fix(FFESUPPORT-891): remediate July 2026 dependabot vulnerabilities by aarsilv · Pull Request #420 · Eppo-exp/eppo-multiplatform

aarsilv · 2026-07-16T15:40:44Z

🤖 Generated from Claude

Remediates the 11 open Dependabot alerts in eppo-multiplatform across the Rust workspaces and npm tooling. Jira: https://datadoghq.atlassian.net/browse/FFESUPPORT-891

Advisories closed

Advisory	Severity	Package	Before → After	Where
shell-quote	critical	shell-quote	1.8.1 → 1.10.0	npm (dev tooling)
form-data	high	form-data	4.0.5 → 4.0.6	npm
GHSA-h67p-54hq-rp68	medium	js-yaml	4.1.1 → 4.3.0 · 3.14.2 → 3.15.0	npm
joi	medium	joi	17.13.3 → 17.13.4	npm
serde_with	medium	serde_with	3.20.0 → 3.21.0	Rust (ruby-sdk, elixir-sdk)
pyo3 (×2)	high+med	pyo3	0.27 → 0.29	Rust (eppo_core, python-sdk)

Approach

pyo3 0.27 → 0.29 (the risky one): the code already uses the modern Bound/into_pyobject API, so the migration was just the version bump + pyo3-log 0.13.2 → 0.13.4 (0.13.2 capped at <0.28) + an explicit from_py_object opt-in on the two #[pyclass] Clone types (ContextAttributes, AssignmentLogger) — pyo3 0.29 makes that derive opt-in, and I kept the existing behavior. serde-pyobject 0.8.0 already allows pyo3 >=0.27, so no change there.
serde_with 3.20 → 3.21: in-range minor across the ruby/elixir Cargo.locks.
npm: lockfile-only re-resolution of the four dev-tooling transitives (package.json unchanged). The root Cargo.lock is gitignored, so the Rust fixes ride on the Cargo.toml bumps (CI regenerates the lock).

How the tests/CI protect this change

cargo check --workspace ✓; cargo test -p eppo_core (pyo3 feature) → 57 tests pass; cargo build -p eppo_py (Python extension) ✓.
npm update reports 0 vulnerabilities.
CI runs cargo test --workspace --all-features plus the Python (maturin + pytest), Ruby, and Elixir SDK suites — which exercise the pyo3 bindings end-to-end.

Deferred advisories

None — all 11 alerts addressed; none left dismissed/auto-dismissed.

Rust: - pyo3 0.27 -> 0.29 (eppo_core + python-sdk); pyo3-log 0.13.2 -> 0.13.4. Migration was version-only plus an explicit `from_py_object` opt-in on the two #[pyclass] Clone types (ContextAttributes, AssignmentLogger), preserving the FromPyObject derive that pyo3 0.29 makes opt-in. serde-pyobject 0.8.0 already supports pyo3 >=0.27, so no bump needed there. - serde_with 3.20.0 -> 3.21.0 (ruby-sdk + elixir-sdk Cargo.lock). npm (package-lock.json; monorepo dev/test tooling): - shell-quote 1.8.1 -> 1.10.0 (critical), form-data 4.0.5 -> 4.0.6, js-yaml 4.1.1 -> 4.3.0 and 3.14.2 -> 3.15.0, joi 17.13.3 -> 17.13.4. Verified: cargo check --workspace, eppo_core 57 tests pass (pyo3 feature), eppo_py extension builds, npm reports 0 vulnerabilities. Python maturin build + pytest and ruby/elixir SDK builds run in CI. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

changeset-bot · 2026-07-16T15:40:52Z

🦋 Changeset detected

Latest commit: e7582e9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
eppo_core	Patch
elixir-sdk	Patch
python-sdk	Patch
ruby-sdk	Patch
rust-sdk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copilot

Pull request overview

This PR remediates Dependabot-reported vulnerabilities by updating vulnerable transitive npm dependencies via package-lock.json re-resolution, and bumping Rust dependency versions/locks across the workspace—most notably upgrading pyo3 to address advisories impacting the Python bindings.

Changes:

Bumped pyo3 to 0.29 (and pyo3-log to 0.13.4) and updated #[pyclass] annotations to opt into from_py_object where required.
Updated serde_with / serde_with_macros to 3.21.0 in the Ruby and Elixir SDK lockfiles.
Updated npm lockfile resolutions to pull patched versions of shell-quote, form-data, js-yaml, and joi (plus related transitives).

Reviewed changes

Copilot reviewed 4 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
ruby-sdk/Cargo.lock	Updates `serde_with` and macro crate lock entries to the patched version.
elixir-sdk/Cargo.lock	Updates `serde_with` and macro crate lock entries to the patched version.
eppo_core/Cargo.toml	Bumps `pyo3` dependency version used under the `pyo3` feature.
eppo_core/src/attributes/context_attributes.rs	Updates `pyclass` attributes to include `from_py_object` for extraction support under `pyo3` 0.29.
python-sdk/Cargo.toml	Bumps `pyo3` and `pyo3-log` to patched/compatible versions for the Python extension.
python-sdk/src/assignment_logger.rs	Adds `from_py_object` to `AssignmentLogger`’s `#[pyclass]` to maintain extractability under `pyo3` 0.29.
package-lock.json	Lockfile-only updates to resolve vulnerable npm transitives to patched versions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pyo3 0.29 declares rust-version 1.83; eppo_core still declared 1.80, so the manifest under-stated the MSRV once the pyo3 feature bumped. Align the declared rust-version with the actual requirement. (Flagged by codex review.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

aarsilv · 2026-07-16T18:49:11Z

🤖 Response from codex:

CONCERNS: PyO3 bump violates the declared MSRV

pyo3 0.29.0 requires Rust 1.83, but eppo_core/Cargo.toml still declares Rust 1.80; builds enabling pyo3—including python-sdk—will fail on Rust 1.80–1.82.
Fixed versions are fully resolved: serde_with 3.21.0, pyo3 0.29.0, pyo3-log 0.13.4, shell-quote 1.10.0, form-data 4.0.6, js-yaml 4.3.0/3.15.0, and joi 17.13.4.
Scope is otherwise clean: seven intended files; the two Rust source edits only preserve FromPyObject via from_py_object.
No advisory is marked DEFERRED; the unrelated @types/node 25.0.3/undici-types 7.16.0 removal is optional-peer lockfile cleanup, not runtime dependency movement.

(codex ran locally via codex exec read-only; relayed here — GitHub blocked codex posting directly under the sandbox.)

aarsilv · 2026-07-16T18:49:59Z

🤖 Response from Claude: Agreed and fixed in f648f6a. pyo3 0.29 declares rust-version 1.83, so eppo_core's declared 1.80.0 under-stated the MSRV once the pyo3 bump landed. Raised eppo_core/Cargo.toml rust-version → 1.83.0 (the crate exposes pyo3 only as an optional feature, but the workspace always builds it via python-sdk, so 1.83 is the honest floor). cargo check stays green. Good catch — my own review missed the MSRV metadata.

aarsilv · 2026-07-16T18:53:08Z

🤖 Response from codex: (re-check after fix)

RESOLVED

eppo_core now declares rust-version = "1.83.0", matching PyO3 0.29.
The follow-up commit changes only that manifest line; no regression found.

Patch bump for eppo_core/python-sdk/ruby-sdk/elixir-sdk/rust-sdk: pyo3 0.27->0.29 and serde_with 3.20->3.21 change the published Rust crates / Python wheel, so this queues a patch release. (Flagged in review — the fix PR was missing a changeset.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dd-oleksii

a couple of minor comments but otherwise looks good 👍

dd-oleksii · 2026-07-20T22:57:23Z

@@ -0,0 +1,9 @@
+---
+"eppo_core": patch


pyo3 version is part of the public interface, so that's technically a major change for the core

Suggested change

"eppo_core": patch

"eppo_core": major

dd-oleksii · 2026-07-20T22:57:51Z

+"elixir-sdk": patch
+"python-sdk": patch
+"ruby-sdk": patch
+"rust-sdk": patch


Nothing changed for Rust SDK, so it doesn't need a release

Suggested change

"rust-sdk": patch

dd-oleksii · 2026-07-20T22:59:46Z

 keywords = ["eppo", "feature-flags"]
 categories = ["config"]
-rust-version = "1.80.0"
+rust-version = "1.83.0" # raised from 1.80: pyo3 0.29 (optional `pyo3` feature) requires Rust >= 1.83


minor: the comment is irrelevant once the PR is merged

Suggested change

rust-version = "1.83.0" # raised from 1.80: pyo3 0.29 (optional `pyo3` feature) requires Rust >= 1.83

rust-version = "1.83.0"

dd-oleksii · 2026-07-20T23:04:05Z

+"rust-sdk": patch
+---
+
+Security: update dependencies to patched versions (July 2026 Dependabot advisories). Bumps `pyo3` 0.27 → 0.29 (python-sdk / eppo_core's optional `pyo3` feature; raises that build's MSRV to 1.83) and `serde_with` 3.20 → 3.21 (ruby-sdk / elixir-sdk). No public API changes.


minor: this looks like it wants separate changeset entries for pyo3 and serde_with bumps. pyo3 is not applicable to ruby/elixir, so ideally should leak into their changelogs

Copilot AI review requested due to automatic review settings July 16, 2026 15:40

Copilot started reviewing on behalf of aarsilv July 16, 2026 15:41 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

aarsilv requested a review from dd-oleksii July 20, 2026 15:31

aarsilv assigned dd-oleksii Jul 20, 2026

dd-oleksii approved these changes Jul 20, 2026

View reviewed changes

aarsilv merged commit 9c813d4 into main Jul 21, 2026
68 of 72 checks passed

aarsilv deleted the aarsilv/ffesupport-891/fix-vulnerabilities branch July 21, 2026 13:56

aarsilv mentioned this pull request Jul 21, 2026

fix(FFESUPPORT-891): re-resolve axios + brace-expansion to patched versions (Vanta 2026-07) #421

Merged

dd-oleksii mentioned this pull request Jul 21, 2026

Split changeset entries for pyo3 and serde_with updates #422

Merged

github-actions Bot mentioned this pull request Jul 22, 2026

chore: bump versions before release #425

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(FFESUPPORT-891): remediate July 2026 dependabot vulnerabilities - #420

fix(FFESUPPORT-891): remediate July 2026 dependabot vulnerabilities#420
aarsilv merged 3 commits into
mainfrom
aarsilv/ffesupport-891/fix-vulnerabilities

aarsilv commented Jul 16, 2026

Uh oh!

changeset-bot Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

aarsilv commented Jul 16, 2026

Uh oh!

aarsilv commented Jul 16, 2026

Uh oh!

aarsilv commented Jul 16, 2026

Uh oh!

dd-oleksii left a comment

Uh oh!

dd-oleksii Jul 20, 2026

Uh oh!

dd-oleksii Jul 20, 2026

Uh oh!

dd-oleksii Jul 20, 2026

Uh oh!

dd-oleksii Jul 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	rust-version = "1.83.0" # raised from 1.80: pyo3 0.29 (optional `pyo3` feature) requires Rust >= 1.83
	rust-version = "1.83.0"

Uh oh!

Conversation

aarsilv commented Jul 16, 2026

Advisories closed

Approach

How the tests/CI protect this change

Deferred advisories

Uh oh!

changeset-bot Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

aarsilv commented Jul 16, 2026

Uh oh!

aarsilv commented Jul 16, 2026

Uh oh!

aarsilv commented Jul 16, 2026

Uh oh!

dd-oleksii left a comment

Choose a reason for hiding this comment

Uh oh!

dd-oleksii Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

dd-oleksii Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

dd-oleksii Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

dd-oleksii Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot Bot commented Jul 16, 2026 •

edited

Loading