How to fix Unsanitized user controlled input in module generation vulnerability

[dominictobias]

GHSA-f8pq-3926-8gx5

This is driving me insane. Yarn only partially forces deps to secure version when doing "**/@opentelemetry/instrumentation": "^0.45.1" in package.json resolutions object (I've tried completely cleaning, even manually editing yarn.lock)

What I don't get is that I can't find anywhere in this repo even though NPM links to it, which is related to this dependency or module. For example if I search for "fastify" there are only a couple of references here, and none point to how I can submit a PR to update @opentelemetry/instrumentation-fastify to use 0.45.1 of @opentelemetry/instrumentation 😫

Any pointers please?

[Flarna]

The link on NPM points to the correct repo: https://github.com/open-telemetry/opentelemetry-js-contrib

And this is the actual folder in the repo for fastify instrumentation.

Renovate did already an update of the deps, release is not yet done.