fix(deps): vuln minor: @opentelemetry/core · patch: @grpc/grpc-js [integration-tests/lambda/otlp-node/package.json] by gh-worker-campaigns-3e9aa4[bot] · Pull Request #1460 · DataDog/datadog-lambda-extension

gh-worker-campaigns-3e9aa4 · 2026-10-26T10:05:20Z

Summary: High-severity security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

integration-tests/lambda/otlp-node/package.json (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
@grpc/grpc-js	1.14.4	1.14.6	patch	Transitive	2 HIGH, 2 LOW
@opentelemetry/core	1.27.0	1.30.1	minor	Transitive	2 MEDIUM

Security Details

🚨 Critical & High Severity (2 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@grpc/grpc-js	GHSA-m9gg-hp2v-232j	HIGH	@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized	1.14.4	1.13.6	-
@grpc/grpc-js	CVE-2026-101916	HIGH	@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized	1.14.4	-	-

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@opentelemetry/core	GHSA-8988-4f7v-96qf	MODERATE	OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation	1.27.0	2.8.0	-
@opentelemetry/core	CVE-2026-54285	MODERATE	opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation	1.27.0	-	-
@grpc/grpc-js	GHSA-f596-whhp-79r4	LOW	@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages	1.14.4	1.13.6	-
@grpc/grpc-js	CVE-2026-101915	LOW	@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages	1.14.4	-	-

Review Checklist

Standard review:

Review changes for compatibility with your code
Check for breaking changes in release notes
Run tests locally or wait for CI
Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

datadog-prod-us1-5 · 2026-10-26T10:08:37Z

✨ Unblock PR with BitsAI

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

DDCI - DataDog/datadog-lambda-extension | build node lambdas — 🔧 Needs a code fix, caused by this PR

View more details · View in DDCI

DataDog/datadog-lambda-extension | build node lambdas — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: df186a2 | Docs | View more details | Give us feedback!}

chatgpt-codex-connector · 2026-10-28T18:49:35Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T21:08:31.952557Z	`df186a2`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Copilot

🟡 Changes recommended

The per-parent overrides leave ten copies of vulnerable @opentelemetry/core@1.27.0 in the updated lockfile, so the dependency update does not fully remove the vulnerable version.

1 open issue

Upgrade all remaining vulnerable OpenTelemetry Core dependencies · New

1 file not reviewed

integration-tests/lambda/otlp-node/package-lock.json: Generated file

What changed in this PR

This PR updates transitive dependencies in the Node.js OTLP Lambda integration-test fixture to address reported security vulnerabilities.

Changes:

Adds scoped npm overrides targeting @opentelemetry/core at ^1.30.1 and @grpc/grpc-js at ^1.14.6.
Updates the lockfile with gRPC 1.14.6 and revised OpenTelemetry dependency resolutions.

File	Description
`integration-tests/lambda/otlp-node/package.json`	Adds transitive dependency overrides for the security updates.
`integration-tests/lambda/otlp-node/package-lock.json`	Records updated versions and nested OpenTelemetry dependencies.

_{Review effort: Balanced}

    "@opentelemetry/sdk-trace-node": "^1.28.0",
    "@opentelemetry/semantic-conventions": "^1.28.0"
+  },
+  "overrides": {


chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 689c21c04f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-28T18:52:11Z

+  },
+  "overrides": {
+    "@opentelemetry/exporter-trace-otlp-grpc": {
+      "@opentelemetry/core": "^1.30.1",


Upgrade core to an actually patched release

Every new @opentelemetry/core override uses ^1.30.1, which can resolve only versions below 2.0.0, but the upstream GHSA-8988-4f7v-96qf advisory marks all versions below 2.8.0 as affected and identifies 2.8.0 as the patched release. Consequently, security scans will continue reporting the vulnerability—and baggage extraction remains vulnerable where untrusted headers reach the propagator—despite the PR summary claiming it is fixed; update the compatible OpenTelemetry package set to 2.8.0 or later rather than overriding it to another affected 1.x release.

AGENTS.md reference: AGENTS.md:L23-L23

Useful? React with 👍 / 👎.

gh-worker-campaigns-3e9aa4 · 2026-10-29T18:51:04Z

Auto-rebase failed

Lockfile regeneration failed during rebase onto main. Your branch was not updated. You may need to rebase and regenerate lockfiles manually.

Error details

child workflow execution error (type: engraver.Engraver_AllManagersWorkflow, workflowID: 01a1b462-7277-7388-8b51-6fe251986b88_69, runID: 01a1b462-8aab-7a06-a6b2-aa9a36d3e4ea, initiatedEventID: 69, startedEventID: 70): custom action(s) failed and produced no changes: [registry.ddbuild.io/images/engraver-custom-action:update-npm-lockfile]

_{Auto-Rebase · Add no-auto-rebase to opt out}

…tion-tests/lambda/otlp-node/package.json] Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>

CI installs with npm 10, which rejects the lock file that the bot wrote for the new overrides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: lym953 <10097700+lym953@users.noreply.github.com>

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>

gh-worker-campaigns-3e9aa4 · 2026-11-12T21:06:14Z

Auto-rebase complete

Branch is up to date with main — rebased onto 6eabbe9.

_{Auto-Rebase · Add no-auto-rebase to opt out}

gh-worker-campaigns-3e9aa4 Bot added campaigner-automated-change adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm bot_family:adms-dependency-update adms-dependency-update labels Oct 26, 2026

lym953 marked this pull request as ready for review October 28, 2026 18:48

Copilot AI balanced review requested due to automatic review settings October 28, 2026 18:48

lym953 requested a review from a team as a code owner October 28, 2026 18:48

lym953 self-requested a review October 28, 2026 18:48

Copilot started reviewing on behalf of lym953 October 28, 2026 18:49

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

Comment thread integration-tests/lambda/otlp-node/package.json

"@opentelemetry/sdk-trace-node": "^1.28.0",

"@opentelemetry/semantic-conventions": "^1.28.0"

},

"overrides": {

chatgpt-codex-connector Bot reviewed Oct 28, 2026

View reviewed changes

dd-octo-sts-b8cf80 Bot and others added 3 commits November 12, 2026 21:06

ADMS: vuln minor: @opentelemetry/core · patch: @grpc/grpc-js [integra…

9cf99b9

…tion-tests/lambda/otlp-node/package.json] Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>

Regenerate package-lock.json with npm 10

8db520b

CI installs with npm 10, which rejects the lock file that the bot wrote for the new overrides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: lym953 <10097700+lym953@users.noreply.github.com>

chore: regenerate lockfiles after rebase

df186a2

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>

dd-octo-sts-b8cf80 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/lambda/1-1793009108 branch from 689c21c to df186a2 Compare November 12, 2026 21:06

Navigation Menu

Repository navigation

fix(deps): vuln minor: @opentelemetry/core · patch: @grpc/grpc-js [integration-tests/lambda/otlp-node/package.json] - #1460

fix(deps): vuln minor: @opentelemetry/core · patch: @grpc/grpc-js [integration-tests/lambda/otlp-node/package.json]#1460
gh-worker-campaigns-3e9aa4[bot] wants to merge 3 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/lambda/1-1793009108

gh-worker-campaigns-3e9aa4 Bot commented Oct 26, 2026

Uh oh!

datadog-prod-us1-5 Bot commented Oct 26, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 28, 2026

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Nov 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Oct 26, 2026

Updates

Security Details

Review Checklist

Uh oh!

datadog-prod-us1-5 Bot commented Oct 26, 2026 • edited by datadog-datadog-prod-us1-2 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Errors

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 28, 2026

Choose a reason for hiding this comment

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Auto-rebase failed

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Nov 12, 2026

Auto-rebase complete

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

datadog-prod-us1-5 Bot commented Oct 26, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading

gh-worker-campaigns-3e9aa4 Bot commented Oct 29, 2026 •

edited

Loading