fix(deps): upgrade OpenTelemetry ecosystem to v2.x (CVE-2026-54285)#42000
Closed
appsmith-smithes[bot] wants to merge 6 commits into
Closed
fix(deps): upgrade OpenTelemetry ecosystem to v2.x (CVE-2026-54285)#42000appsmith-smithes[bot] wants to merge 6 commits into
appsmith-smithes[bot] wants to merge 6 commits into
Conversation
Fixes CVE-2026-54285 (@opentelemetry/core — unbounded memory allocation in W3C Baggage propagation, medium severity). The CVE has no v1.x patch; the fix is only available in v2.x. This commit upgrades the entire @opentelemetry/* package family together to maintain internal version alignment, which is required by the ecosystem. Changes: - @opentelemetry/core: ^1.30.0 → ^2.9.0 - @opentelemetry/sdk-trace-base: ^1.30.0 → ^2.9.0 - @opentelemetry/sdk-trace-web: ^1.30.0 → ^2.9.0 - @opentelemetry/resources: ^1.30.0 → ^2.9.0 - @opentelemetry/context-zone: ^1.30.0 → ^2.9.0 - @opentelemetry/exporter-trace-otlp-http: ^0.57.0 → ^0.220.0 - @opentelemetry/instrumentation: ^0.57.0 → ^0.220.0 - @opentelemetry/semantic-conventions: ^1.28.0 → ^1.29.0 Also updates tsconfig.json moduleResolution from 'node' to 'bundler' to support the package.json subpath exports (/incubating) used by semantic-conventions@1.43.0, which is required for TypeScript to resolve the `@opentelemetry/semantic-conventions/incubating` import in src/instrumentation/index.ts. Closes security alert: Dependabot #654 (CE)
…ons/incubating Switching to moduleResolution: bundler broke klona/full and klona/json subpath imports because klona's exports field maps all subpaths to the same root types file, which TypeScript bundler mode rejects. Correct approach: - Keep moduleResolution: node (compatible with all existing imports) - Add explicit TypeScript paths mapping for the one import that needs it: @opentelemetry/semantic-conventions/incubating → physical .d.ts file TypeScript 'node' moduleResolution cannot resolve package.json exports field for subpath imports. The paths mapping bypasses this by pointing TypeScript directly to the physical declaration file at: node_modules/@opentelemetry/semantic-conventions/build/src/index-incubating
Contributor
Author
🔧 Fix pushed — commit
|
- Replace with (Resource is now type-only in v2) - Replace with constructor-level spanProcessors[] (addSpanProcessor removed in v2) - Type-only import for Resource since verbatimModuleSyntax is enabled - incubating subpath import unchanged (tsconfig moduleResolution fix applied separately)
…orts Switching from moduleResolution:"node" to "bundler" allows TypeScript to resolve subpath exports like @opentelemetry/semantic-conventions/incubating, which uses the package exports field not visible under the legacy node resolver.
…e TS7016 failures)
…ion:node The @opentelemetry/semantic-conventions/incubating subpath export requires moduleResolution:"bundler" which breaks dozens of other packages (astring, klona, react-toastify, @floating-ui). Instead, inline the two string constants (deployment.name, service.instance.id) directly — these are stable OTel spec values that are safe to inline.
Contributor
|
Superceded by #42009 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes CVE-2026-54285 —
@opentelemetry/core: Unbounded memory allocation in W3C Baggage propagation (medium severity, 90-day SLA, 62d remaining).All
@opentelemetry/*packages are upgraded together. The ecosystem has strict internal version alignment requirements — mixing v1.x and v2.x causes runtime crashes and TypeScript errors (this was the root cause of the previous PR #41981 which was closed).What changed
app/client/package.json@opentelemetry/core^1.30.0^2.9.0@opentelemetry/sdk-trace-base^1.30.0^2.9.0@opentelemetry/sdk-trace-web^1.30.0^2.9.0@opentelemetry/resources^1.30.0^2.9.0@opentelemetry/context-zone^1.30.0^2.9.0@opentelemetry/exporter-trace-otlp-http^0.57.0^0.220.0@opentelemetry/instrumentation^0.57.0^0.220.0@opentelemetry/semantic-conventions^1.28.0^1.29.0(resolved: 1.43.0)All packages also added to
resolutionsto enforce the v2 versions across the full dependency tree.app/client/tsconfig.jsonmoduleResolution:"node"→"bundler"Required because
semantic-conventions@1.43.0uses theexportsfield inpackage.jsonfor the/incubatingsubpath (used insrc/instrumentation/index.ts). TypeScript withmoduleResolution: "node"(classic) cannot resolve package.json subpath exports —"bundler"supports them.app/client/yarn.lockFully regenerated with Yarn 3.5.1 in
--mode=update-lockfile. All old v1.x@opentelemetry/*entries removed; v2.x entries added with correct checksums and resolved versions.Why the previous PR (#41981) failed
PR #41981 bumped only
@opentelemetry/coreto v2.x while leaving all companion packages at v1.x:client-unit-tests:sdk-trace-base@1.xcallscore.TracesSamplerValues.AlwaysOn— this enum was removed incore@2.x, causing aTypeErrorclient-build:semantic-conventions@1.43.0was added to the lockfile (forcore@2.x), changing the hoisted version. TypeScript withmoduleResolution: "node"then failed to resolve the/incubatingsubpathTesting
yarn check-typesshould pass withmoduleResolution: bundlerclient-unit-testsshould pass — all packages are now on consistent v2.xATTR_DEPLOYMENT_NAME,ATTR_SERVICE_INSTANCE_ID,ATTR_SERVICE_NAMEall verified present insemantic-conventions@1.43.0TracesSamplerValuesis no longer needed (it was an internal ofsdk-trace-base; v2 uses a different internal API)Resolves Dependabot alert #654
Warning
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/29494641858
Commit: 40288a1
Cypress dashboard.
Tags: @tag.All
Spec:
It seems like no tests ran 😔. We are not able to recognize it, please check workflow here.
Thu, 16 Jul 2026 11:45:28 UTC
Automation
/ok-to-test tags="@tag.All"