@opentelemetry instrumentation-mongoose

• CVE-2026-104872 Medium 5.8 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%