chore(deps): bump @opentelemetry/core to 2.8.0 for CVE-2026-54285

[waleedlatif1]

Summary

• Fixes Dependabot alert #205 (GHSA-8988-4f7v-96qf / CVE-2026-54285) — W3CBaggagePropagator.extract() enforced no size limits on inbound baggage headers
• Bumps @opentelemetry/core, resources, sdk-metrics, sdk-trace-base, sdk-trace-node 2.7.1 → 2.8.0
• Bumps exporter-{logs,metrics,trace}-otlp-http and sdk-node 0.217.0 → 0.219.0 — those pin core exactly, so bumping only the direct core dep would leave a vulnerable 2.7.1 nested under them
• 0.219.0 is the release train that pins core 2.8.0; its breaking changes are confined to sdk-logs, api-logs, and declarative configuration, none of which we import

Notes

• @trigger.dev/core@4.5.7 and posthog-js still nest their own pinned core (2.7.1 / 2.2.0). Those are upstream pins, not reachable from our manifest, and forcing them via an override would fight trigger.dev's exact-version pinning — left alone.

Type of Change

• Bug fix (security)

Testing

• Verified the fix is live in the installed package: an 82KB / 400-entry baggage header now truncates to 40 entries on 2.8.0, vs. all 400 kept on 2.7.1
• tsc -p apps/sim --noEmit clean
• OTel-touching tests pass (lib/copilot/request/lifecycle/start.test.ts, headless.test.ts, go/fetch.test.ts — 14 tests)
• bun run lint clean

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Building	Preview	Aug 2, 2026 2:15am

[cursor]

PR Summary

Low Risk
Dependency-only security patch with no app code changes; risk is limited to OTel runtime behavior after the minor version bump, which the PR author validated with typecheck and OTel-related tests.

Overview
Bumps OpenTelemetry dependencies in apps/sim to address CVE-2026-54285 (unbounded inbound baggage header parsing in W3CBaggagePropagator).

@opentelemetry/core, resources, sdk-metrics, sdk-trace-base, and sdk-trace-node move from 2.7.1 → 2.8.0. exporter-logs-otlp-http, exporter-metrics-otlp-http, exporter-trace-otlp-http, and sdk-node move from 0.217.0 → 0.219.0 so nested pins align with core 2.8.0 (bumping only the direct core dep would still leave vulnerable 2.7.1 under the OTLP exporters).

bun.lock is updated accordingly; some duplicate override entries for @daytona/sdk and nested OTel packages are removed as versions converge.

No application source changes—only package.json and the lockfile.

^{Reviewed by Cursor Bugbot for commit bab3117. Configure here.}

[greptile-apps]

Greptile Summary

The PR upgrades the application’s OpenTelemetry dependencies to the patched 2.8.0/0.219.0 release train for CVE-2026-54285.

• Updates all directly declared OpenTelemetry core, resource, tracing, metrics, SDK, and HTTP exporter packages together.
• Regenerates the Bun lockfile, deduplicating compatible dependencies while retaining isolated versions required by transitive packages.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete build, runtime, lockfile, or remaining reachable security defect identified.

The application-level OpenTelemetry graph consistently resolves to the patched release train, while older nested copies are isolated behind transitive packages and are not reached by the repository’s inbound propagation paths.

Important Files Changed

Filename	Overview
apps/sim/package.json	Updates the directly declared OpenTelemetry packages as a consistent release train with no identified incompatible application usage.
bun.lock	Resolves direct OpenTelemetry dependencies to the intended patched versions and correctly isolates exact versions required by transitive packages.

_{Reviews (1): Last reviewed commit: "chore(deps): bump @opentelemetry/core to..." | Re-trigger Greptile}