Skip to content

Bump the nuget group with 1 update - #496

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/e2e/dotnet4/cs/nuget-68cb291067
Open

Bump the nuget group with 1 update#496
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/e2e/dotnet4/cs/nuget-68cb291067

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Updated OpenTelemetry.Extensions.Propagators from 1.9.0 to 1.15.3.

Release notes

Sourced from OpenTelemetry.Extensions.Propagators's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

  • NuGet: OpenTelemetry v1.15.3

    • Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
      (#​7069)

    • Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
      unspecified or out-of-range severities without returning invalid enum values.
      (#​7092)

    • Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
      infinite values as invalid and fall back to the default ratio when using
      traceidratio and parentbased_traceidratio samplers.
      (#​7103)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.3

    • Fix baggage and trace headers not respecting the maximum length in some cases.
      (#​7061)

    • Improve efficiency of parsing of baggage and B3 propagation headers.
      (#​7061)

    • Breaking change: Fixed tracestate parsing to reject keys that do not
      begin with a lowercase letter, including keys beginning with digits, to
      align with the W3C Trace Context specification.
      (#​7065)

    • Fixed BaggagePropagator to trim optional whitespace (OWS) around =
      separators when parsing the baggage header, as required by the
      W3C Baggage specification.
      (#​7009)

    • Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
      from values when parsing the baggage header.
      (#​7009)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

1.15.2

For highlights and announcements pertaining to this release see: Release Notes > 1.15.2.

The following changes are from the previous release 1.15.1.

... (truncated)

1.15.2-beta.1

The following changes are from the previous release 1.15.1-beta.1.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

1.15.0

For highlights and announcements pertaining to this release see: Release Notes > 1.15.0.

The following changes are from the previous release 1.14.0.

  • NuGet: OpenTelemetry v1.15.0

    • Added support for the OTEL_SDK_DISABLED environment variable in TracerProvider,
      MeterProvider, and LoggerProvider. When OTEL_SDK_DISABLED=true,
      the SDK returns no-op implementations for all telemetry signals.
      The OTEL_SDK_DISABLED environment variable is only evaluated upon application
      startup, later changes have no effect.
      (#​6568)

    • Added LowMemory temporality as an option in the OTLP metrics exporter.
      (#​6648)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    • Improve performance and reduce memory consumption for metrics histograms.
      (#​6715)

    • Decode value in OTEL_RESOURCE_ATTRIBUTES environment variable.
      (#​6737)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.15.0

    • Added a new overload for TracerProvider.GetTracer which accepts an optional
      string? schemaUrl parameter, allowing a schema URL to be set on the Tracer.
      (#​6736)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.15.0

    • Added support for ActivitySource.TelemetrySchemaUrl property.
      (#​6713)

    • Added support for Meter.TelemetrySchemaUrl property.
      (#​6714)

    See CHANGELOG for details.
    ... (truncated)

1.15.0-beta.1

The following changes are from the previous release 1.14.0-beta.1.

1.14.0

For highlights and announcements pertaining to this release see: Release Notes > 1.14.0.

The following changes are from the previous release 1.14.0-rc.1.

  • NuGet: OpenTelemetry v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      and .NET Standard.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update System.Diagnostics.DiagnosticSource dependency to 10.0.0
      for all target frameworks.
      (#​6667)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.14.0

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Update to stable versions for .NET 10.0 NuGet packages.
      (#​6667)

    • Update Microsoft.Extensions.* dependencies to 10.0.0 for .NET Framework
      ... (truncated)

1.14.0-rc.1

The following changes are from the previous release 1.13.1.

... (truncated)

1.14.0-beta.1

The following changes are from the previous release 1.13.1-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.14.0-beta.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      Microsoft.Extensions.Logging.Configuration NuGet packages.
      (#​6327)

    • Add support for .NET 10.0.
      (#​6307)

    • Added the possibility to disable timestamps via the PrometheusAspNetCoreOptions.
      (#​6600)

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Updated OpenTelemetry core component version(s) to 1.14.0.
      (#​6689)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.14.0-beta.1

    • Breaking Change When targeting net8.0, the package now depends on version
      8.0.0 of the Microsoft.Extensions.DependencyInjection.Abstractions,
      Microsoft.Extensions.Diagnostics.Abstractions and
      Microsoft.Extensions.Logging.Configuration NuGet packages.
      (#​6327)

    • Add support for .NET 10.0.
      (#​6307)

    • Added the possibility to disable timestamps via the PrometheusHttpListenerOptions.
      (#​6600)

    • Breaking Change NuGet packages now use the Sigstore bundle format
      (.sigstore.json) for digital signatures instead of separate signature
      (.sig) and certificate (.pem) files. This requires cosign 3.0 or later
      for verification. See the Digital signing
      section       for updated verification instructions.
      (#​6623)

    • Updated OpenTelemetry core component version(s) to 1.14.0.
      ... (truncated)

1.13.1

For highlights and announcements pertaining to this release see: Release Notes > 1.13.1.

The following changes are from the previous release 1.13.0.

... (truncated)

1.13.1-beta.1

The following changes are from the previous release 1.13.0-beta.1.

1.13.0

For highlights and announcements pertaining to this release see: Release Notes > 1.13.0.

The following changes are from the previous release 1.12.0.

  • NuGet: OpenTelemetry v1.13.0

    • Added a verification to ensure that a MetricReader can only be registered
      to a single MeterProvider, as required by the OpenTelemetry specification.
      (#​6458)

    • Added FormatMessage configuration option to self-diagnostics feature. When
      set to true (default is false), log messages will be formatted by replacing
      placeholders with actual parameter values for improved readability.

      Example OTEL_DIAGNOSTICS.json:

      {
    "LogDirectory": ".",
    "FileSize": 32768,
    "LogLevel": "Warning",
    "FormatMessage": true
}

    • Fixed parsing of OTEL_TRACES_SAMPLER_ARG decimal values to always use .
      as the delimiter when using the traceidratio sampler, preventing
      locale-specific parsing issues.
      (#​6444)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.13.0

    • Added AddLink(SpanContext, SpanAttributes?) to TelemetrySpan to support
      linking spans and associating optional attributes for advanced trace relationships.
      (#​6305)

    • Experimental (only in pre-release versions): Added the EventName property
      to LogRecordData
      (#​6306)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.13.0

    No notable changes.

    See CHANGELOG for details.

... (truncated)

1.13.0-beta.1

The following changes are from the previous release 1.12.0-beta.1.

1.12.0

For highlights and announcements pertaining to this release see: Release Notes > 1.12.0.

The following changes are from the previous release 1.11.2.

1.12.0-beta.1

The following changes are from the previous release 1.11.2-beta.1.

1.11.2

For highlights and announcements pertaining to this release see: Release Notes > 1.11.2.

The following changes are from the previous release 1.11.1.

1.11.2-beta.1

The following changes are from the previous release 1.11.0-beta.1.

1.11.1

For highlights and announcements pertaining to this release see: Release Notes > 1.11.1.

The following changes are from the previous release 1.11.0.

... (truncated)

1.11.0

For highlights and announcements pertaining to this release see: Release Notes > 1.11.0.

The following changes are from the previous release 1.11.0-rc.1.

... (truncated)

1.11.0-rc.1

The following changes are from the previous release 1.10.0.

1.11.0-beta.1

The following changes are from the previous release 1.10.0-beta.1.

1.10.0

For highlights and announcements pertaining to this release see: Release Notes > 1.10.0.

The following changes are from the previous release 1.10.0-rc.1.

  • NuGet: OpenTelemetry v1.10.0

    • Promoted the MetricPoint reclaim feature for Delta aggregation temporality
      from experimental to stable.
      (#​5956)

      Previous Behavior:
      The SDK maintained a fixed set of MetricPoints which were assigned on a
      first-come basis based on the tags. MetricPoint reclaim was an experimental
      feature users could opt-into setting the environment variable
      OTEL_DOTNET_EXPERIMENTAL_METRICS_RECLAIM_UNUSED_METRIC_POINTS=true.

      New Behavior:
      MetricPoint reclaim is now enabled by default when Delta aggregation
      temporality is used without the need to set an environment variable. Unused
      MetricPoints will automatically be reclaimed and reused for future
      measurements. There is NO ability to revert to the old behavior.

    • Updated the Microsoft.Extensions.Logging.Configuration and
      Microsoft.Extensions.Diagnostics.Abstractions package versions to
      9.0.0.
      (#​5967)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.10.0

    • Updated System.Diagnostics.DiagnosticSource package version to
      9.0.0.
      (#​5967)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.10.0

    • Updated Microsoft.Extensions.DependencyInjection.Abstractions package
      version to 9.0.0.
      (#​5967)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.10.0

    No notable changes.

    See CHANGELOG for details.
    ... (truncated)

1.10.0-rc.1

The following changes are from the previous release 1.10.0-beta.1.

  • NuGet: OpenTelemetry v1.10.0-rc.1

    • The experimental APIs previously covered by OTEL1003
      (MetricStreamConfiguration.CardinalityLimit) are now part of the public API
      and supported in stable builds.
      (#​5926)

    • Promoted overflow attribute from experimental to stable and removed the
      OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE environment variable.

      Previous Behavior:
      By default, when the cardinality limit was reached, measurements were dropped,
      and an internal log was emitted the first time this occurred. Users could
      opt-in to experimental overflow attribute feature with
      OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE=true.
      With this setting, the SDK would use an overflow attribute
      (otel.metric.overflow = true) to aggregate measurements instead of dropping
      measurements. No internal log was emitted in this case.

      New Behavior:
      The SDK now always uses the overflow attribute (otel.metric.overflow = true)
      to aggregate measurements when the cardinality limit is reached. The previous
      approach of dropping measurements has been removed. No internal logs are
      emitted when the limit is hit.

      The default cardinality limit remains 2000 per metric. To set the cardinality
      limit for an individual metric, use the changing cardinality limit for a
      Metric      .

      There is NO ability to revert to old behavior.
      (#​5909)

    • Exposed a public constructor on Batch<T> which accepts a single instance
      of T to be contained in the batch.
      (#​5642)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.10.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.10.0-rc.1

    No notable changes.

... (truncated)

1.10.0-beta.1

The following changes are from the previous release 1.9.0.

  • NuGet: OpenTelemetry v1.10.0-beta.1

    • Added OpenTelemetrySdk.Create API for configuring OpenTelemetry .NET signals
      (logging, tracing, and metrics) via a single builder. This new API simplifies
      bootstrap and teardown, and supports cross-cutting extensions targeting
      IOpenTelemetryBuilder.
      (#​5325)

    • Updated the Microsoft.Extensions.Logging.Configuration and
      Microsoft.Extensions.Diagnostics.Abstractions packages version to
      9.0.0-rc.1.24431.7.
      (#​5853)

    • Added support in metrics for histogram bucket boundaries set via the .NET 9
      InstrumentAdvice<T>
      API.

      Note: With this change explicit bucket histogram boundary resolution will
      apply in the following order:

      1. View API
      2. Advice API
      3. SDK defaults

      See #​5854
      for details.

    • Added support for collecting metrics emitted via the .NET 9
      Gauge<T>
      API.
      (#​5867)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.10.0-beta.1

    • Breaking change: CompositeTextMapPropagator.Fields now returns a
      unioned set of fields from all combined propagators. Previously this always
      returned an empty set.
      (#​5745)

    • Optimize performance of TraceContextPropagator.Extract.
      (#​5749)

    • Obsoleted the ActivityExtensions.GetStatus and
      ActivityExtensions.SetStatus extension methods. Users should migrate to the
      System.Diagnostics.DiagnosticSource
      Activity.SetStatus
      ... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified de...

Description has been truncated

[!NOTE]
Medium Risk
Dependency upgrades in the .NET Framework e2e app may change OpenTelemetry propagation behavior and introduce subtle runtime/binding issues (notably around OpenTelemetry.Api and System.Diagnostics.DiagnosticSource major version changes). No application logic changes, but failures would surface at runtime during instrumentation/telemetry export.

Overview
Updates the e2e/dotnet4/cs sample’s NuGet dependencies, primarily bumping OpenTelemetry.Extensions.Propagators to 1.15.3 (and OpenTelemetry.Api to 1.15.3) along with transitive/supporting runtime libraries (e.g., System.Diagnostics.DiagnosticSource to 10.0.7, System.* packages).

Adjusts Web.config assembly binding redirects (including adding a redirect for OpenTelemetry.Extensions.Propagators and widening some oldVersion ranges) and updates project references in cs.csproj to point at the new package versions/paths (including setting Private=True for updated assemblies).

Reviewed by Cursor Bugbot for commit 3493215. Bugbot is set up for automated code reviews on this repo. Configure here.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump the nuget group with 1 update
3493215 
Bumps OpenTelemetry.Extensions.Propagators from 1.9.0 to 1.15.3

---
updated-dependencies:
- dependency-name: OpenTelemetry.Extensions.Propagators
  dependency-version: 1.15.3
  dependency-type: direct:production
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner April 23, 2026 21:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Apr 23, 2026
cursor[bot]
cursor Bot reviewed Apr 23, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 3493215. Configure here.

Comment thread e2e/dotnet4/cs/Web.config
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="OpenTelemetry.Extensions.Propagators" publicKeyToken="7bd6737fe5b67e3c" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-1.0.0.0" newVersion="1.0.0.0" />

@cursor cursor Bot Apr 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing binding redirects for upgraded system assemblies

High Severity

The PR upgraded System.Diagnostics.DiagnosticSource from 9.0.0 (assembly version 9.0.0.0) to 10.0.7 (assembly version 10.0.0.7) but added no binding redirect in Web.config. Packages still at 1.11.2 (OpenTelemetry, OpenTelemetry.Api.ProviderBuilderExtensions, OpenTelemetry.Exporter.OpenTelemetryProtocol, OpenTelemetry.Extensions.Hosting) were compiled against the 9.0.0.0 assembly version. At runtime on .NET Framework 4.8, the CLR will fail to resolve the old version, causing a FileLoadException. The same issue applies to System.Buffers (4.0.3.0→4.0.5.0), System.Memory (4.0.1.2→4.0.5.0), System.Numerics.Vectors (4.1.4.0→4.1.6.0), and System.Runtime.CompilerServices.Unsafe (6.0.0.0→6.0.3.0), all of which were upgraded without corresponding binding redirects.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3493215. Configure here.

@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 14, 2026
Merged
osm6495 pushed a commit that referenced this pull request Aug 18, 2026
@devin-ai-integration
fix: remediate dependency vulnerabilities across npm, go, pip, and ru…
9cbe8d5 
…bygems (#732)

## Summary

Automated dependency-vulnerability remediation for findings reported by
GitHub Dependabot and Wiz. Only findings that are actionable under the
severity/age policy (critical immediately; high/moderate after a 7-day
hold; low ignored; must have a published fixed version) and that are
still present in the manifests/lockfiles are included. Stale alerts
(already patched in the lockfile, e.g. `next`, `vite`, `django` in
`sdk/highlight-py` after this change) were verified against the
lockfiles rather than trusted blindly.

Fixed:

| Ecosystem | Package | Change | Severity | Advisory |
|---|---|---|---|---|
| go | `github.com/gofiber/fiber/v2` | 2.52.13 → 2.52.14 (3 modules) |
moderate | GHSA-gcfq-8gqf-4876 |
| npm | `turbo` | 2.8.7 → 2.9.14 | moderate | GHSA-hcf7-66rw-9f5r |
| npm | `hono` | resolution → ^4.12.34 (4.13.2) | moderate |
GHSA-8j4g-w8fx-2239, GHSA-f23p-vx2j-j53r, GHSA-54fx-42gc-7vw4 |
| npm | `valibot` | 1.2.0 → 1.4.2 | moderate | GHSA-5qjj-4xww-7phc |
| npm | `@remix-run/router` | 1.23.2 → 1.23.3 | moderate |
GHSA-2j2x-hqr9-3h42 |
| npm | `markdown-it` | 14.1.1 → 14.3.0 | moderate | GHSA-6v5v-wf23-fmfq
|
| npm | `uuid` | 11.1.0 → 11.1.1 | moderate | GHSA-w5hq-g745-h8pq |
| npm | `@remix-run/node` (e2e/react-native) | 2.15.2 → 2.17.5 |
critical (Wiz) | CVE-2025-61686 |
| npm | `ajv` (e2e/react-native) | 8.17.1 → 8.20.0 | moderate |
GHSA-2g4f-4pwh-qvx6 |
| npm | `yaml` (e2e/react-native) | 1.10.2 → 1.10.3 | moderate |
GHSA-48c2-rrv3-qjmp |
| npm | `js-yaml` | resolutions → ^3.15.1 / ^4.3.1 | high |
GHSA-5p4m-2wfm-xmqj |
| pip | `django` (sdk/highlight-py dev dep) | 4.2.30 → 5.2.17 | moderate
| GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w |
| pip | `django` (e2e/python) | 5.2.14 → 5.2.17 | moderate |
GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w |
| pip | `pytest` (e2e/tests) | 7.4.4 → 9.1.1 | moderate |
GHSA-6w46-j5rx-g56g |
| pip | `loguru` (e2e/python) | constraint `^0` → `^0.7.3` | moderate |
GHSA-39ph-wr67-j4xq |
| rubygems | `activesupport` (RN example Gemfiles) | `>= 6.1.7.5` → `>=
7.2.3.1` | moderate | GHSA-2j26-frm8-cmj9, GHSA-89vf-4333-qx8v,
GHSA-cg4j-q9v8-6v38 |

Deferred, with reasons:

- **Critical `org.bouncycastle:bcprov-jdk18on` 1.77 → 1.80.2** (Wiz,
CVE-2025-14813) in `sdk/@launchdarkly/flutter/.../android/build.gradle`
and
`sdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle`.
It is a build-time-only transitive of the
`com.android.tools.build:gradle` 8.7.2 buildscript classpath (not
shipped in artifacts); the real fix is an AGP upgrade. No Android SDK
and no Maven Central access in this environment, so the change could not
be built or verified — left for a dedicated PR.
- **No published fix**: `@angular/*`, `apollo-server-core`,
`extract-zip`, `image-size`, `react-router-dom`.
- **Major upgrades requiring code changes** (kept out of this bump-only
PR): `@nestjs/core` 10 → 11, `svelte` 4 → 5, `react-router` 6 → 7,
`@opentelemetry/core` 1.30 → 2.x, `file-type` 20 → 21, `fast-xml-parser`
4 → 5, `ts-deepmerge` 2 → 8, transitive `nanoid` 4 → 5 and `markdown-it`
12 → 14.
- **Under the 7-day hold**: `@hono/node-server` 1.19.15, plus the newest
`image-size` advisories.
- **`nanoid`**: the 3.x line is already at 3.3.18 in the lockfile
(patched); the remaining alert covers the transitive `nanoid@4.0.2`,
whose fix is the ESM-only 5.x major, so it stays in the major-upgrade
bucket.
- **Blocked by a peer constraint**: `pytest` 9 in `e2e/python` —
`pytest-asyncio` 0.25.3 requires `pytest <9`, so that manifest stays on
`^8.2.0`.
- **NuGet OpenTelemetry packages** (`e2e/dotnet4/cs/packages.config`):
already covered by open Dependabot PRs (#513, #509, #496) and nuget.org
is not reachable here, so no duplicate change.
- **Low severity** findings are out of policy scope (`webpack`,
`body-parser`, `@babel/core`, `json`, `msgpack`, `sqlite3`, `flask`,
`@tootallnate/once`).

Excluded because it did not build: none — but see the environment
caveats below.

## How did you test this change?

Dependency-only change, no runtime behavior change, so no screenshots or
staging link apply.

- `yarn install` + `yarn dedupe --check` — clean (Puppeteer's
Chrome-download postinstall fails in this sandbox because its CDN is
blocked; unrelated to these bumps).
- `yarn build:sdk` — 20/20 tasks pass. `yarn build` — 49/53; only
`angular.io-example#build` fails, because font inlining needs
`fonts.googleapis.com`, which is blocked in this sandbox.
- `yarn lint` — 49/49 pass.
- `yarn test` — 76/77 pass. `@highlight-run/next#test` fails because the
test boots a Next app whose corepack step downloads yarn from
`repo.yarnpkg.com` (blocked here). `aws-lambda#build` needs the `sam`
CLI, which is not installed.
- Re-validated after the `js-yaml` bump: `yarn build:sdk` 20/20 pass and
`yarn test` 57/61, with `angular.io-example#build` the only failure
(blocked Google Fonts, as above).
- `yarn format-check` — the only warnings are local build artifacts
under `lib/` (not tracked); all changed manifests pass Prettier.
- Go: `go build ./...`, `go vet ./...`, `go mod verify` pass in
`sdk/highlight-go` and `e2e/go-plugin`. `sdk/highlight-go` tests pass
except a pre-existing `log.TestParseConsoleMessages` failure (reproduced
on the unmodified module), and `e2e/go` has a pre-existing duplicate
`main` in `fiber.go`/`echo.go`.
- Python: `sdk/highlight-py` suite passes on Django 5.2.17 (259 tests);
`e2e/tests` installs and collects on pytest 9; `e2e/python` imports
Django/loguru/Flask cleanly.
- Not validated in this environment: the Android/Gradle and Ruby/Bundler
paths (no Android SDK, Maven Central and RubyGems not reachable).
Pre-commit hooks could not run because their hook environments clone
from GitHub directly; the equivalent checks were run manually.

## Are there any deployment considerations?

No migrations or backfills. Notes for reviewers:

- `sdk/highlight-py` moves its **dev** dependency Django from 4.x to
5.2.17 (the advisories have no 4.x fix); the shipped package is
unaffected and the Django integration tests pass.
- The React Native example Gemfiles now require `activesupport >=
7.2.3.1`, which needs Ruby >= 3.1. The Gemfiles still declare `ruby ">=
2.6.10"`; CI runners use modern Ruby, but this is worth a look if anyone
builds those examples on an old Ruby.
- `turbo` moves 2.8.7 → 2.9.14. Note `yarn build` cannot parse
`rrweb/turbo.json` (missing `extends`) on **either** version in a fresh
checkout of this branch's base, so the build was validated with that
submodule file locally patched; the submodule itself is untouched by
this PR.
- Lockfile churn (`yarn.lock`, `poetry.lock`, `package-lock.json`,
`go.sum`) is expected from these bumps; the React Native lockfile was
regenerated and reformatted back to the repo's tab indentation to keep
the diff readable.


Previous session:
https://app.devin.ai/sessions/142c0a5e060144ec97c9177f692e8cb9

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Overview**
> Bumps **dependency versions and lockfiles** across e2e, SDK, and root
tooling to clear Dependabot/Wiz findings, without changing application
logic.
> 
> **Go:** `github.com/gofiber/fiber/v2` **2.52.13 → 2.52.14** in
`sdk/highlight-go`, `e2e/go`, and `e2e/go-plugin` (with `go.sum`
updates).
> 
> **npm/yarn:** Root `package.json` raises **`turbo` to 2.9.14** and
adds/updates **resolutions** for `hono`, `valibot`, `@remix-run/router`,
`markdown-it`, and `uuid`; `yarn.lock` follows. **`e2e/react-native`**
adds overrides for `@remix-run/node`, `ajv@8`, and `yaml@1` and
refreshes `package-lock.json`.
> 
> **Python:** **`django` → 5.2.17** in `e2e/python` and
`sdk/highlight-py` (dev); **`e2e/python`** pins **`loguru` to ^0.7.3**;
**`e2e/tests`** upgrades **`pytest` to ^9** (lockfile includes
**pygments**).
> 
> **Ruby:** React Native example **Gemfiles** require **`activesupport
>= 7.2.3.1`** instead of the older minimum/exclusion pattern.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
92b9ed3. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->


Link to Devin session:
https://app.devin.ai/sessions/52f99250d37f411190c5f723b21ab8b7

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Aug 24, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants