fix(deps): vuln unstable: @opentelemetry/sdk-node · minor: @opentelemetry/api [apps/rolldice-game/game_controller]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 2 packages upgraded (UNSTABLE changes included)

Manifests changed:

• apps/rolldice-game/game_controller (npm)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
@opentelemetry/sdk-node	0.49.1	0.221.0	unstable	Direct	2 HIGH
@opentelemetry/api	1.8.0	1.9.1	minor	Direct	-

---

Security Details

🚨 Critical & High Severity (2 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@opentelemetry/sdk-node	GHSA-q7rr-3cgh-j5r3	HIGH	Prometheus exporter process crash via malformed HTTP request	0.49.1	0.217.0	-
@opentelemetry/sdk-node	CVE-2026-44902	HIGH	opentelemetry-js: Prometheus exporter process crash via malformed HTTP request	0.49.1	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 485a9081d8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Remove the nested vulnerable sdk-node copy

Because @opentelemetry/auto-instrumentations-node@0.43.0 still depends on @opentelemetry/sdk-node:^0.49.1 (see its dependency block in this lockfile), npm installs this nested 0.49.1 copy even after the direct dependency was bumped. This leaves the version called out by the security update in the produced dependency tree, so vulnerability scans for the two sdk-node advisories will still fail; bump the auto-instrumentations package to a compatible release or otherwise eliminate this nested copy.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Use a Node version supported by the upgraded SDK

The upgraded @opentelemetry/sdk-node now declares support only for Node ^18.19.0 || >=20.6.0, but the game_controller image built by apps/rolldice-game/docker-compose.yml still uses apps/rolldice-game/game_controller/Dockerfile with FROM node:14-alpine. In that documented Docker path, install/runtime is outside the package's supported engine and can break in engine-strict builds or when the SDK uses Node-18-only APIs; update the base image or choose an SDK line that still supports Node 14.

Useful? React with 👍 / 👎.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 30b4cbc.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}