Replace Jaeger archive patch with upstream OpenTelemetry SDK upgrade
- Dominant language
- TypeScript
- Stars
- 22.5k
- Forks
- 3.1k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 715
Description
## Summary
The proposed NemoClaw mitigation in #7280 rewrites the reviewed `@openclaw/diagnostics-otel@2026.7.1` archive. The remediation replaces `@opentelemetry/propagator-jaeger@2.8.0` with `2.9.0` and nests `@opentelemetry/core@2.9.0` because the bundled `@opentelemetry/sdk-node@0.219.0` pins the vulnerable propagator version.
That exact, integrity-verified patch removes the vulnerable graph, but it should remain a temporary compatibility measure. NemoClaw should consume an upstream-supported OpenTelemetry dependency graph and then remove the custom Jaeger/core archive surgery.
As of 2026-07-21:
- `@opentelemetry/sdk-node@0.221.0` depends on `@opentelemetry/propagator-jaeger@2.10.0`.
- The latest stable `@openclaw/diagnostics-otel@2026.7.1` still depends on `@opentelemetry/sdk-node@0.219.0`, so the clean upgrade is not yet available through the published OpenClaw diagnostics package.
- openclaw/openclaw#112406 is the current upstream candidate for moving diagnostics to a safe SDK graph, but it is not yet merged or published.
## Acceptance criteria
- Upgrade to a reviewed OpenClaw diagnostics release that bundles a supported OpenTelemetry SDK with `@opentelemetry/propagator-jaeger>=2.9.0`.
- Remove the diagnostics-specific Jaeger/core replacement branch and associated exact pins from `scripts/lib/openclaw-npm-remediation.mts` once the upstream graph is safe.
- Refresh the reviewed archive metadata, shrinkwrap expectations, exact registry integrity and tarball checks, and dependency-review documentation.
- Add a runtime regression test proving malformed percent-encoded `uber-trace-id` and `uberctx-*` headers do not throw.
- Keep the #7280 remediation in place until the upstream-supported graph is shipped and validated.
- Verify the reviewed production graph reports no high or critical findings and run the relevant package, integration, and E2E validation.
## Related work
- #7280 provides the proposed immediate, integrity-pinned mitigation.
- openclaw/openclaw#112406 is the current upstream upgrade candidate.
Contributor guide
Assessment
This issue has not been assessed yet.