From a3d6d2336dfd15b741968e4fcef628102d3a5915 Mon Sep 17 00:00:00 2001 From: skobeltsyn Date: Mon, 25 May 2026 19:36:28 +0300 Subject: [PATCH] =?UTF-8?q?fix(#2387):=20bump=20opentelemetry-api=201.51.0?= =?UTF-8?q?=20=E2=86=92=201.62.0=20(W3C=20Baggage=20CVE)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot alert #5: io.opentelemetry:opentelemetry-api <= 1.61.0 allows unbounded memory allocation and CPU consumption when parsing oversized baggage headers in W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator. Because baggage auto-re-injects into outgoing requests, a single malicious header fans out across the downstream graph. 1.62.0 enforces caps consistent with the W3C Baggage spec at the propagator level: 8,192 bytes total, 64 entries. Over-limit headers are dropped at the cap point; already-extracted valid entries are retained. Practical exposure for Agents.KT is limited — we expose OpenTelemetry only through the `:agents-kt-otel` adapter, and the adapter emits spans rather than parsing inbound baggage. Risk applies to downstream consumers who enable baggage propagation in their own SDK pipeline, especially on non-HTTP transports where transport-layer header limits don't apply. The fix is a version bump: - agents-kt-otel/build.gradle.kts: 1.51.0 → 1.62.0 on both the production `opentelemetry-api` dependency and the testImplementation `opentelemetry-sdk-trace`. - gradle/verification-metadata.xml: refreshed via `./gradlew updateVerificationMetadata` for the four pinned OTel components (api, context, sdk-common, sdk-trace) plus the new transitive `opentelemetry-common` 1.62.0. Stale 1.51.0 entries removed so the metadata file remains the authoritative current state. `./gradlew :agents-kt-otel:test`: 7/7 green. No API surface changes between 1.51 and 1.62 affect our use; the adapter compiles + behaves unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) --- agents-kt-otel/build.gradle.kts | 7 +++-- gradle/verification-metadata.xml | 48 +++++++++++++++++++------------- 2 files changed, 33 insertions(+), 22 deletions(-) diff --git a/agents-kt-otel/build.gradle.kts b/agents-kt-otel/build.gradle.kts index 6186126..94ec17d 100644 --- a/agents-kt-otel/build.gradle.kts +++ b/agents-kt-otel/build.gradle.kts @@ -26,11 +26,14 @@ configurations.all { dependencies { api(project(":agents-kt-observability")) - api("io.opentelemetry:opentelemetry-api:1.51.0") + // #2387 — 1.62.0 patches CVE in W3C Baggage propagation (unbounded + // memory + CPU on oversized headers). Per-propagator caps at 8,192 + // bytes / 64 entries. Affects 1.51.0..1.61.0; no API changes touch us. + api("io.opentelemetry:opentelemetry-api:1.62.0") testImplementation(kotlin("test")) testImplementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.11.0") - testImplementation("io.opentelemetry:opentelemetry-sdk-trace:1.51.0") + testImplementation("io.opentelemetry:opentelemetry-sdk-trace:1.62.0") } kotlin { diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 2f2ddd4..f3835cb 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -161,36 +161,44 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + + + + + + + + +