Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3057 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql2 (>=0.26.0, <=0.66.0)

@opentelemetry/instrumentation-mysql2 NPM version =0.26.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...