fix(deps): update dependency @opentelemetry/core to v2.8.0 [security]#4960
fix(deps): update dependency @opentelemetry/core to v2.8.0 [security]#4960renovate[bot] wants to merge 1 commit into
Conversation
|
Hi @renovate[bot]. Thanks for your PR. I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4960 +/- ##
==========================================
- Coverage 55.82% 55.25% -0.58%
==========================================
Files 121 109 -12
Lines 2350 2132 -218
Branches 539 537 -2
==========================================
- Hits 1312 1178 -134
+ Misses 1033 953 -80
+ Partials 5 1 -4
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/npm-opentelemetry-core-vulnerability
branch
from
bae1882 to
62d3d30
Compare
|
This PR contains the following updates:
2.0.0→2.8.0OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
CVE-2026-54285 / GHSA-8988-4f7v-96qf
More information
Details
Overview
W3CBaggagePropagator.extract()in@opentelemetry/coredoes not enforce size limits when parsing inboundbaggageHTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap.Impact
The practical availability impact for most Node.js deployments is limited. Node.js enforces a default
--max-http-header-sizeof 16,384 bytes on the total combined size of all HTTP headers, constraining what an external attacker can deliver before the propagator is reached. Additionally, the header is already in memory (parsed by the HTTP layer) by the time it reaches the propagator - the additional allocation is the overhead of splitting into entry objects, not an unbounded read.The risk is higher when transport-layer limits are absent - e.g., non-HTTP transports (messaging systems, custom
TextMapGetterimplementations) or deployments that have raised--max-http-header-size.Remediation
Update
@opentelemetry/coreto version 2.8.0 or later. The fix enforces limits consistent with the W3C Baggage specification at the propagator level:Headers that exceed these limits are truncated at the point the limit is reached.
Workarounds
Ensure header size limits are configured at the server or gateway level. The default Node.js HTTP header limit (16 KB) mitigates external attack vectors independently of this fix. For non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.
References
Credit
Reported by tonghuaroot.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
open-telemetry/opentelemetry-js (@opentelemetry/core)
v2.8.0Compare Source
🚀 Features
SpanImpl,Tracer, andBasicTracerProviderviautil.inspectso they render throughdiagandconsole.log#6690 @mcollinahrTimeToSeconds#6449 @anuraaga🐛 Bug Fixes
v2.7.1Compare Source
🐛 Bug Fixes
TraceStatesetnow returns the sameTraceStateinstance if key/value are invalid or makes the while trace state invalid.unsetnow returns the sameTraceStateinstance if key is not present.TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.🏠 Internal
v2.7.0Compare Source
🚀 Features
#6460 @starzlocker
🐛 Bug Fixes
🏠 Internal
v2.6.1Compare Source
🐛 Bug Fixes
_warnOnPreloadedModulesfunction not to show warning logs when the module is not marked as loaded #6095 @rlj1202SpanOptionsfrom API type to prevent drift #6478 @overbalanceattributePerEventCountLimit,attributePerLinkCountLimit,linkCountLimit, andattributeValueLengthLimitfor event/link attributes #6479 @overbalance🏠 Internal
import typefor type-only imports via ESLint #6467 @overbalanceSpan.{addEvent,addLink}performance #6516 @daniellockyerv2.6.0Compare Source
💥 Breaking Changes
OTEL_RESOURCE_ATTRIBUTESparsing to match spec changes (open-telemetry/opentelemetry-specification#4856) #6261 @jacksonweberOTEL_RESOURCE_ATTRIBUTES:export OTEL_RESOURCE_ATTRIBUTES=foo=bar,spamwill now be fully ignored, because thespamentry is invalid (missing=). Per spec, any parsing error results in ignoring the entire environment variable.export OTEL_RESOURCE_ATTRIBUTES='wat=" spaces "'will now result in{"wat": "\" spaces \""}with the double-quotes included in the value. Before this change the implementation included brittle double-quoting to allow leading and trailing whitespace in the value. To support leading or trailing whitespace now, you must percent-encode the whitespace. Internal whitespace still works without encoding, e.g.export OTEL_RESOURCE_ATTRIBUTES='green=eggs and ham'.🚀 Features
🐛 Bug Fixes
setStatusper specification #6461 @newbee1939optimisedflag ingetElementXPathrecursion #6335 @akkupratap323v2.5.1Compare Source
🐛 Bug Fixes
🏠 Internal
v2.5.0Compare Source
🐛 Bug Fixes
🏠 Internal
AsyncHooksContextManager#6298 @trentmv2.4.0Compare Source
🐛 Bug Fixes
🏠 Internal
v2.3.0Compare Source
🚀 Features
🐛 Bug Fixes
🏠 Internal
v2.2.0Compare Source
🐛 Bug Fixes
unrefTimer()util #5986 @pichlermarcotperformanceotperformance.now()andotperformance.timeOriginare not affected.performanceimplementation instead.🏠 Internal
v2.1.0Compare Source
🚀 Features
🐛 Bug Fixes
startTimeparam to ExponentialHistogramAccumulation. This only impacted the closurescript compiler. #5763 @trentm🏠 Internal
v2.0.1Compare Source
🐛 Bug Fixes
Accessing resource attributes before async attributes settledwarning when detecting resources #5546 @dyladangetNumberFromEnvshould return number | undefined #5874 @shubham-vunet📚 Documentation
sdk.start()as async #5617 @JacksonWeber🏠 Internal
parseKeyPairsIntoRecord()#5610 @cjihrigConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.