The fix in #1014 (merged June 17) bumped OpenTelemetry experimental packages from ^0.203.0 to ^0.219.0, but no npm release has been published since v0.27.0 (May 29). Consumers installing @traceloop/node-server-sdk@0.27.0 from npm still get the old ^0.203.0 ranges.
Additionally, the bump to ^0.219.0 is insufficient to fully resolve the vulnerability. The @opentelemetry/core vulnerability (GHSA-8988-4f7v-96qf: unbounded memory allocation in W3C Baggage propagation) requires @opentelemetry/core >= 2.8.0, which only ships with the 0.220.0 experimental release. Since ^0.219.0 caps at 0.219.x for 0.x packages, it will not pull in the patched core
The fix in #1014 (merged June 17) bumped OpenTelemetry experimental packages from
^0.203.0to^0.219.0, but no npm release has been published sincev0.27.0(May 29). Consumers installing@traceloop/node-server-sdk@0.27.0from npm still get the old^0.203.0ranges.Additionally, the bump to
^0.219.0is insufficient to fully resolve the vulnerability. The@opentelemetry/core vulnerability(GHSA-8988-4f7v-96qf: unbounded memory allocation in W3C Baggage propagation) requires@opentelemetry/core >= 2.8.0, which only ships with the0.220.0experimental release. Since^0.219.0caps at0.219.xfor0.xpackages, it will not pull in the patched core