chore(deps): update module go.opentelemetry.io/otel/sdk to v1.43.0 [security] by renovate-sh-app[bot] · Pull Request #165 · grafana/xk6-kubernetes

renovate-sh-app · 2026-02-20T06:02:11Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel/sdk	`v1.40.0` → `v1.43.0`

GitHub Vulnerability Alerts

CVE-2026-24051

Impact

The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

Patches

This has been patched in d45961b, which was released with v1.40.0.

References

CWE-426: Untrusted Search Path

CVE-2026-39883

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
Attacker places a malicious kenv binary earlier in $PATH
Application initializes OpenTelemetry resource detection at startup
hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

CVE-2026-39883 / GHSA-hfvc-g4fc-pqhx

More information

Details

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
Attacker places a malicious kenv binary earlier in $PATH
Application initializes OpenTelemetry resource detection at startup
hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

Severity

CVSS Score: 7.3 / 10 (High)
Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk)

`v1.43.0`: /v0.65.0/v0.19.0

Compare Source

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
make the implementation spec-compliant. (#8027)
Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
Responses exceeding the limit are treated as non-retryable errors. (#8108)
Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
Responses exceeding the limit are treated as non-retryable errors. (#8108)
Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
Responses exceeding the limit are treated as non-retryable errors. (#8108)
WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

What's Changed

chore(deps): update module github.com/jgautheron/goconst to v1.9.0 by @renovate[bot] in #8014
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 190d7d4 by @renovate[bot] in #8013
chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by @renovate[bot] in #8016
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.1 by @renovate[bot] in #8011
fix(deps): update golang.org/x by @renovate[bot] in #8023
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.2 by @renovate[bot] in #8020
chore(deps): update module github.com/mattn/go-runewidth to v0.0.21 by @renovate[bot] in #8017
chore(deps): update module codeberg.org/chavacava/garif to v0.2.1 by @renovate[bot] in #8019
Add doc on how to upgrade to new semconv by @jmmcorreia in #7807
fix(deps): update module go.opentelemetry.io/proto/otlp to v1.10.0 by @renovate[bot] in #8028
resource: add WithService detector option by @codeboten in #7642
fix(deps): update googleapis to a57be14 by @renovate[bot] in #8031
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.3 by @renovate[bot] in #8032
chore(deps): update module github.com/prometheus/procfs to v0.20.1 by @renovate[bot] in #8034
chore(deps): update github.com/securego/gosec/v2 digest to 8895462 by @renovate[bot] in #8036
chore(deps): update module github.com/sonatard/noctx to v0.5.1 by @renovate[bot] in #8040
chore(deps): update github.com/securego/gosec/v2 digest to 6e66a94 by @renovate[bot] in #8043
docs(otlp): document HTTP/protobuf insecure env vars by @marcschaeferger in #8037
Rebuild semconvkit and verifyreadmes on changes by @MrAlias in #7995
chore(sdk/trace): join errors properly by @ash2k in #8030
fix(deps): update googleapis to 84a4fc4 by @renovate[bot] in #8048
attribute: change INVALID Type to EMPTY and mark INVALID as deprecated by @pellared in #8038
fix(sdk/trace): return spec-compliant TraceIdRatioBased description by @ash2k in #8027
linting: add depguard rule to enforce semconv version by @ajuijas in #8041
chore(deps): update actions/download-artifact action to v8.0.1 by @renovate[bot] in #8046
chore(deps): update github.com/securego/gosec/v2 digest to b7b2c7b by @renovate[bot] in #8044
fix(deps): update golang.org/x by @renovate[bot] in #8045
Optimize attribute slice conversion by @MrAlias in #8039
Add benchmarks for end-to-end metrics SDK usage by @dashpole in #7768
fix(deps): update golang.org/x by @renovate[bot] in #8052
chore(deps): update github.com/securego/gosec/v2 digest to befce8d by @renovate[bot] in #8053
trace: add Random Trace ID Flag by @yuanyuanzhao3 in #8012
Improve aggregation concurrent safe tests by @dashpole in #8021
Add tests for exponential histogram concurrent-safety edge-cases by @dashpole in #8024
exphist: replace min, max, sum, and count with atomics by @dashpole in #8025
chore(deps): update github.com/securego/gosec/v2 digest to c2dfcec by @renovate[bot] in #8055
chore(deps): update otel/weaver docker tag to v0.22.0 by @renovate[bot] in #8058
chore(deps): update github.com/securego/gosec/v2 digest to dec52c4 by @renovate[bot] in #8063
chore(deps): update otel/weaver docker tag to v0.22.1 by @renovate[bot] in #8061
chore(deps): update github/codeql-action action to v4.33.0 by @renovate[bot] in #8065
Fix race in the lastvalue aggregation where 0 could be observed by @dashpole in #8056
chore(deps): update github.com/securego/gosec/v2 digest to 744bfb5 by @renovate[bot] in #8064
Migrate to new bare metal runner (Ubuntu 24) by @trask in #8068
sdk/resource: add WithContext variants for Default and Environment (#7808) by @ajuijas in #8051
Use atomics for exponential histogram buckets by @dashpole in #8057
Added the internal/observ package to stdoutlog by @yumosx in #7735
Add support for the development per-series starttime feature by @dashpole in #8060
sdk/trace/internal/observ: guard SpanStarted and spanLive with Enabled by @kouji-yoshimura in #8067
Cleanup exemplar featuregate readme by @dashpole in #8072
chore(deps): update codecov/codecov-action action to v5.5.3 by @renovate[bot] in #8080
chore(deps): update module github.com/ryanrolds/sqlclosecheck to v0.6.0 by @renovate[bot] in #8083
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to de6f1cc by @renovate[bot] in #8082
chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.54.0 by @renovate[bot] in #8085
chore(deps): update module github.com/securego/gosec/v2 to v2.25.0 by @renovate[bot] in #8084
chore(deps): update module github.com/protonmail/go-crypto to v1.4.1 by @renovate[bot] in #8081
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.54.0 by @renovate[bot] in #8086
chore(deps): update actions/cache action to v5.0.4 by @renovate[bot] in #8079
chore(deps): update module github.com/fatih/color to v1.19.0 by @renovate[bot] in #8087
fix(deps): update googleapis to d00831a by @renovate[bot] in #8078
chore(deps): update golang.org/x/telemetry digest to b6b0c46 by @renovate[bot] in #8076
fix(deps): update module google.golang.org/grpc to v1.79.3 [security] by @renovate[bot] in #8075
sdk/metric: Support specifying cardinality limits per instrument kinds by @petern48 in #7855
chore(deps): update github/codeql-action action to v4.34.0 by @renovate[bot] in #8088
chore(deps): update codspeedhq/action action to v4.12.1 by @renovate[bot] in #8089
chore(deps): update github/codeql-action action to v4.34.1 by @renovate[bot] in #8090
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.4 by @renovate[bot] in #8092
chore: fix noctx issues by @mmorel-35 in #8008
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.0 by @renovate[bot] in #8095
chore(deps): update codecov/codecov-action action to v5.5.4 by @renovate[bot] in #8097
chore(deps): update codecov/codecov-action action to v6 by @renovate[bot] in #8098
chore(deps): update module github.com/tetafro/godot to v1.5.6 by @renovate[bot] in #8099
chore(deps): update module github.com/butuzov/ireturn to v0.4.1 by @renovate[bot] in #8100
chore(deps): update github/codeql-action action to v4.35.0 by @renovate[bot] in #8101
chore(deps): update actions/setup-go action to v6.4.0 by @renovate[bot] in #8107
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.1 by @renovate[bot] in #8106
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.0 by @renovate[bot] in #8103
chore(deps): update github/codeql-action action to v4.35.1 by @renovate[bot] in #8102
chore(deps): update module github.com/hashicorp/go-version to v1.9.0 by @renovate[bot] in #8109
metricdatatest: Improve printing of diffs by @dashpole in #8073
fix(deps): update googleapis to d5a96ad by @renovate[bot] in #8112
chore(deps): update codspeedhq/action action to v4.13.0 by @renovate[bot] in #8114
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.55.0 by @renovate[bot] in #8119
chore(deps): update fossas/fossa-action action to v1.9.0 by @renovate[bot] in #8118
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 by @renovate[bot] in #8115
fix(deps): update googleapis to 9d38bb4 by @renovate[bot] in #8117
fix: support getBody in otelploghttp by @Tpuljak in #8096
fix(deps): update module google.golang.org/grpc to v1.80.0 by @renovate[bot] in #8121
Use an absolute path when calling bsd kenv by @dmathieu in #8113
limit response body size for OTLP HTTP exporters by @pellared in #8108
chore(deps): update github.com/golangci/dupl digest to c99c5cf by @renovate[bot] in #8122
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 by @renovate[bot] in #8131
Release v1.43.0 / v0.65.0 / v0.19.0 by @dmathieu in #8128

New Contributors

@jmmcorreia made their first contribution in #7807
@marcschaeferger made their first contribution in #8037
@ajuijas made their first contribution in #8041
@yuanyuanzhao3 made their first contribution in #8012
@kouji-yoshimura made their first contribution in #8067
@Tpuljak made their first contribution in #8096

Full Changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

`v1.42.0`: /v0.64.0/v0.18.0/v0.0.16

Compare Source

Added

Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

Drop support for [Go 1.24]. (#7984)

What's Changed

fix changelog protection marker by @pellared in #7986
Drop support for Go 1.24 by @MrAlias in #7984
fix(deps): update golang.org/x by @renovate[bot] in #7907
chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @renovate[bot] in #7981
chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @renovate[bot] in #7989
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.53.0 by @renovate[bot] in #7982
Revert "Revert "Generate semconv/v1.40.0"" by @MrAlias in #7985
support stdlib request.GetBody on metrics by @marifari-hue in #7931
attribute: add TestNotEquivalence and equality operator tests by @pellared in #7979
Refactor benchmark CI by @XSAM in #7873
chore(deps): update module github.com/securego/gosec/v2 to v2.24.7 by @renovate[bot] in #7988
chore(deps): pin codspeedhq/action action to df47568 by @renovate[bot] in #7996
chore(deps): update actions/checkout action to v6.0.2 by @renovate[bot] in #7997
chore(deps): update codspeedhq/action action to v4.11.0 by @renovate[bot] in #7999
Upgrade to semconv/v1.40.0 by @MrAlias in #7991
Regenerate semconv/v1.40.0/MIGRATION.md by @MrAlias in #7992
fix: generated semconv helpers skipping attributes by @victoraugustolls in #7964
Feat: Have SpanContext support the new W3C random flag. by @nikhilmantri0902 in #7834
Semconv metric helper caller-slice mutation fix by @MrAlias in #7993
Fix semconv generated error type to check error chain for custom type declaration by @MrAlias in #7994
refactor: replace uint64 and int32 with atomic types in tests by @alexandear in #7941
chore(deps): update golang.org/x/telemetry digest to 18da590 by @renovate[bot] in #8000
TracerProvider ForceFlush() Error Fix by @sawamurataxman in #7856
log: add error field to Record and make SDK to emit exception attributes by @iblancasa in #7924
chore(deps): update dependency codespell to v2.4.2 by @renovate[bot] in #8003
chore(deps): update github/codeql-action action to v4.32.6 by @renovate[bot] in #8004
chore(deps): update codspeedhq/action action to v4.11.1 by @renovate[bot] in #8001
fix(deps): update module google.golang.org/grpc to v1.79.2 by @renovate[bot] in #8007
chore(deps): update module github.com/mgechev/revive to v1.15.0 by @renovate[bot] in #8009
chore(deps): update golang.org/x/telemetry digest to e526e8a by @renovate[bot] in #8010
Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 by @pellared in #8006

New Contributors

@marifari-hue made their first contribution in #7931
@victoraugustolls made their first contribution in #7964
@sawamurataxman made their first contribution in #7856
@iblancasa made their first contribution in #7924

Full Changelog: open-telemetry/opentelemetry-go@v1.41.0...v1.42.0

`v1.41.0`: /v0.63.0/v0.17.0/v0.0.15

Compare Source

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

Support testing of Go 1.26. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

What's Changed

fix(deps): update googleapis to ce8ad4c by @renovate[bot] in #7860
chore(deps): update otel/weaver docker tag to v0.21.0 by @renovate[bot] in #7865
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.51.0 by @renovate[bot] in #7863
chore(deps): update golang.org/x/telemetry digest to fe4bb1c by @renovate[bot] in #7861
chore(deps): update golang.org/x/telemetry digest to aaaaaa5 by @renovate[bot] in #7869
sdk/log/observ: guard LogProcessed with Enabled by @NesterovYehor in #7848
stdouttrace observability: skip metric work when instruments are disabled by @NesterovYehor in #7853
chore(deps): update otel/weaver docker tag to v0.21.2 by @renovate[bot] in #7870
fix(deps): update googleapis to 546029d by @renovate[bot] in #7871
stdoutmetric observ: skip metric work when instruments are disabled by @NesterovYehor in #7868
chore(deps): update fossas/fossa-action action to v1.8.0 by @renovate[bot] in #7879
chore(deps): update github/codeql-action action to v4.32.2 by @renovate[bot] in #7878
chore(deps): update module github.com/ghostiam/protogetter to v0.3.20 by @renovate[bot] in #7877
chore(deps): update golang.org/x/telemetry digest to 86a5c4b by @renovate[bot] in #7876
fix(deps): update module golang.org/x/sys to v0.41.0 by @renovate[bot] in #7885
chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.6.0 by @renovate[bot] in #7884
Checked if instrument enabled before measuring in prometheus by @itssaharsh in #7866
exporter/otlploghttp: guard observ metrics with Enabled checks by @NesterovYehor in #7813
chore(deps): update module github.com/go-git/go-git/v5 to v5.16.5 by @renovate[bot] in #7886
chore(deps): update golang.org/x by @renovate[bot] in #7887
fix(deps): update golang.org/x by @renovate[bot] in #7890
fix(deps): update golang.org/x to 2842357 by @renovate[bot] in #7891
fix(deps): update googleapis to 4cfbd41 by @renovate[bot] in #7889
Checked if instrument enabled before measuring in oteltracegrpc by @itssaharsh in #7825
Checked if Instrument Enabled before measuring in otlpgrpc by @itssaharsh in #7824
chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27.8 by @renovate[bot] in #7892
chore(deps): update module github.com/golangci/golines to v0.15.0 by @renovate[bot] in #7893
chore(deps): update module github.com/golangci/misspell to v0.8.0 by @renovate[bot] in #7894
chore(deps): update golang.org/x/telemetry digest to 9f66fae by @renovate[bot] in #7898
fix(deps): update module google.golang.org/grpc to v1.79.0 by @renovate[bot] in #7906
Support Go 1.26 by @dmathieu in #7902
fix(deps): update module google.golang.org/grpc to v1.79.1 by @renovate[bot] in #7908
chore(deps): update github/codeql-action action to v4.32.3 by @renovate[bot] in #7909
chore(deps): update module github.com/kevinburke/ssh_config to v1.5.0 by @renovate[bot] in #7911
chore(deps): update module github.com/kevinburke/ssh_config to v1.6.0 by @renovate[bot] in #7913
chore(deps): update actions/stale action to v10.2.0 by @renovate[bot] in #7917
chore(deps): update module github.com/godoc-lint/godoc-lint to v0.11.2 by @renovate[bot] in #7916
chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.7.0 by @renovate[bot] in #7915
chore(deps): update module github.com/mattn/go-runewidth to v0.0.20 by @renovate[bot] in #7918
chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.28.0 by @renovate[bot] in #7921
Checked if Operation Enabled in otlptracehttp before performing operation by @itssaharsh in #7881
chore(deps): update github/codeql-action action to v4.32.4 by @renovate[bot] in #7936
chore(deps): update module github.com/mirrexone/unqueryvet to v1.5.4 by @renovate[bot] in #7939
chore(deps): update module github.com/uudashr/gocognit to v1.2.1 by @renovate[bot] in #7947
chore(deps): update module github.com/alexkohler/prealloc to v1.0.3 by @renovate[bot] in #7950
chore(deps): update module github.com/go-git/go-billy/v5 to v5.8.0 by @renovate[bot] in #7953
chore(deps): update lycheeverse/lychee-action action to v2.8.0 by @renovate[bot] in #7959
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.0 by @renovate[bot] in #7960
chore(deps): update actions/setup-go action to v6.3.0 by @renovate[bot] in #7962
Document metric api interfaces that methods need to be safe to be called concurrently by @dashpole in #7952
ci: add govulncheck job to CI workflow and update lint target by @pellared in #7971
Comply with W3C Baggage specification limits by @XSAM in [#7880](https://redirect.github.com/open-telemetry/opentele

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

renovate-sh-app · 2026-02-20T06:02:15Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`go.opentelemetry.io/otel`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/metric`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.40.0` -> `v1.43.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.42.0`

CLAassistant · 2026-02-20T06:02:18Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

renovate-sh-app · 2026-04-08T12:02:05Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

renovate-sh-app · 2026-04-08T14:11:08Z

Rebase requested. Renovate is processing this repository now.

…ecurity] | datasource | package | from | to | | ---------- | ---------------------------- | ------- | ------- | | go | go.opentelemetry.io/otel/sdk | v1.40.0 | v1.43.0 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

renovate-sh-app bot requested a review from a team as a code owner February 20, 2026 06:02

renovate-sh-app bot added automerge-security-update severity:UNKNOWN labels Feb 20, 2026

renovate-sh-app bot requested a review from oleiade February 20, 2026 06:02

renovate-sh-app bot enabled auto-merge (squash) February 20, 2026 06:02

renovate-sh-app bot changed the title ~~chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security]~~ chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security] - autoclosed Feb 26, 2026

renovate-sh-app bot closed this Feb 26, 2026

auto-merge was automatically disabled February 26, 2026 09:08
Pull request was closed

renovate-sh-app bot deleted the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch February 26, 2026 09:08

renovate-sh-app bot changed the title ~~chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security] - autoclosed~~ chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security] Feb 26, 2026

renovate-sh-app bot reopened this Feb 26, 2026

renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch 2 times, most recently from 901602c to 5ebfe65 Compare February 26, 2026 12:02

renovate-sh-app bot added severity: severity:UNKNOWN update-minor and removed severity:UNKNOWN severity: labels Mar 4, 2026

renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch from 5ebfe65 to c73912c Compare March 22, 2026 09:05

renovate-sh-app bot enabled auto-merge (squash) March 22, 2026 09:05

renovate-sh-app bot added severity: severity:UNKNOWN and removed severity:UNKNOWN severity: labels Mar 22, 2026

renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch from c73912c to eb043ec Compare April 3, 2026 00:02

renovate-sh-app bot added severity: severity:UNKNOWN and removed severity:UNKNOWN labels Apr 7, 2026

renovate-sh-app bot removed the severity: label Apr 7, 2026

ankur22 force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch from add68a0 to eb043ec Compare April 8, 2026 14:10

renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch 2 times, most recently from 437a807 to 967cadc Compare April 8, 2026 21:02

renovate-sh-app bot changed the title ~~chore(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security]~~ chore(deps): update module go.opentelemetry.io/otel/sdk to v1.43.0 [security] Apr 8, 2026

renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch from 967cadc to ea75a6f Compare April 9, 2026 15:01

renovate-sh-app bot added severity:HIGH and removed severity:UNKNOWN labels Apr 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update module go.opentelemetry.io/otel/sdk to v1.43.0 [security]#165

chore(deps): update module go.opentelemetry.io/otel/sdk to v1.43.0 [security]#165
renovate-sh-app[bot] wants to merge 1 commit intomainfrom
renovate/go-go.opentelemetry.io-otel-sdk-vulnerability

renovate-sh-app bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

renovate-sh-app bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Feb 20, 2026 •

edited by cla-assistant bot

Loading

Uh oh!

renovate-sh-app bot commented Apr 8, 2026

Uh oh!

renovate-sh-app bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate-sh-app bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2026-24051

Impact

Patches

References

CVE-2026-39883

Summary

Root Cause

Attack

Suggested Fix

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

Details

Summary

Root Cause

Attack

Suggested Fix

Severity

References

Release Notes

v1.43.0: /v0.65.0/v0.19.0

Added

Changed

Deprecated

Fixed

What's Changed

New Contributors

v1.42.0: /v0.64.0/v0.18.0/v0.0.16

Added

Changed

Fixed

Removed

What's Changed

New Contributors

v1.41.0: /v0.63.0/v0.17.0/v0.0.15

Added

Fixed

What's Changed

Configuration

Need help?

Uh oh!

renovate-sh-app bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

CLAassistant commented Feb 20, 2026 • edited by cla-assistant bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate-sh-app bot commented Apr 8, 2026

Edited/Blocked Notification

Uh oh!

renovate-sh-app bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate-sh-app bot commented Feb 20, 2026 •

edited

Loading

`v1.43.0`: /v0.65.0/v0.19.0

`v1.42.0`: /v0.64.0/v0.18.0/v0.0.16

`v1.41.0`: /v0.63.0/v0.17.0/v0.0.15

renovate-sh-app bot commented Feb 20, 2026 •

edited

Loading

CLAassistant commented Feb 20, 2026 •

edited by cla-assistant bot

Loading