Skip to content

deps: resolve high-severity advisories in docs and api - #8536

Merged
matthewelwell merged 2 commits into
mainfrom
deps/resolve-high-severity-advisories
Sep 16, 2026
Merged

deps: resolve high-severity advisories in docs and api#8536
matthewelwell merged 2 commits into
mainfrom
deps/resolve-high-severity-advisories

Conversation

@matthewelwell

@matthewelwell matthewelwell commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Clears the outstanding Dependabot advisories in docs/package-lock.json and api/uv.lock:

  1. Add overrides to 3 transitive dependencies in docs/package.json in order to work around parent
    dependency pins.
  2. Remove unused explicit dependency on pyparsing in order to allow httplib2 to move.

@matthewelwell @claude
deps(docs): resolve high-severity advisories in transitive deps
627fe6e 
Three Dependabot advisories against docs/package-lock.json, all transitive, all
resolvable with an override:

- lodash-es 4.17.23 -> 4.18.1 (CVE-2026-13149 range <= 4.17.23)
- yaml 1.10.2 -> 1.10.3 (advisory >= 1.0.0, < 1.10.3)
- js-yaml 4.3.0 -> 4.3.2 (advisory >= 4.0.0, < 4.3.2)

js-yaml needs a version-scoped override key. A blanket `js-yaml` override would
also catch the 5.4.2 copies under @apidevtools/json-schema-ref-parser and
@redocly/openapi-core, which are outside the advisory range and would be pulled
down a major version. Scoping to ^4.0.0 leaves those untouched; the vulnerable
4.3.0 copy under openapi-to-postmanv2 dedupes to the root 4.3.2.

Not addressed here: @faker-js/faker 5.5.3 (advisory <= 10.4.0). postman-collection
pins it exactly, and forcing 10.x breaks the build — v10 renamed the `address`
namespace to `location`, so docusaurus-plugin-openapi-docs dies on
`faker.address.city`. Needs an upstream fix in postman-collection.

Verified with `npm run build`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 92fd3b01-bdd3-4ea9-9837-63693a3bbc31

📥 Commits

Reviewing files that changed from the base of the PR and between 30098e5 and e29f067.

⛔ Files ignored due to path filters (2)
  • api/uv.lock is excluded by !**/*.lock
  • docs/package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (2)
  • api/pyproject.toml
  • docs/package.json
💤 Files with no reviewable changes (1)
  • api/pyproject.toml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Walkthrough

The Python package no longer declares pyparsing as a runtime dependency. The documentation package retains the qs override and adds pinned overrides for lodash-es, yaml, and js-yaml@^4.0.0. No public entities changed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to e29f0

The dependency updates have no established runtime or integration risk and are ready to merge.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@vercel

vercel Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated
docs Ignored Ignored Preview Sep 16, 2026 8:48am UTC
flagsmith-frontend-preview Ignored Ignored Preview Sep 16, 2026 8:48am UTC
flagsmith-frontend-staging Ignored Ignored Preview Sep 16, 2026 8:48am UTC

Request Review

@github-actions github-actions Bot added the docs Documentation updates label Sep 15, 2026
@matthewelwell @claude
deps(api): upgrade httplib2 to 0.32.0, drop vestigial pyparsing pin
e29f067 
httplib2 0.22.0 is subject to a high-severity advisory (patched in 0.32.0). It is
transitive here, via google-api-python-client, google-auth-httplib2 and
oauth2client, all of which accept >=0.19.0,<1.0.0.

The upgrade was blocked by our own pin. httplib2 0.32.0 requires
pyparsing>=3.1,<4, while pyproject declared pyparsing>=2.4.7,<2.5.0 — so
`uv lock --upgrade-package httplib2` silently resolved back to 0.22.0 rather than
reporting a conflict.

Nothing in the API imports pyparsing; httplib2 is its only consumer, and it
declares its own requirement. The pin dates back to the Poetry migration (#2214)
and appears vestigial, so removing the declaration rather than widening it lets
the resolver track whatever httplib2 needs. That takes pyparsing 2.4.7 -> 3.3.2.

Verified: imports of httplib2, oauth2client, googleapiclient.discovery and
google.oauth2 all clean, and tests/unit/app_analytics (the only code touching this
chain) passes 157/157.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@matthewelwell matthewelwell changed the title deps(docs): resolve high-severity advisories in transitive deps deps: resolve high-severity advisories in docs and api Sep 16, 2026
@github-actions github-actions Bot added api Issue related to the REST API dependencies Pull requests that update a dependency file and removed docs Documentation updates labels Sep 16, 2026
@codecov

codecov Bot commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.81%. Comparing base (30098e5) to head (e29f067).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8536      +/-   ##
==========================================
- Coverage   98.82%   98.81%   -0.01%     
==========================================
  Files        1622     1620       -2     
  Lines       66727    66185     -542     
==========================================
- Hits        65942    65400     -542     
  Misses        785      785

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@matthewelwell
matthewelwell marked this pull request as ready for review September 16, 2026 12:00
@matthewelwell
matthewelwell requested review from a team as code owners September 16, 2026 12:00
@matthewelwell
matthewelwell requested review from bakirFS and emyller and removed request for a team and bakirFS September 16, 2026 12:00
@github-actions github-actions Bot added dependencies Pull requests that update a dependency file and removed dependencies Pull requests that update a dependency file labels Sep 16, 2026
@github-actions

github-actions Bot commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-8536 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8536 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-api-test:pr-8536 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8536 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith:pr-8536 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8536 Finished ✅ Results ✅

@github-actions

github-actions Bot commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
✅ private-cloud · depot-ubuntu-latest-arm-16 — run #20486 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  38.7 seconds
commit  e29f067
info  🔄 Run: #20486 (attempt 1)

🗂️ Previous results
✅ private-cloud · depot-ubuntu-latest-16 — run #20486 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  33.2 seconds
commit  e29f067
info  🔄 Run: #20486 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #20486 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  36.4 seconds
commit  e29f067
info  🔄 Run: #20486 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #20486 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  33.9 seconds
commit  e29f067
info  🔄 Run: #20486 (attempt 1)

@github-actions

github-actions Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Visual Regression

19 screenshots compared. See report for details.
View full report

@matthewelwell
matthewelwell merged commit 7efa778 into main Sep 16, 2026
56 checks passed
@matthewelwell
matthewelwell deleted the deps/resolve-high-severity-advisories branch September 16, 2026 12:50
@flagsmith-engineering flagsmith-engineering Bot mentioned this pull request Sep 16, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Zaimwa9 Zaimwa9 Zaimwa9 approved these changes
@emyller emyller Awaiting requested review from emyller emyller is a code owner automatically assigned from Flagsmith/flagsmith-back-end

Assignees

No one assigned

Labels

api Issue related to the REST API dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matthewelwell @Zaimwa9