Update OpenTelemetry libraries to latest versions
- Dominant language
- C#
- Stars
- 3.2k
- Forks
- 1.3k
- PR merge metrics
- PR metrics pending
Description
👋 from the OpenTelemetry .NET folks.
Via https://github.com/dotnet/core/pull/10399 I discovered that you're planning to depend on the OTel SDK in the dotnet CLI. That's cool 😎.
Looking at the code in main, you currently depend on 1.12.0:
https://github.com/dotnet/sdk/blob/2bbd50d58b9410d7808520fe986f79041952f04f/eng/Versions.props#L63
We recently (last week) published a number of GitHub Security Advisories that affect versions < 1.15.x ([opentelemetry-dotnet advisories](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories), [opentelemetry-dotnet-contrib advisories](https://github.com/open-telemetry/opentelemetry-dotnet-contrib)).
I would recommend:
1. Upgrading to the latest versions.
1. Separating the versions [here](https://github.com/dotnet/sdk/blob/2bbd50d58b9410d7808520fe986f79041952f04f/Directory.Packages.props#L25-L28) because they are not guaranteed to have matching versions (this is true for the latest versions patched right now, which are `1.15.3`, `1.15.3`, `1.15.1` and `1.15.1` respectively)
I'm sure you're probably already aware of this the NuGet Audit feature and you need to vendor the code at some point for source build anyway, but I thought I would bring this to your attention.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.