fix(opentelemetry-bridge): update to OTel SDK 2.x, fix `opentelemetryBridgeEnabled` to cover metrics integration by gsoldevila · Pull Request #5126 · elastic/apm-agent-nodejs

gsoldevila · 2026-06-29T16:00:10Z

Summary

Upgrades @opentelemetry/core and @opentelemetry/sdk-metrics from 1.x to 2.8.0, and migrates the agent's OTel Metrics integration to the 2.x SDK API.

This picks up the upstream fix for CVE-2026-54285 (unbounded baggage header processing) in @opentelemetry/core, which is currently pulled in transitively at 1.30.1 by elastic-apm-node (via @opentelemetry/sdk-metrics@^1.12.0).

This supersedes the dependabot-only bumps (#5097, #5095, #5113) which fail CI because they bump the dependency without migrating the calling code to the 2.x API.

Update(@trentm): This also extends the opentelemetryBridgeEnabled config setting to also cover OTel Metrics integration, only allows the setting to be true for new-enough Node.js versions, ensures @opentelemetry/ deps are only require'd if the setting is enabled.
See 50577ce
Closes: #4956

What changed

OTel Metrics SDK 2.x has two breaking changes that the agent relied on:

Aggregation classes removed. ExplicitBucketHistogramAggregation, SumAggregation, LastValueAggregation, and DropAggregation are replaced by AggregationOption config objects keyed by AggregationType.
MeterProvider.addMetricReader() removed. Metric readers must now be passed via the constructor readers option.

Files updated:

lib/opentelemetry-metrics/ElasticApmMetricExporter.js — aggregation config objects + AggregationType import; selectAggregation now returns an AggregationOption.
lib/opentelemetry-metrics/index.js — MeterProvider reader passed via constructor.
lib/instrumentation/modules/@opentelemetry/sdk-metrics.js — ApmMeterProvider appends the agent's reader to user-supplied readers and passes them to super(); supported-version guard moved to >=2.0.0 <3.
test/opentelemetry-metrics/fixtures/* and examples/opentelemetry-metrics/use-otel-metrics-sdk.js — migrated to the 2.x API (plain view-option objects, readers).
package.json + lockfiles (root and fixtures) bumped to core/sdk-metrics 2.8.0.

Test plan

node test/opentelemetry-metrics/fixtures.test.js — 85/85 pass locally (this is the suite that fails on the dependabot-only PRs).
eslint clean on all changed files.
lint:tav and test:deps pass.
Full CI (test-vers matrix across Node versions) — needs maintainer run.
Confirm minimum-supported @opentelemetry/sdk-metrics bump to 2.0.0 is acceptable (drops auto-instrumentation of user MeterProviders on 1.x SDKs).

Note: opened from a fork; raised while remediating the CVE downstream in Kibana, where elastic-apm-node is the remaining consumer pinning @opentelemetry/core < 2.8.0.

Made with Cursor

github-actions · 2026-06-29T16:00:20Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

…cs to 2.x Bumps `@opentelemetry/core` and `@opentelemetry/sdk-metrics` from 1.x to 2.8.0. This picks up the upstream fix for CVE-2026-54285 (unbounded `baggage` header processing) in `@opentelemetry/core`. The OTel Metrics SDK 2.x has breaking API changes that required updating the agent's metrics integration: - The aggregation classes (`ExplicitBucketHistogramAggregation`, `SumAggregation`, `LastValueAggregation`, `DropAggregation`) were removed in favour of `AggregationOption` config objects keyed by `AggregationType`. - `MeterProvider.addMetricReader()` was removed; metric readers must now be passed via the constructor `readers` option. Updated `lib/opentelemetry-metrics`, the `@opentelemetry/sdk-metrics` instrumentation, the OTel metrics test fixtures, and the example to the 2.x API. The minimum supported `@opentelemetry/sdk-metrics` version for instrumentation is now 2.0.0. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-06-29T16:02:30Z

🔍 Preview links for changed docs

github-actions · 2026-06-29T16:02:37Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

…entelemetryBridgeEnabled - Extend the `opentelemetryBridgeEnabled` config setting to *also* cover the integration with `@opentelemetry/sdk-metrics`. This was an oversight with OTel Metrics support was added after the initial support for OTel Tracing. This handles elastic#4956 - Ensure that `@opentelemetry/*` libs are **only require'd if `opentelemetryBridgeEnabled` is true** and if the current running Node.js version is in the supported range for the included Node.js SDK. If a user explicitly tries to enable the OTel Bridge, but is using too old of a Node.js version (e.g. 14 or 16), then the APM agent will log a warning and set `opentelemetryBridgeEnabled = false`. These changes allow the OpenTelemetry integration support to update the internally included `@opentelemetry/*` libs without hard breaking usage of the APM agent with older Node.js versions. It *does* mean that the OpenTelemetry Bridge no longer works with Node.js 14 and 18 (requires "^18.19.0 || >=20.6.0"). This is breaking for those users, but the Bridge is experimental, so that is allowed in minor releases. Closes: elastic#4956

…tests; refactor to avoid circular import and interaction with hooking of sdk-metrics package

…parate PR, but I'm piggy-backing

…=true is used for metrics integration

trentm

LGTM.

trentm · 2026-07-09T15:25:47Z

@gsoldevila elastic-apm-node@4.18.0 is out with the upgrade to OTel SDK 2.x libs (#5137).

## Summary - Bumps `elastic-apm-node` from `4.15.0` to `4.18.0` - `4.17.0` fixes IPv6 URL parsing errors (`Could not set destination context: Invalid URL`) reported in [sdh-apm#2043](elastic/sdh-apm#2043) - `4.18.0` also updates OpenTelemetry 2.x dependencies ([apm-agent-nodejs#5126](elastic/apm-agent-nodejs#5126)) Renovate has not opened this bump yet due to the 14-day `minimumReleaseAge` on the APM dependency group. ## Test plan - [ ] CI green - [ ] Verify Kibana starts with default APM config Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

gsoldevila force-pushed the chore/opentelemetry-2x branch from 11d7ffe to 98cf439 Compare June 29, 2026 16:00

gsoldevila marked this pull request as ready for review June 29, 2026 16:09

gsoldevila requested a review from a team as a code owner June 29, 2026 16:09

trentm added 5 commits July 6, 2026 14:13

Merge branch 'main' into chore/opentelemetry-2x

daab228

update changelog entry

8e9790e

lint:fix

c92e8ec

ensure ELASTIC_APM_OPENTELEMETRY_BRIDGE_ENABLED set for otel metrics …

35f3d3e

…tests; refactor to avoid circular import and interaction with hooking of sdk-metrics package

trentm self-assigned this Jul 6, 2026

trentm added 4 commits July 6, 2026 15:25

fix-up (httpstat.us is not responding) and modernize the bridge example

d3713c3

avoid a spurious sometimes-race in this test case

f3d2f70

update the otel metrics examples

daa636f

add a brief note about the OTel-native SDK option; this could be a se…

6e27e89

…parate PR, but I'm piggy-backing

trentm changed the title ~~chore(deps): upgrade @opentelemetry/core and @opentelemetry/sdk-metrics to 2.x~~ fix(opentelemetry-bridge): update to OTel SDK 2.x, fix opentelemetryBridgeEnabled to cover metrics integration Jul 6, 2026

update bridge docs to ensure ELASTIC_APM_OPENTELEMETRY_BRIDGE_ENABLED…

fa9c45d

…=true is used for metrics integration

trentm previously approved these changes Jul 6, 2026

View reviewed changes

david-luna reviewed Jul 7, 2026

View reviewed changes

Comment thread test/opentelemetry-bridge/fixtures.test.js Outdated

remove debugging tweak in tests

6931c61

trentm dismissed their stale review via 6931c61 July 7, 2026 15:11

david-luna approved these changes Jul 7, 2026

View reviewed changes

trentm merged commit 45c2bcd into elastic:main Jul 7, 2026
33 of 35 checks passed

This was referenced Jul 7, 2026

chore(deps): bump @opentelemetry deps to v2.x #4933

Closed

release 4.18.0 #5137

Merged

trentm mentioned this pull request Jul 9, 2026

Update @opentelemetry/core dependency to v2 #4926

Closed

gsoldevila mentioned this pull request Jul 10, 2026

chore: bump elastic-apm-node to 4.18.0 elastic/kibana#277387

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(opentelemetry-bridge): update to OTel SDK 2.x, fix `opentelemetryBridgeEnabled` to cover metrics integration#5126

fix(opentelemetry-bridge): update to OTel SDK 2.x, fix `opentelemetryBridgeEnabled` to cover metrics integration#5126
trentm merged 12 commits into
elastic:mainfrom
gsoldevila:chore/opentelemetry-2x

gsoldevila commented Jun 29, 2026 •

edited by trentm

Loading

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

trentm left a comment

Uh oh!

Uh oh!

Uh oh!

trentm commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

gsoldevila commented Jun 29, 2026 • edited by trentm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Test plan

Uh oh!

github-actions Bot commented Jun 29, 2026

🤖 GitHub comments

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Jun 29, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

trentm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

trentm commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gsoldevila commented Jun 29, 2026 •

edited by trentm

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading