with 1 update #509, Bump the nuget group with 1 update #496) and nuget.org is not reachable here, so no duplicate change.webpack,body-parser,@babel/core,json,msgpack,sqlite3,flask,@tootallnate/once).Excluded because it did not build: none — but see the environment caveats below.
How did you test this change?
Dependency-only change, no runtime behavior change, so no screenshots or staging link apply.
yarn install+yarn dedupe --check— clean (Puppeteer's Chrome-download postinstall fails in this sandbox because its CDN is blocked; unrelated to these bumps).yarn build:sdk— 20/20 tasks pass.yarn build— 49/53; onlyangular.io-example#buildfails, because font inlining needsfonts.googleapis.com, which is blocked in this sandbox.yarn lint— 49/49 pass.yarn test— 76/77 pass.@highlight-run/next#testfails because the test boots a Next app whose corepack step downloads yarn fromrepo.yarnpkg.com(blocked here).aws-lambda#buildneeds thesamCLI, which is not installed.js-yamlbump:yarn build:sdk20/20 pass andyarn test57/61, withangular.io-example#buildthe only failure (blocked Google Fonts, as above).yarn format-check— the only warnings are local build artifacts underlib/(not tracked); all changed manifests pass Prettier.go build ./...,go vet ./...,go mod verifypass insdk/highlight-goande2e/go-plugin.sdk/highlight-gotests pass except a pre-existinglog.TestParseConsoleMessagesfailure (reproduced on the unmodified module), ande2e/gohas a pre-existing duplicatemaininfiber.go/echo.go.sdk/highlight-pysuite passes on Django 5.2.17 (259 tests);e2e/testsinstalls and collects on pytest 9;e2e/pythonimports Django/loguru/Flask cleanly.Are there any deployment considerations?
No migrations or backfills. Notes for reviewers:
sdk/highlight-pymoves its dev dependency Django from 4.x to 5.2.17 (the advisories have no 4.x fix); the shipped package is unaffected and the Django integration tests pass.activesupport >= 7.2.3.1, which needs Ruby >= 3.1. The Gemfiles still declareruby ">= 2.6.10"; CI runners use modern Ruby, but this is worth a look if anyone builds those examples on an old Ruby.turbomoves 2.8.7 → 2.9.14. Noteyarn buildcannot parserrweb/turbo.json(missingextends) on either version in a fresh checkout of this branch's base, so the build was validated with that submodule file locally patched; the submodule itself is untouched by this PR.yarn.lock,poetry.lock,package-lock.json,go.sum) is expected from these bumps; the React Native lockfile was regenerated and reformatted back to the repo's tab indentation to keep the diff readable.Previous session: https://app.devin.ai/sessions/142c0a5e060144ec97c9177f692e8cb9
Note
Overview
Bumps dependency versions and lockfiles across e2e, SDK, and root tooling to clear Dependabot/Wiz findings, without changing application logic.
Go:
github.com/gofiber/fiber/v22.52.13 → 2.52.14 insdk/highlight-go,e2e/go, ande2e/go-plugin(withgo.sumupdates).npm/yarn: Root
package.jsonraisesturboto 2.9.14 and adds/updates resolutions forhono,valibot,@remix-run/router,markdown-it, anduuid;yarn.lockfollows.e2e/react-nativeadds overrides for@remix-run/node,ajv@8, andyaml@1and refreshespackage-lock.json.Python:
django→ 5.2.17 ine2e/pythonandsdk/highlight-py(dev);e2e/pythonpinsloguruto ^0.7.3;e2e/testsupgradespytestto ^9 (lockfile includes pygments).Ruby: React Native example Gemfiles require
activesupport >= 7.2.3.1instead of the older minimum/exclusion pattern.Reviewed by Cursor Bugbot for commit 92b9ed3. Bugbot is set up for automated code reviews on this repo. Configure here.
Link to Devin session: https://app.devin.ai/sessions/52f99250d37f411190c5f723b21ab8b7