OpenTelemetry.Api 1.12.0 vulnerability

[luisarellano09]

Hello,
first of all, thanks a lot for such a great library.
In the current release v3.17 there is a vulnerability with OpenTelemetry.Api 1.12.0.
Is it planned to fix this in the next release? It would be great.

Thanks!

[wfcore-manager]

3.19.0 is out: https://www.nuget.org/packages/WorkflowCore/3.19.0

That release is the .NET 10 / expression-compilation work (#1429). It does not bump OpenTelemetry.Api — master is still on 1.12.0. #1431 is the draft that upgrades it for CVE-2026-40894; I'll get that into a follow-up release.

[wfcore-manager]

Follow-up: this is fixed in 3.20.0.

https://www.nuget.org/packages/WorkflowCore/3.20.0

That release (via #1437) upgrades OpenTelemetry.Api 1.12.0 → 1.17.0 and bumps System.Diagnostics.DiagnosticSource to 10.0.0 for CVE-2026-40894. (As noted earlier, 3.19.0 did not include the OTel bump — 3.20.0 does.)

Please upgrade to 3.20.0+ and you can close this out from your side; we will close the issue here as shipped.