fix(cve): upgrade OTel exporters v1.42.0 → v1.43.0 (GO-2026-4985)

[divyansh42]

CVE Details

GO-2026-4985 — Oversized OTLP HTTP response bodies can cause memory exhaustion in go.opentelemetry.io/otel/exporters/otlp

• Affected: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
• Affected: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
• Fixed in: v1.43.0
• More info: https://pkg.go.dev/vuln/GO-2026-4985

Fix Summary

Upgraded all go.opentelemetry.io/otel packages from v1.42.0 → v1.43.0 (minimum safe patch within same minor line) to close the memory exhaustion vector in OTLP HTTP exporters. Related transitive dependencies updated to remain consistent:

Package	Old	New
go.opentelemetry.io/otel	v1.42.0	v1.43.0
.../exporters/otlp/otlpmetric/otlpmetrichttp	v1.42.0	v1.43.0
.../exporters/otlp/otlptrace/otlptracehttp	v1.42.0	v1.43.0
.../exporters/otlp/otlpmetric/otlpmetricgrpc	v1.42.0	v1.43.0
.../exporters/otlp/otlptrace/otlptracegrpc	v1.42.0	v1.43.0
.../exporters/prometheus	v0.64.0	v0.65.0
.../exporters/stdout/stdouttrace	v1.42.0	v1.43.0
go.opentelemetry.io/contrib/instrumentation/*	v0.67.0	v0.68.0
google.golang.org/grpc (transitive)	v1.79.3	v1.80.0

Test Results ✅

go mod tidy   → OK
go mod verify → all modules verified
go mod vendor → OK (103 files changed in vendor/)
go test ./... → 5/5 test packages passed

Packages tested:

• pkg/cli/cmd/approve ✅
• pkg/cli/cmd/describe ✅
• pkg/cli/cmd/list ✅
• pkg/cli/cmd/reject ✅
• pkg/reconciler/approvaltask ✅

Breaking Changes

None. OTel v1.43.0 is backward-compatible with v1.42.0. gRPC v1.80.0 is a patch release.

Verification Steps

• Review go.mod and vendor/modules.txt changes
• Confirm CI passes
• Run govulncheck ./... post-merge to verify GO-2026-4985 is resolved

Risk Assessment

Low — Minor-version upgrade within stable OTel SDK (1.42 → 1.43). OTel follows semantic versioning; the v1.x series maintains API compatibility. gRPC bumped one patch version as a transitive dependency.

Note: Two github.com/tektoncd/pipeline@v1.11.0 vulnerabilities (GO-2026-4730, GO-2023-1901) have no fix available (no patched version released upstream). Separate tracking is recommended.

🤖 Generated with Claude Code

[infernus01]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: divyansh42, infernus01

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [divyansh42,infernus01]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.