chore(deps): raise the OpenTelemetry floor to 1.12.0 - #5588
Open
jamescrosswell wants to merge 2 commits into
Open
jamescrosswell wants to merge 2 commits into
jamescrosswell wants to merge 2 commits into
Conversation
Sentry.OpenTelemetry floored OpenTelemetry at 1.6.0 and Sentry.OpenTelemetry.Exporter floored OpenTelemetry.Exporter.OpenTelemetryProtocol at 1.10.0. The latter resolved OpenTelemetry.Api 1.10.0 by default, which is delisted from nuget.org over GHSA-8785-wc3w-h8q6 - a DoS triggered simply by receiving a traceparent/tracestate header, with no opt-in. Nothing warned consumers, because the exporter package itself is still listed. 1.12.0 rather than the 1.11.0 the issue asks for: 1.11.0 and 1.11.1 are delisted too, and 1.11.1/1.11.2 pull the deprecated Grpc.Core on net462. 1.12.0 is the lowest floor that is both listed and free of that. It also drops the Google.Protobuf and Grpc.Net.Client dependencies the exporter carried at 1.10.0. OpenTelemetry 1.12.0 no longer brings System.Net.Http in transitively on .NET Framework, so Sentry.OpenTelemetry now references it explicitly, matching the pattern already in Sentry.csproj. Closes #4931 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> (cherry picked from commit 74e84fb)
The advisory needs opt-in experimental disk retry without a configured directory, plus a local attacker, and is fixed only in 1.15.3. Also refresh the GHSA-g94r-2vxg-569j reason for the new 1.12.0 floor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
jamescrosswell
changed the title
jamescrosswell
changed the title
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5588 +/- ##
=======================================
Coverage 74.76% 74.76%
=======================================
Files 515 515
Lines 18963 18963
Branches 3694 3694
=======================================
Hits 14177 14177
Misses 3908 3908
Partials 878 878 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ric-oliv
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4931
Summary
Backports #5560 from
version7tomain(6.x), and allowlists the remaining OpenTelemetry advisory so the nightly List vulnerable packages job goes green again.Sentry.OpenTelemetryOpenTelemetrySentry.OpenTelemetry.ExporterOpenTelemetry.Exporter.OpenTelemetryProtocolThe floor rationale is unchanged from #5560:
OpenTelemetry.Api1.10.0–1.11.1 are delisted from nuget.org over GHSA-8785-wc3w-h8q6, a CPU DoS triggered just by receivingtraceparent/tracestateheaders, and 1.11.1/1.11.2 pull the deprecatedGrpc.Coreon net462. The cherry-pick applied cleanly.Allowlist changes
OpenTelemetry.Exporter.OpenTelemetryProtocol, fixed only in 1.15.3). Exploiting it requires the user to opt in to the experimental disk retry (OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk) without setting a retry directory, and a local attacker with access to the shared temp directory. Sentry never enables disk retry, and setting the directory is a full workaround, so it doesn't justify forcing consumers up to 1.15.3.🤖 Generated with Claude Code