dotnet / dotnet/sdk

Update OpenTelemetry libraries to latest versions

Open
#54,156 1 comment 0 reactions 0 assignees View on GitHub
Area-SourceBuild dependencies
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

👋 from the OpenTelemetry .NET folks.

Via https://github.com/dotnet/core/pull/10399 I discovered that you're planning to depend on the OTel SDK in the dotnet CLI. That's cool 😎.

Looking at the code in main, you currently depend on 1.12.0:

https://github.com/dotnet/sdk/blob/2bbd50d58b9410d7808520fe986f79041952f04f/eng/Versions.props#L63

We recently (last week) published a number of GitHub Security Advisories that affect versions < 1.15.x ([opentelemetry-dotnet advisories](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories), [opentelemetry-dotnet-contrib advisories](https://github.com/open-telemetry/opentelemetry-dotnet-contrib)).

I would recommend:

1. Upgrading to the latest versions.
1. Separating the versions [here](https://github.com/dotnet/sdk/blob/2bbd50d58b9410d7808520fe986f79041952f04f/Directory.Packages.props#L25-L28) because they are not guaranteed to have matching versions (this is true for the latest versions patched right now, which are `1.15.3`, `1.15.3`, `1.15.1` and `1.15.1` respectively)

I'm sure you're probably already aware of this the NuGet Audit feature and you need to vendor the code at some point for source build anyway, but I thought I would bring this to your attention.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.