fix: bump pacote and django for security advisories

[devin-ai-integration]

Summary

Dependency-only security remediation from the automated Wiz + Dependabot reconciliation run (2026-09-07).

• pacote 21.0.0 → 21.5.1 via root resolutions (High, CVE-2026-9496)
• django 5.2.16 → 5.2.17 and 6.0.7 → 6.1.1 in the Python SDK lockfile (High CVE-2026-15307 + Moderate CVE-2026-15337/15830/15920)
• Manifest + lockfile changes only; no source changes. yarn.lock churn (~289 lines) is lockfile regeneration from the new pacote resolution.

Findings, decisions, and verification

Findings addressed

Package	Ecosystem	Current → Target	Severity	Age	Source	Advisory	Manifest
pacote	npm	21.0.0 → 21.5.1	High	10d (first seen 2026-08-28)	Dependabot + Wiz	CVE-2026-9496	package.json resolutions / yarn.lock
django	pip	5.2.16 → 5.2.17	High	13d (2026-08-25)	Wiz	CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920	sdk/@launchdarkly/observability-python/poetry.lock
django	pip	6.0.7 → 6.1.1	Moderate	13d (2026-08-25)	Wiz	CVE-2026-15337, CVE-2026-15830, CVE-2026-15920	sdk/@launchdarkly/observability-python/poetry.lock

Django is a dev-extra dependency of the Python SDK; the lockfile holds one entry per Python version (<3.13 → 5.2.x, >=3.13 → 6.x). Both were regenerated with poetry update --lock django; the 6.x entry resolves to 6.1.1 (a minor bump within the same major, which supersedes the 6.0.8 fix Wiz recommends).

Deferred

• github.com/labstack/echo/v4 4.11.4 → 4.15.3 (High, CVE-2026-55677, e2e/go/go.mod + sdk/highlight-go/go.mod) — already covered by open Dependabot PR chore(deps): bump the go_modules group across 2 directories with 1 update #748; not duplicated here.
• Inside the 7-day hold (first seen 2026-09-02 or later): fast-uri 3.1.5→3.1.6, browserslist 4.28.1→4.28.7, google.golang.org/grpc 1.82.1→1.83.1, @humanfs/node, @xmldom/xmldom, fflate, qs 6.15.2→6.16.0.
• Major bumps (skill forbids): toml 3→4, decode-uri-component 0.2→0.5, svelte 4→5, react-router 6→7, @nestjs/core 10→11, @opentelemetry/core 1→2, nanoid 4→5, file-type 20→21, uuid <11.1.1, pacote 20.0.0 (pinned exactly by @angular/cli, only fixed at 21.x).
• No manifest entry / not fixable here: Wiz Java rows (netty, jackson, bcprov/bcpkix, wire-runtime, opentelemetry-api, commons-compress) are Gradle-toolchain transitives.
• e2e/dotnet4 OpenTelemetry 1.11→1.15: nuget.org is blocked in this environment; covered by Dependabot Bump the nuget group with 4 updates #513/Bump the nuget group with 1 update #509/Bump the nuget group with 1 update #496.
• next and vite Wiz rows are stale — root resolutions on main already pin patched versions.

Verification

• yarn install — lockfile resolved and written. The @highlight-run/rrvideo postinstall build fails in this environment because the Chrome download CDN is blocked (PUPPETEER_SKIP_DOWNLOAD=1); unrelated to this change.
• yarn dedupe --check — clean.
• yarn build:sdk — 20/20 tasks pass.
• yarn lint — 49/49 tasks pass.
• poetry check --lock — lockfile consistent with pyproject.toml.
• yarn format-check warns only on generated lib/typescript build output (untracked, pre-existing).
• Python/Go e2e suites were not run: yarn test's angular.io-example#build needs fonts.googleapis.com, which is blocked here.

Link to Devin session: https://app.devin.ai/sessions/036fd39cfe4f442081faba7c81d9fc1f
Open in Devin Desktop: https://app.devin.ai/desktop/session/036fd39cfe4f442081faba7c81d9fc1f?variant=devin

---

Note

Overview
Security-only dependency bumps with no application source changes.

Root package.json resolutions now pin pacote@^21.0.0 to 21.5.1 (CVE-2026-9496). yarn.lock was regenerated so the resolved tree moves to pacote@21.5.1 and newer @npmcli/*, registry-fetch, sigstore, and related install tooling transitives.

In sdk/@launchdarkly/observability-python/poetry.lock, optional dev Django entries are updated: 5.2.16 → 5.2.17 (Python <3.13) and 6.0.7 → 6.1.1 (Python ≥3.13) for the cited Django CVEs.

^{Reviewed by Cursor Bugbot for commit f662024. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
1731	1508	87%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: f662024 by action🐍