fix: attribute key that is prefixed with / are not redacted when allAttributesPrivate is set to true#150
Merged
joker23 merged 1 commit intoJul 17, 2026
Conversation
…llAttributesPrivate` is set to `true`
Contributor
Author
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit cd7c6fa. Configure here.
joker23
marked this pull request as ready for review
July 15, 2026 17:13
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
keelerm84
reviewed
Jul 16, 2026
keelerm84
left a comment
keelerm84
left a comment
Member
There was a problem hiding this comment.
Does this showcase a gap in our contract tests? Can we make sure to expand that coverage as well?
Contributor
Author
maybe, I can take a look at that, but I don't think the packages that uses this common module are contract tested. |
tanderson-ld
approved these changes
Jul 17, 2026
joker23
pushed a commit
that referenced
this pull request
Jul 17, 2026
🤖 I have created a release *beep* *boop* --- ## [5.8.2](5.8.1...5.8.2) (2026-07-17) ### Bug Fixes * attribute key that is prefixed with `/` are not redacted when `allAttributesPrivate` is set to `true` ([#150](#150)) ([8cd6b15](8cd6b15)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Metadata-only release bump with no code changes in the diff; risk is limited to consumers picking up the published 5.8.2 artifact that includes the prior privacy fix. > > **Overview** > **Release 5.8.2** — bumps `launchdarkly-js-sdk-common` from **5.8.1** to **5.8.2** via Release Please (`.release-please-manifest.json`, `package.json`) and adds the **5.8.2** section to `CHANGELOG.md`. > > There is **no application source change** in this diff; it publishes a patch that documents bug fix **#150**: with **`allAttributesPrivate: true`**, context attribute keys that start with **`/`** are now redacted correctly (they were previously left unredacted). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9321305. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Low Risk
Small, targeted change to privacy redaction with new tests; fixes a data-leak bug without altering unrelated filtering paths.
Overview
When
allAttributesPrivateis on or anonymous redaction applies, attribute names that literally start with/were not always stripped becausegetAttributesToFilterused rawObject.keysvalues while redaction compares attribute references (e.g./ssn→/~1ssn).getAttributesToFilternow maps keys that start with/throughAttributeReference.literalToReference, matching the behavior already used for legacyprivateAttributeNamesand forcloneExcluding. Legacy users (custom fields), single-kind contexts, and multi-kind sub-contexts all get the same fix.Tests cover legacy custom fields, top-level slash keys, anonymous redaction, and multi-kind
allAttributesPrivatecases.Reviewed by Cursor Bugbot for commit cd7c6fa. Bugbot is set up for automated code reviews on this repo. Configure here.