From 9cbaa0b9ae11787809254b6a22524835b8db6400 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 20 Aug 2026 20:05:30 +0000 Subject: [PATCH] [AAI-399] Resolve open langfuse-rb security alerts Co-authored-by: kade --- Gemfile.lock | 11 ++++++----- langfuse.gemspec | 11 +++++++++-- spec/langfuse/span_processor_spec.rb | 2 +- 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 92af099..36b974f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -3,9 +3,10 @@ PATH specs: langfuse-rb (0.11.0) base64 (~> 0.2) - concurrent-ruby (~> 1.2) - faraday (>= 1.0, < 3) + concurrent-ruby (>= 1.3.7, < 2.0) + faraday (>= 2.14.3, < 3) faraday-retry (>= 1.0, < 3.0) + json (~> 2.19, >= 2.19.9) mustache (~> 1.1) opentelemetry-api (~> 1.2) opentelemetry-common (~> 0.21) @@ -20,14 +21,14 @@ GEM ast (2.4.3) base64 (0.3.0) bigdecimal (3.3.1) - concurrent-ruby (1.3.6) + concurrent-ruby (1.3.8) crack (1.0.0) bigdecimal rexml diff-lcs (1.6.2) docile (1.4.1) dotenv (2.8.1) - faraday (2.14.1) + faraday (2.14.3) faraday-net_http (>= 2.0, < 3.5) json logger @@ -41,7 +42,7 @@ GEM googleapis-common-protos-types (1.22.0) google-protobuf (~> 4.26) hashdiff (1.2.1) - json (2.19.3) + json (2.21.2) language_server-protocol (3.17.0.5) lint_roller (1.1.0) logger (1.7.0) diff --git a/langfuse.gemspec b/langfuse.gemspec index 145c927..c097241 100644 --- a/langfuse.gemspec +++ b/langfuse.gemspec @@ -29,12 +29,19 @@ Gem::Specification.new do |spec| spec.require_paths = ["lib"] # Runtime dependencies - HTTP & Templating - spec.add_dependency "faraday", ">= 1.0", "< 3" + # faraday floor raised to 2.14.3 to exclude CVE-2026-33637 and CVE-2026-54297. + # This drops Faraday 1.x support; Faraday 2.x needs Ruby >= 3.0, satisfied by our >= 3.2.0 floor. + spec.add_dependency "faraday", ">= 2.14.3", "< 3" spec.add_dependency "faraday-retry", ">= 1.0", "< 3.0" spec.add_dependency "mustache", "~> 1.1" + # json is used directly at runtime (api_client, read_api, score_client) and was only + # constrained transitively via faraday. Declared explicitly with a >= 2.19.9 floor so + # consumers cannot resolve json affected by CVE-2026-54696. + spec.add_dependency "json", "~> 2.19", ">= 2.19.9" # Runtime dependencies - Concurrency (for SWR caching) - spec.add_dependency "concurrent-ruby", "~> 1.2" + # concurrent-ruby floor raised to 1.3.7 to exclude CVE-2026-54904/54905/54906. + spec.add_dependency "concurrent-ruby", ">= 1.3.7", "< 2.0" # Runtime dependencies - OpenTelemetry (for tracing) spec.add_dependency "opentelemetry-api", "~> 1.2" diff --git a/spec/langfuse/span_processor_spec.rb b/spec/langfuse/span_processor_spec.rb index ccaff19..e3569cd 100644 --- a/spec/langfuse/span_processor_spec.rb +++ b/spec/langfuse/span_processor_spec.rb @@ -152,7 +152,7 @@ def exported_spans_by_name span.finish span_data = exported_spans_by_name.fetch("generation") otlp_exporter = OpenTelemetry::Exporter::OTLP::Exporter.new( - endpoint: "http://localhost/api/public/otel/v1/traces" + endpoint: "https://localhost/api/public/otel/v1/traces" ) expect(otlp_exporter.send(:encode, [span_data])).to be_a(String)