Remove unused @opentelemetry/exporter-jaeger production dependency

[ameyypawar]

@opentelemetry/exporter-jaeger is listed as a production dependency but is not referenced anywhere in the application source. It is a top-level-only install — nothing else in the dependency tree depends on it — and it pulls in a subtree that npm audit flags.

Location

• package.json — "@opentelemetry/exporter-jaeger": "^2.0.1"

Verification

grep -rni "opentelemetry\|jaeger" src/ returns no matches. The Genkit setup configures no exporter:

import {genkit} from 'genkit';
import {googleAI} from '@genkit-ai/googleai';

export const ai = genkit({
  plugins: [googleAI()],
  model: 'googleai/gemini-2.0-flash',
});

src/ai/ contains only genkit.ts, dev.ts, and flows/auto-tag-question.ts, none of which reference tracing. npm ls shows no dependent inside the tree:

nextn@0.1.0
└── @opentelemetry/exporter-jaeger@2.0.1

Vulnerability impact, scoped precisely

The packages whose only path into the tree is through exporter-jaeger:

@opentelemetry/exporter-jaeger@2.0.1  (moderate)
└─┬ jaeger-client@3.19.0              (moderate, via uuid)
  ├── thriftrw@3.11.4                 (not currently flagged)
  └── uuid@8.x                        (moderate — missing buffer bounds check)

One correction worth stating so this PR is not judged against a cleanup it cannot deliver: @opentelemetry/propagator-jaeger@1.25.1 (high — DoS in JaegerPropagator via malformed header) is not pulled in by this dependency. It arrives via the genkit-cli devDependency:

genkit-cli@1.8.0
└─┬ @genkit-ai/telemetry-server@1.8.0
  └─┬ @opentelemetry/sdk-node@0.52.1
    └─┬ @opentelemetry/sdk-trace-node@1.25.1
      └── @opentelemetry/propagator-jaeger@1.25.1

Removing exporter-jaeger will not clear that entry. The nested @opentelemetry/core, resources, and sdk-trace-base copies are likewise shared with the Genkit tree and will remain.

Why this matters

An unused production dependency ships in the deployment bundle and adds attack surface with no offsetting function. The Jaeger client is a tracing transport for an exporter that is never constructed — dead weight rather than a live risk, but it also confuses the audit signal, because three of the reported vulnerabilities trace to a package the app does not use.

Suggested fix

1. Confirm nothing in the Genkit tree needs it before removing. npm ls @opentelemetry/exporter-jaeger shows no dependents today and a grep of the Genkit lib directories returns nothing, so the evidence points to safe removal — but Genkit resolves telemetry plugins dynamically in places, so validate rather than assume.
2. npm uninstall @opentelemetry/exporter-jaeger.
3. Verify npm run build succeeds and that npm run genkit:dev still starts and can execute the autoTagQuestion flow — that is the path most likely to reveal a dynamic requirement.
4. Re-run npm audit and record the delta. Expect exporter-jaeger, jaeger-client, and the nested uuid@8 to drop out; expect propagator-jaeger to remain.
5. If tracing is genuinely wanted later, add it back as a devDependency and actually wire an exporter in src/ai/genkit.ts.