chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security]#122
chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security]#122
Conversation
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
📝 WalkthroughWalkthroughDependency updates in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
154-160: Consider aligning exporter sub-modules to v1.40.0.The seven
exporters/otlp/*andexporters/stdout/*packages remain at v1.37.0 while the core SDK and its siblings are now at v1.40.0. All of these live in the sameopentelemetry-gorepository and are co-released. This creates a split:
Package Version otel/sdk,otel/trace,otel/metric,otel/sdk/metricv1.40.0 ✅ otel/exporters/otlp/*,otel/exporters/stdout/*v1.37.0 ⚠️ From a security standpoint this is fine — Go's Minimum Version Selection will resolve
go.opentelemetry.io/otel/sdkto v1.40.0 for the whole build graph, so the patchedsdk/resource/host_id.gois used. However, the exporters at v1.37.0 will miss bug fixes shipped between v1.37.0 and v1.40.0, such as the fix that includes W3C TraceFlags in the OTLP Span.Flags field forotlptrace/otlptracehttpandotlptrace/otlptracegrpc.These are indirect dependencies, so bumping them here is only effective if the upstream packages that pull them in also permit the newer version. It may be worth opening a follow-up to verify and bump the exporters once those upstream constraints allow it.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 154 - 160, Update the exporter dependency versions from v1.37.0 to v1.40.0 for the OpenTelemetry exporter modules listed (e.g. go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, otlpmetrichttp, otlptrace, otlptracegrpc, otlptracehttp and go.opentelemetry.io/otel/exporters/stdout/stdoutmetric, stdouttrace) in go.mod so they align with the core SDK v1.40.0; note these are indirect dependencies so after bumping them here, run go mod tidy and verify there are no upstream version constraints preventing the upgrade and open follow-ups if upstream modules need to be updated.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@go.mod`:
- Around line 154-160: Update the exporter dependency versions from v1.37.0 to
v1.40.0 for the OpenTelemetry exporter modules listed (e.g.
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc,
otlpmetrichttp, otlptrace, otlptracegrpc, otlptracehttp and
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric, stdouttrace) in go.mod
so they align with the core SDK v1.40.0; note these are indirect dependencies so
after bumping them here, run go mod tidy and verify there are no upstream
version constraints preventing the upgrade and open follow-ups if upstream
modules need to be updated.
NumaryBot
force-pushed
the
renovate/go-go.opentelemetry.io-otel-sdk-vulnerability
branch
from
6ea6e8b to
f5b2417
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
26-26: Consider aligning remaining OTEL exporters tov1.40.0to avoid cross-minor drift.The core OTEL modules are now on
v1.40.0, but OTEL exporter modules are still onv1.37.0(lines 154-160). Keeping OTEL modules on one minor reduces integration risk and future debugging overhead.Suggested follow-up diff
- go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.37.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 // indirect🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 26, go.mod currently pins core OTEL at go.opentelemetry.io/otel/trace v1.40.0 but the OTEL exporter modules are still on v1.37.0; update any exporter require lines (e.g., modules under go.opentelemetry.io/otel/exporters/ or other go.opentelemetry.io/otel/* exporter packages referenced in go.mod) from v1.37.0 to v1.40.0 so all OTEL packages align, then run go get go.opentelemetry.io/otel@v1.40.0 (or go get <exporter>@v1.40.0) and go mod tidy to ensure dependencies are resolved. Ensure references to go.opentelemetry.io/otel/trace remain at v1.40.0 and verify builds/tests pass.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@go.mod`:
- Line 26: go.mod currently pins core OTEL at go.opentelemetry.io/otel/trace
v1.40.0 but the OTEL exporter modules are still on v1.37.0; update any exporter
require lines (e.g., modules under go.opentelemetry.io/otel/exporters/ or other
go.opentelemetry.io/otel/* exporter packages referenced in go.mod) from v1.37.0
to v1.40.0 so all OTEL packages align, then run go get
go.opentelemetry.io/otel@v1.40.0 (or go get <exporter>@v1.40.0) and go mod tidy
to ensure dependencies are resolved. Ensure references to
go.opentelemetry.io/otel/trace remain at v1.40.0 and verify builds/tests pass.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
1 participant
This PR contains the following updates:
v1.37.0->v1.40.0GitHub Vulnerability Alerts
CVE-2026-24051
Impact
The OpenTelemetry Go SDK in version
v1.20.0-1.39.0is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code insdk/resource/host_id.goexecutes theioregsystem command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.Patches
This has been patched in d45961b, which was released with
v1.40.0.References
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq / GO-2026-4394
More information
Details
Impact
The OpenTelemetry Go SDK in version
v1.20.0-1.39.0is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code insdk/resource/host_id.goexecutes theioregsystem command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.Patches
This has been patched in d45961b, which was released with
v1.40.0.References
Severity
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq / GO-2026-4394
More information
Details
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk)
v1.40.0: /v0.62.0/v0.16.0Compare Source
Overview
Added
Enabledmethod to all synchronous instrument interfaces (Float64Counter,Float64UpDownCounter,Float64Histogram,Float64Gauge,Int64Counter,Int64UpDownCounter,Int64Histogram,Int64Gauge,) ingo.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)AlwaysRecordsampler ingo.opentelemetry.io/otel/sdk/trace. (#7724)go.opentelemetry.io/otel/semconv/v1.39.0package. The package contains semantic conventions from thev1.39.0version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade fromgo.opentelemetry.io/otel/semconv/v1.38.0.(#7783, #7789)Changed
Exporteringo.opentelemetry.io/otel/exporters/prometheusignores metrics with the scopego.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)go.opentelemetry.io/otel/sdk/metric. (#7474)go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)HistogramReservoiringo.opentelemetry.io/otel/sdk/metric/exemplarby 4x. (#7443)go.opentelemetry.io/otel/sdk/metric. (#7478)go.opentelemetry.io/otel/sdk/metric. (#7702)FixedSizeReservoiringo.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)rpc.grpc.status_codeattribute in the experimental metrics emitted fromgo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpcis replaced with therpc.response.status_codeattribute to align with the semantic conventions. (#7854)rpc.grpc.status_codeattribute in the experimental metrics emitted fromgo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcis replaced with therpc.response.status_codeattribute to align with the semantic conventions. (#7854)Fixed
go.opentelemetry.io/otel/sdk/log. (#7662)DroppedAttributesonRecordingo.opentelemetry.io/otel/sdk/logto not count the non-attribute key-value pairs dropped because of key duplication. (#7662)SetAttributesonRecordingo.opentelemetry.io/otel/sdk/logto not log that attributes are dropped when they are actually not dropped. (#7662)WithHostIDdetector ingo.opentelemetry.io/otel/sdk/resourceto use full path forioregcommand on Darwin (macOS). (#7818)request.GetBodyingo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpto correctly handle HTTP2 GOAWAY frame. (#7794)Deprecated
go.opentelemetry.io/otel/exporters/zipkin. For more information, see the OTel blog post deprecating the Zipkin exporter. (#7670)What's Changed
8475f28by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/76922b6eea26by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/7694497cd9d5by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77088e75fd47by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/771002adc8cfby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/772557004b74by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77277e0dd3ddby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77322944ab1fby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/773330a764e5by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/774003f2a21fby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77399TestEmitinattributeby @itssaharsh in https://github.com/open-telemetry/opentelemetry-go/pull/7751492b5bcby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/7759919053a8by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77600AlwaysRecordsampler by @vitorvasc in https://github.com/open-telemetry/opentelemetry-go/pull/772499fd39fby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/777443f89685by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77855c6413dcby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/77955b8f7ae3by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/78199e5a2b31by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/782118e98ce8by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/78299d11affdby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/7838858372ceby @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/783998636f87by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/78411fcf36f6by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/7843373d1f95by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/78455New Contributors
Full Changelog: open-telemetry/opentelemetry-go@v1.39.0...v1.40.0
v1.39.0: /v0.61.0/v0.15.0/v0.0.14Compare Source
Overview
Added
go.opentelemetry.io/otel/sdk/metricusing hashing for map keys. (#7175)WithInstrumentationAttributeSetoption togo.opentelemetry.io/otel/log,go.opentelemetry.io/otel/metric, andgo.opentelemetry.io/otel/tracepackages. This provides a concurrent-safe and performant alternative toWithInstrumentationAttributesby accepting a pre-constructedattribute.Set. (#7287)go.opentelemetry.io/otel/exporters/prometheus. Check thego.opentelemetry.io/otel/exporters/prometheus/internal/xpackage documentation for more information. (#7345)go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)DeltaTemporalitySelector,CumulativeTemporalitySelector,LowMemoryTemporalitySelectortogo.opentelemetry.io/otel/sdk/metric. (#7434)go.opentelemetry.io/otel/sdk/log. (#7548)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)go.opentelemetry.io/otel/sdk/trace. (#7374)go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)go.opentelemetry.io/otel/sdk/metric. (#7524)go.opentelemetry.io/otel/sdk/metric. (#7571)OTEL_EXPORTER_OTLP_LOGS_INSECUREandOTEL_EXPORTER_OTLP_INSECUREenvironmental variables ingo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)Enabledmethod to theProcessorinterface ingo.opentelemetry.io/otel/sdk/log. AllProcessorimplementations now include anEnabledmethod. (#7639)go.opentelemetry.io/otel/semconv/v1.38.0package. The package contains semantic conventions from thev1.38.0version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade fromgo.opentelemetry.io/otel/semconv/v1.37.0.(#7648)Changed
Distinctingo.opentelemetry.io/otel/attributeis no longer guaranteed to uniquely identify an attribute set. Collisions betweenDistinctvalues for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)WithInstrumentationAttributesingo.opentelemetry.io/otel/tracesynchronously de-duplicates the passed attributes instead of delegating it to the returnedTracerOption. (#7266)WithInstrumentationAttributesingo.opentelemetry.io/otel/metersynchronously de-duplicates the passed attributes instead of delegating it to the returnedMeterOption. (#7266)WithInstrumentationAttributesingo.opentelemetry.io/otel/logsynchronously de-duplicates the passed attributes instead of delegating it to the returnedLoggerOption. (#7266)OTEL_GO_X_SELF_OBSERVABILITYenvironment variable toOTEL_GO_X_OBSERVABILITYingo.opentelemetry.io/otel/sdk/trace,go.opentelemetry.io/otel/sdk/log, andgo.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)Recordingo.opentelemetry.io/otel/sdk/metricwhen min and max are disabled usingNoMinMax. (#7306)prometheus.NewInvalidMetricingo.opentelemetry.io/otel/exporters/prometheus.NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with:promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)go.opentelemetry.io/otel/attributefor better performance. (#7371)TranslationStrategyingo.opentelemetry.io/exporters/prometheusis changed fromotlptranslator.NoUTF8EscapingWithSuffixestootlptranslator.UnderscoreEscapingWithSuffixes. (#7421)go.opentelemetry.io/otel/sdk/metric. (#7427)Span.Flagsfield ingo.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttpandgo.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)ErrorTypefunction ingo.opentelemetry.io/otel/semconv/v1.37.0now handles custom error types.If an error implements an
ErrorType() stringmethod, the return value of that method will be used as the error type. (#7442)Fixed
WithInstrumentationAttributesoptions ingo.opentelemetry.io/otel/trace,go.opentelemetry.io/otel/metric, andgo.opentelemetry.io/otel/logto properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)attribute.Setwhen using theEqualmethod is not affected by the user overriding the empty set pointed to byattribute.EmptySetingo.opentelemetry.io/otel/attribute. (#7357)go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7372)go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7372)go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#7372)go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7372)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7372)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7372)AddAttributes,SetAttributes,SetBodyonRecordingo.opentelemetry.io/otel/sdk/logto not mutate input. (#7403)RecordSetmethods ingo.opentelemetry.io/otel/semconv/v1.37.0. (#7655)RecordSetmethods ingo.opentelemetry.io/otel/semconv/v1.36.0. (#7656)Removed
FilterProcessorinterface ingo.opentelemetry.io/otel/sdk/log. TheEnabledmethod has been added to theProcessorinterface instead. AllProcessorimplementations must now implement theEnabledmethod. Custom processors that do not filter records can implementEnabledto returntrue. (#7639)What's Changed
ef028d9by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/727990261db7by @renovate[bot] inhttps://github.com/open-telemetry/opentelemetry-go/pull/72788Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.
Summary by CodeRabbit