*: bump go.opentelemetry.io/otel/sdk to v1.43.0 to fix CVE-2026-24051 #4884
+23
−14
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
For OpenTelemetry Go, arego.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0andgo.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0officially compatible withgo.opentelemetry.io/otel v1.43.0? Please cite the relevant compatibility policy or release notes.💡 Result:
No, they are not officially compatible. OpenTelemetry Go follows semantic versioning (SemVer 2.0) with Go modules. The core go.opentelemetry.io/otel module at v1.43.0 is a patch release within the v1 major version, providing API stability. However, go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc is an experimental v0 module (v0.49.0), where v0.y.z versions indicate initial development with no backwards compatibility guarantees—anything may change at any time per SemVer. Similarly, go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0 is significantly older than v1.43.0 (latest is v1.43.0), and Go module compatibility requires matching major versions for v1+ modules or explicit dependency alignment. pkg.go.dev listings show recent contrib otelgrpc versions (e.g., v0.68.0) and otlptrace (v1.22.0 depends on otel v1.22.0) align with corresponding otel versions, not v1.43.0. The VERSIONING.md policy states experimental v0 modules have weak stability, and stable modules version with the core, but mixing specific older patch/minor versions risks dependency conflicts or API mismatches. Use go mod tidy to verify, but per policy/release notes, these exact versions are not guaranteed compatible with otel v1.43.0.
Citations:
Update OpenTelemetry contrib and exporter dependencies to versions compatible with otel v1.43.0.
The current versions are incompatible:
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.22.0depends on otel v1.22.0, not v1.43.0, andgo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0is an experimental v0 module with no backwards compatibility guarantees. Per OpenTelemetry's VERSIONING.md policy, stable modules (v1+) version with the core otel, while v0 modules may introduce breaking changes. Recent versions like otelgrpc v0.68.0 align with current otel versions; verify pkg.go.dev for the minimum versions that support otel v1.43.0 and update accordingly to avoid dependency conflicts and API mismatches.🤖 Prompt for AI Agents