Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +911 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-oracledb (>=0.27.0, <=0.45.0)

@opentelemetry/instrumentation-oracledb NPM version =0.27.0, =0.1.0, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.7, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488,...