From e44e2c8adde00830d5e7011ad9033b8060a936c1 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Fri, 24 Apr 2026 19:51:36 +0000
Subject: [PATCH] fix(deps): bump OpenTelemetry to 1.15.3 to resolve CVE
 advisories

Three moderate-severity GHSA advisories (GHSA-g94r-2vxg-569j, GHSA-mr8r-92fq-pj8p,
GHSA-q834-8qmm-v933) were blocking CI on all restore-dependent jobs. Bumping to
1.15.3 and enabling transitive pinning resolves the 1.9.0 pull from Akka.Hosting.
---
 Directory.Packages.props | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 8cfb3d768..ef82ff5c9 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,11 +1,12 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <!-- Nuget package versions -->
     <AkkaHostingVersion>1.5.65</AkkaHostingVersion>
     <AkkaPersistenceSqlHostingVersion>1.5.62</AkkaPersistenceSqlHostingVersion>
     <AkkaRemindersVersion>0.6.0-beta2</AkkaRemindersVersion>
-    <OpenTelemetryVersion>1.13.1</OpenTelemetryVersion>
+    <OpenTelemetryVersion>1.15.3</OpenTelemetryVersion>
     <SlackNetVersion>0.17.10</SlackNetVersion>
     <MicrosoftExtensionsAIVersion>10.4.1</MicrosoftExtensionsAIVersion>
     <MicrosoftAspNetCoreVersion>10.0.7</MicrosoftAspNetCoreVersion>
@@ -41,6 +42,7 @@
     <PackageVersion Include="JsonSchema.Net" Version="7.4.0" />
     <PackageVersion Include="NSec.Cryptography" Version="24.4.0" />
     <PackageVersion Include="OpenTelemetry" Version="$(OpenTelemetryVersion)" />
+    <PackageVersion Include="OpenTelemetry.Api" Version="$(OpenTelemetryVersion)" />
     <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="$(OpenTelemetryVersion)" />
     <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="$(OpenTelemetryVersion)" />
     <PackageVersion Include="OllamaSharp" Version="5.4.25" />