The Pulumi NuGet package (3.105.0) transitively pulls in OpenTelemetry.Api 1.9.0 via the OpenTelemetry 1.9.0 reference in sdk/Pulumi/Pulumi.csproj, which is flagged by CVE-2026-40894 / GHSA-g94r-2vxg-569j (CVSS 5.3, fixed in 1.15.3). We should update this dependency for security reasons.
The
PulumiNuGet package (3.105.0) transitively pulls inOpenTelemetry.Api1.9.0 via theOpenTelemetry1.9.0 reference insdk/Pulumi/Pulumi.csproj, which is flagged by CVE-2026-40894 / GHSA-g94r-2vxg-569j (CVSS 5.3, fixed in 1.15.3). We should update this dependency for security reasons.