From df5601059e72be8cc442883bc15a1308a5d32341 Mon Sep 17 00:00:00 2001 From: Kane Parkinson Date: Tue, 14 Jul 2026 00:36:25 +0000 Subject: [PATCH] chore(deps): remediate critical dependency alerts --- e2e/react-native/package-lock.json | 6 +- e2e/ruby/rails/demo-rails70/Gemfile | 17 +- e2e/ruby/rails/demo-rails70/Gemfile.lock | 161 ++++++++++-------- e2e/ruby/rails/demo-rails70/README.md | 28 ++- .../observability-next/package.json | 4 +- yarn.lock | 86 +++++----- 6 files changed, 153 insertions(+), 149 deletions(-) diff --git a/e2e/react-native/package-lock.json b/e2e/react-native/package-lock.json index cc28d38b21..0d9d5943ad 100644 --- a/e2e/react-native/package-lock.json +++ b/e2e/react-native/package-lock.json @@ -15724,9 +15724,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.2", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.2.tgz", - "integrity": "sha512-AzqKpGKjrj7EM6rKVQEPpB288oCfnrEIuyoT9cyF4nmGa7V8Zk6f7RRqYisX8X9m+Q7bd632aZW4ky7EhbQztA==", + "version": "1.8.4", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", + "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", "license": "MIT", "engines": { "node": ">= 0.4" diff --git a/e2e/ruby/rails/demo-rails70/Gemfile b/e2e/ruby/rails/demo-rails70/Gemfile index 0ba87cc288..12aec8d5ca 100644 --- a/e2e/ruby/rails/demo-rails70/Gemfile +++ b/e2e/ruby/rails/demo-rails70/Gemfile @@ -5,18 +5,11 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '~> 3.3.4' -# Rails 7.0 on purpose: this app reproduces the CardFlight failure where the -# OTel Rails-family instrumentations (opentelemetry-instrumentation-rails >= 0.35) -# raised their floor to Rails 7.1, so on Rails 7.0 they fail their runtime -# `compatible?` check and never attach. Ruby stays at 3.3.4 (>= 3.2) so bundler -# resolves the LATEST opentelemetry-instrumentation-all — the same versions a -# real Rails 7.0 customer on a current Ruby gets. (On Ruby < 3.2 bundler would -# self-heal to an older instrumentation-all and the bug would not reproduce.) -gem 'rails', '~> 7.0.0' - -# Rails 7.0's test runner (railties test_unit line filtering) is incompatible -# with minitest 6.x (the `run` arity changed). Pin to 5.x so the suite runs. -# Unrelated to the instrumentation bug — just a Rails-7.0 test-toolchain pin. +# Keep the legacy Rails-family instrumentation coverage on the oldest safe +# Rails 7.1 release line. +gem 'rails', '~> 7.1.5', '>= 7.1.5.2' + +# The Rails test runner is incompatible with minitest 6.x (`run` arity changed). gem 'minitest', '~> 5.0' # The original asset pipeline for Rails [https://github.com/rails/sprockets-rails] diff --git a/e2e/ruby/rails/demo-rails70/Gemfile.lock b/e2e/ruby/rails/demo-rails70/Gemfile.lock index dc84228d35..04941e368a 100644 --- a/e2e/ruby/rails/demo-rails70/Gemfile.lock +++ b/e2e/ruby/rails/demo-rails70/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: ../../../../sdk/@launchdarkly/observability-ruby specs: - launchdarkly-observability (0.2.2) + launchdarkly-observability (0.3.0) launchdarkly-server-sdk (>= 8.11.0) opentelemetry-exporter-otlp (~> 0.28) opentelemetry-exporter-otlp-logs (~> 0.1) @@ -31,72 +31,78 @@ PATH GEM remote: https://rubygems.org/ specs: - actioncable (7.0.10) - actionpack (= 7.0.10) - activesupport (= 7.0.10) + actioncable (7.1.6) + actionpack (= 7.1.6) + activesupport (= 7.1.6) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (7.0.10) - actionpack (= 7.0.10) - activejob (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + zeitwerk (~> 2.6) + actionmailbox (7.1.6) + actionpack (= 7.1.6) + activejob (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) mail (>= 2.7.1) net-imap net-pop net-smtp - actionmailer (7.0.10) - actionpack (= 7.0.10) - actionview (= 7.0.10) - activejob (= 7.0.10) - activesupport (= 7.0.10) + actionmailer (7.1.6) + actionpack (= 7.1.6) + actionview (= 7.1.6) + activejob (= 7.1.6) + activesupport (= 7.1.6) mail (~> 2.5, >= 2.5.4) net-imap net-pop net-smtp - rails-dom-testing (~> 2.0) - actionpack (7.0.10) - actionview (= 7.0.10) - activesupport (= 7.0.10) + rails-dom-testing (~> 2.2) + actionpack (7.1.6) + actionview (= 7.1.6) + activesupport (= 7.1.6) + cgi + nokogiri (>= 1.8.5) racc - rack (~> 2.0, >= 2.2.4) + rack (>= 2.2.4) + rack-session (>= 1.0.1) rack-test (>= 0.6.3) - rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (7.0.10) - actionpack (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + actiontext (7.1.6) + actionpack (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.0.10) - activesupport (= 7.0.10) + actionview (7.1.6) + activesupport (= 7.1.6) builder (~> 3.1) - erubi (~> 1.4) - rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (7.0.10) - activesupport (= 7.0.10) + cgi + erubi (~> 1.11) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + activejob (7.1.6) + activesupport (= 7.1.6) globalid (>= 0.3.6) - activemodel (7.0.10) - activesupport (= 7.0.10) - activerecord (7.0.10) - activemodel (= 7.0.10) - activesupport (= 7.0.10) - activestorage (7.0.10) - actionpack (= 7.0.10) - activejob (= 7.0.10) - activerecord (= 7.0.10) - activesupport (= 7.0.10) + activemodel (7.1.6) + activesupport (= 7.1.6) + activerecord (7.1.6) + activemodel (= 7.1.6) + activesupport (= 7.1.6) + timeout (>= 0.4.0) + activestorage (7.1.6) + actionpack (= 7.1.6) + activejob (= 7.1.6) + activerecord (= 7.1.6) + activesupport (= 7.1.6) marcel (~> 1.0) - mini_mime (>= 1.1.0) - activesupport (7.0.10) + activesupport (7.1.6) base64 benchmark (>= 0.3) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) + connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) logger (>= 1.4.2) @@ -122,8 +128,10 @@ GEM rack-test (>= 0.6.3) regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) + cgi (0.5.2) concurrent-ruby (1.3.7) - crass (1.0.6) + connection_pool (3.0.2) + crass (1.0.7) date (3.5.1) debug (1.11.1) irb (~> 1.10) @@ -132,7 +140,7 @@ GEM drb (2.2.3) erb (6.0.4) erubi (1.13.1) - globalid (1.3.0) + globalid (1.4.0) activesupport (>= 6.1) google-protobuf (4.35.1) bigdecimal @@ -162,7 +170,7 @@ GEM llhttp (~> 0.6.1) http-cookie (1.1.6) domain_name (~> 0.5) - i18n (1.15.1) + i18n (1.15.2) concurrent-ruby (~> 1.0) importmap-rails (2.2.3) actionpack (>= 6.0.0) @@ -196,7 +204,7 @@ GEM loofah (2.25.1) crass (~> 1.0.2) nokogiri (>= 1.12.0) - mail (2.9.0) + mail (2.9.1) logger mini_mime (>= 0.1.1) net-imap @@ -204,7 +212,6 @@ GEM net-smtp marcel (1.2.1) matrix (0.4.3) - method_source (1.1.0) mini_mime (1.1.5) minitest (5.27.0) msgpack (1.8.3) @@ -346,23 +353,28 @@ GEM puma (6.6.1) nio4r (~> 2.0) racc (1.8.1) - rack (2.2.23) + rack (3.2.6) + rack-session (2.1.2) + base64 (>= 0.1.0) + rack (>= 3.0.0) rack-test (2.2.0) rack (>= 1.3) - rails (7.0.10) - actioncable (= 7.0.10) - actionmailbox (= 7.0.10) - actionmailer (= 7.0.10) - actionpack (= 7.0.10) - actiontext (= 7.0.10) - actionview (= 7.0.10) - activejob (= 7.0.10) - activemodel (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + rackup (2.3.1) + rack (>= 3) + rails (7.1.6) + actioncable (= 7.1.6) + actionmailbox (= 7.1.6) + actionmailer (= 7.1.6) + actionpack (= 7.1.6) + actiontext (= 7.1.6) + actionview (= 7.1.6) + activejob (= 7.1.6) + activemodel (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) bundler (>= 1.15.0) - railties (= 7.0.10) + railties (= 7.1.6) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -370,13 +382,16 @@ GEM rails-html-sanitizer (1.7.0) loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.0.10) - actionpack (= 7.0.10) - activesupport (= 7.0.10) - method_source + railties (7.1.6) + actionpack (= 7.1.6) + activesupport (= 7.1.6) + cgi + irb + rackup (>= 1.0.0) rake (>= 12.2) - thor (~> 1.0) - zeitwerk (~> 2.5) + thor (~> 1.0, >= 1.2.2) + tsort (>= 0.2) + zeitwerk (~> 2.6) rake (13.4.2) rdoc (7.2.0) erb @@ -427,7 +442,7 @@ GEM railties (>= 6.0.0) webrick (1.9.2) websocket (1.2.11) - websocket-driver (0.8.1) + websocket-driver (0.8.2) base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) @@ -459,7 +474,7 @@ DEPENDENCIES launchdarkly-server-sdk (~> 8.0) minitest (~> 5.0) puma (~> 6.0) - rails (~> 7.0.0) + rails (~> 7.1.5, >= 7.1.5.2) redis (~> 4.0) selenium-webdriver sprockets-rails diff --git a/e2e/ruby/rails/demo-rails70/README.md b/e2e/ruby/rails/demo-rails70/README.md index fa45d7ed0d..408d3a1db7 100644 --- a/e2e/ruby/rails/demo-rails70/README.md +++ b/e2e/ruby/rails/demo-rails70/README.md @@ -1,20 +1,16 @@ -# demo-rails70 — Rails 7.0 observability regression repro +# demo-rails70 — legacy Rails observability regression repro -A Rails **7.0** application that pins the LaunchDarkly observability plugin to a -known-broken scenario and guards against it regressing. It is a copy of -[`../demo`](../demo) (Rails 7.2) with Rails pinned to `~> 7.0`. +A legacy Rails application that pins the LaunchDarkly observability plugin to a +known-broken scenario and guards against it regressing. The historical directory +name is retained to avoid path churn, while Rails is constrained to the oldest +safe 7.1 release line. ## Why this exists -CardFlight runs Rails 7.0. The plugin used to depend on -`opentelemetry-instrumentation-all`, whose Rails-family members raised their -minimum to **Rails 7.1**. On Rails 7.0 every Rails-family instrumentation failed -its runtime `compatible?` check, logged a flurry of `"... failed to install"` -warnings, and never attached — so the app lost all Rails auto-instrumentation -(no HTTP server spans, DB spans, etc.) and got only manual instrumentation. - -The other e2e apps run Rails 7.2, which is **above** that floor, so they can -never catch this class of break. This app reproduces it on Rails 7.0. +The plugin used to depend on `opentelemetry-instrumentation-all`, whose +Rails-family members could fail their runtime `compatible?` checks and never +attach. This app keeps dedicated coverage for the individually pinned +Rails-family instrumentations on an older supported Rails release. Ruby stays at **3.3.4** on purpose: on a current Ruby, Bundler still resolves the *latest* instrumentation gems, faithfully matching a real Rails 7.0 customer. (On @@ -33,9 +29,9 @@ are actually **exported over the wire** — in pure Ruby, no Docker or Node, und `test/integration/otlp_export_e2e_test.rb` is the headline test: -- **Before the fix** (instrumentation-all → instrumentation-rails 0.42): no server - span is produced or exported — the test fails. -- **After the fix** (instrumentation-rails pinned to 0.41): the server span, +- **Without compatible Rails-family instrumentation**: no server span is + produced or exported — the test fails. +- **With instrumentation-rails pinned to 0.41**: the server span, log, and exception all reach the sink — the test passes. ## Running it diff --git a/sdk/@launchdarkly/observability-next/package.json b/sdk/@launchdarkly/observability-next/package.json index cb503ac4bc..fd6c186cb8 100644 --- a/sdk/@launchdarkly/observability-next/package.json +++ b/sdk/@launchdarkly/observability-next/package.json @@ -69,7 +69,7 @@ }, "author": "", "peerDependencies": { - "next": ">=14", + "next": ">=14.2.25", "react": ">=17" }, "dependencies": { @@ -87,7 +87,7 @@ "@types/js-cookie": "^3", "@types/node": "^20.14.7", "@types/react": "^19.0.10", - "next": ">=14", + "next": ">=14.2.25", "react": "^19.0.0", "rollup": "^4.4.1", "typescript": "^5.0.4" diff --git a/yarn.lock b/yarn.lock index 6b076b2d05..b60acb7c0e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9236,12 +9236,12 @@ __metadata: "@types/node": "npm:^20.14.7" "@types/react": "npm:^19.0.10" js-cookie: "npm:^3.0.5" - next: "npm:>=14" + next: "npm:>=14.2.25" react: "npm:^19.0.0" rollup: "npm:^4.4.1" typescript: "npm:^5.0.4" peerDependencies: - next: ">=14" + next: ">=14.2.25" react: ">=17" languageName: unknown linkType: soft @@ -10221,10 +10221,10 @@ __metadata: languageName: node linkType: hard -"@next/env@npm:16.2.9": - version: 16.2.9 - resolution: "@next/env@npm:16.2.9" - checksum: 10/5cb54e8a956dbeb72eb5db966a7280fdc08693f4ffbd98c425a43f4d03abfa3c66868c1035b3203572990bdcd46d385eb8edcf41ee31dde5359743264001bce9 +"@next/env@npm:16.2.10": + version: 16.2.10 + resolution: "@next/env@npm:16.2.10" + checksum: 10/6a1db53fb923f8b3678b9fcc01cbe659a4724b6b29a8ce35fc61961ff0c9216b4ea3653fa0ddc059b26890eb4efaca6c7b8328ca920db53d18432f6d0cfab0d2 languageName: node linkType: hard @@ -10244,9 +10244,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-arm64@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-darwin-arm64@npm:16.2.9" +"@next/swc-darwin-arm64@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-darwin-arm64@npm:16.2.10" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard @@ -10258,9 +10258,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-x64@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-darwin-x64@npm:16.2.9" +"@next/swc-darwin-x64@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-darwin-x64@npm:16.2.10" conditions: os=darwin & cpu=x64 languageName: node linkType: hard @@ -10272,9 +10272,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-arm64-gnu@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-linux-arm64-gnu@npm:16.2.9" +"@next/swc-linux-arm64-gnu@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-linux-arm64-gnu@npm:16.2.10" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard @@ -10286,9 +10286,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-arm64-musl@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-linux-arm64-musl@npm:16.2.9" +"@next/swc-linux-arm64-musl@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-linux-arm64-musl@npm:16.2.10" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard @@ -10300,9 +10300,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-x64-gnu@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-linux-x64-gnu@npm:16.2.9" +"@next/swc-linux-x64-gnu@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-linux-x64-gnu@npm:16.2.10" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard @@ -10314,9 +10314,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-x64-musl@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-linux-x64-musl@npm:16.2.9" +"@next/swc-linux-x64-musl@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-linux-x64-musl@npm:16.2.10" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard @@ -10328,9 +10328,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-win32-arm64-msvc@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-win32-arm64-msvc@npm:16.2.9" +"@next/swc-win32-arm64-msvc@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-win32-arm64-msvc@npm:16.2.10" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard @@ -10342,9 +10342,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-win32-x64-msvc@npm:16.2.9": - version: 16.2.9 - resolution: "@next/swc-win32-x64-msvc@npm:16.2.9" +"@next/swc-win32-x64-msvc@npm:16.2.10": + version: 16.2.10 + resolution: "@next/swc-win32-x64-msvc@npm:16.2.10" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -37143,19 +37143,19 @@ __metadata: languageName: node linkType: hard -"next@npm:>=14": - version: 16.2.9 - resolution: "next@npm:16.2.9" +"next@npm:>=14.2.25": + version: 16.2.10 + resolution: "next@npm:16.2.10" dependencies: - "@next/env": "npm:16.2.9" - "@next/swc-darwin-arm64": "npm:16.2.9" - "@next/swc-darwin-x64": "npm:16.2.9" - "@next/swc-linux-arm64-gnu": "npm:16.2.9" - "@next/swc-linux-arm64-musl": "npm:16.2.9" - "@next/swc-linux-x64-gnu": "npm:16.2.9" - "@next/swc-linux-x64-musl": "npm:16.2.9" - "@next/swc-win32-arm64-msvc": "npm:16.2.9" - "@next/swc-win32-x64-msvc": "npm:16.2.9" + "@next/env": "npm:16.2.10" + "@next/swc-darwin-arm64": "npm:16.2.10" + "@next/swc-darwin-x64": "npm:16.2.10" + "@next/swc-linux-arm64-gnu": "npm:16.2.10" + "@next/swc-linux-arm64-musl": "npm:16.2.10" + "@next/swc-linux-x64-gnu": "npm:16.2.10" + "@next/swc-linux-x64-musl": "npm:16.2.10" + "@next/swc-win32-arm64-msvc": "npm:16.2.10" + "@next/swc-win32-x64-msvc": "npm:16.2.10" "@swc/helpers": "npm:0.5.15" baseline-browser-mapping: "npm:^2.9.19" caniuse-lite: "npm:^1.0.30001579" @@ -37199,7 +37199,7 @@ __metadata: optional: true bin: next: dist/bin/next - checksum: 10/07903fdd4cc68beb7bff8f04f85bda52b3ebec6112702d6761e7e5d17fa2843ac12cd7cbdb369bfb5fadd6cd6b3620c22c9865cb46f8e7615134238ac1422672 + checksum: 10/a5b17dd807d935320bcea3491f188121ab5abed2a83c561b0b4452b98fd58e7553b9dc2d2e3014ec5e8ed84b33535be81a9c601e355a5a86d1fc6d13ca13a637 languageName: node linkType: hard