Description
Dependabot alert 9 (moderate): @opentelemetry/core below 2.8.0 allocates unbounded memory in W3C Baggage propagation. apps/agents pins 2.11.0 directly, but @grafana/agento11y 0.13.0 pulls 2.6.x and 2.7.0 transitively (its bundled OTLP exporters and @google/adk). Either a newer @grafana/agento11y that lifts them or an npm override forcing @opentelemetry/core 2.11.0 would clear it; an override needs the SDK’s exporters to still work, so the agents’ telemetry must be checked after.
Acceptance Criteria
- #1 npm ls @opentelemetry/core in apps/agents shows no version below 2.8.0
- #2 Dependabot alert 9 is closed as fixed
- #3 The agents still export traces and generations to Agent Observability after the change
Definition of Done
- #1 just check
Implementation Plan
- Add npm override forcing @opentelemetry/core 2.11.0 in apps/agents; 2. npm install, confirm npm ls shows no version below 2.8.0; 3. just check and node –test; 4. exercise the telemetry init locally
Implementation Notes
Shipped 3e6ad14: npm override @opentelemetry/core 2.11.0 in apps/agents; npm ls shows 35 copies, all 2.11.0. Dependabot alert 9 state fixed 2026-10-02T09:22Z. just check exit 0, 117 agents tests pass. Telemetry exercised locally: orchestrator against a local OTLP sink exports /v1/traces, identical to the pre-change baseline (metrics did not reach the sink in either run). AC3 stays open: generations to Agent Observability not checked, needs the lab stack.
2026-10-02: Rob chose to leave the lab down; the remaining live AC is proved on the next demo deploy, not by a standalone redeploy.
2026-10-02: v0.4.1 released and deployed to the lab by a full apply (156 added); touchline pods Running. Live ACs can now be sampled: dev sessions after the agent host’s ~30-minute sign-in, the Experiments AC within 24h.
AC3 live-verified 2026-10-02 on v0.4.1 (override included): within 10 minutes of deploy, 17 in-app touchline conversations carried generations in Agent Observability, and Tempo held traces rooted in orchestrator, odds, news, compliance, editorial, site-api and loadgen.
Final Summary
Forced @opentelemetry/core 2.11.0 with an npm override in apps/agents (3e6ad14), closing Dependabot alert 9. Verified by npm ls, just check, and live on v0.4.1: the agents still export traces and generations.