fix(pubsub): upgrade OpenTelemetry packages to resolve CVE-2026-54285 #8792

Library Name

@google-cloud/pubsub

A screenshot that you have tested with "Try this API".

N/A — This is a client-side security vulnerability in a third-party dependency, not a bug in the Google Cloud Pub/Sub API itself.

Link to the code that reproduces this issue.

https://github.com/googleapis/google-cloud-node/blob/main/handwritten/pubsub/package.json#L58

A step-by-step description of how to reproduce the issue, based on the linked reproduction.

1. Run npm list @opentelemetry/core or check the dependency tree in a project using @google-cloud/pubsub.
2. Notice it pulls in @opentelemetry/core at a version prior to 2.8.0.

A clear and concise description of what the bug is, and what you expected to happen.

The package pulls in a version of @opentelemetry/core affected by CVE-2026-54285 (details also on CVE-2026-54285 registry page).

The vulnerability is in W3CBaggagePropagator.extract(), which fails to enforce size limits on inbound baggage HTTP headers. An attacker can send oversized baggage headers to exhaust system memory and trigger a Denial of Service (DoS) attack.

We expect the library to use a non-vulnerable version of @opentelemetry/core.

A clear and concise description WHY you expect this behavior.

The vulnerability is resolved starting in @opentelemetry/core version 2.8.0.

To safely fix this without peer dependency and runtime mismatches, the full OpenTelemetry stack should be updated together:

• @opentelemetry/core to ^2.8.0 (fixed version)
• @opentelemetry/api to ^1.9.1
• @opentelemetry/semantic-conventions to ^1.41.1