Skip to content

fix(runtime-sdk): fix top-level import for opentelemetry package - #248

Merged
ryanking13 merged 4 commits into
mainfrom
gyeongjae/opentelemetry
Sep 17, 2026
Merged

ryanking13 merged 4 commits into
mainfrom
gyeongjae/opentelemetry

Conversation

@ryanking13

Copy link
Copy Markdown
Contributor

opentelementry is used inside the official mcp and fastMCP package, and has os.urandom() calls during the initialization

@ryanking13 ryanking13 changed the title fix(runtime-sdk): add entropy patch for opentelemetry fix(runtime-sdk): fix top-level import for opentelemetry package Sep 8, 2026
Comment thread packages/runtime-sdk/src/_workers_sdk_entropy_import_context.py
@ask-bonk

ask-bonk Bot commented Sep 8, 2026

Copy link
Copy Markdown

I'm Bonk, and I've done a quick review of your PR.

PR #248 adds an entropy allowance for OpenTelemetry context imports.

  1. High: opentelemetry.trace still triggers an unallowed UUID entropy call via opentelemetry.trace.propagation, the path used by MCP and FastMCP. Posted 2 inline suggestions.

github run

@ryanking13

Copy link
Copy Markdown
Contributor Author

@ask-bonk try again

Comment thread packages/runtime-sdk/src/_workers_sdk_entropy_import_context.py Outdated
Comment thread packages/runtime-sdk/tests/workerd-test/entropy-patches/pyproject.toml Outdated
@ask-bonk

ask-bonk Bot commented Sep 8, 2026

Copy link
Copy Markdown

Posted 3 new inline findings.

github run

@dom96 dom96 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bonk comments look important. Accepting to unblock.

Comment thread packages/runtime-sdk/src/_workers_sdk_entropy_import_context.py Outdated
@ryanking13
ryanking13 merged commit 338c12e into main Sep 17, 2026
29 of 30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants