Description
@livekit/agents@1.5.5 currently installs OpenTelemetry packages from incompatible stable/experimental families. This makes the July 2026 OpenTelemetry security advisories difficult to remediate without breaking the agent runtime.
The published manifest includes, among others:
@opentelemetry/core ^2.2.0- OTLP exporters / logs packages
0.54.x
@opentelemetry/resources, sdk-trace-base, and sdk-trace-node 1.28.x@opentelemetry/otlp-exporter-base ^0.208.0
OpenTelemetry's compatibility matrix pairs stable 1.27.x with experimental 0.54.x, and stable 2.0.x with experimental 0.200.x. A clean npm install therefore reports invalid peer relationships around @opentelemetry/core.
Security impact
The dependency graph is reported through:
The Jaeger issue is opt-in and can be mitigated by using only W3C Trace Context. However, forcing patched OpenTelemetry packages through npm overrides is not safe.
Reproduction
With @livekit/agents@1.5.5 and the corresponding 1.5.5 OpenAI/Silero plugins:
- Run
npm ci.
- Run
npm ls --all and observe invalid @opentelemetry/core@2.8.0 peer relationships beneath the OTLP exporters, pino instrumentation, and otlp-exporter-base.
- Add global overrides for
@opentelemetry/core and @opentelemetry/propagator-jaeger to their patched 2.x releases.
- Import/start the agent. The runtime fails in
@opentelemetry/sdk-trace-base while reading the sampler (AlwaysOn), because the graph now crosses incompatible API generations.
Requested resolution
Please publish the Agents package with one coherent OpenTelemetry compatibility family, or expose telemetry dependencies in a way that allows the patched propagator/core versions to be selected together. A release note identifying the compatible package set would also help downstream canary testing.
No external Jaeger or baggage propagation is enabled in our deployment; we are temporarily pinning LiveKit 1.5.5 and enforcing OTEL_PROPAGATORS=tracecontext while waiting for an upstream-compatible release.
Description
@livekit/agents@1.5.5currently installs OpenTelemetry packages from incompatible stable/experimental families. This makes the July 2026 OpenTelemetry security advisories difficult to remediate without breaking the agent runtime.The published manifest includes, among others:
@opentelemetry/core ^2.2.00.54.x@opentelemetry/resources,sdk-trace-base, andsdk-trace-node1.28.x@opentelemetry/otlp-exporter-base ^0.208.0OpenTelemetry's compatibility matrix pairs stable
1.27.xwith experimental0.54.x, and stable2.0.xwith experimental0.200.x. A clean npm install therefore reports invalid peer relationships around@opentelemetry/core.Security impact
The dependency graph is reported through:
@opentelemetry/propagator-jaeger <2.9.0)@opentelemetry/core <2.8.0)The Jaeger issue is opt-in and can be mitigated by using only W3C Trace Context. However, forcing patched OpenTelemetry packages through npm overrides is not safe.
Reproduction
With
@livekit/agents@1.5.5and the corresponding 1.5.5 OpenAI/Silero plugins:npm ci.npm ls --alland observe invalid@opentelemetry/core@2.8.0peer relationships beneath the OTLP exporters, pino instrumentation, andotlp-exporter-base.@opentelemetry/coreand@opentelemetry/propagator-jaegerto their patched 2.x releases.@opentelemetry/sdk-trace-basewhile reading the sampler (AlwaysOn), because the graph now crosses incompatible API generations.Requested resolution
Please publish the Agents package with one coherent OpenTelemetry compatibility family, or expose telemetry dependencies in a way that allows the patched propagator/core versions to be selected together. A release note identifying the compatible package set would also help downstream canary testing.
No external Jaeger or baggage propagation is enabled in our deployment; we are temporarily pinning LiveKit 1.5.5 and enforcing
OTEL_PROPAGATORS=tracecontextwhile waiting for an upstream-compatible release.