Repository navigation
fix(security): preserve tracing contexts and runtime dependencies - #2399
Draft
dependabot[bot] wants to merge 12 commits into
Draft
dependabot[bot] wants to merge 12 commits into
dependabot[bot] wants to merge 12 commits into
Conversation
Bumps [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) from 2.11.0 to 2.12.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/v2.12.0/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0) --- updated-dependencies: - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency ReviewThe following issues were found:
OpenSSF ScorecardScorecard details
Scanned Files
|
groupthinking
requested changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Review at head e7503ec8: this PR changes apps/web/package.json without updating the root package-lock.json, and current-head build, lint, and frontend test checks fail. Reconcile the workspace lockfile with the manifest, then rerun the checks before approval.
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at exact head ff73f48397d6ff72e94a71af3e1132235e26906d: the earlier requested change is resolved. The web manifest and root lockfile both resolve direct @opentelemetry/sdk-trace-base@2.12.0. I inspected the two-file diff and verified a clean npm 10.8.0 install, package resolution, 1,520 passing web tests (28 skipped), lint, typecheck and build. Current hosted build, lint, frontend tests and issue-link checks pass. The SDK deprecation notice is disclosed in the PR description. This approval covers the code and lockfile correction only. The shared dependency-review job still fails after a 3-base/1-head snapshot warning and has no reliable evidence artifact. Keep this PR open and unmerged until that check passes with a complete dependency verdict on the final head.
…ry/sdk-trace-base-2.12.0
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
changed the title
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
changed the title
Contributor
🔍 PR Validation |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
changed the title
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
changed the title
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Nov 10, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Reviewed exact head 13dc8cc31a00245f485378090ba7bca3fa2169fe against 61522e9170a91bf8c8c6bf02f2e5dbdf2eb5bbd6. The workspace manifest/lock mismatch and failing build/test findings are resolved. The maintained tracing SDK replaces sdk-trace-base and the added context regression verifies restoration after both success and a thrown callback.
I inspected the complete eight-path diff and the merge of current main, preserving both current product changes and the tracing/security repairs. Clean installs, types, lint, 96 recorder tests, installed tracing compatibility tests and all 11 MCP security/runtime cases pass. Hosted validation passes 1,577 web cases (one existing skip), the 47-page application and Docker builds, 21 real Studio preflight checks, and 16 preview pipeline tests.
The current dependency review passed. I downloaded its artifact and independently verified the ZIP and raw-diff digests, exact base/head/run, successful outcome, and all 78 typed npm rows against the fresh live comparison. It contains zero vulnerability entries and no snapshot-warning or pagination header. No inline review threads remain. The subsequent PR metadata validation and repository reconciliation report also passed.
Approving these scoped source changes resolves my earlier requested changes. Remaining repository risks are explicit: full npm audit still reports 24 high/18 moderate findings (no new advisory IDs versus current main); the root Python scanner fell back to declared packages, leaving transitive coverage incomplete; preview tests may use cached packs. This review grants no audit exception, production-readiness claim, deployment or merge authorization. The PR remains open with auto-merge disabled.
groupthinking
marked this pull request as draft
November 13, 2026 01:37
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OpenTelemetry SDK 3 repair now integrates current main without downgrading its Gemini SDK or newer transitive security packages. Integration head:
73ec0d4fe2d523e84f5d0212fba4522e768f06eb, tree7efe0b056665b1b756f50082d80c4643a1582754(GitHub/local exact match).Maintained sdk-trace 3.0.0 replaces deprecated sdk-trace-base 2.12.0. The installed compatibility test verifies instrumentation/API loading and StackContextManager restoration after normal and throwing callbacks. The scoped MCP json-schema-typed 9.0.0 override and strict type/runtime security tests remain. Main's newer @hono/node-server 2.1.6, hono 4.13.16, fast-uri 3.1.9 and ip-address 10.7.5, plus its actual dependency scope flags, are retained. Main's newer Gemini SDK no longer has the earlier optional-MCP peer path; the old runtime-optional classification is historical and is not reimposed.
The change is ten files relative to main: manifests/lock, OTel regression, root MCP tests/configs, required CI invocation, and two exact-branch deployment exclusions. Root MCP tests remain outside production web compilation. No application runtime source changes relative to main.
Current integration uses main
512a2558f73d6281b6a880548bedf140b7e30292. The history-preserving commit retains the prior PR head and that main as parents. Frozen installs used Node 24.22.1 and repository npm 10.8.0 withci --ignore-scripts --legacy-peer-deps --no-audit --no-fund; manifest and lockfile bytes stayed unchanged. The reviewed existing postinstall transport patch was run explicitly.Both root and app Vercel configurations use
git.deploymentEnabledwith this exact branch set false. This is a draft: do not merge or deploy. No live extraction, provider request, production mutation, security exception, or CI weakening was performed. Hosted checks on earlier heads are historical and do not certify this integration. Current-head CI and hosted build/security evidence are required before acceptance. Preview E2E may fail because preview deployment is intentionally disabled; preserve that gate.The full current dependency audit was not rerun; no clean-audit or clean-image claim is made.
Validation on this exact tree, November 12, 2026 (America/Chicago):
npm --workspace=apps/web test -- --maxWorkers=2: 1,570 passed, 28 skipped, 172 files; exit 0.npm run test:mcp-security: strict TypeScript check plus 11/11 runtime/security cases; exit 0.npm --workspace=apps/web run type-check,npm --workspace=apps/web run lint, and diff whitespace check: exit 0.npm run build:web: FAILED exit 137 (Killed) while two local builds were active. The resource cause is not proven. No passing build is claimed. Another build's continuation was subsequently blocked by automatic approval review for potential Sentry data transmission; no retry or bypass was attempted.This tree strictly supersedes #2398: before integration, the only tree difference between its head 108dc7f and this PR's prior head 13dc8cc was this PR's additional 23-line StackContextManager regression. All source, dependency and configuration content otherwise matched. Keep one canonical repair here.
Security dependency evidence