fix(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] by cloudquery-ci[bot] · Pull Request #22496 · cloudquery/cloudquery

cloudquery-ci · 2026-04-08T22:34:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	`v1.42.0` → `v1.43.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-39882

overview:
this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.

this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).

severity

HIGH

not claiming: this is a remote dos against every default deployment.
claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.

callsite (pinned):

exporters/otlp/otlptrace/otlptracehttp/client.go:199
exporters/otlp/otlptrace/otlptracehttp/client.go:230
exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170
exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201
exporters/otlp/otlplog/otlploghttp/client.go:190
exporters/otlp/otlplog/otlploghttp/client.go:221

permalinks (pinned):

root cause:
each exporter client reads resp.Body using io.Copy(&respData, resp.Body) into a bytes.Buffer on both success and error paths, with no upper bound.

impact:
a malicious collector can force large transient heap allocations during export (peak memory scales with attacker-chosen response size) and can potentially crash the instrumented process (oom).

affected component:

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

repro (local-only):

unzip poc.zip -d poc
cd poc
make canonical resp_bytes=33554432 chunk_delay_ms=0

expected output contains:

[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[PROOF_MARKER]: resp_bytes=33554432 peak_alloc_bytes=118050512

control (same env, patched target):

unzip poc.zip -d poc
cd poc
make control resp_bytes=33554432 chunk_delay_ms=0

expected control output contains:

[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[NC_MARKER]: resp_bytes=33554432 peak_alloc_bytes=512232

attachments: poc.zip (attached)

PR_DESCRIPTION.md

attack_scenario.md

poc.zip

Fixed in: https://github.com/open-telemetry/opentelemetry-go/pull/8108

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp)

`v1.43.0`: /v0.65.0/v0.19.0

Compare Source

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
make the implementation spec-compliant. (#8027)
Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
Responses exceeding the limit are treated as non-retryable errors. (#8108)
Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
Responses exceeding the limit are treated as non-retryable errors. (#8108)
Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
Responses exceeding the limit are treated as non-retryable errors. (#8108)
WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

What's Changed

chore(deps): update module github.com/jgautheron/goconst to v1.9.0 by @renovate[bot] in #8014
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 190d7d4 by @renovate[bot] in #8013
chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by @renovate[bot] in #8016
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.1 by @renovate[bot] in #8011
fix(deps): update golang.org/x by @renovate[bot] in #8023
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.2 by @renovate[bot] in #8020
chore(deps): update module github.com/mattn/go-runewidth to v0.0.21 by @renovate[bot] in #8017
chore(deps): update module codeberg.org/chavacava/garif to v0.2.1 by @renovate[bot] in #8019
Add doc on how to upgrade to new semconv by @jmmcorreia in #7807
fix(deps): update module go.opentelemetry.io/proto/otlp to v1.10.0 by @renovate[bot] in #8028
resource: add WithService detector option by @codeboten in #7642
fix(deps): update googleapis to a57be14 by @renovate[bot] in #8031
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.3 by @renovate[bot] in #8032
chore(deps): update module github.com/prometheus/procfs to v0.20.1 by @renovate[bot] in #8034
chore(deps): update github.com/securego/gosec/v2 digest to 8895462 by @renovate[bot] in #8036
chore(deps): update module github.com/sonatard/noctx to v0.5.1 by @renovate[bot] in #8040
chore(deps): update github.com/securego/gosec/v2 digest to 6e66a94 by @renovate[bot] in #8043
docs(otlp): document HTTP/protobuf insecure env vars by @marcschaeferger in #8037
Rebuild semconvkit and verifyreadmes on changes by @MrAlias in #7995
chore(sdk/trace): join errors properly by @ash2k in #8030
fix(deps): update googleapis to 84a4fc4 by @renovate[bot] in #8048
attribute: change INVALID Type to EMPTY and mark INVALID as deprecated by @pellared in #8038
fix(sdk/trace): return spec-compliant TraceIdRatioBased description by @ash2k in #8027
linting: add depguard rule to enforce semconv version by @ajuijas in #8041
chore(deps): update actions/download-artifact action to v8.0.1 by @renovate[bot] in #8046
chore(deps): update github.com/securego/gosec/v2 digest to b7b2c7b by @renovate[bot] in #8044
fix(deps): update golang.org/x by @renovate[bot] in #8045
Optimize attribute slice conversion by @MrAlias in #8039
Add benchmarks for end-to-end metrics SDK usage by @dashpole in #7768
fix(deps): update golang.org/x by @renovate[bot] in #8052
chore(deps): update github.com/securego/gosec/v2 digest to befce8d by @renovate[bot] in #8053
trace: add Random Trace ID Flag by @yuanyuanzhao3 in #8012
Improve aggregation concurrent safe tests by @dashpole in #8021
Add tests for exponential histogram concurrent-safety edge-cases by @dashpole in #8024
exphist: replace min, max, sum, and count with atomics by @dashpole in #8025
chore(deps): update github.com/securego/gosec/v2 digest to c2dfcec by @renovate[bot] in #8055
chore(deps): update otel/weaver docker tag to v0.22.0 by @renovate[bot] in #8058
chore(deps): update github.com/securego/gosec/v2 digest to dec52c4 by @renovate[bot] in #8063
chore(deps): update otel/weaver docker tag to v0.22.1 by @renovate[bot] in #8061
chore(deps): update github/codeql-action action to v4.33.0 by @renovate[bot] in #8065
Fix race in the lastvalue aggregation where 0 could be observed by @dashpole in #8056
chore(deps): update github.com/securego/gosec/v2 digest to 744bfb5 by @renovate[bot] in #8064
Migrate to new bare metal runner (Ubuntu 24) by @trask in #8068
sdk/resource: add WithContext variants for Default and Environment (#7808) by @ajuijas in #8051
Use atomics for exponential histogram buckets by @dashpole in #8057
Added the internal/observ package to stdoutlog by @yumosx in #7735
Add support for the development per-series starttime feature by @dashpole in #8060
sdk/trace/internal/observ: guard SpanStarted and spanLive with Enabled by @kouji-yoshimura in #8067
Cleanup exemplar featuregate readme by @dashpole in #8072
chore(deps): update codecov/codecov-action action to v5.5.3 by @renovate[bot] in #8080
chore(deps): update module github.com/ryanrolds/sqlclosecheck to v0.6.0 by @renovate[bot] in #8083
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to de6f1cc by @renovate[bot] in #8082
chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.54.0 by @renovate[bot] in #8085
chore(deps): update module github.com/securego/gosec/v2 to v2.25.0 by @renovate[bot] in #8084
chore(deps): update module github.com/protonmail/go-crypto to v1.4.1 by @renovate[bot] in #8081
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.54.0 by @renovate[bot] in #8086
chore(deps): update actions/cache action to v5.0.4 by @renovate[bot] in #8079
chore(deps): update module github.com/fatih/color to v1.19.0 by @renovate[bot] in #8087
fix(deps): update googleapis to d00831a by @renovate[bot] in #8078
chore(deps): update golang.org/x/telemetry digest to b6b0c46 by @renovate[bot] in #8076
fix(deps): update module google.golang.org/grpc to v1.79.3 [security] by @renovate[bot] in #8075
sdk/metric: Support specifying cardinality limits per instrument kinds by @petern48 in #7855
chore(deps): update github/codeql-action action to v4.34.0 by @renovate[bot] in #8088
chore(deps): update codspeedhq/action action to v4.12.1 by @renovate[bot] in #8089
chore(deps): update github/codeql-action action to v4.34.1 by @renovate[bot] in #8090
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.4 by @renovate[bot] in #8092
chore: fix noctx issues by @mmorel-35 in #8008
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.0 by @renovate[bot] in #8095
chore(deps): update codecov/codecov-action action to v5.5.4 by @renovate[bot] in #8097
chore(deps): update codecov/codecov-action action to v6 by @renovate[bot] in #8098
chore(deps): update module github.com/tetafro/godot to v1.5.6 by @renovate[bot] in #8099
chore(deps): update module github.com/butuzov/ireturn to v0.4.1 by @renovate[bot] in #8100
chore(deps): update github/codeql-action action to v4.35.0 by @renovate[bot] in #8101
chore(deps): update actions/setup-go action to v6.4.0 by @renovate[bot] in #8107
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.1 by @renovate[bot] in #8106
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.0 by @renovate[bot] in #8103
chore(deps): update github/codeql-action action to v4.35.1 by @renovate[bot] in #8102
chore(deps): update module github.com/hashicorp/go-version to v1.9.0 by @renovate[bot] in #8109
metricdatatest: Improve printing of diffs by @dashpole in #8073
fix(deps): update googleapis to d5a96ad by @renovate[bot] in #8112
chore(deps): update codspeedhq/action action to v4.13.0 by @renovate[bot] in #8114
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.55.0 by @renovate[bot] in #8119
chore(deps): update fossas/fossa-action action to v1.9.0 by @renovate[bot] in #8118
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 by @renovate[bot] in #8115
fix(deps): update googleapis to 9d38bb4 by @renovate[bot] in #8117
fix: support getBody in otelploghttp by @Tpuljak in #8096
fix(deps): update module google.golang.org/grpc to v1.80.0 by @renovate[bot] in #8121
Use an absolute path when calling bsd kenv by @dmathieu in #8113
limit response body size for OTLP HTTP exporters by @pellared in #8108
chore(deps): update github.com/golangci/dupl digest to c99c5cf by @renovate[bot] in #8122
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 by @renovate[bot] in #8131
Release v1.43.0 / v0.65.0 / v0.19.0 by @dmathieu in #8128

New Contributors

@jmmcorreia made their first contribution in #7807
@marcschaeferger made their first contribution in #8037
@ajuijas made their first contribution in #8041
@yuanyuanzhao3 made their first contribution in #8012
@kouji-yoshimura made their first contribution in #8067
@Tpuljak made their first contribution in #8096

Full Changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

cloudquery-ci · 2026-04-08T22:35:01Z

/gen sha=c6fdf50be3c4ac3071e64882f2f5720f4c4a08a3 dir=plugins/source/hackernews

cloudquery-ci · 2026-04-08T22:35:02Z

/gen sha=c6fdf50be3c4ac3071e64882f2f5720f4c4a08a3 dir=plugins/source/test

cloudquery-ci · 2026-04-08T22:35:03Z

/gen sha=c6fdf50be3c4ac3071e64882f2f5720f4c4a08a3 dir=plugins/source/xkcd

🤖 I have created a release *beep* *boop* --- ## [2.8.36](plugins-destination-test-v2.8.35...plugins-destination-test-v2.8.36) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.7.7](plugins-destination-kafka-v5.7.6...plugins-destination-kafka-v5.7.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [3.0.4](plugins-destination-meilisearch-v3.0.3...plugins-destination-meilisearch-v3.0.4) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [8.14.7](plugins-destination-postgresql-v8.14.6...plugins-destination-postgresql-v8.14.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [2.1.18](plugins-transformer-jsonflattener-v2.1.17...plugins-transformer-jsonflattener-v2.1.18) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [2.14.7](plugins-destination-sqlite-v2.14.6...plugins-destination-sqlite-v2.14.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [3.9.7](plugins-source-hackernews-v3.9.6...plugins-source-hackernews-v3.9.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [2.6.20](plugins-transformer-basic-v2.6.19...plugins-transformer-basic-v2.6.20) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.3.8](plugins-destination-mssql-v5.3.7...plugins-destination-mssql-v5.3.8) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [4.8.18](plugins-source-test-v4.8.17...plugins-source-test-v4.8.18) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.6.7](plugins-destination-mysql-v5.6.6...plugins-destination-mysql-v5.6.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.5.7](plugins-destination-neo4j-v5.5.6...plugins-destination-neo4j-v5.5.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [1.5.39](plugins-source-xkcd-v1.5.38...plugins-source-xkcd-v1.5.39) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [1.1.36](plugins-transformer-test-v1.1.35...plugins-transformer-test-v1.1.36) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [8.2.1](plugins-destination-clickhouse-v8.2.0...plugins-destination-clickhouse-v8.2.1) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [4.0.2](plugins-destination-elasticsearch-v4.0.1...plugins-destination-elasticsearch-v4.0.2) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [4.7.8](plugins-destination-bigquery-v4.7.7...plugins-destination-bigquery-v4.7.8) (2026-04-15) ### Bug Fixes * **deps:** Update module cloud.google.com/go/bigquery to v1.75.0 ([#22523](#22523)) ([477d7d8](477d7d8)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) * **deps:** Update module google.golang.org/api to v0.273.0 ([#22476](#22476)) ([826e24f](826e24f)) * **deps:** Update module google.golang.org/api to v0.274.0 ([#22524](#22524)) ([f5067c6](f5067c6)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [6.3.7](plugins-destination-duckdb-v6.3.6...plugins-destination-duckdb-v6.3.7) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [7.10.10](plugins-destination-s3-v7.10.9...plugins-destination-s3-v7.10.10) (2026-04-15) ### Bug Fixes * **deps:** Update aws-sdk-go-v2 monorepo ([#22475](#22475)) ([c9cb3cf](c9cb3cf)) * **deps:** Update aws-sdk-go-v2 monorepo ([#22519](#22519)) ([ab37fc2](ab37fc2)) * **deps:** Update module github.com/aws/smithy-go to v1.24.3 ([#22522](#22522)) ([b86973d](b86973d)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.2.7](plugins-destination-snowflake-v5.2.6...plugins-destination-snowflake-v5.2.7) (2026-04-15) ### Bug Fixes * **deps:** Update module github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream to v1.7.8 [SECURITY] ([#22493](#22493)) ([bfc0e61](bfc0e61)) * **deps:** Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [SECURITY] ([#22494](#22494)) ([605bf84](605bf84)) * **deps:** Update module github.com/snowflakedb/gosnowflake to v2 ([#22439](#22439)) ([5417c8e](5417c8e)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [2.8.8](plugins-destination-firehose-v2.8.7...plugins-destination-firehose-v2.8.8) (2026-04-15) ### Bug Fixes * **deps:** Update aws-sdk-go-v2 monorepo ([#22472](#22472)) ([8d5c016](8d5c016)) * **deps:** Update module github.com/aws/aws-sdk-go-v2/config to v1.32.14 ([#22520](#22520)) ([56296bb](56296bb)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [2.8.2](plugins-destination-gremlin-v2.8.1...plugins-destination-gremlin-v2.8.2) (2026-04-15) ### Bug Fixes * **deps:** Update aws-sdk-go-v2 monorepo ([#22473](#22473)) ([8d1340d](8d1340d)) * **deps:** Update module github.com/aws/aws-sdk-go-v2/config to v1.32.14 ([#22521](#22521)) ([21cb00b](21cb00b)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [3.0.3](plugins-destination-mongodb-v3.0.2...plugins-destination-mongodb-v3.0.3) (2026-04-15) ### Bug Fixes * **deps:** Update aws-sdk-go-v2 monorepo ([#22474](#22474)) ([edab21c](edab21c)) * **deps:** Update aws-sdk-go-v2 monorepo ([#22518](#22518)) ([4c835e4](4c835e4)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [4.5.8](plugins-destination-azblob-v4.5.7...plugins-destination-azblob-v4.5.8) (2026-04-15) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.5.8](plugins-destination-gcs-v5.5.7...plugins-destination-gcs-v5.5.8) (2026-04-15) ### Bug Fixes * **deps:** Update module github.com/go-jose/go-jose/v4 to v4.1.4 [SECURITY] ([#22467](#22467)) ([5ea6f26](5ea6f26)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) * **deps:** Update module google.golang.org/api to v0.273.0 ([#22477](#22477)) ([8fd4bea](8fd4bea)) * **deps:** Update module google.golang.org/api to v0.274.0 ([#22525](#22525)) ([b6d8afa](b6d8afa)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [5.5.7](plugins-destination-file-v5.5.6...plugins-destination-file-v5.5.7) (2026-04-16) ### Bug Fixes * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] ([#22495](#22495)) ([c0a38fd](c0a38fd)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] ([#22496](#22496)) ([1cf6439](1cf6439)) * **deps:** Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] ([#22497](#22497)) ([122ba44](122ba44)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

cloudquery-ci bot added automerge Automatically merge once required checks pass security labels Apr 8, 2026

kodiakhq bot approved these changes Apr 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY]#22496

fix(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY]#22496
kodiakhq[bot] merged 2 commits intomainfrom
renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlpmetric-otlpmetrichttp-vulnerability

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

cloudquery-ci bot commented Apr 8, 2026

GitHub Vulnerability Alerts

CVE-2026-39882

Release Notes

v1.43.0: /v0.65.0/v0.19.0

Added

Changed

Deprecated

Fixed

What's Changed

New Contributors

Configuration

Uh oh!

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

cloudquery-ci bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v1.43.0`: /v0.65.0/v0.19.0