Bump MongoDB.Driver.Core.Extensions.DiagnosticSources from 1.1.0 to 1.2.0 in /src/OpenTelemetry.AutoInstrumentation.AdditionalDeps

[dependabot]

Bumps MongoDB.Driver.Core.Extensions.DiagnosticSources from 1.1.0 to 1.2.0.

Release notes

Sourced from MongoDB.Driver.Core.Extensions.DiagnosticSources's releases.

1.2.0

What's Changed

• Bump dependencies to fix security vulnerabilities by @​mishamyte in jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#15
• Downgrade MongoDB.Driver.Core version. by @​pengweiqhca in jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#17
• Adjusted OTEL tags to correspond spec by @​mishamyte in jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#18

New Contributors

• @​mishamyte made their first contribution in jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#15
• @​pengweiqhca made their first contribution in jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#17

Full Changelog: jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources@1.1.0...1.2.0

Commits

• d2e453b Merge pull request #18 from mishamyte/adjust-otel-tags
• 12fefe6 Merge pull request #17 from pengweiqhca/patch-1
• da2a17d Adjusted OTEL tags to correspond spec
• a76c444 Downgrade MongoDB.Driver.Core version.
• d82ab5e Merge pull request #15 from mishamyte/bump-dependencies
• 9a78a27 Just supressed with NoWarn
• 6cf021c Changed Driver.Core to Driver
• 4df688d Updated README
• bcd7310 Updated GitHub pipelines
• 7188cbf Bumped vulnerable transitive deps for tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pellared]

@RassK PTAL

EDIT: I saw the release has some fixes that make it worth bumping. E.g. jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#18. Right now the build is not working. I have currently no idea what I have done wrong 😞

[Kielek]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[Kielek]

MongoDB.Driver.Core.Extensions.DiagnosticSources requires MongoDB.Driver v 2.13.3.
Previously we supported 2.3.0+. It is worth to upgrade due to tag changes: - jbogard/MongoDB.Driver.Core.Extensions.DiagnosticSources#18

I have tested it locally also with 2.17.1.

[Kielek]

@rajkumar-rangaraj, after upgrade to https://www.nuget.org/packages/MongoDB.Driver.Core/2.13.3 AdditionalDeps functionality expects to have native code library available in our store.

For now, our build pipeline includes into the store only managed libs. Do you know easy way (without manual copying) to put it into the correct place? I suppose that it can be related to https://github.com/open-telemetry/opentelemetry-dotnet-instrumentation/blob/main/src/OpenTelemetry.AutoInstrumentation.AdditionalDeps/Package.xml but I do not found solution yet.

Steps to reproduce

1. Checkout this branch
2. nuke BuildTracer
3. Execute TestApplication.Smoke under net6.0 with following launchSettings.json

{
  "profiles": {
    "TestApplication.Smoke": {
      "commandName": "Project",
      "commandLineArgs": "",
      "environmentVariables": {
        "CORECLR_ENABLE_PROFILING": "1",
        "CORECLR_PROFILER": "{918728DD-259F-4A6A-AC2B-B85E1B658318}",
        "CORECLR_PROFILER_PATH": "$(SolutionDir)bin\\tracer-home\\win-x64\\OpenTelemetry.AutoInstrumentation.Native.dll",
        "DOTNET_STARTUP_HOOKS": "$(SolutionDir)bin\\tracer-home\\netcoreapp3.1\\OpenTelemetry.AutoInstrumentation.StartupHook.dll",
        "DOTNET_SHARED_STORE": "$(SolutionDir)bin\\tracer-home\\store",
        "DOTNET_ADDITIONAL_DEPS": "$(SolutionDir)bin\\tracer-home\\AdditionalDeps",
        "OTEL_TRACES_EXPORTER": "zipkin",
        "OTEL_EXPORTER_ZIPKIN_ENDPOINT": "http://127.0.0.1:9411/api/v2/spans",
        "OTEL_DOTNET_AUTO_DEBUG": "1",
        "OTEL_DOTNET_AUTO_TRACES_CONSOLE_EXPORTER_ENABLED": "true",
        "OTEL_DOTNET_AUTO_INTEGRATIONS_FILE": "$(SolutionDir)bin\\tracer-home\\integrations.json",
        "OTEL_DOTNET_AUTO_HOME": "$(SolutionDir)bin\\tracer-home\\",
        "OTEL_DOTNET_AUTO_METRICS_CONSOLE_EXPORTER_ENABLED": "true",
        "LONG_RUNNING": "true"
      }
    }
  }
}

The result is

  An assembly specified in the application dependencies manifest (OpenTelemetry.AutoInstrumentation.AdditionalDeps.deps.json) was not found:
    package: 'MongoDB.Driver.Core', version: '2.13.3'
    path: 'runtimes/win/native/libzstd.dll'

If I put file manually in correct places (here and one more for https://www.nuget.org/packages/MongoDB.Libmongocrypt/1.2.2 everything works fine.

[Kielek]

@rajkumar-rangaraj, side-effect of bump. New version references DiagnosticSource v 6 so it was automatically removed.

[RassK]

some maybe helpful nits, all good.

[pjanotti]

The change itself looks good.

I do have a question about the dependencies that are being added to the additional deps. Aren't they dependencies of the library being instrumented? It seems that they would be already present on the application it self. I'm assuming that instrumentation helper/middleman indirectly depends on those. Is that correct?

Anyway, the change looks good. This question of indirect dependencies, if real, can and should be addressed separately.

[rajkumar-rangaraj]

Do we need all of these libraries or just should have MongoDB.Driver.Core.Extensions.DiagnosticSources.dll to resolve dependencies?
Maybe we need to make AdditionalDeps little smarter to avoid the dependencies that are not needed.

These libraries not only increase the size of the package, also it may not be used by an app itself as the version of MongoDB.Driver.Core.dll and its dependencies are old.

[Kielek]

It is really good question. I suppose that it is the same scenario as we have for https://github.com/open-telemetry/opentelemetry-dotnet-instrumentation/blob/main/src/CommonExcludedAssets.props

If you don't mind I would like to cover it by separate issue. This PR is big enough.

[Kielek]

@rajkumar-rangaraj, @pjanotti - your concers should be handled in scope of #1382,