Update dependency @opentelemetry/core to v2 [SECURITY]#76
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/npm-opentelemetry-core-vulnerability
branch
from
3b9a66b to
1bf7669
Compare
renovate
Bot
force-pushed
the
renovate/npm-opentelemetry-core-vulnerability
branch
from
1bf7669 to
55bfe67
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.25.1→^2.8.0OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
CVE-2026-54285 / GHSA-8988-4f7v-96qf
More information
Details
Overview
W3CBaggagePropagator.extract()in@opentelemetry/coredoes not enforce size limits when parsing inboundbaggageHTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap.Impact
The practical availability impact for most Node.js deployments is limited. Node.js enforces a default
--max-http-header-sizeof 16,384 bytes on the total combined size of all HTTP headers, constraining what an external attacker can deliver before the propagator is reached. Additionally, the header is already in memory (parsed by the HTTP layer) by the time it reaches the propagator - the additional allocation is the overhead of splitting into entry objects, not an unbounded read.The risk is higher when transport-layer limits are absent - e.g., non-HTTP transports (messaging systems, custom
TextMapGetterimplementations) or deployments that have raised--max-http-header-size.Remediation
Update
@opentelemetry/coreto version 2.8.0 or later. The fix enforces limits consistent with the W3C Baggage specification at the propagator level:Headers that exceed these limits are truncated at the point the limit is reached.
Workarounds
Ensure header size limits are configured at the server or gateway level. The default Node.js HTTP header limit (16 KB) mitigates external attack vectors independently of this fix. For non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.
References
Credit
Reported by tonghuaroot.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
open-telemetry/opentelemetry-js (@opentelemetry/core)
v2.8.0Compare Source
🚀 Features
SpanImpl,Tracer, andBasicTracerProviderviautil.inspectso they render throughdiagandconsole.log#6690 @mcollinahrTimeToSeconds#6449 @anuraaga🐛 Bug Fixes
v2.7.1Compare Source
🐛 Bug Fixes
TraceStatesetnow returns the sameTraceStateinstance if key/value are invalid or makes the while trace state invalid.unsetnow returns the sameTraceStateinstance if key is not present.TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.🏠 Internal
v2.7.0Compare Source
🚀 Features
#6460 @starzlocker
🐛 Bug Fixes
🏠 Internal
v2.6.1Compare Source
🐛 Bug Fixes
_warnOnPreloadedModulesfunction not to show warning logs when the module is not marked as loaded #6095 @rlj1202SpanOptionsfrom API type to prevent drift #6478 @overbalanceattributePerEventCountLimit,attributePerLinkCountLimit,linkCountLimit, andattributeValueLengthLimitfor event/link attributes #6479 @overbalanceonCancelTaskagainst terminal-state tasks to prevent infinite loop with rc-align (Ant Design) in React 16 dev mode #6512 @Renegade2345🏠 Internal
import typefor type-only imports via ESLint #6467 @overbalanceSpan.{addEvent,addLink}performance #6516 @daniellockyerv2.6.0Compare Source
💥 Breaking Changes
OTEL_RESOURCE_ATTRIBUTESparsing to match spec changes (open-telemetry/opentelemetry-specification#4856) #6261 @jacksonweberOTEL_RESOURCE_ATTRIBUTES:export OTEL_RESOURCE_ATTRIBUTES=foo=bar,spamwill now be fully ignored, because thespamentry is invalid (missing=). Per spec, any parsing error results in ignoring the entire environment variable.export OTEL_RESOURCE_ATTRIBUTES='wat=" spaces "'will now result in{"wat": "\" spaces \""}with the double-quotes included in the value. Before this change the implementation included brittle double-quoting to allow leading and trailing whitespace in the value. To support leading or trailing whitespace now, you must percent-encode the whitespace. Internal whitespace still works without encoding, e.g.export OTEL_RESOURCE_ATTRIBUTES='green=eggs and ham'.🚀 Features
🐛 Bug Fixes
setStatusper specification #6461 @newbee1939optimisedflag ingetElementXPathrecursion #6335 @akkupratap323v2.5.1Compare Source
🐛 Bug Fixes
🏠 Internal
v2.5.0Compare Source
🐛 Bug Fixes
🏠 Internal
AsyncHooksContextManager#6298 @trentmv2.4.0Compare Source
🐛 Bug Fixes
🏠 Internal
v2.3.0Compare Source
🚀 Features
🐛 Bug Fixes
🏠 Internal
v2.2.0Compare Source
🐛 Bug Fixes
unrefTimer()util #5986 @pichlermarcotperformanceotperformance.now()andotperformance.timeOriginare not affected.performanceimplementation instead.🏠 Internal
v2.1.0Compare Source
🚀 Features
🐛 Bug Fixes
startTimeparam to ExponentialHistogramAccumulation. This only impacted the closurescript compiler. #5763 @trentm🏠 Internal
v2.0.1Compare Source
🐛 Bug Fixes
Accessing resource attributes before async attributes settledwarning when detecting resources #5546 @dyladangetNumberFromEnvshould return number | undefined #5874 @shubham-vunet📚 Documentation
sdk.start()as async #5617 @JacksonWeber🏠 Internal
parseKeyPairsIntoRecord()#5610 @cjihrigparsePairKeyValue()#5885 @sivakumarscv2.0.0Compare Source
Summary
^18.19.0 || >=20.6.0. This means that support for Node.js 14 and 16 has been dropped.0.200.0are compatible with this release💥 Breaking Change
parentSpanContextand removeparentSpanIdfromSpanandReadableSpan#5450 @JacksonWeberSpansparentSpanIdwas replaced byparentSpanContext, to migrate to the new property, please replacespan.parentSpanId->span.parentSpanContext?.spanIdtypefield onMetricDescriptor#5291 @chancancodeInstrumentDescriptortype; useMetricDescriptorinstead #5277 @chancancode@opentelemetry/apipeer dependency to 1.9.0 #5254 @chancancodeSpanAttributeswithAttributes#5009 @david-lunaResourceAttributeswithAttributes#5016 @david-lunaViewandAggregationin favor ofViewOptionsandAggregationOption#4931 @pichlermarcnew Spanconstructor in favor ofTracer.startSpanAPI #5048 @david-lunaBasicTracerProvider.addSpanProcessorAPI in favor of constructor options. #5134 @david-lunaresourceproperty private inBasicTracerProviderand removegetActiveSpanProcessorAPI. #5192 @david-lunaIMetricReaderinterface and use it over abstract class #5311MeterProviderOptionsnow provides the more generalIMetricReadertype overMetricReaderMetricReaderin your public interface, consider accepting the more generalIMetricReaderinstead to avoid unintentional breaking changesBasicTracerProvider, the class offered multiple methods to facilitate the creation of exporters and auto-pairing withSpanProcessors.SpanProcessors to the base class constructor when extending_registeredExportershas been removed_getSpanExporterhas been removed_buildExporterFromEnvhas been removedIdGeneratorandRandomIdGenerator#5309 @pichlermarcInstrumentationLibrary#5308 @pichlermarcInstrumentationScopeinsteadInstrumentationLibrarywithInstrumentationScope#5308 @pichlermarcTracer.instrumentationLibrary->Tracer.instrumentationScopeReadableSpan.instrumentationLibrary->ReadableSpan.instrumentationScopeReadableSpanReadableSpan.instrumentationScopeoverReadableSpan.instrumentationLibrary#5308 @pichlermarcReadableSpan.instrumentationScopeoverReadableSpan.instrumentationLibrary#5308 @pichlermarc5.0.4#5145 @david-lunatypescript@<5.0.4typescriptin minor releases. We will only drop support for versions that are older than 2 years.AlwaysOnSamplerhas moved to@opentelemetry/sdk-trace-baseAlwaysOffSamplerhas moved to@opentelemetry/sdk-trace-baseParentBasedSamplerhas moved to@opentelemetry/sdk-trace-baseTraceIdRatioSamplerhas moved to@opentelemetry/sdk-trace-baseattributesobjectDetectedResourceplain objects instead ofnew Resource()BasicTracerProvider#register().OTEL_PROPAGATORSorwindow.OTEL_PROPAGATORSanymore, please pass the propagator toNodeTracerProvider#register()instead.BasicTracerProvider#register()will now fall back to defaults (tracecontextandbaggage)NodeTracerProvider#register().OTEL_PROPAGATORSanymore, please pass the propagator toNodeTracerProvider#register()instead.NodeTracerProvider#register()will now fall back to the defaults (tracecontextandbaggage)NodeSDKfrom@opentelemetry/sdk-node.WebTracerProvider#register().window.OTEL_PROPAGATORSanymore, please pass the propagator toWebTracerProvider#register()instead.WebTracerProvider#register()will now fall back to defaults (tracecontextandbaggage)EXPORTER_FACTORYis not used anymore and has been removedPROPAGATOR_FACTORYis not used anymore and has been removedForceFlushStatewas intended for internal use and has been removedTracerclass was unintentionally exported and has been removedTracer, please useBasicTracerProvider#getTracer(),NodeTracerProvider#getTracer()orWebTracerProvider#getTracer()Tracer, please use theTracertype from@opentelemetry/api^18.19.0 || >=20.6.0. Support for Node.js 14, 16, and early minor versions of 18 and 20 have been dropped. This applies to all packages except the 'api' and 'semantic-conventions' packages. #5395 @trentm@opentelemetry/resourcein favor of@opentelemetry/opentelemetry-browser-detector#5420VERSIONwas an internal constant that was unintentionally exported. It has been removed without replacement.isWrappedhas been removed in favor ofisWrappedfrom@opentelemetry/instrumentationShimWrappedhas been removed in favor ofShimWrappedfrom@opentelemetry/instrumentationhexToBase64was a utility function that is not used by the SDK anymore. It has been removed without replacement.hexToBinarywas a utility function that now internal to@opentelemetry/otlp-tranformer. It has been removed without replacement.baggageUtils.getKeyPariswas an internal utility function that was unintentionally exported. It has been removed without replacement.baggageUtils.serializeKeyPairswas an internal utility function that was unintentionally exported. It has been removed without replacement.baggageUtils.parseKeyPairsIntoRecord,has been removed in favor ofparseKeyPairsIntoRecordbaggageUtils.parsePairKeyValuewas an internal utility function that was unintentionally exported. It has been removed without replacement.TimeOriginLegacyhas been removed without replacement.isAttributeKeywas an internal utility function that was unintentionally exported. It has been removed without replacement.window.OTEL_*is now not supported anymore, please pass configuration options to constructors instead.window.OTEL_*is now not supported anymore, please pass configuration options to constructors instead.Resourceclass toResourceImpland makes it package-privateIResourceinterface toResourceresourceFromAttributesto create aResourcefrom aDetectedAttributesobjectdefaultResourceto create a default resource #5467 @pichlermarcemptyResourceto create an empty resource #5467 @pichlermarcwindow.OTEL_*is now not supported anymoreenvDetectorin browser environments, please migrate to manually creating a resource.ParentBasedAlwaysOnSampleroverAlwaysOnSamplerwhen bogus data is supplied toOTEL_TRACES_SAMPLERgetEnv(),getEnvWithoutDefaults()#5481 @pichlermarcgetEnv()has been replaced bygetStringFromEnv(),getNumberFromEnv(),getBooleanFromEnv(),getStringListFromEnv()getStringFromEnv("OTEL_FOO") ?? "my-default")getEnvWithoutDefaults()has been replaced bygetStringFromEnv(),getNumberFromEnv(),getBooleanFromEnv(),getStringListFromEnv()DEFAULT_ENVIRONMENThas been removed, please inline any defaults from now onENVIRONMENThas been removed without replacementRAW_ENVIRONMENThas been removed without replacementparseEnvironmenthas been removed without replacementBasicTracerProvider#register()to improve tree-shaking #5503 @pichlermarcBasicTracerProvider#register()has been removedpropagation.setGlobalPropagator()from@opentelemetry/apicontext.setGlobalContextManager()from@opentelemetry/api@opentelemetry/api,@opentelemetry/api-logs,@opentelemetry/api-events, and@opentelemetry/semantic-conventions#5456 @david-lunaDEFAULT_ATTRIBUTE_VALUE_LENTGHT_LIMIThas been removed, please useInfinityinsteadDEFAULT_ATTRIBUTE_VALUE_COUNT_LIMIThas been removed, please use128insteadDEFAULT_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIThas been removed, please use128insteadDEFAULT_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIThas been removed, please use128instead🚀 (Enhancement)
WebTracerProviderconstructor now does not throw anymore whencontextManagerorpropagatorare passed as extra options to the constructordiagLogLevelFromStringutility #5475 @pichlermarc🐛 (Bug Fix)
url.parsefromnode:url#5390 @chancancodePeriodicExportingMetricReaderwhen there are no metrics to export. #5288 @jacksonweber🏠 (Internal)
InstrumentDescriptortype now extendsMetricDescriptor; moved publicInstrumentTypetype enum into./src/export/MetricData.ts#5277GaugeandMetricAdviceworkaround types in favor of the upstream@opentelemetry/apitypes #5254 @chancancodeBasicTracerProvider._registeredSpanProcessorsprivate property. #5134 @david-lunaBasicTracerProvider.activeSpanProcessorprivate property. #5211 @david-lunamodulecompiler option tonode16. #5347 @david-lunasemverpackage with internal semantic versioning check implementation to get rid ofsemverpackage initialization overhead especially in the AWS Lambda environment during coldstart #5305 @serkan-ozal@opentelemetry/semantic-conventionsdep to allow better de-duplication in installs #5439 @trentmv1.30.1Compare Source
1.30.1
🐛 (Bug Fix)
PeriodicExportingMetricReaderwhen there are no metrics to export. #5288 @jacksonweber🏠 (Internal)
v1.30.0Compare Source
🚀 (Enhancement)
🐛 (Bug Fix)
ignoreNetworkEvents: truebeing set #5229v1.29.0Compare Source
🚀 (Enhancement)
v1.28.0Compare Source
🚀 (Enhancement)
feat(sdk-metrics, sdk-trace): add
mergeResourceWithDefaultsflag, which allows opting-out of resources getting merged with the default resource #4617true(no change in behavior)falsewill become the default behavior in the next major version in order to comply with specification requirementsfeat(sdk-trace-base): add
spanProcessorsproperty inTracerConfiginterface. #5138 @david-luna🐛 (Bug Fix)
PeriodicExportingMetricReaderwhen async resource attributes have not yet settled #5119 @pichlermarcv1.27.0Compare Source
🚀 (Enhancement)
🐛 (Bug Fix)
fix(sdk-trace-base): avoid keeping non-string
status.messageonSpan#setStatus()#4999 @pichlermarcfix(sdk-metrics): Add missing catch and handle error in promise of
PeriodicExportingMetricReader#5006 @jj22eefix(opentelemetry-core): confusing log extract of composite propagator #5017 @rv2673
fix(propagator-aws-xray-*): move propagators back to contrib repository #4966 @pichlermarc
@opentelemetry/propagator-aws-xrayis now located in open-telemetry/opentelemetry-js-contrib@opentelemetry/propagator-aws-xray-lambdais now located in [open-telemetry/opentelemetry-js-contrib](https://redirect.github.com/open-telemetry/opentelemetry-Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.