Skip to content

Update OpenTelemetry and Azure Monitor packages to address vulnerabilities #3174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rajkumar-rangaraj merged 2 commits into from
May 1, 2026
+27 −12
Merged

Update OpenTelemetry and Azure Monitor packages to address vulnerabilities #3174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f63fdcd
Update OpenTelemetry and Azure Monitor packages to address vulnerabil…
rajkumar-rangaraj May 1, 2026
71da695
Address Copilot review feedback: update section comment and add PR link
rajkumar-rangaraj May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions BASE/src/Microsoft.ApplicationInsights/Properties/AssemblyInfo.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@
[assembly: InternalsVisibleTo("Microsoft.ApplicationInsights.AspNetCore, PublicKey=" + AssemblyInfo.PublicKey)]
[assembly: InternalsVisibleTo("Microsoft.ApplicationInsights.WorkerService, PublicKey=" + AssemblyInfo.PublicKey)]

// Required so Moq/Castle.DynamicProxy can subclass internal types (e.g. MemoryMappedFileHandler) for unit testing.
[assembly: InternalsVisibleTo("DynamicProxyGenAssembly2, PublicKey=" + AssemblyInfo.MoqPublicKey)]

internal static class AssemblyInfo
{
#if PUBLIC_RELEASE
Expand Down
12 changes: 12 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,17 @@
# Changelog

## Unreleased
- [Update OpenTelemetry and Azure Monitor dependencies to address known security advisories (e.g. [GHSA-g94r-2vxg-569j](https://github.com/advisories/GHSA-g94r-2vxg-569j) in `OpenTelemetry.Api` 1.15.1).](https://github.com/microsoft/ApplicationInsights-dotnet/pull/3174)
- OpenTelemetry 1.15.3
- OpenTelemetry.Exporter.Console 1.15.3
- OpenTelemetry.Exporter.InMemory 1.15.3
- OpenTelemetry.Extensions.Hosting 1.15.3
- OpenTelemetry.Instrumentation.AspNetCore 1.15.2
- OpenTelemetry.Instrumentation.AspNet 1.15.2
- OpenTelemetry.Instrumentation.Http 1.15.1
- OpenTelemetry.Instrumentation.SqlClient 1.15.2
- Azure.Monitor.OpenTelemetry.Exporter 1.8.0

## Version 3.1.0
- [Make `TelemetryContext` properties public and propagate them via `TelemetryClient`.](https://github.com/microsoft/ApplicationInsights-dotnet/pull/3137)
- [Add fallback to `APPLICATIONINSIGHTS_CONNECTION_STRING` environment variable for Base, Web, and NLog packages when connection string is not set via code.](https://github.com/microsoft/ApplicationInsights-dotnet/pull/3134)
Expand Down
24 changes: 12 additions & 12 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,22 +15,22 @@
<!--
==============================================================================
OPENTELEMETRY PACKAGES
Core packages using stable version 1.15.1 with some RC/Beta components
Core packages using stable version 1.15.3 with some RC/Beta components
==============================================================================
-->

<ItemGroup Label="OpenTelemetry - Core (Stable 1.15.1)">
<PackageVersion Include="OpenTelemetry" Version="1.15.1" />
<PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.1" />
<PackageVersion Include="OpenTelemetry.Exporter.InMemory" Version="1.15.1" />
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.1" />
<ItemGroup Label="OpenTelemetry - Core (Stable 1.15.3)">
<PackageVersion Include="OpenTelemetry" Version="1.15.3" />
Comment thread
rajkumar-rangaraj marked this conversation as resolved.
<PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.3" />
<PackageVersion Include="OpenTelemetry.Exporter.InMemory" Version="1.15.3" />
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
</ItemGroup>

<ItemGroup Label="OpenTelemetry - Instrumentation">
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNet" Version="1.15.1" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.SqlClient" Version="1.15.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNet" Version="1.15.2" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
<PackageVersion Include="OpenTelemetry.Instrumentation.SqlClient" Version="1.15.2" />
</ItemGroup>

<!--
Expand All @@ -40,13 +40,13 @@
-->

<ItemGroup Label="Azure Monitor">
<PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.7.0" />
<PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.8.0" />
</ItemGroup>

<!--
==============================================================================
MICROSOFT.EXTENSIONS PACKAGES
Most packages on 10.0.2; Microsoft.Extensions.Options on 10.0.3 (required by Azure Monitor Exporter 1.7.0)
Most packages on 10.0.2; Microsoft.Extensions.Options on 10.0.3 (required by Azure Monitor Exporter 1.8.0)
==============================================================================
-->

Expand Down
Loading