fix(deps): upgrade @opentelemetry/core to v2 to fix CVE-2026-54285 by subrata71 · Pull Request #42009 · appsmithorg/appsmith

subrata71 · 2026-07-17T06:09:38Z

Description

Upgrades the OpenTelemetry JS SDK from v1 to v2 and Grafana Faro observability packages from v1.12.2 to v2.0.2 to resolve the Dependabot alert for CVE-2026-54285 — unbounded memory allocation in W3C Baggage propagation (W3CBaggagePropagator.extract()).

What changed

Dependencies (package.json):

@opentelemetry/core, resources, sdk-trace-base, sdk-trace-web, context-zone: ^1.30.0 → ^2.8.0
@opentelemetry/exporter-trace-otlp-http, instrumentation: ^0.57.0 → ^0.220.0
@grafana/faro-react, faro-web-tracing: ^1.12.2 → ^2.0.2 (v2.0.2 uses OTel v2 natively while maintaining react-router-dom v5 compatibility)
Added resolutions entry for @opentelemetry/core: ^2.8.0 to prevent any transitive v1 copies in the lockfile

Code (src/instrumentation/index.ts):

new Resource({...}) → resourceFromAttributes({...}) (v2 API change)
tracerProvider.addSpanProcessor(...) → spanProcessors: [...] in constructor options (v2 API change)
FaroSessionSpanProcessor → FaroMetaAttributesSpanProcessor (Faro v2 rename, same constructor signature)
@opentelemetry/semantic-conventions/incubating import → inline ATTR_DEPLOYMENT_NAME constant + main package import

Why Faro was also upgraded

@grafana/faro-web-tracing@1.12.2 bundles @opentelemetry/core@^1.26.0 as a regular dependency. Without upgrading Faro, the v1 copy would remain in yarn.lock and the Dependabot alert would persist. @grafana/faro-react@2.0.2 was chosen because it still supports react-router-dom v5, unlike later 2.x versions that require v7+.

Verification

yarn.lock contains only @opentelemetry/core@2.9.0 — no v1 entries remain
Webpack production build passes (yarn build exit 0)
ESLint passes on changed files
No new TypeScript errors introduced (all 6 pre-existing tsc errors in instrumentation/index.ts remain unchanged)

Automation

/ok-to-test tags=""

🔍 Cypress test results

Communication

Should the DevRel and Marketing teams inform users about this change?

Yes
No

Summary by CodeRabbit

Improvements
- Upgraded telemetry and tracing libraries to newer versions for better compatibility and reliability.
- Refreshed browser tracing initialization for more consistent span metadata and session-scoped trace handling.
- Added session-only span processing to avoid attaching user-identifying data to spans.
- Maintains existing behavior when telemetry is disabled (no tracing setup performed).

Warning

Tests have not run on the HEAD e1c86d4 yet

Fri, 17 Jul 2026 07:39:06 UTC

Upgrade OpenTelemetry JS SDK from v1 to v2 and Grafana Faro from v1.12.2 to v2.0.2 to resolve Dependabot alert for unbounded memory allocation in W3C Baggage propagation (CVE-2026-54285). Changes: - @opentelemetry/core, resources, sdk-trace-base, sdk-trace-web, context-zone: ^1.30.0 → ^2.8.0 - @opentelemetry/exporter-trace-otlp-http, instrumentation: ^0.57.0 → ^0.220.0 - @grafana/faro-react, faro-web-tracing: ^1.12.2 → ^2.0.2 (v2.0.2 supports react-router-dom v5 and uses OTel v2 natively) - Add resolutions entry for @opentelemetry/core to ensure no transitive v1 copies remain in the lockfile - Adapt instrumentation code to v2 API: Resource → resourceFromAttributes, addSpanProcessor → spanProcessors constructor option, FaroSessionSpanProcessor → FaroMetaAttributesSpanProcessor

coderabbitai · 2026-07-17T06:11:01Z

Walkthrough

Updates Faro and OpenTelemetry dependencies, pins the OpenTelemetry core resolution, and adapts AppsmithTelemetry to construct resources and register session-aware Faro span processors through newer tracing APIs.

Changes

Telemetry upgrade

Layer / File(s)	Summary
Align Faro and OpenTelemetry dependencies `app/client/package.json`	Upgrades Faro and OpenTelemetry packages and pins `@opentelemetry/core` to `^2.8.0`.
Adapt telemetry initialization `app/client/src/instrumentation/index.ts`	Uses stable resource and semantic-convention APIs, removes web-vitals attribution tracking, and forwards spans through a session-only processor and Faro exporter.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AppsmithTelemetry
  participant WebTracerProvider
  participant SessionOnlySpanProcessor
  participant FaroTraceExporter
  AppsmithTelemetry->>WebTracerProvider: Create with resource attributes and span processors
  WebTracerProvider->>SessionOnlySpanProcessor: Send spans
  SessionOnlySpanProcessor->>FaroTraceExporter: Forward spans with session.id
  AppsmithTelemetry->>WebTracerProvider: Register provider

Poem

Faro sails on newer streams,
Traces bloom through typed-up dreams.
Sessions ride each span with care,
Processors route them through the air,
OpenTelemetry beams.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the main change: upgrading OpenTelemetry core to v2 to address CVE-2026-54285.
Description check	✅ Passed	Mostly complete and follows the template, with Description, Automation, Cypress, and Communication sections filled; only the Fixes issue reference is missing.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dependabot-echarts-otel-core-cve

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/client/src/instrumentation/index.ts`:
- Around line 85-89: Update the span processor configuration around
FaroMetaAttributesSpanProcessor so user-identifying fields from this.faro.metas,
including id, username, and email populated by identifyUser(), are removed
before spans reach FaroTraceExporter. Preserve non-user metadata while ensuring
these PII fields are never exported.
- Around line 78-92: In the instrumentation initialization flow, update the
WebTracerProvider instance created in the tracerProvider declaration to call
tracerProvider.register() before this.faro.api.initOTEL(trace, context). Keep
the existing Faro span processor configuration unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f38ca6ca-aabf-4923-b341-4d76156344db

📥 Commits

Reviewing files that changed from the base of the PR and between 7e506b7 and ae41626.

⛔ Files ignored due to path filters (1)

app/client/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

app/client/package.json
app/client/src/instrumentation/index.ts

- Remove trackWebVitalsAttribution config option (removed in Faro v2) which caused TS2353 build failure in CI - Add tracerProvider.register() before initOTEL() so the provider becomes the active global tracer (CodeRabbit review) - Replace FaroMetaAttributesSpanProcessor with a custom SessionOnlySpanProcessor that only copies session ID onto spans, matching the old FaroSessionSpanProcessor behavior and avoiding exporting user PII (email, username, id) on every span (CodeRabbit security review)

coderabbitai

🧹 Nitpick comments (1)

app/client/src/instrumentation/index.ts (1)
31-66: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression coverage for the session-only processor.

Test that session.id is forwarded, user metadata is omitted, and all wrapped processor lifecycle methods are delegated.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/client/src/instrumentation/index.ts` around lines 31 - 66, The
SessionOnlySpanProcessor lacks regression coverage. Add tests for
SessionOnlySpanProcessor verifying that onStart forwards session.id while
omitting user metadata, and that onStart, onEnd, forceFlush, and shutdown
delegate to the wrapped SpanProcessor with the expected arguments and results.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@app/client/src/instrumentation/index.ts`:
- Around line 31-66: The SessionOnlySpanProcessor lacks regression coverage. Add
tests for SessionOnlySpanProcessor verifying that onStart forwards session.id
while omitting user metadata, and that onStart, onEnd, forceFlush, and shutdown
delegate to the wrapped SpanProcessor with the expected arguments and results.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 87545316-4f64-4959-a97d-5d1e9a3c400b

📥 Commits

Reviewing files that changed from the base of the PR and between ae41626 and e1c86d4.

📒 Files selected for processing (1)

app/client/src/instrumentation/index.ts

subrata71 requested a review from a team as a code owner July 17, 2026 06:09

coderabbitai Bot reviewed Jul 17, 2026

View reviewed changes

Comment thread app/client/src/instrumentation/index.ts Outdated

Comment thread app/client/src/instrumentation/index.ts

coderabbitai Bot reviewed Jul 17, 2026

View reviewed changes

wyattwalter mentioned this pull request Jul 17, 2026

fix(deps): upgrade OpenTelemetry ecosystem to v2.x (CVE-2026-54285) #42000

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): upgrade @opentelemetry/core to v2 to fix CVE-2026-54285#42009

fix(deps): upgrade @opentelemetry/core to v2 to fix CVE-2026-54285#42009
subrata71 wants to merge 2 commits into
releasefrom
fix/dependabot-echarts-otel-core-cve

subrata71 commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

subrata71 commented Jul 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What changed

Why Faro was also upgraded

Verification

Automation

🔍 Cypress test results

Communication

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

subrata71 commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading