NVIDIA / NVIDIA/NemoClaw

Replace Jaeger archive patch with upstream OpenTelemetry SDK upgrade

Open
#7,337 0 comments 0 reactions 1 assignee Claimed by @apurvvkumaria View on GitHub
area: observability area: packaging security v0.0.127
Dominant language
TypeScript
Stars
22.5k
Forks
3.1k
Avg merge
1d 1h
Merged PRs (30d)
715

Description

## Summary

The proposed NemoClaw mitigation in #7280 rewrites the reviewed `@openclaw/diagnostics-otel@2026.7.1` archive. The remediation replaces `@opentelemetry/propagator-jaeger@2.8.0` with `2.9.0` and nests `@opentelemetry/core@2.9.0` because the bundled `@opentelemetry/sdk-node@0.219.0` pins the vulnerable propagator version.

That exact, integrity-verified patch removes the vulnerable graph, but it should remain a temporary compatibility measure. NemoClaw should consume an upstream-supported OpenTelemetry dependency graph and then remove the custom Jaeger/core archive surgery.

As of 2026-07-21:

- `@opentelemetry/sdk-node@0.221.0` depends on `@opentelemetry/propagator-jaeger@2.10.0`.
- The latest stable `@openclaw/diagnostics-otel@2026.7.1` still depends on `@opentelemetry/sdk-node@0.219.0`, so the clean upgrade is not yet available through the published OpenClaw diagnostics package.
- openclaw/openclaw#112406 is the current upstream candidate for moving diagnostics to a safe SDK graph, but it is not yet merged or published.

## Acceptance criteria

- Upgrade to a reviewed OpenClaw diagnostics release that bundles a supported OpenTelemetry SDK with `@opentelemetry/propagator-jaeger>=2.9.0`.
- Remove the diagnostics-specific Jaeger/core replacement branch and associated exact pins from `scripts/lib/openclaw-npm-remediation.mts` once the upstream graph is safe.
- Refresh the reviewed archive metadata, shrinkwrap expectations, exact registry integrity and tarball checks, and dependency-review documentation.
- Add a runtime regression test proving malformed percent-encoded `uber-trace-id` and `uberctx-*` headers do not throw.
- Keep the #7280 remediation in place until the upstream-supported graph is shipped and validated.
- Verify the reviewed production graph reports no high or critical findings and run the relevant package, integration, and E2E validation.

## Related work

- #7280 provides the proposed immediate, integrity-pinned mitigation.
- openclaw/openclaw#112406 is the current upstream upgrade candidate.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.