fix(deps): force @opentelemetry/core >=2.8.0 (CVE-2026-54285)#7975
Merged
Conversation
Pin the transitive @opentelemetry/core dep (pulled in via @elastic/elasticsearch -> @elastic/transport) to >=2.8.0 to clear GHSA-8988-4f7v-96qf / CVE-2026-54285: W3CBaggagePropagator.extract() did not enforce W3C size limits on inbound baggage headers, allowing unbounded memory allocation. @elastic/transport declares the dep as "2.x" so 2.8.0 satisfies the existing range with no parent bump, and 2.8.0's @opentelemetry/api peer range (>=1.0.0 <1.10.0) is satisfied by the 1.9.1 already in the tree. Override added to pnpm-workspace.yaml alongside the other CVE force-bumps (pnpm 11 ignores root package.json pnpm.overrides). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require review |
PR Summary by QodoFix CVE-2026-54285 by forcing @opentelemetry/core >= 2.8.0 via pnpm override WalkthroughsDescription• Add pnpm override to enforce @opentelemetry/core >=2.8.0 and clear CVE-2026-54285 alert. • Update lockfile resolution from @opentelemetry/core 2.7.1 to 2.8.0 under @elastic/transport. Diagramgraph TD
A["Etherpad repo"] --> B["pnpm-workspace.yaml"] --> C["pnpm overrides"] --> D["@opentelemetry/core"]
A --> E["pnpm-lock.yaml"] --> D
High-Level AssessmentThe following are alternative approaches to this PR: 1. Bump the parent dependency (e.g., @elastic/transport/@elastic/elasticsearch)
2. Use root package.json pnpm.overrides (if supported)
3. Patch-package / vendor a fix
Recommendation: The current approach (workspace-level pnpm override to force @opentelemetry/core >=2.8.0) is the best fit: it’s minimally invasive, aligns with the existing semver range (2.x), and matches the repo’s documented pnpm 11 behavior. Prefer an upstream parent bump only if future constraints require removing overrides or if additional upstream fixes are needed. File ChangesOther (2)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves Dependabot alert #205 — GHSA-8988-4f7v-96qf / CVE-2026-54285 (medium, CVSS 5.3).
The vulnerability
W3CBaggagePropagator.extract()in@opentelemetry/core< 2.8.0 does not enforce the W3C Baggage size limits (8,192 bytes / 180 entries) on inboundbaggageheaders — limits were only applied oninject(). Parsing oversized baggage allocates memory proportional to the header size with no cap (CWE-770). Fixed in 2.8.0.Dependency chain (transitive, runtime)
Practical reachability in Etherpad: low
@elastic/elasticsearchis only exercised by the optional Elasticsearch ueberdb backend.extract()on inbound baggage headers; Etherpad's ES client makes outbound requests to a trusted, operator-configured ES server — there is no attacker-controlled inbound baggage reaching the propagator.--max-http-header-size(16 KB) independently caps the vector; the advisory itself rates availability impact as "limited".Still worth patching to clear the alert and harden non-HTTP/raised-limit deployments.
The fix
@elastic/transport@9.3.6declares its dep as@opentelemetry/core: 2.x, so 2.8.0 satisfies the existing range — no parent bump needed. 2.8.0's peer range (@opentelemetry/api >=1.0.0 <1.10.0) is satisfied by the1.9.1already in the tree.Added a
>=2.8.0override topnpm-workspace.yamlalongside the other CVE force-bumps (pnpm 11 no longer reads rootpackage.jsonpnpm.overrides). Lockfile diff is surgical: only the override line and the2.7.1 -> 2.8.0resolution.🤖 Generated with Claude Code