Repository navigation
Upgrade to opentelemetry_sdk 0.32.1 to address vulnerability #3598
Description
#3595 required updating spin-timer's Cargo.lock file, which bumped opentelemetry_sdk's version, which caused the "Review new dependencies for known vulnerabilities" CI check to fail due to GHSA-w9wp-h8wv-79jx.
That's technically a false positive since both the old and new versions of that dep are vulnerable, and the version bump was done in the top level Cargo.toml a month ago. In any case it needs to be addressed, but since it's unrelated to the PR, I'm going to disable the check temporarily with a comment to re-enable it once this issue has been addressed.
FWIW, I took a stab at addressing it myself, but it turned into a rabbit hole, so I had to punt.
Activity
temporarily disable `dependency-review` job
temporarily disable `dependency-review` job
temporarily disable `dependency-review` job
temporarily disable `dependency-review` job
Update to Wasmtime 46 and WASI 0.3.0, retaining support for 0.3.0-rc-…
itowlson commentedon Jul 8, 2026
I started looking at this. It's not in a PR-able state and I dunno if I'll be able to get it to a PR-able state, but just so folks know rather than duplicating effort. I'm hoping Caleb will be able to offer insight and direction.
ChihweiLHBird commentedon Jul 9, 2026
I took a look into this, and I think it's a bigger issue than I thought. Even if the upstream OTel Rust SDK will implement the
MetricProducerin the future, it will still be very complex to support thewasi-otelwith the OTel SDK.