Skip to content

Bump backend otel deps to resolve a CVE#4276

Merged
imnasnainaec merged 1 commit into
masterfrom
backend-deps-otel-bump
May 4, 2026
Merged

Bump backend otel deps to resolve a CVE#4276
imnasnainaec merged 1 commit into
masterfrom
backend-deps-otel-bump

Conversation

@imnasnainaec
Copy link
Copy Markdown
Collaborator

@imnasnainaec imnasnainaec commented May 1, 2026

This resolves

  /home/runner/work/TheCombine/TheCombine/Backend/BackendFramework.csproj : error NU1902: Warning As Error: Package 'OpenTelemetry.Exporter.OpenTelemetryProtocol' 1.12.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-4625-4j76-fww9 [/home/runner/work/TheCombine/TheCombine/BackendFramework.sln]

Also, when I updated the license file, some MS versions dropped from 9 to 8, because I had previously been accidentally using .NET 9 with this project even though it is currently at .NET 8.

Devin: https://app.devin.ai/review/sillsdev/TheCombine/pull/4276


This change is Reviewable

Summary by CodeRabbit

  • Chores
    • Updated OpenTelemetry packages to versions 1.15.x for enhanced observability and telemetry capabilities.
    • Updated core framework dependencies and diagnostic packages to latest stable versions for improved functionality and reliability.

@imnasnainaec imnasnainaec self-assigned this May 1, 2026
@imnasnainaec imnasnainaec added the 🟥High High-priority PR: please review this asap! label May 1, 2026
@github-actions github-actions Bot added documentation Improvements or additions to documentation backend dependencies Pull requests that update a dependency file labels May 1, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 1, 2026

📝 Walkthrough

Walkthrough

The PR updates OpenTelemetry NuGet package versions in the backend project file, moving to newer releases (1.15.3, 1.15.2, and 1.15.1), and synchronizes the license documentation file with the updated package versions and other framework dependencies.

Changes

Cohort / File(s) Summary
Backend Project Configuration
Backend/BackendFramework.csproj
Updated OpenTelemetry NuGet packages (console exporter, OTLP exporter, hosting extensions to 1.15.3; ASP.NET Core instrumentation to 1.15.2; HTTP instrumentation to 1.15.1).
License Documentation
docs/user_guide/assets/licenses/backend_licenses.txt
Synchronized package versions to match project dependencies, including OpenTelemetry upgrades, Microsoft.Extensions downgrades from 9.0.0 to 8.0.x, System.Diagnostics.DiagnosticSource bump to 10.0.0, and removal of System.Text.Json license entry.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

backend, dependencies, .NET

Suggested reviewers

  • jasonleenaylor

Poem

🐰 Hop along with versions new,
OpenTelemetry shines in 1.15 brew,
Licenses updated, dependencies aligned,
Framework foundations, refined and signed! ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title directly describes the main change: updating OpenTelemetry dependencies to resolve a CVE, which matches the actual changeset modifications.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch backend-deps-otel-bump

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 1, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.94%. Comparing base (c8d6318) to head (b7ac8cf).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4276      +/-   ##
==========================================
+ Coverage   66.79%   75.94%   +9.14%     
==========================================
  Files         246      303      +57     
  Lines        6274    11352    +5078     
  Branches      787     1403     +616     
==========================================
+ Hits         4191     8621    +4430     
- Misses       1824     2330     +506     
- Partials      259      401     +142     
Flag Coverage Δ
backend 87.23% <ø> (?)
frontend 66.79% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

@jasonleenaylor jasonleenaylor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:lgtm:

@jasonleenaylor reviewed 2 files and all commit messages, and made 1 comment.
Reviewable status: :shipit: complete! all files reviewed, all discussions resolved (waiting on imnasnainaec).

@imnasnainaec imnasnainaec merged commit f1d68a6 into master May 4, 2026
20 checks passed
@imnasnainaec imnasnainaec deleted the backend-deps-otel-bump branch May 4, 2026 17:59
@coderabbitai coderabbitai Bot mentioned this pull request May 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backend dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation 🟥High High-priority PR: please review this asap!

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants