@opentelemetry Instrumentation-mysql2 vulnerabilities

• @opentelemetry instrumentation-cassandra-driver, instrumentation-knex, instrumentation-mongoose +6 more +8 more Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute CVE-2026-104872 Fix available 5.8 MediumOctober 2, 2026