Skip to content

fix: bump nanoid, @hono/node-server, and sqlparse to patched versions - #744

Merged
osm6495 merged 1 commit into
mainfrom
devin/dep-vulns/2026-08-24
Aug 24, 2026
Merged

fix: bump nanoid, @hono/node-server, and sqlparse to patched versions#744
osm6495 merged 1 commit into
mainfrom
devin/dep-vulns/2026-08-24

Conversation

@devin-ai-integration

@devin-ai-integration devin-ai-integration Bot commented Aug 24, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

Patches three actionable dependency vulnerability findings (Dependabot + Wiz) with lockfile/resolution-only changes — no source changes.

All target versions were published more than 7 days ago.

Triage, deferrals and testing

Policy applied

Critical fixed immediately; High/Moderate fixed when the alert is older than 7 days; Low and no-published-fix findings ignored. 103 open Dependabot alerts were reconciled against the current manifests/lockfiles (many were already remediated by PR #732 and are simply awaiting a Dependabot rescan — e.g. the vite alerts still report 5.4.21 while yarn.lock resolves 6.4.3 / 7.3.6 / 8.0.16).

Deferred — needs a major upgrade with code changes

  • nanoid 4.0.2 (yarn.lock) — patched line is the ESM-only 5.x major
  • svelte 4.2.19 → 5.55.7, react-router 6.30.4 → 7.18.0, @nestjs/core → 11.1.18, @opentelemetry/core 1.30.1 → 2.8.0, file-type → 21.3.2, fast-xml-parser → 5.7.0, ts-deepmerge → 8.0.0, markdown-it 12.3.2 → 14.x, uuid 7.0.3 → 11.1.1, pytest 8.3.5 → 9.0.3
  • These are e2e-example/transitive dev dependencies; each needs its own PR with test validation.

Deferred — not buildable in this environment

  • bcprov-jdk18on (Wiz critical, build-time-only AGP transitive in sdk/@launchdarkly/flutter/.../android/build.gradle and sdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle) — needs Android SDK / Maven Central, both unreachable from the agent sandbox, so it cannot be changed safely or verified here.
  • NuGet OpenTelemetry findings in e2e/dotnet4/cs/packages.config — nuget.org is unreachable; Dependabot already has PRs open for these.

Excluded — no published fix

@angular/common, @angular/core, @angular/compiler, image-size, extract-zip, react-router-dom, apollo-server-core.

Testing

  • yarn dedupe --check — clean
  • yarn format-check — clean
  • yarn build:sdk — 20/20 tasks pass
  • yarn lint — 49/49 tasks pass
  • poetry update sqlparse --lock run with Poetry 2.2.1 in each of the three projects (lock-only, no format churn)
  • npm lockfile for e2e/react-native regenerated with npm install --package-lock-only and re-formatted with the repo's Prettier config, so the diff is limited to the nanoid entries

Known environment failures, not introduced by this PR: yarn install fails linking @highlight-run/rrvideo because its postinstall downloads Playwright Firefox from a blocked CDN (playwright.download.prss.microsoft.com), and puppeteer's postinstall fails on the blocked Chrome CDN. Neither affects dependency resolution or the lockfile. yarn test was not run to completion in the sandbox — angular.io-example#build requires fonts.googleapis.com, which is blocked; CI covers it.

Note: the "Require additional human oversight on bot PRs" check is action_required by design on bot PRs and needs a human.

Link to Devin session: https://app.devin.ai/sessions/842a8045765a4ccb96a0bc7d13ffb2c5

Note

Overview
Patches three known dependency CVEs with lockfile/resolution-only updates (no application source changes).

Forces nanoid@3 to 3.3.18 in the React Native e2e app so a hoisted 3.3.8 copy is no longer used. Tightens the root Yarn resolution for @hono/node-server to ^1.19.15 (lockfile lands on 1.19.17). Bumps transitive sqlparse 0.5.5 → 0.6.0 in the Python e2e and SDK poetry locks (requires Python ≥3.10, matching existing Django/dev extras).

Reviewed by Cursor Bugbot for commit 48fd991. Bugbot is set up for automated code reviews on this repo. Configure here.

@devin-ai-integration
fix: bump nanoid, @hono/node-server, and sqlparse to patched versions
48fd991 
Addresses open Dependabot/Wiz dependency findings:
- nanoid 3.3.8 -> 3.3.18 (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8) via npm override in e2e/react-native
- @hono/node-server ^1.19.13 -> ^1.19.15, resolves 1.19.17 (GHSA-frvp-7c67-39w9)
- sqlparse 0.5.5 -> 0.6.0 in three poetry.lock files (GHSA-f2ff-p2ww-7p4p, GHSA-pwgv-4x5q-6m9f, GHSA-prg7-hcfm-mfcr, GHSA-3496-9g83-7v6x)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@devin-ai-integration
devin-ai-integration Bot requested a review from a team as a code owner August 24, 2026 13:21
@devin-ai-integration

devin-ai-integration Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment, CI, and merge conflict monitoring

@devin-ai-integration devin-ai-integration Bot added automated-security-deps Automated dependency security remediation devin-pr labels Aug 24, 2026
@devin-ai-integration
devin-ai-integration Bot requested a review from a team August 24, 2026 13:21
@github-actions

github-actions Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines Covered Coverage Threshold Status
628 551 88% 0% 🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 48fd991 by action🐍

@osm6495
osm6495 merged commit 03b4da5 into main Aug 24, 2026
28 checks passed
@osm6495
osm6495 deleted the devin/dep-vulns/2026-08-24 branch August 24, 2026 19:33
@LaunchDarklyReleaseBot LaunchDarklyReleaseBot mentioned this pull request Aug 24, 2026
Merged
Vadman97 pushed a commit that referenced this pull request Aug 26, 2026
@LaunchDarklyReleaseBot
chore: release main (#745)
d678b54 
🤖 I have created a release *beep* *boop*
---


<details><summary>launchdarkly-observability-python: 1.3.3</summary>

##
[1.3.3](launchdarkly-observability-python-1.3.2...launchdarkly-observability-python-1.3.3)
(2026-08-24)


### Bug Fixes

* bump nanoid, @hono/node-server, and sqlparse to patched versions
([#744](#744))
([03b4da5](03b4da5))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Release Please bumps **launchdarkly-observability** from **1.3.2** to
**1.3.3** across the manifest, `pyproject.toml`, `PROVENANCE.md`, and
changelog.
> 
> The new changelog entry documents a bug-fix release that ships patched
dependency versions (**sqlparse**, plus **nanoid** and
**@hono/node-server** from the broader monorepo fix in
[#744](#744)).
This PR contains no runtime or API code changes—only release metadata
for publishing **1.3.3** to PyPI.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
040d4ad. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
abelonogov-ld added a commit that referenced this pull request Sep 14, 2026
@abelonogov-ld
Merge branch 'main' into andrey/flutter-sr-screenview
1e53227 
* main: (57 commits)
  chore: release main (#761)
  fix(highlight.run): never JSON.stringify binary XHR bodies or capture the SDK's own exports (iPad crash root cause) (#760)
  chore: release main (#759)
  fix(highlight.run): WebKit/iPad performance hardening — dedupe OpenTelemetry bundles, cap body capture, resync option, telemetry-intake blocklist (#758)
  chore: release main (#754)
  fix(highlight.run): record fetch request bodies and headers that are not plain strings or objects (#753)
  fix(highlight.run): capture XMLHttpRequest bodies and headers on traces without the session replay listener (#752)
  fix: bump next to 15.5.24 / 16.3.3 for Critical GHSA-2xp9-vwfh-vxw4 (#751)
  fix(deps): pin image-size to 1.2.1 in the react-native e2e app (#747)
  chore: release main (#749)
  feat(go): Add explicit ForceSample marker to the span-kind sampler (#738)
  chore: release main (#745)
  fix: bump nanoid, @hono/node-server, and sqlparse to patched versions (#744)
  fix(highlight-go): allow histogram bucket boundaries, and stop racing on the instrument cache (#740)
  chore(react-native): add fading overlay examples to session replay masking tab (#742)
  chore: Update Skip Howdy example (#733)
  chore: release main (#741)
  feat(react-native): fix lagging masks and imageQuality option (#734)
  chore: release main (#736)
  fix(android): anchor session replay masks to the rendered frame and cover stretch overscroll (Rubber animation) (#739)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Vadman97 Vadman97 Vadman97 approved these changes
@osm6495 osm6495 osm6495 approved these changes

Assignees

No one assigned

Labels

automated-security-deps Automated dependency security remediation devin-pr

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Vadman97 @osm6495