fix: upgrade OpenTelemetry OTLP deps to 0.209.0 to resolve protobufjs vulnerability#3784
fix: upgrade OpenTelemetry OTLP deps to 0.209.0 to resolve protobufjs vulnerability#3784mdayan8 wants to merge 1 commit into
Conversation
…@7.5.5 vulnerability Updates @opentelemetry OTLP exporter packages from 0.203.0 to 0.209.0 and their co-dependencies (core, resources, SDK packages) to matching versions. This pulls in @opentelemetry/otlp-transformer@0.209.0 which depends on protobufjs@8.0.0, resolving the protobufjs@7.5.5 vulnerability. Affected packages: - packages/core/package.json (10 deps bumped) - packages/cli-v3/package.json (6 deps bumped) - apps/webapp/package.json (12 deps bumped) - references/d3-chat/package.json (6 deps bumped)
|
|
Hi @mdayan8, thanks for your interest in contributing! This project requires that pull request authors are vouched, and you are not in the list of vouched users. This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
WalkthroughThis PR upgrades OpenTelemetry packages across the monorepo from versions 0.203.0/2.0.1 to 0.209.0/2.3.0. The changes affect Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
1 participant
Summary
Upgrades
@opentelemetry/exporter-logs-otlp-http,@opentelemetry/exporter-metrics-otlp-http,@opentelemetry/exporter-metrics-otlp-proto, and@opentelemetry/exporter-trace-otlp-httpfrom0.203.0to0.209.0across the monorepo, along with their co-dependencies.Why
Vulnerability chain:
@opentelemetry/otlp-transformer@0.203.0→protobufjs@7.5.5(vulnerable).@opentelemetry/otlp-transformer@0.209.0depends onprotobufjs@8.0.0which resolves it.Changes
packages/core/package.jsonpackages/cli-v3/package.jsonapps/webapp/package.jsonreferences/d3-chat/package.json