fix: patch OTel Snyk vulnerabilities and upgrade dependencies - #95
Merged
Conversation
All OpenTelemetry packages flagged by Snyk are ghost transitive dependencies of google.golang.org/grpc — none are imported or compiled into any binary (`go mod why` confirms). Added .snyk ignores for: - CVE-2026-29181 (CWE-770): otel/baggage, internal/global, internal/errorhandler, propagation - CVE-2026-39882 (CWE-789): otlpmetrichttp, otlptracehttp - CVE-2026-39883 (CWE-426): otel/sdk/resource (new CVE, separate from existing -15182758 ignore) Also upgraded grpc v1.79.3 → v1.80.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
go mod tidy dropped these security pins because upstream deps (grpc, hcl/v2) only require older versions. Re-adding to keep the module graph at patched versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the dependency graph to address Snyk findings by upgrading google.golang.org/grpc and adding new .snyk ignore entries for OpenTelemetry CVEs that are reported as transitive “ghost” dependencies.
Changes:
- Upgrade
google.golang.org/grpcfromv1.79.3tov1.80.0(indirect). - Add
.snykignore entries for multiple new OpenTelemetry vulnerability IDs flagged by Snyk. - Run dependency tidy/update resulting in removal of now-unneeded
go-joseandgolang.org/x/cryptoentries fromgo.mod/go.sum(and examples).
Reviewed changes
Copilot reviewed 3 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
go.mod |
Bumps grpc to v1.80.0 and removes go-jose/x/crypto indirect requirements. |
go.sum |
Updates checksums to reflect grpc bump and pruned deps. |
.snyk |
Adds new OpenTelemetry CVE ignore entries (ghost transitive deps). |
_examples/go.mod |
Removes go-jose/x/crypto indirect requirements in examples module. |
_examples/go.sum |
Updates checksums to reflect pruned deps and grpc bump. |
Comments suppressed due to low confidence (2)
go.mod:28
- go.mod no longer pins go-jose/v4, but .snyk’s existing ignore entry for SNYK-GOLANG-GITHUBCOMGOJOSEGOJOSE-15875219 states the issue is “fixed via go.mod pin”. Please either reintroduce the pin or update/remove the corresponding .snyk ignore reason so it matches the current dependency strategy.
github.com/agnivade/levenshtein v1.2.1 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/bmatcuk/doublestar v1.3.4 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
github.com/goccy/go-yaml v1.19.2 // indirect
go.mod:45
- go.mod no longer pins golang.org/x/crypto, but .snyk’s existing ignores for x/crypto vulnerabilities describe them as “fixed via go.mod pin to golang.org/x/crypto v0.49.0”. Please update/remove those .snyk ignore reasons (or restore the pin) to avoid misleading future readers/audits.
github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
github.com/zclconf/go-cty v1.18.0 // indirect
github.com/zclconf/go-cty-yaml v1.2.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.49.0 // indirect
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Fix typo: otel/internal errorhandler → otel/internal/errorhandler - Fix package path: go.opentelemetry.io/otel error handler → go.opentelemetry.io/otel/internal/errorhandler - Remove hardcoded grpc version from existing ignore reasons to avoid stale references after upgrades Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
- golang.org/x/mod v0.34.0 → v0.35.0 - golang.org/x/text v0.35.0 → v0.36.0 - mattn/go-sqlite3 v1.14.40 → v1.14.42 (examples) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
josue
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 5 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
corvramirez
previously approved these changes
Apr 9, 2026
make upgrade-deps dropped the security pins via go mod tidy. Re-pinned go-jose/v4 to v4.1.4 and x/crypto to v0.49.0. Added .snyk safety-net ignores for 3 new go-jose Uncaught Exception vulnerabilities (CVE-2026-34986, CWE-248) across go-jose/v4, go-jose/cipher, and go-jose/v4/cipher package paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 5 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- ariga.io/atlas v1.1.0 → v1.2.0 - golang.org/x/exp → 2026-04-10 snapshot - golang.org/x/tools v0.43.0 → v0.44.0 - Re-pinned go-jose/v4 v4.1.4 and x/crypto v0.49.0 after go mod tidy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 5 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
caseyh
approved these changes
Apr 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.snykignores for 7 new OpenTelemetry vulnerabilities (CVE-2026-29181, CVE-2026-39882, CVE-2026-39883) — all are ghost transitive deps fromgoogle.golang.org/grpc, never imported or compiled into any binary.snykignores for 3 new go-jose vulnerabilities (CVE-2026-34986 Uncaught Exception) acrossgo-jose/v4,go-jose/cipher, andgo-jose/v4/cipherpackage paths — fixed via go.mod pin to v4.1.4, ignores retained as safety net sincego mod tidydrops the pingoogle.golang.org/grpcv1.79.3 → v1.80.0go-jose/v4to v4.1.4 andgolang.org/x/cryptoto v0.49.0 (go mod tidy drops these pins since upstream requires older versions)golang.org/x/modv0.34.0 → v0.35.0,golang.org/x/textv0.35.0 → v0.36.0,mattn/go-sqlite3v1.14.40 → v1.14.42Test plan
go test ./— unit tests passcd _examples && go test ./.— integration tests passgo mod whyconfirms no OTel package is needed by the main module🤖 Generated with Claude Code