Skip to content

NO-JIRA: chore(deps): weekly dependabot consolidation #8395

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
May 2, 2026
Merged

NO-JIRA: chore(deps): weekly dependabot consolidation #8395

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8001952
chore(deps): update root module dependencies
May 1, 2026
b8d21a9
chore(deps): update vendored dependencies
May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,19 +274,19 @@ require (
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.40.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
go.opentelemetry.io/otel/metric v1.40.0 // indirect
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
go.opentelemetry.io/otel/trace v1.40.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
Comment on lines +277 to +282
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 1, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify OpenTelemetry version compatibility and security advisories

echo "=== Checking latest versions available ==="
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/@v/list | tail -5
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/sdk/@v/list | tail -5
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/exporters/otlp/otlptrace/@v/list | tail -5

echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: GO, package: "go.opentelemetry.io/otel") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

echo -e "\n=== Checking module info for v1.43.0 ==="
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/@v/v1.43.0.info

echo -e "\n=== Checking exporter compatibility ==="
# Check if exporter v1.37.0 supports otel v1.43.0
curl -s https://proxy.golang.org/go.opentelemetry.io/otel/exporters/otlp/otlptrace/@v/v1.37.0.mod | grep "go.opentelemetry.io/otel"

Repository: openshift/hypershift

Length of output: 1340

🌐 Web query:

OpenTelemetry Go v1.43.0 release notes and breaking changes

💡 Result:

OpenTelemetry Go v1.43.0 was released on 2026-04-03. Official release notes are available at https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0 and in CHANGELOG.md https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md. Key additions: - Added IsRandom and WithRandom on TraceFlags, IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context support (#8012). - Added service detection with WithService in go.opentelemetry.io/otel/sdk/resource (#7642). - Added DefaultWithContext and EnvironmentWithContext in resource detection (#8051). - Support for attribute.EMPTY in various OTLP exporters (trace, metric, log; gRPC and HTTP) and metricdatatest (#8038). - Per-series start time tracking for cumulative metrics in sdk/metric (env var OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true) (#8060). - WithCardinalityLimitSelector for metric reader (#7855). - Performance improvements in attribute slice handling (#8039), span metric recording (#8067), and metric data diffs (#8073). Deprecations: - Deprecate attribute.INVALID; use EMPTY instead (#8038). Breaking changes: - TraceIdRatioBased sampler now returns spec-compliant description (behavioral change for spec compliance) (#8027). Fixes: - Race condition in sdk/metric lastvalue aggregation (#8056). - HTTP response body limited to 4 MiB in OTLP HTTP exporters (trace, metric, log) to prevent excessive memory use; large responses are non-retryable (#8108). - WithHostID detector fix for BSD (#8113). - Missing request.GetBody in otlploghttp for HTTP2 GOAWAY (#8096). Full changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

Citations:

🌐 Web query:

OpenTelemetry Go exporter compatibility with SDK v1.43.0

💡 Result:

The OpenTelemetry Go SDK v1.43.0 (released 2026-04-03) is fully compatible with the official exporters included in the monorepo, such as OTLP (gRPC and HTTP for traces/metrics/logs), Prometheus (metrics), stdout, and Zipkin (traces). These exporters were updated and released together as part of v1.43.0, with changes like support for empty attributes (attribute.EMPTY), response body limits in OTLP HTTP exporters, and observability metrics guarded by Enabled checks. Exporters are separate Go modules (e.g., go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0), but the SDK depends on matching versions of otel/trace, otel/metric, otel/sdk/metric (all v1.43.0). Projects using SDK v1.43.0 commonly pair it with exporter v1.43.0, as shown in go.mod updates from Dependabot across multiple repositories. No compatibility issues or breaking changes affecting exporters are noted in the v1.43.0 release notes or changelog. Official docs confirm all listed exporters work with the current SDK.

Citations:

Update OTLP trace exporters to v1.43.0 to resolve version mismatch with core packages.

The OpenTelemetry core packages are upgraded to v1.43.0, which patches a HIGH severity security vulnerability (CVE affecting versions 1.36.0–1.40.0 with baggage header DoS amplification; fixed in v1.41.0+). However, the OTLP trace exporters remain at v1.37.0, which explicitly depends on otel v1.37.0, otel/sdk v1.37.0, otel/trace v1.37.0, and otel/metric v1.37.0. This version mismatch creates a dependency conflict and should be resolved by updating the exporters to v1.43.0.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 277 - 282, go.mod lists otlp trace exporter modules at
v1.37.0 which conflicts with core OpenTelemetry packages updated to v1.43.0;
update the versions for go.opentelemetry.io/otel/exporters/otlp/otlptrace and
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.43.0 in
go.mod so they match the core packages (ensure go.sum is updated by running `go
mod tidy` after changing the versions).

Copy link
Copy Markdown
Author

@hypershift-jira-solve-ci hypershift-jira-solve-ci Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The version mismatch between otel core (v1.43.0) and the OTLP trace exporters (v1.37.0) is benign — Go's Minimum Version Selection resolves the shared dependency (go.opentelemetry.io/otel) to v1.43.0 at build time, which satisfies the exporters' requirement of ≥v1.37.0. There is no actual dependency conflict.

Regarding the security advisory (baggage header DoS, CVE affecting v1.36.0–v1.40.0): this is already addressed since the core go.opentelemetry.io/otel package is at v1.43.0. The exporters themselves are not independently affected by that CVE.

That said, updating the exporters to v1.43.0 for version consistency is reasonable and could be done in a follow-up PR. This PR is a dependabot consolidation that bundles the updates dependabot flagged — the exporters weren't included in that set.

AI-assisted response via Claude Code

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: comment is from another GitHub bot.

Copy link
Copy Markdown
Author

@hypershift-jira-solve-ci hypershift-jira-solve-ci Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The security concern here is already mitigated — the CVE (baggage header DoS amplification, affecting v1.36.0–v1.40.0) is in the core go.opentelemetry.io/otel package, which this PR updates to v1.43.0.

The OTLP trace exporter's require go.opentelemetry.io/otel v1.37.0 is a minimum version requirement, not a pin. Go's Minimum Version Selection (MVS) resolves the core packages to v1.43.0 in the final build since the root module requires that version. The exporter compiles against the patched v1.43.0 core — there is no actual dependency conflict or security gap.

That said, aligning the exporter versions to v1.43.0 is a reasonable cleanup. However, since these are indirect dependencies (not directly imported by HyperShift) and the version is MVS-selected based on the transitive dependency graph, bumping them in this automated consolidation PR would expand its scope. This can be addressed in a follow-up dependency update.

AI-assisted response via Claude Code

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: comment is from another GitHub bot.

Copy link
Copy Markdown
Author

@hypershift-jira-solve-ci hypershift-jira-solve-ci Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The version mismatch flagged here is benign. Go's Minimum Version Selection (MVS) resolves the shared go.opentelemetry.io/otel dependency to v1.43.0 regardless of what the OTLP exporter modules declare as their minimum. The security concern (baggage header DoS amplification, CVE affecting v1.36.0–v1.40.0) is addressed by this PR's update of the core otel package to v1.43.0. No action needed.

AI-assisted response via Claude Code

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: comment is from another GitHub bot.

go.opentelemetry.io/proto/otlp v1.7.1 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/sys v0.41.0 // indirect
golang.org/x/sys v0.42.0 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.35.0 // indirect
golang.org/x/tools v0.42.0 // indirect
Expand Down
24 changes: 12 additions & 12 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -770,20 +770,20 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
Expand Down Expand Up @@ -896,8 +896,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
Expand Down
12 changes: 12 additions & 0 deletions vendor/go.opentelemetry.io/otel/.golangci.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

90 changes: 89 additions & 1 deletion vendor/go.opentelemetry.io/otel/CHANGELOG.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 9 additions & 6 deletions vendor/go.opentelemetry.io/otel/Makefile
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 7 additions & 7 deletions vendor/go.opentelemetry.io/otel/README.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading