npm audit reports vulnerable OpenTelemetry dependencies in Artillery 2.0.33

Description

Installing [email protected] currently produces 16 moderate-severity audit findings through [email protected].

The plugin depends on the OpenTelemetry OTLP exporters at ^0.218.0. Those exporters pin @opentelemetry/[email protected], which is affected by GHSA-8988-4f7v-96qf. The patched OpenTelemetry exporter line is 0.221.0, using Core 2.10.x.

Reproduction

mkdir artillery-audit-repro
cd artillery-audit-repro
npm init -y
npm install [email protected]
npm audit

Result:

16 moderate severity vulnerabilities
@opentelemetry/core <2.8.0
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

Dependency path:

[email protected]
└─ [email protected]
   └─ @opentelemetry/exporter-*-otlp-*@0.218.0
      └─ @opentelemetry/[email protected]

npm audit fix cannot resolve the remaining findings. npm audit fix --force proposes downgrading Artillery to 1.7.9, which is not a suitable fix.

Suggested fix

Update the six OTLP metric/trace exporter dependencies in artillery-plugin-publish-metrics from ^0.218.0 to the patched, aligned ^0.221.0 release and publish an updated Artillery release.

Environment

• Node.js 24.14.1
• npm 11.11.0
• Artillery 2.0.33
• artillery-plugin-publish-metrics 2.38.0