Repository navigation
chore(deps): resolve all Dependabot security alerts - #362
Merged
Merged
Conversation
Update vulnerable dependencies across npm, Python, Go, and NuGet ecosystems: - npm: upgrade @apollo/server, next, wrangler, happy-dom, playwright, Angular, Remix, NestJS, @trpc/server, @sveltejs/kit, glob, react-router-dom, vercel - npm resolutions: add resolutions for transitive deps including vite, undici, lodash, devalue, node-forge, multer, tar-fs, protobufjs, form-data, sha.js, ws, semver, body-parser, qs, validator, cookie, and more - Python: upgrade urllib3, requests, werkzeug, starlette, h11, httpcore, protobuf, flask, fastapi, brotli, filelock across all poetry.lock files - Go: upgrade golang.org/x/crypto, golang.org/x/net, go-chi/chi/v5 - NuGet: upgrade OpenTelemetry.Api to 1.11.2 - Dismiss 7 alerts with no fix available (apollo-server, npm, orjson, vue-template-compiler, request, golang-jwt/jwt v3) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
- Pin next to ^15.5.10 in e2e/nextjs instead of overly permissive >=13 - Align all Angular packages to ^19.2.18 (animations, forms, devkit, cli) - Revert @trpc/server in sdk/highlight-next back to ^9.27.4 to avoid breaking v9 API usage in tests - Fix go.sum checksums in e2e/nextjs/go-service via go mod tidy Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Pin vite to ^5.4.21 in SDK packages (highlight-run, observability, session-replay, observability-react-native) that use Rollup plugins incompatible with Vite 7's Rolldown bundler - Replace blanket vite resolution with scoped per-major-version resolutions (^4: 4.5.14, ^5: 5.4.21, ^6: 6.4.1, ^7: 7.0.8) - Scope path-to-regexp resolution per major version to avoid cross-major downgrades (^3: 3.3.0, ^6: 6.3.0, ^8: 8.2.0) - Add exact-version resolution for path-to-regexp@6.1.0 -> 6.3.0 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Vadman97
changed the title
- Restore @launchdarkly SDK packages (observability, session-replay, observability-react-native) to vite ^6.3.4 since the vite@^6 root resolution already handles bumping to >=6.4.1 - Pin e2e/react-router and e2e/react-three-vite to vite ^5.4.21 since their React plugins (@vitejs/plugin-react-swc ^3.7.0 and @vitejs/plugin-react ^4.3.0) are not compatible with Vite 7 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@rollup/plugin-commonjs@25 depends on glob@^10.5.0 which removed its default export in v10.5.0, breaking the ESM import. Upgrade to @rollup/plugin-commonjs@^28.0.2 and @rollup/plugin-node-resolve@^16.0.0 which don't depend on glob at all. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Next.js 16 changed the NextConfig type to no longer accept function returns, breaking the withHighlightConfig typegen. Pin to <16 until the SDK is updated for Next 16 compatibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace blanket body-parser resolution with version-qualified ones: body-parser@~1.20.3 -> ^1.20.4 (for Express 4) body-parser@^2 -> ^2.2.1 (for Express 5) - Align @remix-run/node to ^2.17.3 to match other @remix-run packages Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update peerDependencies to also specify <16 so users with Next.js 16+ get a proper peer dependency warning. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dependabot bumped OpenTelemetry packages from 1.11.1 to 1.11.2 in packages.config but didn't update the corresponding HintPath references in cs.csproj. This caused xbuild to look for assemblies in nonexistent 1.11.1 directories, failing with 'Tracer type not found'. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Revert the <16 upper bound from highlight-next's peerDependencies and dependencies so Next.js 16 users aren't blocked from installing. Instead add a root workspace resolution to pin next@>=13 to ^15.5.12 for the build, since the SDK code isn't yet compatible with Next 16 types. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mayberryzane
approved these changes
Feb 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
yarn build:sdk)yarn test)🤖 Generated with Claude Code
Note
Medium Risk
Mostly version bumps, but broad dependency upgrades and added transitive overrides can introduce build/runtime incompatibilities across multiple language toolchains (notably Go 1.24 and updated JS bundler/framework deps).
Overview
Primarily a dependency-security sweep across the monorepo, updating versions in multiple ecosystems (npm/Yarn, Go modules, Poetry/Python, and NuGet) to address Dependabot alerts.
Notable changes include adding extensive root
package.jsonYarnresolutionsto pin/override vulnerable transitive packages, upgrading e2e app dependencies (Angular, Remix, Next.js tooling, Vite, React Router, NestJS), bumping Go toolchains togo 1.24.xand updatinggolang.org/x/*+chi, updating .NET Framework e2e OpenTelemetry packages from1.11.1to1.11.2, and refreshing Python lockfiles/dependency floors (e.g.,requests,urllib3,fastapi/starlette,werkzeug,filelock, plus newannotated-doc/typing-inspection).Written by Cursor Bugbot for commit 8e0fae7. This will update automatically on new commits. Configure here.