chore(deps): security bump @opentelemetry/core (Dependabot) (SK-1438)

[saif-at-scalekit]

Summary

• Resolves open Dependabot alert #135 (GHSA-8988-4f7v-96qf / CVE-2026-54285) on transitive @opentelemetry/core (< 2.8.0).
• Adds a pnpm override @opentelemetry/core: ^2.8.0 (lockfile resolves to 2.10.0).
• Source of the transitive dep: @netlify/otel via netlify-cli (dev tooling). Security-only; no other dependency ranges changed.

Security

Package	Before	After	Advisory
@opentelemetry/core	2.7.1	2.10.0	Unbounded memory allocation in W3C Baggage propagation

Test plan

• pnpm install succeeds with override
• Lockfile contains only @opentelemetry/core@2.10.0 (no <2.8.0)
• CI green on this PR
• Dependabot alert Passwordless: OIDC flow results user profile without having to create users in Scalekit #135 auto-closes after merge

Summary by CodeRabbit

• Chores
  • Updated the internal OpenTelemetry core package version constraint for improved dependency consistency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 270a8567-2976-48e6-bdd8-0b1627be5d9d

📥 Commits

Reviewing files that changed from the base of the PR and between 3c7c063 and 2037720.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: Redirect rules - scalekit-starlight
• GitHub Check: Header rules - scalekit-starlight
• GitHub Check: Pages changed - scalekit-starlight

🧰 Additional context used

📓 Path-based instructions (2)

**/*.{js,ts,tsx,jsx,py,java,cs,go,cpp,c,rb,php,swift,kt,scala,rs,m,mm,groovy,gradle,xml,json}

📄 CodeRabbit inference engine (.cursor/rules/comment-standards.mdc)

Comments should not duplicate the code - avoid comments that simply restate what the code does; comments should add value beyond what's obvious from reading the code

Files:

• package.json

**/*

📄 CodeRabbit inference engine (AGENTS.md)

Use pnpm for package management, and ensure changes pass Prettier formatting, the build, Git hook validations, and content-structure validation.

Files:

• package.json

🔇 Additional comments (1)

package.json (1)

105-106: 🗄️ Data Integrity & Integration

Complete dependency and CI validation before merge.

Confirm that pnpm-lock.yaml resolves @opentelemetry/core only to 2.10.0 and contains no 2.7.1 entry. Complete the required Prettier, build, Git hook, and content-structure checks.

As per coding guidelines, use pnpm and ensure all required validations pass.

Source: Coding guidelines

---

Walkthrough

The package configuration adds a pnpm override for @opentelemetry/core at ^2.8.0. The existing mdast-util-to-hast override remains unchanged.

Changes

Dependency override

Layer / File(s)	Summary
pnpm override configuration package.json	The pnpm overrides now force @opentelemetry/core to ^2.8.0 and retain the existing mdast-util-to-hast override.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: akshayparihar33, ravibits

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the security dependency bump for @opentelemetry/core, which matches the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-bumps

• 🛠️ fix frontmatter
• 🛠️ fix internal links

---

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for scalekit-starlight ready!

Name	Link
🔨 Latest commit	2037720
🔍 Latest deploy log	https://app.netlify.com/projects/scalekit-starlight/deploys/6a6d793af6293800086cb07d
😎 Deploy Preview	https://deploy-preview-925--scalekit-starlight.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 67 (🟢 up 12 from production) Accessibility: 100 (no change from production) Best Practices: 92 (no change from production) SEO: 92 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[saif-at-scalekit]

We don't use opentelemetry AFAIK. Why is this dependency added?