Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade: , , #288

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

micahg
Copy link
Owner

@micahg micahg commented Sep 18, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@opentelemetry/exporter-trace-otlp-proto
from 0.52.1 to 0.53.0 | 1 version ahead of your current version | 21 days ago
on 2024-08-28
@opentelemetry/sdk-node
from 0.52.1 to 0.53.0 | 1 version ahead of your current version | 21 days ago
on 2024-08-28
@opentelemetry/exporter-metrics-otlp-proto
from 0.52.1 to 0.53.0 | 1 version ahead of your current version | 21 days ago
on 2024-08-28

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106
524 Proof of Concept
Release notes
Package name: @opentelemetry/exporter-trace-otlp-proto
  • 0.53.0 - 2024-08-28

    0.53.0

    💥 Breaking Change

    • fix(instrumentation)!:remove unused description property from interface #4847 @ blumamir
    • feat(exporter--otlp-)!: use transport interface in node.js exporters #4743 @ pichlermarc
      • (user-facing) headers was intended for internal use has been removed from all exporters
      • (user-facing) compression was intended for internal use and has been removed from all exporters
      • (user-facing) hostname was intended for use in tests and is not used by any exporters, it will be removed in a future release
    • fix(exporter--otlp-)!: ensure User-Agent header cannot be overwritten by the user #4743 @ pichlermarc
      • allowing overrides of the User-Agent header was not specification compliant.
    • feat(exporter--otlp)!: remove environment-variable specific code from browser exporters
      • (user-facing) removes the ability to configure browser exporters by using process.env polyfills
    • feat(sdk-node)!: Automatically configure logs exporter #4740
    • feat(exporter--otlp-)!: use transport interface in browser exporters #4895 @ pichlermarc
      • (user-facing) protected headers property was intended for internal use has been removed from all exporters

    🚀 (Enhancement)

    • feat(otlp-transformer): Do not limit @ opentelemetry/api upper range peerDependency #4816 @ mydea
    • feat(instrumentation-http): Allow to opt-out of instrumenting incoming/outgoing requests #4643 @ mydea
    • feat(sampler-jaeger-remote): added support of jaeger-remote-sampler according to this spec #4534 @ legalimpurity

    🐛 (Bug Fix)

    • fix(instrumentation): ensure .setConfig() results in config.enabled defaulting to true #4941 @ trentm
    • fix(instrumentation-http): Ensure instrumentation of http.get and https.get work when used in ESM code #4857 @ trentm
    • fix(api-logs): align AnyValue to spec #4893 @ blumamir
    • fix(instrumentation): remove diag.debug() message for instrumentations that do not patch modules #4925 @ trentm

    🏠 (Internal)

    • refactor: Simplify the code for the getEnv function #4799 @ danstarns
    • refactor: remove "export *" in favor of explicit named exports #4880 @ robbkidd
      • Packages updated:
        • api-events
        • api-logs
        • opentelemetry-browser-detector
        • opentelemetry-exporter-prometheus
        • opentelemetry-instrumentation-fetch
        • opentelemetry-instrumentation-http
        • opentelemetry-instrumentation-xml-http-request
        • opentelemetry-instrumentation
  • 0.52.1 - 2024-06-20

    0.52.1

    🚀 (Enhancement)

    • refactor(instrumentation-fetch): move fetch to use SEMATRR #4632
    • refactor(otlp-transformer): use explicit exports #4785 @ pichlermarc

    🐛 (Bug Fix)

    🏠 (Internal)

    • test: add npm run maint:regenerate-test-certs maintenance script and regenerate recently expired test certs #4777
from @opentelemetry/exporter-trace-otlp-proto GitHub release notes
Package name: @opentelemetry/sdk-node
  • 0.53.0 - 2024-08-28

    0.53.0

    💥 Breaking Change

    • fix(instrumentation)!:remove unused description property from interface #4847 @ blumamir
    • feat(exporter--otlp-)!: use transport interface in node.js exporters #4743 @ pichlermarc
      • (user-facing) headers was intended for internal use has been removed from all exporters
      • (user-facing) compression was intended for internal use and has been removed from all exporters
      • (user-facing) hostname was intended for use in tests and is not used by any exporters, it will be removed in a future release
    • fix(exporter--otlp-)!: ensure User-Agent header cannot be overwritten by the user #4743 @ pichlermarc
      • allowing overrides of the User-Agent header was not specification compliant.
    • feat(exporter--otlp)!: remove environment-variable specific code from browser exporters
      • (user-facing) removes the ability to configure browser exporters by using process.env polyfills
    • feat(sdk-node)!: Automatically configure logs exporter #4740
    • feat(exporter--otlp-)!: use transport interface in browser exporters #4895 @ pichlermarc
      • (user-facing) protected headers property was intended for internal use has been removed from all exporters

    🚀 (Enhancement)

    • feat(otlp-transformer): Do not limit @ opentelemetry/api upper range peerDependency #4816 @ mydea
    • feat(instrumentation-http): Allow to opt-out of instrumenting incoming/outgoing requests #4643 @ mydea
    • feat(sampler-jaeger-remote): added support of jaeger-remote-sampler according to this spec #4534 @ legalimpurity

    🐛 (Bug Fix)

    • fix(instrumentation): ensure .setConfig() results in config.enabled defaulting to true #4941 @ trentm
    • fix(instrumentation-http): Ensure instrumentation of http.get and https.get work when used in ESM code #4857 @ trentm
    • fix(api-logs): align AnyValue to spec #4893 @ blumamir
    • fix(instrumentation): remove diag.debug() message for instrumentations that do not patch modules #4925 @ trentm

    🏠 (Internal)

    • refactor: Simplify the code for the getEnv function #4799 @ danstarns
    • refactor: remove "export *" in favor of explicit named exports #4880 @ robbkidd
      • Packages updated:
        • api-events
        • api-logs
        • opentelemetry-browser-detector
        • opentelemetry-exporter-prometheus
        • opentelemetry-instrumentation-fetch
        • opentelemetry-instrumentation-http
        • opentelemetry-instrumentation-xml-http-request
        • opentelemetry-instrumentation
  • 0.52.1 - 2024-06-20

    0.52.1

    🚀 (Enhancement)

    • refactor(instrumentation-fetch): move fetch to use SEMATRR #4632
    • refactor(otlp-transformer): use explicit exports #4785 @ pichlermarc

    🐛 (Bug Fix)

    🏠 (Internal)

    • test: add npm run maint:regenerate-test-certs maintenance script and regenerate recently expired test certs #4777
from @opentelemetry/sdk-node GitHub release notes
Package name: @opentelemetry/exporter-metrics-otlp-proto
  • 0.53.0 - 2024-08-28

    0.53.0

    💥 Breaking Change

    • fix(instrumentation)!:remove unused description property from interface #4847 @ blumamir
    • feat(exporter--otlp-)!: use transport interface in node.js exporters #4743 @ pichlermarc
      • (user-facing) headers was intended for internal use has been removed from all exporters
      • (user-facing) compression was intended for internal use and has been removed from all exporters
      • (user-facing) hostname was intended for use in tests and is not used by any exporters, it will be removed in a future release
    • fix(exporter--otlp-)!: ensure User-Agent header cannot be overwritten by the user #4743 @ pichlermarc
      • allowing overrides of the User-Agent header was not specification compliant.
    • feat(exporter--otlp)!: remove environment-variable specific code from browser exporters
      • (user-facing) removes the ability to configure browser exporters by using process.env polyfills
    • feat(sdk-node)!: Automatically configure logs exporter #4740
    • feat(exporter--otlp-)!: use transport interface in browser exporters #4895 @ pichlermarc
      • (user-facing) protected headers property was intended for internal use has been removed from all exporters

    🚀 (Enhancement)

    • feat(otlp-transformer): Do not limit @ opentelemetry/api upper range peerDependency #4816 @ mydea
    • feat(instrumentation-http): Allow to opt-out of instrumenting incoming/outgoing requests #4643 @ mydea
    • feat(sampler-jaeger-remote): added support of jaeger-remote-sampler according to this spec #4534 @ legalimpurity

    🐛 (Bug Fix)

    • fix(instrumentation): ensure .setConfig() results in config.enabled defaulting to true #4941 @ trentm
    • fix(instrumentation-http): Ensure instrumentation of http.get and https.get work when used in ESM code #4857 @ trentm
    • fix(api-logs): align AnyValue to spec #4893 @ blumamir
    • fix(instrumentation): remove diag.debug() message for instrumentations that do not patch modules #4925 @ trentm

    🏠 (Internal)

    • refactor: Simplify the code for the getEnv function #4799 @ danstarns
    • refactor: remove "export *" in favor of explicit named exports #4880 @ robbkidd
      • Packages updated:
        • api-events
        • api-logs
        • opentelemetry-browser-detector
        • opentelemetry-exporter-prometheus
        • opentelemetry-instrumentation-fetch
        • opentelemetry-instrumentation-http
        • opentelemetry-instrumentation-xml-http-request
        • opentelemetry-instrumentation
  • 0.52.1 - 2024-06-20

    0.52.1

    🚀 (Enhancement)

    • refactor(instrumentation-fetch): move fetch to use SEMATRR #4632
    • refactor(otlp-transformer): use explicit exports #4785 @ pichlermarc

    🐛 (Bug Fix)

    🏠 (Internal)

    • test: add npm run maint:regenerate-test-certs maintenance script and regenerate recently expired test certs #4777
from @opentelemetry/exporter-metrics-otlp-proto GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade:
  - @opentelemetry/exporter-trace-otlp-proto from 0.52.1 to 0.53.0.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/exporter-trace-otlp-proto
  - @opentelemetry/sdk-node from 0.52.1 to 0.53.0.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/sdk-node
  - @opentelemetry/exporter-metrics-otlp-proto from 0.52.1 to 0.53.0.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/exporter-metrics-otlp-proto

See this project in Snyk:
https://app.snyk.io/org/micahgalizia/project/6d68838d-fd86-4090-9964-b2df8c93aeeb?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants