fix(deps): require patched OpenTelemetry core - #9823
fix(deps): require patched OpenTelemetry core#9823Victor Vazquez (vhvb1989) wants to merge 1 commit into
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25a17f9b-287c-4396-b7c9-8e15432773a4
|
Azure Pipelines: Successfully started running 1 pipeline(s). 21 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
🟢 Approval recommended
The manifest and lockfile consistently resolve OpenTelemetry core to the patched 2.9.0 release.
Pull request overview
Pins the eval tooling to a patched OpenTelemetry core release, resolving GHSA-8988-4f7v-96qf.
Changes:
- Adds a global
@opentelemetry/core2.9.0 override. - Removes the vulnerable nested 2.0.0 lockfile entry.
File summaries
| File | Description |
|---|---|
cli/azd/test/evals/package.json |
Declares the patched dependency override. |
cli/azd/test/evals/package-lock.json |
Deduplicates OpenTelemetry core to 2.9.0. |
Review details
Files not reviewed (1)
- cli/azd/test/evals/package-lock.json: Generated file
- Files reviewed: 1/2 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
Summary
@opentelemetry/coreto 2.9.0 in the azd eval toolingThe direct dependency graph already selected 2.9.0, but the exporter retained a nested vulnerable copy; the override ensures all consumers use the patched release.
Validation
npm cipasses