fix: resolve all 24 open Dependabot security alerts#1179
Merged
Conversation
Update dependencies across npm, Go, and Python ecosystems to address all open Dependabot security alerts (2 critical, 6 high, 14 medium, 2 low). npm (1 alert): - axios: ^1.6.7 -> ^1.15.0 (fixes CVE-2025-62718 SSRF bypass) Go (12 alerts): - golang.org/x/net: v0.2.0 -> v0.52.0 (fixes 8 alerts including HTTP/2 vulns) - google.golang.org/grpc: v1.50.1 -> v1.80.0 (fixes 2 alerts including auth bypass) - google.golang.org/protobuf: v1.28.1 -> v1.36.11 (fixes infinite loop CVE) - github.com/golang/glog: v1.0.0 -> v1.2.5 (fixes insecure temp file usage) Python (11 alerts): - Werkzeug: 2.2.2 -> 3.1.8 (fixes 9 alerts including RCE via debugger) - Flask: 2.1.2 -> 3.1.3 (fixes 2 alerts including session cookie disclosure) All affected manifests are in test infrastructure (integration-tests/, local_tests/), not the production Rust extension (bottlecap/). Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
jchrostek-dd
marked this pull request as ready for review
April 15, 2026 16:41
Contributor
There was a problem hiding this comment.
Pull request overview
Updates vulnerable dependencies used by this repository’s test infrastructure (integration tests + local test apps) to clear Dependabot security alerts, without modifying the production Rust extension in bottlecap/.
Changes:
- Bump
axiosinintegration-tests/to^1.15.0(and update lockfile accordingly). - Update Go module dependencies in
local_tests/golang/, includinggolang.org/x/net,grpc, andprotobuf. - Update Python test app dependencies in
local_tests/serverless-init/to Flask 3.x / Werkzeug 3.x.
Reviewed changes
Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
local_tests/serverless-init/requirements.txt |
Updates Flask/Werkzeug versions for security fixes in the serverless-init local test app. |
local_tests/golang/go.mod |
Updates Go dependency versions and bumps the Go toolchain directive for the Go local test app. |
local_tests/golang/go.sum |
Synchronizes Go module checksums for updated Go dependencies. |
integration-tests/package.json |
Updates axios version range for integration test tooling. |
integration-tests/package-lock.json |
Locks axios (and transitive deps) to the updated versions. |
Files not reviewed (1)
- integration-tests/package-lock.json: Language not supported
| module app | ||
|
|
||
| go 1.22 | ||
| go 1.25.0 |
There was a problem hiding this comment.
The go directive was bumped from 1.22 to 1.25.0, which increases the minimum Go toolchain required to build/run this local test app. If this version bump isn’t strictly required by the updated deps, consider keeping the directive at the lowest supported version (or at least using the repo/CI’s Go version) to avoid breaking contributors’ local test workflows; if it is required, it would help to document the new minimum Go version for local_tests/golang/.
Suggested change
| go 1.25.0 | |
| go 1.22 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 24 open Dependabot security alerts (2 critical, 6 high, 14 medium, 2 low) across three ecosystems by updating vulnerable dependencies in test infrastructure.
Note: All affected dependencies are in test infrastructure (
integration-tests/,local_tests/), not the production Rust extension (bottlecap/).Changes
npm (
integration-tests/)^1.6.7→^1.15.0— fixes SSRF bypass via NO_PROXY hostname normalization (CVE-2025-62718, critical)Go (
local_tests/golang/)v0.2.0→v0.52.0— fixes 8 alerts: HTTP/2 rapid reset, uncontrolled resource consumption, XSS, IPv6 zone ID proxy bypass, excessive memory growth, stream cancellation, improper text renderingv1.50.1→v1.80.0— fixes 2 alerts: authorization bypass via missing leading slash (CVE-2026-33186, critical), HTTP/2 rapid resetv1.28.1→v1.36.11— fixes infinite loop in protojson.Unmarshalv1.0.0→v1.2.5— fixes insecure temporary file usagePython (
local_tests/serverless-init/)2.1.2→3.1.3— fixes session cookie disclosure, missing Vary:Cookie header2.2.2→3.1.8— fixes 9 alerts: debugger RCE, safe_join Windows device name bypasses, multipart form DoS, resource exhaustion, nameless cookie bypassReviewer Notes
godirective inlocal_tests/golang/go.modwas auto-upgraded fromgo 1.22togo 1.25.0(required bygolang.org/x/net v0.52.0). This only affects the test Lambda function, not CI build toolchains for the main extension.app.py) uses minimal Flask APIs and was reviewed for compatibility. However,ddtrace==1.4.1compatibility with Flask 3.x should be verified in CI.Alert Breakdown