fix: CVE-2023-38704

[codecapitano]

Description

The package opentelementry/instrumentation which we use in the Web-Tracing package has the package
import-in-the-middle as a dependency.

import-in-the-middle has a vulnerability rated with a base score of 9.8 - CRITICAL. To fix it we updated the the related OTel package as well as all the other OTel packages uses by the instrumentation.

Using the Faro demo I additionally did a manual check if traces data is sent correctly 👍

Fixes

Fixes #

• CVE-2023-38704
• [security] - import-in-the-middle Support for Faro #7051

Checklist

• Tests added
• Changelog updated
• Documentation updated

[skeilson]

@codecapitano Thank you for correcting this! When can we anticipate this to be released and available?

[codecapitano]

@codecapitano Thank you for correcting this! When can we anticipate this to be released and available?

Hi @skeilson the patch update (1.2.3) is now released.

NPM: https://www.npmjs.com/package/@grafana/faro-web-tracing