Skip to content

chore(deps): raise the OpenTelemetry floor to 1.12.0 #5588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jamescrosswell merged 2 commits into from
Sep 20, 2026
Merged

chore(deps): raise the OpenTelemetry floor to 1.12.0 #5588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7a03771
feat(otel): raise the OpenTelemetry floor to 1.12.0 (#5560)
jamescrosswell Sep 15, 2026
7e7755f
ci: allowlist GHSA-4625-4j76-fww9 for the OTLP exporter
jamescrosswell Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions scripts/vulnerability-allowlist.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,14 @@
{
"advisory": "https://github.com/advisories/GHSA-g94r-2vxg-569j",
"package": "OpenTelemetry.Api",
"reviewed": "2026-09-10",
"reason": "Sentry.OpenTelemetry floors the OpenTelemetry package at 1.6.0, the minimum version without trim warnings. The advisory is fixed only in 1.15.3, so clearing it means forcing every consumer up nine minor versions. The impact is excessive allocation while parsing oversized baggage/B3/Jaeger headers, and the advisory's own mitigation - HTTP request header size limits - is applied by default by IIS (16KB) and nginx (8KB)."
"reviewed": "2026-09-17",
"reason": "Sentry.OpenTelemetry and Sentry.OpenTelemetry.Exporter floor OpenTelemetry at 1.12.0, the lowest listed version clear of GHSA-8785-wc3w-h8q6. The advisory is fixed only in 1.15.3, so clearing it means forcing every consumer up three more minor versions. The impact is excessive allocation while parsing oversized baggage/B3/Jaeger headers, and the advisory's own mitigation - HTTP request header size limits - is applied by default by IIS (16KB) and nginx (8KB)."
},
{
"advisory": "https://github.com/advisories/GHSA-4625-4j76-fww9",
"package": "OpenTelemetry.Exporter.OpenTelemetryProtocol",
"reviewed": "2026-09-17",
"reason": "Sentry.OpenTelemetry.Exporter floors the OTLP exporter at 1.12.0; the advisory is fixed only in 1.15.3. It requires the user to opt in to the experimental disk retry (OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk) without setting OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH, plus a local attacker with access to the shared temp directory. Sentry never enables disk retry, and setting the directory path is a complete workaround, so it does not justify forcing every consumer up three more minor versions."
}
]
}
5 changes: 4 additions & 1 deletion src/Sentry.OpenTelemetry.Exporter/Sentry.OpenTelemetry.Exporter.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,10 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.10.0" />
<!-- 1.12.0 is the lowest floor we can offer: 1.10.0-1.11.1 are delisted from nuget.org over
GHSA-8785-wc3w-h8q6, and 1.11.1/1.11.2 pull the deprecated Grpc.Core on net462. 1.12.0 also
drops the Google.Protobuf and Grpc.Net.Client dependencies 1.10.0 carried. -->
<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.12.0" />
</ItemGroup>

<ItemGroup>
Expand Down
11 changes: 9 additions & 2 deletions src/Sentry.OpenTelemetry/Sentry.OpenTelemetry.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,15 @@
</ItemGroup>

<ItemGroup>
<!-- Version 1.6.0 is the minimum version that does not have trim warnings -->
<PackageReference Include="OpenTelemetry" Version="1.6.0" />
<!-- 1.6.0 was the lowest version without trim warnings; 1.12.0 is the lowest that also avoids
the delisted 1.10.0-1.11.1 range (GHSA-8785-wc3w-h8q6). -->
<PackageReference Include="OpenTelemetry" Version="1.12.0" />
</ItemGroup>

<!-- On .NET Framework, we need an assembly reference to System.Net.Http. OpenTelemetry 1.6.0 pulled
one in transitively; 1.12.0 dropped those dependencies, so reference it explicitly. -->
<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
<Reference Include="System.Net.Http" />
</ItemGroup>

<ItemGroup>
Expand Down
4 changes: 2 additions & 2 deletions test/Sentry.OpenTelemetry.Tests/Sentry.OpenTelemetry.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="OpenTelemetry" Version="1.6.0" />
<PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.6.0" />
<PackageReference Include="OpenTelemetry" Version="1.12.0" />
<PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.12.0" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == '$(PreviousTfm)'">
Expand Down
Loading