NO-JIRA: chore(deps): weekly dependabot consolidation#8395
Conversation
Weekly dependabot dependency consolidation.
Vendor updates for root module dependency changes.
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
@hypershift-jira-solve-ci[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
📝 WalkthroughWalkthroughThe pull request updates Go module dependencies in 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 277-282: go.mod lists otlp trace exporter modules at v1.37.0 which
conflicts with core OpenTelemetry packages updated to v1.43.0; update the
versions for go.opentelemetry.io/otel/exporters/otlp/otlptrace and
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.43.0 in
go.mod so they match the core packages (ensure go.sum is updated by running `go
mod tidy` after changing the versions).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e5938083-3234-49e0-ada2-e86142860bb9
⛔ Files ignored due to path filters (72)
go.sumis excluded by!**/*.sumvendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!vendor/**,!**/vendor/**,!**/*_string.govendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/errorhandler/errorhandler.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/handler.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/state.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/asyncfloat64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/asyncint64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/syncfloat64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/syncint64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/requirements.txtis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/features.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/exception.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/otelconv/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.40.0/schema.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/asm_darwin_arm64_gc.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_darwin_arm64_other.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_other_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/syscall_darwin_arm64_gc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/syscall_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/registry/key.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
| go.opentelemetry.io/otel v1.43.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.43.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.43.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.43.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify OpenTelemetry version compatibility and security advisories
echo "=== Checking latest versions available ==="
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/@v/list | tail -5
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/sdk/@v/list | tail -5
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/exporters/otlp/otlptrace/@v/list | tail -5
echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "go.opentelemetry.io/otel") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo -e "\n=== Checking module info for v1.43.0 ==="
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/@v/v1.43.0.info
echo -e "\n=== Checking exporter compatibility ==="
# Check if exporter v1.37.0 supports otel v1.43.0
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/exporters/otlp/otlptrace/@v/v1.37.0.mod | grep "go.opentelemetry.io/otel"Repository: openshift/hypershift
Length of output: 1340
🌐 Web query:
OpenTelemetry Go v1.43.0 release notes and breaking changes
💡 Result:
OpenTelemetry Go v1.43.0 was released on 2026-04-03. Official release notes are available at https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0 and in CHANGELOG.md https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md. Key additions: - Added IsRandom and WithRandom on TraceFlags, IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context support (#8012). - Added service detection with WithService in go.opentelemetry.io/otel/sdk/resource (#7642). - Added DefaultWithContext and EnvironmentWithContext in resource detection (#8051). - Support for attribute.EMPTY in various OTLP exporters (trace, metric, log; gRPC and HTTP) and metricdatatest (#8038). - Per-series start time tracking for cumulative metrics in sdk/metric (env var OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true) (#8060). - WithCardinalityLimitSelector for metric reader (#7855). - Performance improvements in attribute slice handling (#8039), span metric recording (#8067), and metric data diffs (#8073). Deprecations: - Deprecate attribute.INVALID; use EMPTY instead (#8038). Breaking changes: - TraceIdRatioBased sampler now returns spec-compliant description (behavioral change for spec compliance) (#8027). Fixes: - Race condition in sdk/metric lastvalue aggregation (#8056). - HTTP response body limited to 4 MiB in OTLP HTTP exporters (trace, metric, log) to prevent excessive memory use; large responses are non-retryable (#8108). - WithHostID detector fix for BSD (#8113). - Missing request.GetBody in otlploghttp for HTTP2 GOAWAY (#8096). Full changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0
Citations:
- 1: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0
- 2: https://github.com/open-telemetry/opentelemetry-go/releases
- 3: https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md
- 4: https://newreleases.io/project/github/open-telemetry/opentelemetry-go/release/v1.43.0
- 5: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0
🌐 Web query:
OpenTelemetry Go exporter compatibility with SDK v1.43.0
💡 Result:
The OpenTelemetry Go SDK v1.43.0 (released 2026-04-03) is fully compatible with the official exporters included in the monorepo, such as OTLP (gRPC and HTTP for traces/metrics/logs), Prometheus (metrics), stdout, and Zipkin (traces). These exporters were updated and released together as part of v1.43.0, with changes like support for empty attributes (attribute.EMPTY), response body limits in OTLP HTTP exporters, and observability metrics guarded by Enabled checks. Exporters are separate Go modules (e.g., go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0), but the SDK depends on matching versions of otel/trace, otel/metric, otel/sdk/metric (all v1.43.0). Projects using SDK v1.43.0 commonly pair it with exporter v1.43.0, as shown in go.mod updates from Dependabot across multiple repositories. No compatibility issues or breaking changes affecting exporters are noted in the v1.43.0 release notes or changelog. Official docs confirm all listed exporters work with the current SDK.
Citations:
- 1: open-telemetry/opentelemetry-go@v1.40.0...v1.43.0
- 2: https://github.com/open-telemetry/opentelemetry-go
- 3: https://github.com/open-telemetry/opentelemetry-go/releases
- 4: https://newreleases.io/project/github/open-telemetry/opentelemetry-go/release/v1.43.0
- 5: https://opentelemetry.io/docs/languages/go/exporters/
- 6: https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md
- 7: https://github.com/open-telemetry/opentelemetry-go/blob/sdk/v1.43.0/sdk/go.mod
- 8: open-edge-platform/infra-core@8fa0af6
- 9: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0
- 10: https://pkg.go.dev/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.41.0
- 11: https://libraries.io/go/go.opentelemetry.io%2Fotel%2Fexporters%2Fotlp%2Fotlptrace%2Fotlptracehttp
- 12: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.40.0 to 1.43.0 openconfig/featureprofiles#5325
Update OTLP trace exporters to v1.43.0 to resolve version mismatch with core packages.
The OpenTelemetry core packages are upgraded to v1.43.0, which patches a HIGH severity security vulnerability (CVE affecting versions 1.36.0–1.40.0 with baggage header DoS amplification; fixed in v1.41.0+). However, the OTLP trace exporters remain at v1.37.0, which explicitly depends on otel v1.37.0, otel/sdk v1.37.0, otel/trace v1.37.0, and otel/metric v1.37.0. This version mismatch creates a dependency conflict and should be resolved by updating the exporters to v1.43.0.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 277 - 282, go.mod lists otlp trace exporter modules at
v1.37.0 which conflicts with core OpenTelemetry packages updated to v1.43.0;
update the versions for go.opentelemetry.io/otel/exporters/otlp/otlptrace and
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.43.0 in
go.mod so they match the core packages (ensure go.sum is updated by running `go
mod tidy` after changing the versions).
There was a problem hiding this comment.
The version mismatch between otel core (v1.43.0) and the OTLP trace exporters (v1.37.0) is benign — Go's Minimum Version Selection resolves the shared dependency (go.opentelemetry.io/otel) to v1.43.0 at build time, which satisfies the exporters' requirement of ≥v1.37.0. There is no actual dependency conflict.
Regarding the security advisory (baggage header DoS, CVE affecting v1.36.0–v1.40.0): this is already addressed since the core go.opentelemetry.io/otel package is at v1.43.0. The exporters themselves are not independently affected by that CVE.
That said, updating the exporters to v1.43.0 for version consistency is reasonable and could be done in a follow-up PR. This PR is a dependabot consolidation that bundles the updates dependabot flagged — the exporters weren't included in that set.
AI-assisted response via Claude Code
There was a problem hiding this comment.
Skipped: comment is from another GitHub bot.
There was a problem hiding this comment.
The security concern here is already mitigated — the CVE (baggage header DoS amplification, affecting v1.36.0–v1.40.0) is in the core go.opentelemetry.io/otel package, which this PR updates to v1.43.0.
The OTLP trace exporter's require go.opentelemetry.io/otel v1.37.0 is a minimum version requirement, not a pin. Go's Minimum Version Selection (MVS) resolves the core packages to v1.43.0 in the final build since the root module requires that version. The exporter compiles against the patched v1.43.0 core — there is no actual dependency conflict or security gap.
That said, aligning the exporter versions to v1.43.0 is a reasonable cleanup. However, since these are indirect dependencies (not directly imported by HyperShift) and the version is MVS-selected based on the transitive dependency graph, bumping them in this automated consolidation PR would expand its scope. This can be addressed in a follow-up dependency update.
AI-assisted response via Claude Code
There was a problem hiding this comment.
Skipped: comment is from another GitHub bot.
There was a problem hiding this comment.
The version mismatch flagged here is benign. Go's Minimum Version Selection (MVS) resolves the shared go.opentelemetry.io/otel dependency to v1.43.0 regardless of what the OTLP exporter modules declare as their minimum. The security concern (baggage header DoS amplification, CVE affecting v1.36.0–v1.40.0) is addressed by this PR's update of the core otel package to v1.43.0. No action needed.
AI-assisted response via Claude Code
There was a problem hiding this comment.
Skipped: comment is from another GitHub bot.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8395 +/- ##
=======================================
Coverage 36.71% 36.71%
=======================================
Files 768 768
Lines 93396 93396
=======================================
Hits 34286 34286
Misses 56426 56426
Partials 2684 2684
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
/area ci-tooling |
openshift-ci
Bot
added
area/ci-tooling
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox, hypershift-jira-solve-ci[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/lgtm cancel |
|
/lgtm |
|
Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage. |
|
/verified by e2e |
openshift-ci-robot
added
the
verified
|
@bryan-cox: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Test Resultse2e-aws
e2e-aks
|
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
|
| # | Evidence | Source |
|---|---|---|
| 1 | Test expects 2 Ready nodes but only 1 appeared within 45m timeout | build-log.txt lines 2013–2016 |
| 2 | Test creates NodePool with Replicas: 2, UpgradeType: InPlace |
test/e2e/nodepool_nto_machineconfig_test.go — BuildNodePoolManifest() |
| 3 | Wait timeout is hardcoded at 45 minutes in WaitForNReadyNodesWithOptions() |
test/e2e/util/util.go:571 |
| 4 | CAPI Machine 8snl2 reached Provisioned phase but no Node registered with matching ProviderID |
NodePool status and Machine YAML in step artifacts |
| 5 | The working machine (8kkr2) successfully registered as a Node; the failing machine (8snl2) did not |
Comparison of both Machine objects |
| 6 | 295 other tests passed — only this single test failed (4 reported failures are cascade) | build-log.txt test summary: 339 run, 40 skipped, 4 failed |
| 7 | Existing CI failure analysis artifact confirms: "infrastructure flake, not a code regression" | claude-failure-analysis-text.txt in job artifacts |
| 8 | Pre phase (AKS provision, HyperShift install) succeeded in 12m41s — cluster infra was healthy | junit_operator.xml step timings |
| 9 | No symptom labels or interval files found for this job | GCS artifact listing returned empty |
|
@hypershift-jira-solve-ci[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Summary
Weekly consolidation of dependabot dependency updates.
Consolidated PRs
Commits
Assisted-by: Claude (via Claude Code)
Summary by CodeRabbit
Release Notes