You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(deps): address dependabot security alerts across SDK manifests (#478)
## Summary
Addresses all open Dependabot security alerts across SDK manifests
(excluding `e2e/`).
### Fixes by manifest
- **`go/go.mod` & `sdk/highlight-go/go.mod`** — OpenTelemetry Go
`v1.43.0` / otlplog `v0.19.0` (PATH hijacking + unbounded HTTP body).
- **`sdk/highlight-py/poetry.lock`** — Django 4.2.30, pytest 9.0.3,
requests 2.33.1, pygments 2.20.0. **Drops Python 3.9** (EOL Oct 2025;
required to pick up patched `requests`/`pytest`).
- **`sdk/@launchdarkly/observability-python/poetry.lock`** — Django
5.2.13, pytest 9.0.3, requests 2.33.1, pygments 2.20.0.
-
**`sdk/@launchdarkly/react-native-ld-session-replay/example/Gemfile.lock`**
— activesupport 7.2.3.1, addressable 2.9.0, json 2.19.4.
- **`sdk/highlight-apollo/package.json`** — `@apollo/server` `^4.13.0` →
`^5.5.0`, moved from `dependencies` to `peerDependencies` (types-only
usage).
- **`sdk/highlight-next/package.json`** — tighten `next` to `^15.5.15`.
**Drops next 13/14** (all versions <15.5.15 are vulnerable per #715).
Function overloads in `with-highlight-config.ts` for next 15.5.15's
stricter `NextConfig`.
- **`sdk/@launchdarkly/observability-react-native`, `observability`,
`session-replay`, `highlight-hono`** — bump direct deps (axios, hono,
vite) to patched versions.
- **Root `package.json` resolutions / `yarn.lock`** — force safe
versions of protobufjs, node-forge, brace-expansion, picomatch, yaml,
path-to-regexp, vite (all majors), handlebars, serialize-javascript,
fast-xml-parser, smol-toml, srvx, defu, happy-dom, @xmldom/xmldom,
flatted, follow-redirects, basic-ftp, @hono/node-server, @apollo/server,
@sveltejs/kit, react-server-dom-webpack, lodash.
### Out of scope / not addressed
- `apollo-server-core` (#579) — **no patched version available**. devDep
in `sdk/highlight-apollo` for v3 plugin testing. Alert will remain; may
need manual dismissal.
- `@nestjs/core` (#651) — driven by `e2e/nestjs` only.
`sdk/highlight-nest` references it as a peerDep, so the sdk doesn't
install it.
- All `e2e/**` alerts (per request).
### Breaking changes
- **`@highlight-run/apollo`**: `@apollo/server` moved from
`dependencies` to `peerDependencies` and bumped from v4 to v5. Consumers
previously relying on v4 being transitively installed will need to (a)
install `@apollo/server` themselves, and (b) upgrade to v5 (v4 is EOL
Jan 2026).
- **`@highlight-run/next`**: `peerDependencies.next` narrowed from
`>=13` to `^15.5.15`. Consumers on next 13/14 will need to upgrade (all
versions <15.5.15 are vulnerable per GHSA-xv57-4mr9-wg8v).
- **`highlight-io` (Python)**: minimum Python bumped from 3.9 to 3.10
(3.9 is EOL; required to pick up patched `requests`/`pytest`).
### Supporting CI tooling updates
- `sdk/highlight-go/.golangci.yaml` migrated to v2 syntax; `go-sdk.yml`
workflow uses golangci-lint-action v8 + golangci-lint v2.11.4 (v1.64.x
does not support go 1.25).
- `e2e/express-ts`: added `@types/node-fetch` + `node-fetch` directly
(previously pulled transitively via `@apollo/server` v4).
## Test plan
- [x] `yarn build:sdk` succeeds
- [x] `GOWORK=off go build ./...` in `go/` and `sdk/highlight-go/`
succeeds
- [x] `yarn dedupe --check` reports no dedupes needed
- [x] `poetry lock` clean for both python projects
- [x] `bundle lock` clean for react-native example
- [x] `yarn turbo run test --filter=@highlight-run/next` passes (11/11)
- [x] CI workflows pass
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
0 commit comments