Repository navigation
fix: remediate high and critical Dependabot alerts across SDKs and examples - #710
Merged
Merged
Conversation
Contributor
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
Contributor
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
![semgrep-code-launchdarkly[bot]](https://avatars.githubusercontent.com/u/8039656?s=60&v=4){kind=small}
pkaeding
marked this pull request as ready for review
August 7, 2026 20:54
Vadman97
approved these changes
Aug 7, 2026
pkaeding
enabled auto-merge (squash)
August 7, 2026 21:00
Contributor
|
@cursor review |
Merged
abelonogov-ld
added a commit
that referenced
this pull request
Aug 8, 2026
…darkly/observability-sdk into andrey/ci-symbolication-artifacts * 'andrey/ci-symbolication-artifacts' of github.com:launchdarkly/observability-sdk: fix: remediate high and critical Dependabot alerts across SDKs and examples (#710) chore: release main (#709) ci: prevent script injection in manual-publish-docs workflow (#694) feat: emit UCUM units for first-party SDK instruments (O11Y-1820) (#707)
abelonogov-ld
pushed a commit
that referenced
this pull request
Aug 10, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>launchdarkly-observability-python: 1.3.2</summary> ## [1.3.2](launchdarkly-observability-python-1.3.1...launchdarkly-observability-python-1.3.2) (2026-08-10) ### Bug Fixes * remediate high and critical Dependabot alerts across SDKs and examples ([#710](#710)) ([32fdfc1](32fdfc1)) </details> <details><summary>launchdarkly_flutter_observability: 0.14.0</summary> ## [0.14.0](launchdarkly_flutter_observability-0.13.0...launchdarkly_flutter_observability-0.14.0) (2026-08-10) ### Features * expose native Flutter observability options ([#713](#713)) ([ab29eea](ab29eea)) </details> <details><summary>session-replay-react-native: 0.21.2</summary> ## [0.21.2](session-replay-react-native-0.21.1...session-replay-react-native-0.21.2) (2026-08-10) ### Bug Fixes * remediate high and critical Dependabot alerts across SDKs and examples ([#710](#710)) ([32fdfc1](32fdfc1)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **Release Please** version cut for three packages: no application logic changes in this diff beyond release metadata. > > **`launchdarkly_flutter_observability` 0.14.0** — bumps `pubspec.yaml`, the native bridge `_packageVersion`, `.release-please-manifest.json`, and adds a changelog entry for **exposing native Flutter observability options** ([#713]). > > **`launchdarkly-observability` (Python) 1.3.2** — bumps `pyproject.toml`, `PROVENANCE.md` example version, manifest, and changelog for **Dependabot high/critical dependency remediation** ([#710]). > > **`@launchdarkly/session-replay-react-native` 0.21.2** — bumps `package.json`, manifest, and changelog with the same **dependency security fix** ([#710]). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 5084069. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediates the open HIGH/CRITICAL Dependabot alerts in this repo. Changes are confined to dependency manifests/lockfiles.
Fixed
Root yarn workspace (
package.jsonresolutions +yarn.lock):socksbump to 2.8.9)e2e/react-router,e2e/react-three-vite:vite^5.4.21->^6.4.3(no patch exists for the vite 5 line), with the matching@vitejs/plugin-react-swc/@vitejs/plugin-reactbumps needed for the vite 6 peer range.e2e/react-native(overrides+package-lock.json): tar 7.5.15 -> 7.5.22, undici 6.25.0 -> 6.28.0, ws 6.2.3/7.5.10/8.18.0 -> 6.2.6/7.5.13/8.21.3, form-data 3.0.2/4.0.1 -> 3.0.5/4.0.6, brace-expansion 1.1.11/2.0.1 -> 1.1.18/2.1.4, js-yaml 3.14.1/4.1.x -> 3.15.1/4.3.1, postcss 8.4.49 -> 8.5.26, fast-uri 3.1.2 -> 3.1.5, shell-quote 1.8.4 -> 1.10.0, tmp 0.0.33 -> 0.2.7, turbo-stream 2.4.0 -> 3.2.0, @remix-run/server-runtime 2.15.2 -> 2.17.5.Python (
poetry.lockforsdk/@launchdarkly/observability-pythonandsdk/highlight-py): starlette 0.50.0 -> 1.4.1 (fastapi 0.128.2 -> 0.141.1, which no longer caps starlette).Ruby:
puma~> 6.0->~> 7.2, >= 7.2.1ine2e/ruby/rails/demo-rails70(no 6.x patch exists);concurrent-ruby< 1.3.4->>= 1.3.7in the two React Native session replay example Gemfiles.Not fixed
@angular/core/@angular/common/@angular/compiler19.2.25 (GHSA-rgjc-h3x7-9mwg, GHSA-39pv-4j6c-2g6v, GHSA-48r7-hpm6-gfxm, GHSA-jhpw-976m-542j, GHSA-jj27-h5hq-8x99) — no patched version has been published for the Angular 19 line; the only remedy would be a major upgrade of the Angular e2e app.vite5.4.21 (GHSA-fx2h-pf6j-xcff) — this is thevite5aliassdk/highlight-rundeliberately uses to produce its build output. The advisory has no vite 5 patch, and moving the browser SDK's build toolchain to vite 6 is out of scope for a dependency-security PR. The vulnerability affects the vite dev server (server.fs.denybypass on Windows), notvite build.activestorage7.1.6 (GHSA-xr9x-r78c-5hrm CRITICAL, GHSA-9xrj-h377-fr87) — first patched version is 7.2.3.1/7.2.3.2; there is no 7.1.x backport.e2e/ruby/rails/demo-rails70intentionally pins the Rails 7.1 line to keep regression coverage for old-Rails auto-instrumentation, so this would require abandoning the purpose of that app. It is a local test app and does not use Active Storage variant processing.sdk/highlight-runvite^6.4.3and root@remix-run/server-runtime/turbo-stream/ws/nextentries) were already remediated onmainand should auto-close on the next Dependabot scan.How did you test this change?
yarn install+yarn format-check(clean) +yarn test --continue: 78/79 turbo tasks pass. The single failure isaws-lambda#build, which needs the AWSsamCLI that isn't installed in this environment — unrelated to these bumps.e2e/react-routerande2e/react-three-vitebuild successfully on vite 6.poetry install --all-extras && pytestforsdk/@launchdarkly/observability-python(75 passed) andsdk/highlight-py(259 passed) with starlette 1.4.1.Validate PyProjectstep withImportError: cannot import name 'stdlib_pkgs' from 'pip._internal.utils.compat'(pip-tools 7.6.0 against pip 26.2.1). The identical failure is present onmain(run 31217966004), so it is preexisting and unrelated.bundle install, so it will re-resolve.A second commit runs
yarn dedupebecause the Yarn CI job enforcesyarn dedupe --check.Are there any deployment considerations?
No source changes; dependency manifests and lockfiles only.
Link to Devin session: https://app.devin.ai/sessions/50eeb479b0fb461784f29b03fc1dc706
Requested by: @pkaeding