fix(openai-agents): bump @opentelemetry/core to ^2.8.0 to resolve W3C Baggage DoS advisory

[mikeldking]

Summary

Resolves the open Dependabot security alert affecting
js/packages/openinference-instrumentation-openai-agents/package.json.

• Dependabot alert 707
  — @opentelemetry/core Unbounded memory allocation in W3C Baggage
  propagation (GHSA-8988-4f7v-96qf / CVE-2026-54285). Vulnerable range
  < 2.8.0, first patched 2.8.0.

Changes

• js/packages/openinference-instrumentation-openai-agents/package.json: bumped
  the direct runtime dependency @opentelemetry/core from ^1.25.1 to ^2.8.0.
• js/pnpm-lock.yaml: regenerated with pnpm install --lockfile-only for the
  target package. @opentelemetry/core@2.8.0 already existed in the lockfile
  (used by sibling packages such as anthropic and langchain-v0), so only the
  target importer's specifier/resolution changed — no broad churn.

This mirrors the fix already applied for langchain-v0 in commit d5a24f2, which
keeps @opentelemetry/core at ^2.8.0 alongside @opentelemetry/api@^1.9.0 and
the other 1.x OpenTelemetry packages. @opentelemetry/core@2.8.0 is compatible
with @opentelemetry/api@1.9.0.

Validation

Run from js/:

• pnpm install --frozen-lockfile -r — lockfile consistent with the manifest.
• pnpm run -r build — all workspace packages build, including the target.
• pnpm --filter @arizeai/openinference-instrumentation-openai-agents run type:check — passes.
• pnpm --filter @arizeai/openinference-instrumentation-openai-agents run test -- --reporter=default — 53/53 tests pass. (The trailing EROFS message is only the GitHub Actions Vitest reporter trying to write a job summary from the sandbox; it does not affect the test result.)

Follow-up

None. The single alert for this manifest is fully resolved.

[pkg-pr-new]

Open in StackBlitz

@arizeai/openinference-core

npm i https://pkg.pr.new/@arizeai/openinference-core@3377

@arizeai/openinference-genai

npm i https://pkg.pr.new/@arizeai/openinference-genai@3377

@arizeai/openinference-instrumentation-anthropic

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-anthropic@3377

@arizeai/openinference-instrumentation-bedrock

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-bedrock@3377

@arizeai/openinference-instrumentation-bedrock-agent-runtime

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-bedrock-agent-runtime@3377

@arizeai/openinference-instrumentation-beeai

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-beeai@3377

@arizeai/openinference-instrumentation-claude-agent-sdk

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-claude-agent-sdk@3377

@arizeai/openinference-instrumentation-langchain

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-langchain@3377

@arizeai/openinference-instrumentation-langchain-v0

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-langchain-v0@3377

@arizeai/openinference-instrumentation-mcp

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-mcp@3377

@arizeai/openinference-instrumentation-openai

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-openai@3377

@arizeai/openinference-instrumentation-openai-agents

npm i https://pkg.pr.new/@arizeai/openinference-instrumentation-openai-agents@3377

@arizeai/openinference-semantic-conventions

npm i https://pkg.pr.new/@arizeai/openinference-semantic-conventions@3377

@arizeai/openinference-tanstack-ai

npm i https://pkg.pr.new/@arizeai/openinference-tanstack-ai@3377

@arizeai/openinference-vercel

npm i https://pkg.pr.new/@arizeai/openinference-vercel@3377

commit: 65be6c2

[github-actions]

Missing changeset file

This PR modifies js/packages/openinference-instrumentation-openai-agents/package.json but does not include a .changeset/*.md file. Per js/CLAUDE.md:

pnpm changeset  # before merging PRs

Without a changeset, the automated release tooling cannot determine the version bump or generate a changelog entry for this security fix. Please run pnpm changeset locally, select openinference-instrumentation-openai-agents as a patch bump, add a brief description (e.g. "bump @opentelemetry/core to ^2.8.0 to resolve CVE-2026-54285"), and commit the generated .changeset/*.md file.