fix: remediate dependency vulnerabilities across npm, go, pip, and rubygems

[devin-ai-integration]

Summary

Automated dependency-vulnerability remediation for findings reported by GitHub Dependabot and Wiz. Only findings that are actionable under the severity/age policy (critical immediately; high/moderate after a 7-day hold; low ignored; must have a published fixed version) and that are still present in the manifests/lockfiles are included. Stale alerts (already patched in the lockfile, e.g. next, vite, django in sdk/highlight-py after this change) were verified against the lockfiles rather than trusted blindly.

Fixed:

Ecosystem	Package	Change	Severity	Advisory
go	github.com/gofiber/fiber/v2	2.52.13 → 2.52.14 (3 modules)	moderate	GHSA-gcfq-8gqf-4876
npm	turbo	2.8.7 → 2.9.14	moderate	GHSA-hcf7-66rw-9f5r
npm	hono	resolution → ^4.12.34 (4.13.2)	moderate	GHSA-8j4g-w8fx-2239, GHSA-f23p-vx2j-j53r, GHSA-54fx-42gc-7vw4
npm	valibot	1.2.0 → 1.4.2	moderate	GHSA-5qjj-4xww-7phc
npm	@remix-run/router	1.23.2 → 1.23.3	moderate	GHSA-2j2x-hqr9-3h42
npm	markdown-it	14.1.1 → 14.3.0	moderate	GHSA-6v5v-wf23-fmfq
npm	uuid	11.1.0 → 11.1.1	moderate	GHSA-w5hq-g745-h8pq
npm	@remix-run/node (e2e/react-native)	2.15.2 → 2.17.5	critical (Wiz)	CVE-2025-61686
npm	ajv (e2e/react-native)	8.17.1 → 8.20.0	moderate	GHSA-2g4f-4pwh-qvx6
npm	yaml (e2e/react-native)	1.10.2 → 1.10.3	moderate	GHSA-48c2-rrv3-qjmp
pip	django (sdk/highlight-py dev dep)	4.2.30 → 5.2.17	moderate	GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w
pip	django (e2e/python)	5.2.14 → 5.2.17	moderate	GHSA-8qcx-xf44-272x, GHSA-crhf-3pfg-w68w
pip	pytest (e2e/tests)	7.4.4 → 9.1.1	moderate	GHSA-6w46-j5rx-g56g
pip	loguru (e2e/python)	constraint ^0 → ^0.7.3	moderate	GHSA-39ph-wr67-j4xq
rubygems	activesupport (RN example Gemfiles)	>= 6.1.7.5 → >= 7.2.3.1	moderate	GHSA-2j26-frm8-cmj9, GHSA-89vf-4333-qx8v, GHSA-cg4j-q9v8-6v38

Deferred, with reasons:

• Critical org.bouncycastle:bcprov-jdk18on 1.77 → 1.80.2 (Wiz, CVE-2025-14813) in sdk/@launchdarkly/flutter/.../android/build.gradle and sdk/@launchdarkly/react-native-ld-session-replay/android/build.gradle. It is a build-time-only transitive of the com.android.tools.build:gradle 8.7.2 buildscript classpath (not shipped in artifacts); the real fix is an AGP upgrade. No Android SDK and no Maven Central access in this environment, so the change could not be built or verified — left for a dedicated PR.
• No published fix: @angular/*, apollo-server-core, extract-zip, image-size, react-router-dom.
• Major upgrades requiring code changes (kept out of this bump-only PR): @nestjs/core 10 → 11, svelte 4 → 5, react-router 6 → 7, @opentelemetry/core 1.30 → 2.x, file-type 20 → 21, fast-xml-parser 4 → 5, ts-deepmerge 2 → 8, transitive nanoid 4 → 5 and markdown-it 12 → 14.
• Under the 7-day hold: @hono/node-server 1.19.15, js-yaml 3.15.1/4.3.1, nanoid 3.3.18, plus the newest image-size advisories.
• Blocked by a peer constraint: pytest 9 in e2e/python — pytest-asyncio 0.25.3 requires pytest <9, so that manifest stays on ^8.2.0.
• NuGet OpenTelemetry packages (e2e/dotnet4/cs/packages.config): already covered by open Dependabot PRs (Bump the nuget group with 4 updates #513, Bump the nuget group with 1 update #509, Bump the nuget group with 1 update #496) and nuget.org is not reachable here, so no duplicate change.
• Low severity findings are out of policy scope (webpack, body-parser, @babel/core, json, msgpack, sqlite3, flask, @tootallnate/once).

Excluded because it did not build: none — but see the environment caveats below.

How did you test this change?

Dependency-only change, no runtime behavior change, so no screenshots or staging link apply.

• yarn install + yarn dedupe --check — clean.
• yarn build:sdk — 20/20 tasks pass. yarn build — 49/53; only angular.io-example#build fails, because font inlining needs fonts.googleapis.com, which is blocked in this sandbox.
• yarn lint — 49/49 pass.
• yarn test — 76/77 pass. @highlight-run/next#test fails because the test boots a Next app whose corepack step downloads yarn from repo.yarnpkg.com (blocked here). aws-lambda#build needs the sam CLI, which is not installed.
• yarn format-check — the only warnings are local build artifacts under lib/ (not tracked); all changed manifests pass Prettier.
• Go: go build ./..., go vet ./..., go mod verify pass in sdk/highlight-go and e2e/go-plugin. sdk/highlight-go tests pass except a pre-existing log.TestParseConsoleMessages failure (reproduced on the unmodified module), and e2e/go has a pre-existing duplicate main in fiber.go/echo.go.
• Python: sdk/highlight-py suite passes on Django 5.2.17 (259 tests); e2e/tests installs and collects on pytest 9; e2e/python imports Django/loguru/Flask cleanly.
• Not validated in this environment: the Android/Gradle and Ruby/Bundler paths (no Android SDK, Maven Central and RubyGems not reachable). Pre-commit hooks could not run because their hook environments clone from GitHub directly; the equivalent checks were run manually.

Are there any deployment considerations?

No migrations or backfills. Notes for reviewers:

• sdk/highlight-py moves its dev dependency Django from 4.x to 5.2.17 (the advisories have no 4.x fix); the shipped package is unaffected and the Django integration tests pass.
• The React Native example Gemfiles now require activesupport >= 7.2.3.1, which needs Ruby >= 3.1. The Gemfiles still declare ruby ">= 2.6.10"; CI runners use modern Ruby, but this is worth a look if anyone builds those examples on an old Ruby.
• turbo moves 2.8.7 → 2.9.14. Note yarn build cannot parse rrweb/turbo.json (missing extends) on either version in a fresh checkout of this branch's base, so the build was validated with that submodule file locally patched; the submodule itself is untouched by this PR.
• Lockfile churn (yarn.lock, poetry.lock, package-lock.json, go.sum) is expected from these bumps; the React Native lockfile was regenerated and reformatted back to the repo's tab indentation to keep the diff readable.

Link to Devin session: https://app.devin.ai/sessions/142c0a5e060144ec97c9177f692e8cb9

---

Note

Overview
Bumps dependency versions and lockfiles across e2e, SDK, and root tooling to clear Dependabot/Wiz findings, without changing application logic.

Go: github.com/gofiber/fiber/v2 2.52.13 → 2.52.14 in sdk/highlight-go, e2e/go, and e2e/go-plugin (with go.sum updates).

npm/yarn: Root package.json raises turbo to 2.9.14 and adds/updates resolutions for hono, valibot, @remix-run/router, markdown-it, and uuid; yarn.lock follows. e2e/react-native adds overrides for @remix-run/node, ajv@8, and yaml@1 and refreshes package-lock.json.

Python: django → 5.2.17 in e2e/python and sdk/highlight-py (dev); e2e/python pins loguru to ^0.7.3; e2e/tests upgrades pytest to ^9 (lockfile includes pygments).

Ruby: React Native example Gemfiles require activesupport >= 7.2.3.1 instead of the older minimum/exclusion pattern.

^{Reviewed by Cursor Bugbot for commit 92b9ed3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
628	551	88%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 92b9ed3 by action🐍