Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[elastic. azure, gcp] Mitigate STJ vulnerabilities #2198

Merged
merged 2 commits into from
Oct 9, 2024
Merged

[elastic. azure, gcp] Mitigate STJ vulnerabilities #2198

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6cd557d
Mitigate STJ vulnerabilities in remaining projects with direct refere…
CodeBlanch Oct 9, 2024
eba9b31
CHANGELOG patches.
CodeBlanch Oct 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/Common.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
-->
<PackageReference Include="System.Text.Encodings.Web"
Version="$(SystemTextEncodingsWebMinimumOutOfBandPkgVer)"
Condition="'$(SystemTextJsonMinimumRequiredPkgVer)' == '4.7.2' AND '$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />
Condition="($(SystemTextJsonMinimumRequiredPkgVer.StartsWith('[4.7.2')) OR '$(SystemTextJsonMinimumRequiredPkgVer)' == '4.7.2') AND '$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />
<PackageReference Include="System.Text.Json"
Version="$(SystemTextJsonMinimumRequiredPkgVer)"
Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />
Expand Down
5 changes: 5 additions & 0 deletions src/OpenTelemetry.Instrumentation.ElasticsearchClient/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,11 @@
* Updated OpenTelemetry core component version(s) to `1.9.0`.
([#1888](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/1888))

* Lowered the `System.Text.Json` reference to `4.7.2` for `net462` and
`netstandard2.0` targets in response to
[CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
([#2198](https://github.com/open-telemetry/opentelemetry-dotnet/pull/2198))

## 1.0.0-beta.5

Released 2023-Oct-24
Expand Down
4 changes: 2 additions & 2 deletions ...trumentation.ElasticsearchClient/OpenTelemetry.Instrumentation.ElasticsearchClient.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@
<Description>Elasticsearch instrumentation for OpenTelemetry .NET.</Description>
<PackageTags>$(PackageTags);distributed-tracing</PackageTags>
<MinVerTagPrefix>Instrumentation.ElasticsearchClient-</MinVerTagPrefix>
<SystemTextJsonMinimumRequiredPkgVer>$(SystemTextJsonMinimumOutOfBandPkgVer)</SystemTextJsonMinimumRequiredPkgVer>
</PropertyGroup>

<!-- Do not run Package Baseline Validation as this package has never released a stable version.
<!-- Do not run Package Baseline Validation as this package has never released a stable version.
Remove this property once we have released a stable version and add PackageValidationBaselineVersion property. -->
<PropertyGroup>
<DisablePackageBaselineValidation>true</DisablePackageBaselineValidation>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="OpenTelemetry" Version="$(OpenTelemetryCoreLatestVersion)" />
<PackageReference Include="System.Text.Json" Version="6.0.4" />
</ItemGroup>

<ItemGroup>
Expand Down
5 changes: 5 additions & 0 deletions src/OpenTelemetry.Resources.Azure/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@
* Drop support for .NET 6 as this target is no longer supported and add .NET 8 target.
([#2165](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/2165))

* Added direct reference to `System.Text.Json` for the `net8.0` target with
minimum version of `8.0.5` in response to
[CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
([#2198](https://github.com/open-telemetry/opentelemetry-dotnet/pull/2198))

## 1.0.0-beta.9

Released 2024-Sep-24
Expand Down
4 changes: 1 addition & 3 deletions src/OpenTelemetry.Resources.Azure/OpenTelemetry.Resources.Azure.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
<Description>OpenTelemetry Resource Detectors for Azure cloud environments.</Description>
<PackageTags>$(PackageTags);ResourceDetector</PackageTags>
<MinVerTagPrefix>Resources.Azure-</MinVerTagPrefix>
<SystemTextJsonMinimumRequiredPkgVer>$(SystemTextJsonMinimumOutOfBandPkgVer)</SystemTextJsonMinimumRequiredPkgVer>
</PropertyGroup>

<!-- Do not run Package Baseline Validation as this package has never released a stable version.
Expand All @@ -15,9 +16,6 @@

<ItemGroup>
<PackageReference Include="OpenTelemetry" Version="$(OpenTelemetryCoreLatestVersion)" />
<PackageReference Include="System.Text.Json" Version="4.7.2" />
<!-- System.Text.Encodings.Web is indirect reference. It is needed to upgrade it directly to avoid https://github.com/advisories/GHSA-ghhp-997w-qr28 -->
<PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
</ItemGroup>

<ItemGroup>
Expand Down
10 changes: 8 additions & 2 deletions src/OpenTelemetry.Resources.Gcp/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,13 @@
is accessible via `AddGcpDetector` extension method on `ResourceBuilder`.
([#1691](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/1691))

For more details, please refer to the [README](README.md).

* Updated OpenTelemetry core component version(s) to `1.9.0`.
([#1888](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/1888))

* Drop support for .NET 6 as this target is no longer supported and add .NET 8 target.
([#2167](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/2167))

* Added direct reference to `System.Text.Json` for the `net8.0` target with
minimum version of `8.0.5` in response to
[CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
([#2198](https://github.com/open-telemetry/opentelemetry-dotnet/pull/2198))
4 changes: 1 addition & 3 deletions src/OpenTelemetry.Resources.Gcp/OpenTelemetry.Resources.Gcp.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
<Description>OpenTelemetry Resource Detectors for Google Cloud Platform environments.</Description>
<PackageTags>$(PackageTags);ResourceDetector</PackageTags>
<MinVerTagPrefix>Resources.Gcp-</MinVerTagPrefix>
<SystemTextJsonMinimumRequiredPkgVer>$(SystemTextJsonMinimumOutOfBandPkgVer)</SystemTextJsonMinimumRequiredPkgVer>
</PropertyGroup>

<!-- Do not run Package Baseline Validation as this package has never released a stable version.
Expand All @@ -16,9 +17,6 @@
<ItemGroup>
<PackageReference Include="Google.Api.Gax" Version="4.8.0" />
<PackageReference Include="OpenTelemetry" Version="$(OpenTelemetryCoreLatestVersion)" />
<PackageReference Include="System.Text.Json" Version="4.7.2" />
<!-- System.Text.Encodings.Web is indirect reference. It is needed to upgrade it directly to avoid https://github.com/advisories/GHSA-ghhp-997w-qr28 -->
<PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
</ItemGroup>

<ItemGroup>
Expand Down
Loading