Build(deps): Bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0#1105
Build(deps): Bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0#1105dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.41.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.41.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
Summary by CodeRabbit
WalkthroughOpenTelemetry Go module dependencies are upgraded from v1.39.0 to v1.41.0 in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 135-139: Update the vulnerable OpenTelemetry SDK module versions
in go.mod: change the entries for go.opentelemetry.io/otel/sdk and
go.opentelemetry.io/otel/sdk/metric from v1.39.0 to v1.43.0 to include fixes for
GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx; after editing the module lines, run
the Go tooling (e.g., go get go.opentelemetry.io/otel@v1.43.0 and go mod tidy)
to refresh go.sum and ensure the dependency graph and vendor files are updated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 65c03f38-3d6f-48d2-94eb-7d7d6ab41a26
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| go.opentelemetry.io/otel v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.39.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.41.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify current OTel versions in go.mod
rg -n 'go\.opentelemetry\.io/otel(/sdk|/sdk/metric|/metric|/trace)?\s+v' go.mod
# Verify advisory status for the pinned vulnerable package version via OSV
cat <<'JSON' | curl -sS https://api.osv.dev/v1/query -d `@-`
{
"package": { "name": "go.opentelemetry.io/otel/sdk", "ecosystem": "Go" },
"version": "1.39.0"
}
JSONRepository: openshift-online/ocm-cli
Length of output: 6600
Bump otel/sdk to v1.43.0 to fix two critical PATH hijacking vulnerabilities
Lines 137–138 pin go.opentelemetry.io/otel/sdk and go.opentelemetry.io/otel/sdk/metric to v1.39.0, which is vulnerable to two separate PATH hijacking CVEs:
- GHSA-9h8m-3fm2-qjrq (CVE-2026-24051 / GO-2026-4394) affects v1.21.0–v1.39.0 (patched in v1.40.0) — Darwin
ioregcommand execution vulnerability - GHSA-hfvc-g4fc-pqhx (CVE-2026-39883) affects v1.15.0–v1.42.0 (patched in v1.43.0) — BSD/Solaris
kenvcommand execution vulnerability
Bumping to v1.41.0 (as initially suggested) would only fix the first. Bump to v1.43.0 to address both:
Corrected go.mod update
- go.opentelemetry.io/otel/sdk v1.39.0 // indirect
- go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
+ go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+ go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go.opentelemetry.io/otel v1.41.0 // indirect | |
| go.opentelemetry.io/otel/metric v1.41.0 // indirect | |
| go.opentelemetry.io/otel/sdk v1.39.0 // indirect | |
| go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect | |
| go.opentelemetry.io/otel/trace v1.39.0 // indirect | |
| go.opentelemetry.io/otel/trace v1.41.0 // indirect | |
| go.opentelemetry.io/otel v1.41.0 // indirect | |
| go.opentelemetry.io/otel/metric v1.41.0 // indirect | |
| go.opentelemetry.io/otel/sdk v1.43.0 // indirect | |
| go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect | |
| go.opentelemetry.io/otel/trace v1.41.0 // indirect |
🧰 Tools
🪛 OSV Scanner (2.3.5)
[HIGH] 137-137: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 137-137: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 137-137: go.opentelemetry.io/otel/sdk 1.39.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 135 - 139, Update the vulnerable OpenTelemetry SDK
module versions in go.mod: change the entries for go.opentelemetry.io/otel/sdk
and go.opentelemetry.io/otel/sdk/metric from v1.39.0 to v1.43.0 to include fixes
for GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx; after editing the module lines,
run the Go tooling (e.g., go get go.opentelemetry.io/otel@v1.43.0 and go mod
tidy) to refresh go.sum and ensure the dependency graph and vendor files are
updated.
Bumps go.opentelemetry.io/otel from 1.39.0 to 1.41.0.
Changelog
Sourced from go.opentelemetry.io/otel's changelog.
... (truncated)
Commits
4575a97Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)66fc10dfix: add error handling for insecure HTTP endpoints with TLS client configura...76e6eecchore(deps): update github/codeql-action action to v4.32.5 (#7980)0d50f90Revert "Generate semconv/v1.40.0" (#7978)c38a4a5Generate semconv/v1.40.0 (#7929)0f1a224chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)c79ebf4chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)f758157chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)92a1164fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...3cd7c27chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.