Skip to content

fix(FFESUPPORT-891): remediate July 2026 dependabot vulnerabilities #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aarsilv merged 3 commits into from
Jul 21, 2026
Merged

fix(FFESUPPORT-891): remediate July 2026 dependabot vulnerabilities #420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8c51632
fix(FFESUPPORT-891): remediate July 2026 dependabot vulnerabilities
aarsilv Jul 16, 2026
f648f6a
fix(FFESUPPORT-891): raise eppo_core MSRV to 1.83 for pyo3 0.29
aarsilv Jul 16, 2026
e7582e9
chore(FFESUPPORT-891): add changeset for July 2026 security dep bumps
aarsilv Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .changeset/july-2026-security-deps.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
"eppo_core": patch

@dd-oleksii dd-oleksii Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pyo3 version is part of the public interface, so that's technically a major change for the core

Suggested change
"eppo_core": patch
"eppo_core": major

"elixir-sdk": patch
"python-sdk": patch
"ruby-sdk": patch
"rust-sdk": patch

@dd-oleksii dd-oleksii Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing changed for Rust SDK, so it doesn't need a release

Suggested change
"rust-sdk": patch

---

Security: update dependencies to patched versions (July 2026 Dependabot advisories). Bumps `pyo3` 0.27 → 0.29 (python-sdk / eppo_core's optional `pyo3` feature; raises that build's MSRV to 1.83) and `serde_with` 3.20 → 3.21 (ruby-sdk / elixir-sdk). No public API changes.

@dd-oleksii dd-oleksii Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor: this looks like it wants separate changeset entries for pyo3 and serde_with bumps. pyo3 is not applicable to ruby/elixir, so ideally should leak into their changelogs

8 changes: 4 additions & 4 deletions elixir-sdk/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions eppo_core/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ repository = "https://github.com/Eppo-exp/rust-sdk"
license = "MIT"
keywords = ["eppo", "feature-flags"]
categories = ["config"]
rust-version = "1.80.0"
rust-version = "1.83.0" # raised from 1.80: pyo3 0.29 (optional `pyo3` feature) requires Rust >= 1.83

@dd-oleksii dd-oleksii Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor: the comment is irrelevant once the PR is merged

Suggested change
rust-version = "1.83.0" # raised from 1.80: pyo3 0.29 (optional `pyo3` feature) requires Rust >= 1.83
rust-version = "1.83.0"


[features]
# Use ahash for HashMaps. This is currently disabled by default to
Expand Down Expand Up @@ -51,7 +51,7 @@ uuid = { version = "1.11.0", features = ["v4", "serde"], optional = true }
exponential-backoff = { version = "2.0.0", optional = true }

# pyo3 dependencies
pyo3 = { version = "0.27.0", optional = true, default-features = false }
pyo3 = { version = "0.29", optional = true, default-features = false }
serde-pyobject = { version = "0.8.0", optional = true }

# magnus dependencies
Expand Down
2 changes: 1 addition & 1 deletion eppo_core/src/attributes/context_attributes.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ use super::{
// it and make it an internal type.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
#[cfg_attr(feature = "pyo3", pyo3::pyclass(module = "eppo_client"))]
#[cfg_attr(feature = "pyo3", pyo3::pyclass(module = "eppo_client", from_py_object))]
pub struct ContextAttributes {
/// Numeric attributes are quantitative (e.g., real numbers) and define a scale.
///
Expand Down
75 changes: 36 additions & 39 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions python-sdk/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ crate-type = ["cdylib"]
[dependencies]
eppo_core = { version = "=10.0.0", path = "../eppo_core", features = ["pyo3", "ahash"] }
log = "0.4.22"
pyo3 = "0.27.2"
pyo3-log = "0.13.2"
pyo3 = "0.29"
pyo3-log = "0.13.4"
serde-pyobject = "0.8.0"
serde_json = "1.0.125"
2 changes: 1 addition & 1 deletion python-sdk/src/assignment_logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ use pyo3::prelude::*;
use pyo3::types::PyDict;

#[derive(Debug, Clone)]
#[pyclass(frozen, subclass, module = "eppo_client")]
#[pyclass(frozen, subclass, module = "eppo_client", from_py_object)]
pub struct AssignmentLogger {}

#[pymethods]
Expand Down
8 changes: 4 additions & 4 deletions ruby-sdk/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading