[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19.
Change type: Major version bump — includes source/config changes to adapt to a breaking change.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
svelte (packages/rrweb-player)	npm	Major	^4.2.14 → ^5.55.7	Medium	241d	Dependabot	GHSA-f7gr-6p89-r883 / CVE-2026-27121, GHSA-m56q-vw4c-c2cp / CVE-2026-27122, GHSA-crpf-4hrx-3jrp / CVE-2026-27125, GHSA-phwv-c562-gvmh / CVE-2026-27901, GHSA-pr6f-5x2q-rwfp / CVE-2026-42599, GHSA-rcqx-6q8c-2c42 / CVE-2026-42573 (Dependabot #52–#55, #75, #76)

Notes for reviewers:

• 5.55.7 is the smallest version that clears all six advisories. The repo has no committed lockfile (/yarn.lock is gitignored and owned by launchdarkly/observability-sdk), so this PR only changes manifests. A fresh install currently resolves svelte 5.57.2.
• This replaces Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32, which only bumps svelte. Bumping svelte alone builds, but breaks the public player at runtime: Svelte 5 components are no longer classes, so new Player({ target, props }) in src/main.ts throws (Cannot use 'in' operator to search for 'Symbol($state)' in undefined).
• Config changes in packages/rrweb-player:
  • @sveltejs/vite-plugin-svelte ^3.0.0 → ^5.1.1. This is the Svelte 5 plugin line that supports the repo's Vite 6.
  • vite.config.ts sets compilerOptions: { compatibility: { componentApi: 4 } }, so the components still compile to the Svelte 4 class API (new Player({ target, props }), $set, $on, $destroy) that rrweb-player exposes. This is why the PR is fix: and not fix!:. No .svelte source changes were needed.
• Svelte 5 is bundled into the rrweb-player dist, so consumers don't need to install Svelte themselves. Please check the generated *.svelte.d.ts typings and the player UI before merging.

Deferred / excluded findings

• In other open automation PRs: nanoid and vitest are in fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities) #40. react-router (Wiz only) is in fix: bump react-router-dom to ^7.18.0 in web-extension (dependency vulnerabilities) #41.
• Wiz was unavailable during this run, so only Dependabot findings were checked.

Verification

• Install: ✅ yarn install (Yarn 4.9.1) resolves svelte 5.57.2 and @sveltejs/vite-plugin-svelte 5.1.1. The only failure is packages/rrvideo's Playwright browser postinstall, which can't reach the Playwright CDN from the automation sandbox. This also happens on main.
• Build: ✅ yarn build:all passes 22/22. Locally, web-extension's manifest schema validation had to be skipped because the sandbox can't fetch the schema; that change isn't committed. A headless Chrome smoke test against the built rrweb-player UMD bundle passed with no errors. It recorded a page with rrweb, then exercised new Player({ target, props }), getMetaData, play, pause, goto, addEventListener, $set and $destroy, and checked that the replayed iframe content rendered.
• Tests: ✅ rrweb-player has no test suite. yarn check-types passes 34/34, and svelte-check reports 0 errors. Other package tests don't depend on Svelte, and their local results match main.
• Lint: ✅ yarn lint has no new errors. The only errors are the same 3 rrweb-player .svelte parser errors as on main.

---

Note

Overview
Upgrades @highlight-run/rrweb-player to Svelte 5 (^5.55.7) and @sveltejs/vite-plugin-svelte ^5.1.1 to address multiple medium-severity Svelte advisories, with Vite 6-compatible tooling.

Because Svelte 5 drops class components by default, vite.config.ts adds compilerOptions.compatibility.componentApi: 4 so components still compile to the Svelte 4 class API (new Player({ target, props }), $set, $on, $destroy) that src/main.ts exposes—no .svelte source changes.

^{Reviewed by Cursor Bugbot for commit 386fad1. Bugbot is set up for automated code reviews on this repo. Configure here.}