Skip to content

chore(deps): bump @opentelemetry/instrumentation-mongoose to >=0.67.0 - #21403

Open
mozilla-blender[bot] wants to merge 1 commit into
mainfrom
blender/security-bump-@opentelemetry/instrumentation-mongoose
Open

chore(deps): bump @opentelemetry/instrumentation-mongoose to >=0.67.0#21403
mozilla-blender[bot] wants to merge 1 commit into
mainfrom
blender/security-bump-@opentelemetry/instrumentation-mongoose

Conversation

@mozilla-blender

@mozilla-blender mozilla-blender Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Resolves a flagged transitive dependency advisory.

This is a transitive dependency update. Only yarn.lock (and possibly package.json) changed.

Created by BLEnder investigation via BLEnder

@mozilla-blender

mozilla-blender Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor Author

BLEnder could not fix this PR automatically. Workflow run

@toufali
toufali force-pushed the blender/security-bump-@opentelemetry/instrumentation-mongoose branch from c519c01 to 9b321ea Compare October 7, 2026 20:15
@vbudhram
vbudhram force-pushed the blender/security-bump-@opentelemetry/instrumentation-mongoose branch 3 times, most recently from 64b8a0e to 863fffb Compare October 13, 2026 20:27
@mozilla-blender

mozilla-blender Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

Vulnerable instrumentation-mongoose@0.55.0 is pulled in only by @sentry/node@10.33.0; the otel copy is already 0.68.0. mongoose isn't installed or imported anywhere in the repo, so no mongoose spans or db.user attributes are ever emitted.

This PR can be reviewed and merged as a normal dependency update.

@vbudhram
vbudhram force-pushed the blender/security-bump-@opentelemetry/instrumentation-mongoose branch from 863fffb to bf515cd Compare October 28, 2026 01:28
@coderabbitai

coderabbitai Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1
  • coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: mozilla/fxa
  • Branch: main
  • File: .coderabbit.yaml
  • Commit: 769fb07
  • Layers: Repository YAML
  • Review profile: CHILL
  • Plan: Enterprise
  • Run ID: da7a02a0-aa6a-4f13-ba26-73e229f0e42e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@mozilla-blender @vbudhram
chore(deps): bump @opentelemetry/instrumentation-mongoose to >=0.67.0
340d95f 
Resolves Dependabot alert #997. The bump installs the highest
version satisfying the dependency range; the title uses >=<min> when the
advisory provides a minimum patched version — see the lockfile diff for the exact resolved version.
Created by BLEnder (https://github.com/mozilla/blender)
@vbudhram
vbudhram force-pushed the blender/security-bump-@opentelemetry/instrumentation-mongoose branch from bf515cd to 340d95f Compare November 3, 2026 21:51

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants