You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(deps): patch critical/high Dependabot alerts across ecosystems (#551)
## Summary
Patches the open critical and high Dependabot alerts at
https://github.com/launchdarkly/observability-sdk/security/dependabot.
Each bump was validated locally before pushing.
### Closed by this PR (with alert IDs)
**Critical**
- `github.com/gofiber/fiber/v2` v2.52.9 → v2.52.11 in
`sdk/highlight-go`, `e2e/go`, `e2e/go-plugin` — alerts #377, #378, #379
(GHSA-83x4-jq7c-cgr9, predictable / zero UUID).
**High**
- `protobufjs` 7.5.5 → 7.5.8 via root yarn resolutions — alerts #827,
#828, #829, #831.
- `protobufjs-cli` 1.1.1 → 1.2.2 (transitive of `google-gax`) via yarn
resolution — alerts #823, #824.
- `immutable` ~3.7.6 → ^3.8.3 (transitive of `@ardatan/relay-compiler`)
via yarn resolution — alert #477.
- `fastapi` ^0 → ^0.65.2 in `e2e/python/pyproject.toml`, lockfile
resolves to 0.65.3 — alert #820 (CSRF).
- `protobuf` (Python) → 5.29.6 in `e2e/python/poetry.lock` and
`sdk/@launchdarkly/observability-python/poetry.lock` — alerts #369,
#371.
- `activestorage` 7.1.5.1 → 7.2.3.1 in both Rails e2e Gemfile.lock files
— alerts #540, #541. Rails 7.1.x has no security release; the fix is
only available on 7.2+. Updated `Gemfile` constraints to `~> 7.2.3.1`
and `bundle lock --update`'d both lockfiles.
### Not addressed in this PR — need a separate, focused migration
**@opentelemetry/sdk-node, auto-instrumentations-node,
exporter-prometheus (alerts #791, #792, #796)** — `sdk/highlight-node`
devDependencies still pull the 0.56/0.57 line. Forcing them up to
0.217.0 brings `@opentelemetry/sdk-trace-base` from 1.x to 2.x at the
root, which conflicts with `highlight.run`'s pinned
`@opentelemetry/sdk-trace-web@~1.30.1` (nested 1.x sdk-trace-base lacks
the new `instrumentationScope` field). This needs a coordinated otel-js
ecosystem bump across `highlight-run` + `highlight-node` together, not a
single resolution flip.
**undici (alerts #510, #511)** — root resolution already pins undici 6.x
to ^6.24.0 (lockfile resolves to 6.25.0). The 5.x line remains at 5.29.0
because `@vercel/node@5.5.31` pins to undici 5.28.4. The GHSA range is
"< 6.24.0", but the affected WebSocket code path differs between 5.x and
6.x; Dependabot may close these on rescan once it sees only 6.25.0 /
7.25.0 in the lockfile.
## Test plan
- [x] `yarn install` clean (puppeteer arm64 install warning is local env
only)
- [x] `yarn dedupe --check` reports no remaining duplicates
- [x] `yarn format-check` clean
- [x] `yarn turbo run test` for `highlight.run`,
`@launchdarkly/observability`, `@launchdarkly/observability-node`,
`@launchdarkly/session-replay`, `@highlight-run/node` — all green (421
highlight.run tests pass)
- [x] `cd sdk/highlight-go && go test ./...` — only pre-existing
`TestParseConsoleMessages` failure remains (verified on `main` before
the bump)
- [x] `cd e2e/go-plugin && make build` clean; `e2e/go` per-file `go
build` clean
- [x] `poetry check` + `poetry install --no-root` pass in `e2e/python`
and `sdk/@launchdarkly/observability-python`
- [x] `bundle install` (Ruby 3.3.4) clean in `e2e/ruby/rails/demo` and
`e2e/ruby/rails/api-only` with `rails 7.2.3.1`/`activestorage 7.2.3.1`
locked
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Primarily dependency upgrades across Go, Python, Ruby, and Node;
moderate risk due to major framework bumps (notably Rails 7.1→7.2 and
FastAPI/Starlette/Pydantic updates) that can introduce
runtime/compatibility regressions in e2e apps.
>
> **Overview**
> This PR patches multiple security alerts by **upgrading dependencies
across the monorepo**.
>
> It bumps `github.com/gofiber/fiber/v2` to `v2.52.11` in Go e2e apps
and `sdk/highlight-go`, updates Python e2e dependencies via Poetry
(notably `fastapi` to `0.136.1` with newer `starlette`/`pydantic` and
new `typing-inspection`/`annotated-doc`), and refreshes Rails e2e apps
to **Rails `7.2.3.1`** (plus related gem updates) while also bumping the
local `launchdarkly-observability` gem to `0.2.0`.
>
> On the JS side, it tightens root Yarn `resolutions` to newer
`protobufjs`/`protobufjs-cli` and `immutable`, with corresponding
`yarn.lock` updates (including minor `@opentelemetry/*` patch bumps
pulled in by the lockfile).
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
14b8e75. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
0 commit comments