fix(deps): bundle vulnerability dep bumps (closes #1258-#1263)#1264
Merged
Conversation
…ration-tests/lambda]
….org/x/sys [local_tests/golang]
…or: 10 · patch: 1) [integration-tests/lambda/otlp-node]
…norpatch/maven/lambda/4-1781564316' into jordan.gonzalez/deps/vuln-bundle
…norpatch/go/golang/3-1781564317' into jordan.gonzalez/deps/vuln-bundle
…jor/npm/otlp-node/0-1781564317' into jordan.gonzalez/deps/vuln-bundle
…norpatch/npm/integration-tests/1-1781564316' into jordan.gonzalez/deps/vuln-bundle
Closes Dependabot alert #180 (uuid v3/v5/v6 buffer bounds check).
duncanista
requested review from
Copilot and
lym953
and removed request for
Copilot
June 16, 2026 18:06
This comment has been minimized.
This comment has been minimized.
PR #1263's merged lock was missing root entries for @opentelemetry/[email protected] and @opentelemetry/[email protected], breaking 'npm ci' in the gitlab build node lambdas job. Regenerated via 'npm install --package-lock-only'.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR consolidates multiple Dependabot/ADMS vulnerability updates by bumping dependency versions across the repo’s integration-test and local-test fixtures (Go, Node.js, and Java) to address known security advisories without impacting the shipped Rust extension.
Changes:
- Bumped Go module dependencies in
local_tests/golang(aws-sdk-go and severalgolang.org/x/*libs) and updatedgo.sum. - Updated
integration-testsNode dependencies (notablyuuidmajor bump andaxiosbump) and added npmoverridesto force patched transitive versions. - Updated OTLP integration-test fixtures: OpenTelemetry Java API version bump and a major OpenTelemetry SDK bump for the OTLP Node Lambda test.
Reviewed changes
Copilot reviewed 4 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| local_tests/golang/go.mod | Minor dependency bumps for Go local test module. |
| local_tests/golang/go.sum | Updated checksums to match Go dependency bumps. |
| integration-tests/package.json | Bumped axios/uuid and added overrides for vulnerable transitive deps. |
| integration-tests/package-lock.json | Lockfile updates reflecting dependency/override changes (large regen). |
| integration-tests/lambda/otlp-node/package.json | Major OpenTelemetry Node SDK bump plus overrides. |
| integration-tests/lambda/otlp-node/package-lock.json | Lockfile updates for OTLP Node Lambda dependency graph. |
| integration-tests/lambda/otlp-java/pom.xml | OpenTelemetry Java API version bump. |
Files not reviewed (2)
- integration-tests/lambda/otlp-node/package-lock.json: Generated file
- integration-tests/package-lock.json: Generated file
Comment on lines
+103
to
+106
| "aws-cdk-lib": { | ||
| "brace-expansion": "^5.0.6", | ||
| "fast-uri": "^3.1.2" | ||
| } |
Contributor
Author
There was a problem hiding this comment.
Good catch — confirmed root cause. Incremental npm install --package-lock-only runs treated the lock as in-sync and silently skipped re-resolving the override targets (the bot-authored source PR #1262 had the same defect). Fixed in 3fa49e6 by deleting integration-tests/package-lock.json and regenerating it from scratch. Lock now has aws-cdk-lib/node_modules/[email protected] and aws-cdk-lib/node_modules/[email protected], satisfying the overrides.
Comment on lines
+19
to
+22
| "@opentelemetry/exporter-trace-otlp-grpc": { | ||
| "undici-types": "^7.27.2", | ||
| "@opentelemetry/core": "^1.30.1" | ||
| }, |
Contributor
Author
There was a problem hiding this comment.
Fixed in 3fa49e6 — same root cause as the brace-expansion/fast-uri override comment. Regenerated integration-tests/lambda/otlp-node/package-lock.json from scratch; undici-types now resolves to 7.28.0, satisfying the ^7.27.2 override.
Addresses Copilot review on PR #1264: - Bump axios pin to ^1.18.0 to match lock resolution. - Regenerate both lock files from scratch so npm overrides for brace-expansion (^5.0.6), fast-uri (^3.1.2), and undici-types (^7.27.2) are actually applied. Previous incremental --package-lock-only runs silently kept the vulnerable transitive versions.
This was referenced Jun 16, 2026
fix(deps): vuln io.opentelemetry:opentelemetry-api (minor → 1.63.0) [integration-tests/lambda]
#1258
Closed
The CI 'build node lambdas' job runs 'npm ci' inside node:20-alpine (npm 10.8.2), but the lock generated by my npm 10.9.2 contained override-applied resolutions that npm 10.8.2 considered out-of-sync, e.g. missing nested entries for @opentelemetry/[email protected] / @opentelemetry/[email protected] / [email protected]. Regenerated via a full 'npm install' under npm 10.8.2 to match the CI's resolver. Verified 'npm ci --production --dry-run' now passes.
The major OTel SDK bump (sdk-node 0.54 → 0.219) broke the otlp-node
Lambda's runtime instrumentation: index.js still uses the OTel 1.x API
(new Resource({...}), provider.addSpanProcessor) which silently fails on
the 2.x SDK, so no traces are emitted and the OTLP integration suite
returns 0 traces for the node runtime.
Revert otlp-node deps to the 0.54.2 / 1.28.0 / 1.x line and rely on a
top-level protobufjs override (^7.6.4) to pull in the patched protobufjs
without changing the public OTel API surface. This still resolves the
high-severity protobufjs alerts (DoS via unbounded recursion, code
generation gadgets, prototype injection, etc.) and #191/#192 via the
transitive @grpc/[email protected].
The lone critical (GHSA-xq3m-2v4x-88gg, fixed in protobufjs 8.0.1) is
not closed here because the major requires updating index.js to the OTel
2.x API — tracking as follow-up.
Lock regenerated with npm 10.8.2 (node 20) to match CI's resolver.
litianningdatadog
approved these changes
Jun 17, 2026
litianningdatadog
left a comment
litianningdatadog
left a comment
Contributor
There was a problem hiding this comment.
nit: mind linking the JIRA to track this effort?
Contributor
Author
|
@litianningdatadog no jira tacket for vulnerabilities on maintenance for tests, no OKR to track it to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Consolidates the 6 open Dependabot/ADMS vulnerability PRs into a single PR.
integration-tests/lambda/otlp-java/pom.xmlio.opentelemetry:opentelemetry-api1.58.0 → 1.63.0local_tests/golang/go.{mod,sum}aws-sdk-go,golang.org/x/net,golang.org/x/sysminor bumpsintegration-tests/lambda/otlp-node/package*.json@grpc/[email protected],@protobufjs/utf8override carried over)integration-tests/package*.jsonuuid9 → 14 (ported manually onto #1262 to avoid lock conflict)integration-tests/package*.jsonaxios1.15 → 1.18, plus overrides for@opentelemetry/core,fast-xml-parser,fast-xml-builder,fast-uri,brace-expansionintegration-tests/lambda/otlp-node/package*.json@opentelemetry/sdk-node0.54 → 0.219,protobufjs7.5.4 → 7.6.4)Closes the following Dependabot alerts: #191, #192 (
@grpc/grpc-js); #183–#190 + older axios alerts; protobufjs alerts via the major OTel SDK bump; uuid #180; OpenTelemetry Java #176.Testing
GitHub Actions checks (Build All, Test Suite, Clippy, Audit, CodeQL) passed on each individual source PR.
dd-gitlab/*checks failed identically on all 6 — appears to be an unrelated infra/permissions issue with the bot-authored branches. Re-running CI on this branch (created from a maintainer account) should clear them.The vendored deps live entirely under
integration-tests/andlocal_tests/, so they have no impact on the shipped extension binary.