Skip to content

Bump the nuget group with 1 update - #509

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/e2e/dotnet4/cs/nuget-c0c12a1371
Open

Bump the nuget group with 1 update#509
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/e2e/dotnet4/cs/nuget-c0c12a1371

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Updated OpenTelemetry.Exporter.Zipkin from 1.9.0 to 1.15.3.

Release notes

Sourced from OpenTelemetry.Exporter.Zipkin's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

  • NuGet: OpenTelemetry v1.15.3

    • Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
      (#​7069)

    • Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
      unspecified or out-of-range severities without returning invalid enum values.
      (#​7092)

    • Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
      infinite values as invalid and fall back to the default ratio when using
      traceidratio and parentbased_traceidratio samplers.
      (#​7103)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.3

    • Fix baggage and trace headers not respecting the maximum length in some cases.
      (#​7061)

    • Improve efficiency of parsing of baggage and B3 propagation headers.
      (#​7061)

    • Breaking change: Fixed tracestate parsing to reject keys that do not
      begin with a lowercase letter, including keys beginning with digits, to
      align with the W3C Trace Context specification.
      (#​7065)

    • Fixed BaggagePropagator to trim optional whitespace (OWS) around =
      separators when parsing the baggage header, as required by the
      W3C Baggage specification.
      (#​7009)

    • Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
      from values when parsing the baggage header.
      (#​7009)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

1.15.2

For highlights and announcements pertaining to this release see: Release Notes > 1.15.2.

The following changes are from the previous release 1.15.1.

... (truncated)

1.15.2-beta.1

The following changes are from the previous release 1.15.1-beta.1.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

1.15.0

For highlights and announcements pertaining to this release see: Release Notes > 1.15.0.

The following changes are from the previous release 1.14.0.

  • NuGet: OpenTelemetry v1.15.0

    • Added support for the OTEL_SDK_DISABLED environment variable in TracerProvider,
      MeterProvider, and LoggerProvider. When OTEL_SDK_DISABLED=true,
      the SDK returns no-op implementations for all telemetry signals.
      The OTEL_SDK_DISABLED environment variable is only evaluated upon application
      startup, later changes have no effect.
      (#​6568)

    • Added LowMemory temporality as an option in the OTLP metrics exporter.
      (#​6648)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    • Improve performance and reduce memory consumption for metrics histograms.
      (#​6715)

    • Decode value in OTEL_RESOURCE_ATTRIBUTES environment variable.
      (#​6737)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.0

    • Added a new overload for TracerProvider.GetTracer which accepts an optional
      string? schemaUrl parameter, allowing a schema URL to be set on the Tracer.
      (#​6736)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.15.0

    • Added support for ActivitySource.TelemetrySchemaUrl property.
      (#​6713)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    See CHANGELOG for details.
    ... (truncated)

1.15.0-beta.1

The following changes are from the previous release 1.14.0-beta.1.

1.14.0

For highlights and announcements pertaining to this release see: Release Notes > 1.14.0.

The following changes are from the previous release 1.14.0-rc.1.

  • NuGet: OpenTelemetry v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      and .NET Standard.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update System.Diagnostics.DiagnosticSource dependency to 10.0.0
      for all target frameworks.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      ... (truncated)

1.14.0-rc.1

The following changes are from the previous release 1.13.1.

... (truncated)

1.14.0-beta.1

The following changes are from the previous release 1.13.1-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.14.0-beta.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      Microsoft.Extensions.Logging.Configuration NuGet packages.
      (#​6327)

    • Add support for .NET 10.0.
      (#​6307)

    • Added the possibility to disable timestamps via the PrometheusAspNetCoreOptions.
      (#​6600)

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Updated OpenTelemetry core component version(s) to 1.14.0.
      (#​6689)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.14.0-beta.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      Microsoft.Extensions.Logging.Configuration NuGet packages.
      (#​6327)

    • Add support for .NET 10.0.
      (#​6307)

    • Added the possibility to disable timestamps via the PrometheusHttpListenerOptions.
      (#​6600)

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Updated OpenTelemetry core component version(s) to 1.14.0.
      ... (truncated)

1.13.1

For highlights and announcements pertaining to this release see: Release Notes > 1.13.1.

The following changes are from the previous release 1.13.0.

... (truncated)

1.13.1-beta.1

The following changes are from the previous release 1.13.0-beta.1.

1.13.0

For highlights and announcements pertaining to this release see: Release Notes > 1.13.0.

The following changes are from the previous release 1.12.0.

  • NuGet: OpenTelemetry v1.13.0

    • Added a verification to ensure that a MetricReader can only be registered
      to a single MeterProvider, as required by the OpenTelemetry specification.
      (#​6458)

    • Added FormatMessage configuration option to self-diagnostics feature. When
      set to true (default is false), log messages will be formatted by replacing
      placeholders with actual parameter values for improved readability.

      Example OTEL_DIAGNOSTICS.json:

      {
    "LogDirectory": ".",
    "FileSize": 32768,
    "LogLevel": "Warning",
    "FormatMessage": true
}

    • Fixed parsing of OTEL_TRACES_SAMPLER_ARG decimal values to always use .
      as the delimiter when using the traceidratio sampler, preventing
      locale-specific parsing issues.
      (#​6444)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.13.0

    • Added AddLink(SpanContext, SpanAttributes?) to TelemetrySpan to support
      linking spans and associating optional attributes for advanced trace relationships.
      (#​6305)

    • Experimental (only in pre-release versions): Added the EventName property
      to LogRecordData
      (#​6306)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.13.0

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.13.0-beta.1

The following changes are from the previous release 1.12.0-beta.1.

1.12.0

For highlights and announcements pertaining to this release see: Release Notes > 1.12.0.

The following changes are from the previous release 1.11.2.

1.12.0-beta.1

The following changes are from the previous release 1.11.2-beta.1.

1.11.2

For highlights and announcements pertaining to this release see: Release Notes > 1.11.2.

The following changes are from the previous release 1.11.1.

1.11.2-beta.1

The following changes are from the previous release 1.11.0-beta.1.

1.11.1

For highlights and announcements pertaining to this release see: Release Notes > 1.11.1.

The following changes are from the previous release 1.11.0.

... (truncated)

1.11.0

For highlights and announcements pertaining to this release see: Release Notes > 1.11.0.

The following changes are from the previous release 1.11.0-rc.1.

... (truncated)

1.11.0-rc.1

The following changes are from the previous release 1.10.0.

1.11.0-beta.1

The following changes are from the previous release 1.10.0-beta.1.

1.10.0

For highlights and announcements pertaining to this release see: Release Notes > 1.10.0.

The following changes are from the previous release 1.10.0-rc.1.

  • NuGet: OpenTelemetry v1.10.0

    • Promoted the MetricPoint reclaim feature for Delta aggregation temporality
      from experimental to stable.
      (#​5956)

      Previous Behavior:
      The SDK maintained a fixed set of MetricPoints which were assigned on a
      first-come basis based on the tags. MetricPoint reclaim was an experimental
      feature users could opt-into setting the environment variable
      OTEL_DOTNET_EXPERIMENTAL_METRICS_RECLAIM_UNUSED_METRIC_POINTS=true.

      New Behavior:
      MetricPoint reclaim is now enabled by default when Delta aggregation
      temporality is used without the need to set an environment variable. Unused
      MetricPoints will automatically be reclaimed and reused for future
      measurements. There is NO ability to revert to the old behavior.

    • Updated the Microsoft.Extensions.Logging.Configuration and
      Microsoft.Extensions.Diagnostics.Abstractions package versions to
      9.0.0.
      (#​5967)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.10.0

    • Updated System.Diagnostics.DiagnosticSource package version to
      9.0.0.
      (#​5967)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.10.0

    • Updated Microsoft.Extensions.DependencyInjection.Abstractions package
      version to 9.0.0.
      (#​5967)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.10.0

    No notable changes.

    See CHANGELOG for details.
    ... (truncated)

1.10.0-rc.1

The following changes are from the previous release 1.10.0-beta.1.

  • NuGet: OpenTelemetry v1.10.0-rc.1

    • The experimental APIs previously covered by OTEL1003
      (MetricStreamConfiguration.CardinalityLimit) are now part of the public API
      and supported in stable builds.
      (#​5926)

    • Promoted overflow attribute from experimental to stable and removed the
      OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE environment variable.

      Previous Behavior:
      By default, when the cardinality limit was reached, measurements were dropped,
      and an internal log was emitted the first time this occurred. Users could
      opt-in to experimental overflow attribute feature with
      OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE=true.
      With this setting, the SDK would use an overflow attribute
      (otel.metric.overflow = true) to aggregate measurements instead of dropping
      measurements. No internal log was emitted in this case.

      New Behavior:
      The SDK now always uses the overflow attribute (otel.metric.overflow = true)
      to aggregate measurements when the cardinality limit is reached. The previous
      approach of dropping measurements has been removed. No internal logs are
      emitted when the limit is hit.

      The default cardinality limit remains 2000 per metric. To set the cardinality
      limit for an individual metric, use the changing cardinality limit for a
      Metric      .

      There is NO ability to revert to old behavior.
      (#​5909)

    • Exposed a public constructor on Batch<T> which accepts a single instance
      of T to be contained in the batch.
      (#​5642)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.10.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.10.0-rc.1

    No notable changes.

... (truncated)

1.10.0-beta.1

The following changes are from the previous release 1.9.0.

  • NuGet: OpenTelemetry v1.10.0-beta.1

    • Added OpenTelemetrySdk.Create API for configuring OpenTelemetry .NET signals
      (logging, tracing, and metrics) via a single builder. This new API simplifies
      bootstrap and teardown, and supports cross-cutting extensions targeting
      IOpenTelemetryBuilder.
      (#​5325)

    • Updated the Microsoft.Extensions.Logging.Configuration and
      Microsoft.Extensions.Diagnostics.Abstractions packages version to
      9.0.0-rc.1.24431.7.
      (#​5853)

    • Added support in metrics for histogram bucket boundaries set via the .NET 9
      InstrumentAdvice<T>
      API.

      Note: With this change explicit bucket histogram boundary resolution will
      apply in the following order:

      1. View API
      2. Advice API
      3. SDK defaults

      See #​5854
      for details.

    • Added support for collecting metrics emitted via the .NET 9
      Gauge<T>
      API.
      (#​5867)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.10.0-beta.1

    • Breaking change: CompositeTextMapPropagator.Fields now returns a
      unioned set of fields from all combined propagators. Previously this always
      returned an empty set.
      (#​5745)

    • Optimize performance of TraceContextPropagator.Extract.
      (#​5749)

    • Obsoleted the ActivityExtensions.GetStatus and
      ActivityExtensions.SetStatus extension methods. Users should migrate to the
      System.Diagnostics.DiagnosticSource
      Activity.SetStatus
      ... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • `@dependab...

Description has been truncated

[!NOTE]
Medium Risk
Primarily dependency and assembly-binding changes in the .NET Framework e2e app; risk is moderate due to potential runtime binding/version conflicts after upgrading OpenTelemetry and Microsoft.Extensions.*/System.* assemblies.

Overview
Updates the e2e/dotnet4/cs test app’s NuGet dependencies, bumping OpenTelemetry.Exporter.Zipkin to 1.15.3 and aligning OpenTelemetry/OpenTelemetry.Api/ProviderBuilderExtensions plus several Microsoft.Extensions.* and System.* packages to newer versions.

Adjusts .NET Framework runtime binding behavior and build wiring: updates Web.config binding redirects (notably Newtonsoft.Json to 13.0.0.0 and adds OpenTelemetry.Exporter.Zipkin), refreshes cs.csproj assembly references (new versions, Private=True), and adds System.ValueTuple build targets/imports for restore/build consistency.

Reviewed by Cursor Bugbot for commit bcef06b. Bugbot is set up for automated code reviews on this repo. Configure here.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump the nuget group with 1 update
bcef06b 
Bumps OpenTelemetry.Exporter.Zipkin from 1.9.0 to 1.15.3

---
updated-dependencies:
- dependency-name: OpenTelemetry.Exporter.Zipkin
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Apr 28, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner April 28, 2026 23:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Apr 28, 2026
cursor[bot]
cursor Bot reviewed Apr 28, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit bcef06b. Configure here.

Comment thread e2e/dotnet4/cs/Web.config
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="OpenTelemetry.Exporter.Zipkin" publicKeyToken="7bd6737fe5b67e3c" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-1.0.0.0" newVersion="1.0.0.0" />

@cursor cursor Bot Apr 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing binding redirects for major version assembly bumps

Medium Severity

The Microsoft.Extensions.* and System.Diagnostics.DiagnosticSource assemblies jumped from assembly version 9.0.0.0 to 10.0.0.7, but no corresponding binding redirects were added to Web.config. Other packages still at older versions (e.g., OpenTelemetry.Extensions.Hosting 1.11.2, OpenTelemetry.Exporter.OpenTelemetryProtocol 1.11.2) were compiled against the 9.0.0.0 assembly versions. Since these are strong-named assemblies and AutoGenerateBindingRedirects is not enabled, the CLR will throw FileLoadException at runtime when those packages attempt to load the old assembly versions.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit bcef06b. Configure here.

@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 14, 2026
Merged
osm6495 pushed a commit that referenced this pull request Aug 18, 2026
@devin-ai-integration
fix: remediate dependency vulnerabilities across npm, go, pip, and ru…
9cbe8d5 
…bygems (#732)

## Summary

Automated dependency-vulnerability remediation for findings reported by
GitHub Dependabot and Wiz. Only findings that are actionable under the
severity/age policy (critical immediately; high/moderate after a 7-day
hold; low ignored; must have a published fixed version) and that are
still present in the manifests/lockfiles are included. Stale alerts
(already patched in the lockfile, e.g. `next`, `vite`, `django` in
`sdk/highlight-py` after this change) were verified against the
lockfiles rather than trusted blindly.

Fixed:

| Ecosystem | Package | Change | Severity | Advisory |
|---|---|---|---|---|
| go | `github.com/gofiber/fiber/v2` | 2.52.13 → 2.52.14 (3 modules) |
moderate | GHSA-gcfq-8gqf-4876 |
| npm | `turbo` | 2.8.7 → 2.9.14 | moderate | GHSA-hcf7-66rw-9f5r |
| npm | `hono` | resolution → ^4.12.34 (4.13.2) | moderate |
GHSA-8j4g-w8fx-2239, GHSA-f23p-vx2j-j53r, GHSA-54fx-42gc-7vw4 |
| npm | `valibot` | 1.2.0 → 1.4.2 | moderate | GHSA-5qjj-4xww-7phc |
| npm | `@remix-run/router` | 1.23.2 → 1.23.3 | moderate |
GHSA-2j2x-hqr9-3h42 |
| npm | `markdown-it` | 14.1.1 → 14.3.0 | moderate | GHSA-6v5v-wf23-fmfq
|
| npm | `uuid` | 11.1.0 → 11.1.1 | moderate | GHSA-w5hq-g745-h8pq |
| npm | `@remix-run/node` (e2e/react-native) | 2.15.2 → 2.17.5 |
critical (Wiz) | CVE-2025-61686 |
| npm | `ajv` (e2e/react-native) | 8.17.1 → 8.20.0 | moderate |
GHSA-2g4f-4pwh-qvx6 |
| npm | `yaml` (e2e/react-native) | 1.10.2 → 1.10.3 | moderate |
GHSA-48c2-rrv3-qjmp |
| npm | `js-yaml` | resolutions → ^3.15.1 / ^4.3.1 | high |
GHSA-5p4m-2wfm-xmqj |
| pip | `django` (sdk/highlight-py dev dep) | 4.2.30 → 5.2.17 | moderate
| GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w |
| pip | `django` (e2e/python) | 5.2.14 → 5.2.17 | moderate |
GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w |
| pip | `pytest` (e2e/tests) | 7.4.4 → 9.1.1 | moderate |
GHSA-6w46-j5rx-g56g |
| pip | `loguru` (e2e/python) | constraint `^0` → `^0.7.3` | moderate |
GHSA-39ph-wr67-j4xq |
| rubygems | `activesupport` (RN example Gemfiles) | `>= 6.1.7.5` → `>=
7.2.3.1` | moderate | GHSA-2j26-frm8-cmj9, GHSA-89vf-4333-qx8v,
GHSA-cg4j-q9v8-6v38 |

Deferred, with reasons:

- **Critical `org.bouncycastle:bcprov-jdk18on` 1.77 → 1.80.2** (Wiz,
CVE-2025-14813) in `sdk/@launchdarkly/flutter/.../android/build.gradle`
and
`sdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle`.
It is a build-time-only transitive of the
`com.android.tools.build:gradle` 8.7.2 buildscript classpath (not
shipped in artifacts); the real fix is an AGP upgrade. No Android SDK
and no Maven Central access in this environment, so the change could not
be built or verified — left for a dedicated PR.
- **No published fix**: `@angular/*`, `apollo-server-core`,
`extract-zip`, `image-size`, `react-router-dom`.
- **Major upgrades requiring code changes** (kept out of this bump-only
PR): `@nestjs/core` 10 → 11, `svelte` 4 → 5, `react-router` 6 → 7,
`@opentelemetry/core` 1.30 → 2.x, `file-type` 20 → 21, `fast-xml-parser`
4 → 5, `ts-deepmerge` 2 → 8, transitive `nanoid` 4 → 5 and `markdown-it`
12 → 14.
- **Under the 7-day hold**: `@hono/node-server` 1.19.15, plus the newest
`image-size` advisories.
- **`nanoid`**: the 3.x line is already at 3.3.18 in the lockfile
(patched); the remaining alert covers the transitive `nanoid@4.0.2`,
whose fix is the ESM-only 5.x major, so it stays in the major-upgrade
bucket.
- **Blocked by a peer constraint**: `pytest` 9 in `e2e/python` —
`pytest-asyncio` 0.25.3 requires `pytest <9`, so that manifest stays on
`^8.2.0`.
- **NuGet OpenTelemetry packages** (`e2e/dotnet4/cs/packages.config`):
already covered by open Dependabot PRs (#513, #509, #496) and nuget.org
is not reachable here, so no duplicate change.
- **Low severity** findings are out of policy scope (`webpack`,
`body-parser`, `@babel/core`, `json`, `msgpack`, `sqlite3`, `flask`,
`@tootallnate/once`).

Excluded because it did not build: none — but see the environment
caveats below.

## How did you test this change?

Dependency-only change, no runtime behavior change, so no screenshots or
staging link apply.

- `yarn install` + `yarn dedupe --check` — clean (Puppeteer's
Chrome-download postinstall fails in this sandbox because its CDN is
blocked; unrelated to these bumps).
- `yarn build:sdk` — 20/20 tasks pass. `yarn build` — 49/53; only
`angular.io-example#build` fails, because font inlining needs
`fonts.googleapis.com`, which is blocked in this sandbox.
- `yarn lint` — 49/49 pass.
- `yarn test` — 76/77 pass. `@highlight-run/next#test` fails because the
test boots a Next app whose corepack step downloads yarn from
`repo.yarnpkg.com` (blocked here). `aws-lambda#build` needs the `sam`
CLI, which is not installed.
- Re-validated after the `js-yaml` bump: `yarn build:sdk` 20/20 pass and
`yarn test` 57/61, with `angular.io-example#build` the only failure
(blocked Google Fonts, as above).
- `yarn format-check` — the only warnings are local build artifacts
under `lib/` (not tracked); all changed manifests pass Prettier.
- Go: `go build ./...`, `go vet ./...`, `go mod verify` pass in
`sdk/highlight-go` and `e2e/go-plugin`. `sdk/highlight-go` tests pass
except a pre-existing `log.TestParseConsoleMessages` failure (reproduced
on the unmodified module), and `e2e/go` has a pre-existing duplicate
`main` in `fiber.go`/`echo.go`.
- Python: `sdk/highlight-py` suite passes on Django 5.2.17 (259 tests);
`e2e/tests` installs and collects on pytest 9; `e2e/python` imports
Django/loguru/Flask cleanly.
- Not validated in this environment: the Android/Gradle and Ruby/Bundler
paths (no Android SDK, Maven Central and RubyGems not reachable).
Pre-commit hooks could not run because their hook environments clone
from GitHub directly; the equivalent checks were run manually.

## Are there any deployment considerations?

No migrations or backfills. Notes for reviewers:

- `sdk/highlight-py` moves its **dev** dependency Django from 4.x to
5.2.17 (the advisories have no 4.x fix); the shipped package is
unaffected and the Django integration tests pass.
- The React Native example Gemfiles now require `activesupport >=
7.2.3.1`, which needs Ruby >= 3.1. The Gemfiles still declare `ruby ">=
2.6.10"`; CI runners use modern Ruby, but this is worth a look if anyone
builds those examples on an old Ruby.
- `turbo` moves 2.8.7 → 2.9.14. Note `yarn build` cannot parse
`rrweb/turbo.json` (missing `extends`) on **either** version in a fresh
checkout of this branch's base, so the build was validated with that
submodule file locally patched; the submodule itself is untouched by
this PR.
- Lockfile churn (`yarn.lock`, `poetry.lock`, `package-lock.json`,
`go.sum`) is expected from these bumps; the React Native lockfile was
regenerated and reformatted back to the repo's tab indentation to keep
the diff readable.


Previous session:
https://app.devin.ai/sessions/142c0a5e060144ec97c9177f692e8cb9

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Bumps **dependency versions and lockfiles** across e2e, SDK, and root
tooling to clear Dependabot/Wiz findings, without changing application
logic.
> 
> **Go:** `github.com/gofiber/fiber/v2` **2.52.13 → 2.52.14** in
`sdk/highlight-go`, `e2e/go`, and `e2e/go-plugin` (with `go.sum`
updates).
> 
> **npm/yarn:** Root `package.json` raises **`turbo` to 2.9.14** and
adds/updates **resolutions** for `hono`, `valibot`, `@remix-run/router`,
`markdown-it`, and `uuid`; `yarn.lock` follows. **`e2e/react-native`**
adds overrides for `@remix-run/node`, `ajv@8`, and `yaml@1` and
refreshes `package-lock.json`.
> 
> **Python:** **`django` → 5.2.17** in `e2e/python` and
`sdk/highlight-py` (dev); **`e2e/python`** pins **`loguru` to ^0.7.3**;
**`e2e/tests`** upgrades **`pytest` to ^9** (lockfile includes
**pygments**).
> 
> **Ruby:** React Native example **Gemfiles** require **`activesupport
>= 7.2.3.1`** instead of the older minimum/exclusion pattern.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
92b9ed3. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->


Link to Devin session:
https://app.devin.ai/sessions/52f99250d37f411190c5f723b21ab8b7

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 24, 2026
Merged
osm6495 pushed a commit that referenced this pull request Aug 28, 2026
@devin-ai-integration
fix(deps): pin image-size to 1.2.1 in the react-native e2e app (#747)
ddcfece 
## Summary

Automated dependency-vulnerability remediation run for this repo. Only
one finding was actionable this run; everything else was either already
remediated on `main`, has no fix, or needs a major bump.

- Pins `image-size` to `^1.2.1` via npm `overrides` in the React Native
e2e app, closing a High Wiz finding (CVE-2025-71319) against
`e2e/react-native/package-lock.json`
- Manifest + lockfile only (3 lockfile lines); no source changes, no
major bumps
- The root `yarn.lock` was already on `image-size` 1.2.1 via root
`resolutions`, so only the standalone npm lockfile needed the pin
- Most open Dependabot alerts for this repo are stale (already fixed by
the resolutions on `main`); the rest require major upgrades or have no
patched version

## How did you test this change?

Backend/tooling change, no UI. `npm install` in the react-native e2e app
resolves `image-size@1.2.1`, and the monorepo yarn install + `yarn
build:sdk` were unaffected (20/20 packages build).

## Are there any deployment considerations?

No — the change is limited to an e2e example app's dev dependency tree.

<details>
<summary>Implementation details</summary>

### Findings addressed
| Package | Ecosystem | Current → Target | Severity | Age | Source(s) |
Advisory |
|---|---|---|---|---|---|---|
| image-size (in `e2e/react-native`) | npm | 1.2.0 → 1.2.1 | High | ~2.5
months | Wiz | CVE-2025-71319 |

### Not addressed (require a major version bump)
- `nanoid` 4.0.2 → 5.1.16 (5.x is ESM-only)
- `react-router` 6.30.4 → 7.18.0; `@opentelemetry/core` 1.30.1 → 2.8.0;
`svelte` 4.2.19 → 5.55.7; `@nestjs/core` 10.4.22 → 11.1.18; `file-type`
20.4.1 → 21.3.2; `ts-deepmerge` 2.0.7 → 8.0.0; `markdown-it` 12.3.2 →
14.2.0; `fast-xml-parser` 4.5.6 → 5.7.0; `uuid` (legacy 3.x/7.x/8.x/9.x
copies) → 11.1.1; `@angular/*` 19.2.x → 20.3.27; `pytest` 8.3.5 → 9.0.3
- Java/Android build-time transitives from the Gradle toolchain
(`bcprov-jdk18on` — the only Critical, `netty-*`, `jackson-*`,
`wire-runtime`, `jose4j`, `jdom2`, `grpc-netty`, `commons-io`,
`protobuf-java`): not declared in any manifest here and Maven Central is
not reachable from the automation environment.

### Not addressed (no patched version)
`extract-zip`, `image-size` CVE-2025-71329/71330 (affect all versions
incl. 2.x), `@angular/*` advisories with no fix, `apollo-server-core`,
`react-router-dom` 6.30.4.

### Stale alerts (already fixed on `main`)
`vite` (6.4.3), `next` (15.5.22/16.2.12), `sqlparse` (0.6.0),
`image-size` in root `yarn.lock` (1.2.1), `markdown-it` 14.3.0,
`@opentelemetry/core` 2.10.0 — all pinned by root `resolutions` /
lockfiles already.

### Deferred: NuGet OTel bumps in `e2e/dotnet4/cs/packages.config`
`OpenTelemetry.Api`/`Exporter.OpenTelemetryProtocol` 1.11.2,
`Exporter.Zipkin`/`Extensions.Propagators` 1.9.0 → 1.15.3 and
`Resources.Azure` beta → 1.15.1-beta.1 are in-major bumps, but nuget.org
is not reachable from the automation environment so a restore/build
could not be validated; Dependabot PRs #513 / #509 / #496 already target
them.

### Verification
- Install: npm (react-native e2e app) ✅ / yarn (monorepo) ✅ — only the
known `@highlight-run/rrvideo` puppeteer postinstall failure (Chrome CDN
unreachable)
- Build: `yarn build:sdk` ✅ 20/20
- Tests: unchanged by this diff; the react-native e2e app is not part of
`yarn test` or CI
- Lint/format: `prettier --check` ✅ on both changed files

Note: the `Require additional human oversight on bot PRs` check is
`action_required` by design on bot-authored PRs and needs a human
approval.
</details>


Link to Devin session:
https://app.devin.ai/sessions/4f3892ef6ba94c30abfeafe43b95a6e9

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Addresses **CVE-2025-71319** by forcing transitive **`image-size`**
from **1.2.0 → 1.2.1** in the React Native e2e example, which uses its
own npm lockfile instead of the monorepo yarn resolutions.
> 
> Adds an **`overrides`** entry in `e2e/react-native/package.json` and
updates **`package-lock.json`** accordingly. No application source
changes.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
7870763. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants