Skip to content

[TT-16932] CVE-2026-39883 Fix #8081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
buger merged 4 commits into from
Apr 17, 2026
+22 −22

ammend tidy

9c9546b
Select commit
Loading
Failed to load commit list.
Merged

[TT-16932] CVE-2026-39883 Fix #8081

ammend tidy
9c9546b
Select commit
Loading
Failed to load commit list.
probelabs / Visor: security succeeded Apr 17, 2026 in 39s

✅ Check Passed (Warnings Found)

security check passed. Found 1 warning, but fail_if condition was not met.

Details

📊 Summary

  • Total Issues: 1
  • Warning Issues: 1

🔍 Failure Condition Results

Passed Conditions

  • global_fail_if: Condition passed

Issues by Category

Security (1)

  • ⚠️ go.mod:575 - The go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp package is explicitly pinned to an older version v0.49.0 using a replace directive, while newer versions up to v0.60.0 are available in the dependency tree. While version v0.49.0 is patched for known vulnerabilities (e.g., CVE-2024-28180), this pinning prevents the project from receiving future security patches and bug fixes for this package, creating a potential security risk.

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>

Annotations

Check warning on line 575 in go.mod

See this annotation in the file changed.

@probelabs probelabs / Visor: security

security Issue 

The `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` package is explicitly pinned to an older version `v0.49.0` using a `replace` directive, while newer versions up to `v0.60.0` are available in the dependency tree. While version `v0.49.0` is patched for known vulnerabilities (e.g., CVE-2024-28180), this pinning prevents the project from receiving future security patches and bug fixes for this package, creating a potential security risk.
Raw output 
It is recommended to update the application code to be compatible with the latest version of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` and remove the `replace` directive. If the pin is required to avoid breaking changes, a comment should be added to the `go.mod` file explaining the reason for the pin and a ticket should be created to address the required refactoring.
View more details on probelabs