Description
Dependabot alert 9 (moderate): @opentelemetry/core below 2.8.0 allocates unbounded memory in W3C Baggage propagation. apps/agents pins 2.11.0 directly, but @grafana/agento11y 0.13.0 pulls 2.6.x and 2.7.0 transitively (its bundled OTLP exporters and @google/adk). Either a newer @grafana/agento11y that lifts them or an npm override forcing @opentelemetry/core 2.11.0 would clear it; an override needs the SDK’s exporters to still work, so the agents’ telemetry must be checked after.
Acceptance Criteria
- #1 npm ls @opentelemetry/core in apps/agents shows no version below 2.8.0
- #2 Dependabot alert 9 is closed as fixed
- #3 The agents still export traces and generations to Agent Observability after the change
Definition of Done
- #1 just check