Skip to content

chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.43.0 to 1.45.0 in /cli - #1496

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/go_modules/cli/go.opentelemetry.io/otel/exporters/otlp/otlptrace-1.45.0
Open

chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.43.0 to 1.45.0 in /cli#1496
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/go_modules/cli/go.opentelemetry.io/otel/exporters/otlp/otlptrace-1.45.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.43.0 to 1.45.0.

Release notes

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace's releases.

Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

Overview

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

... (truncated)

Commits
  • 93a693e Release v1.45.0 (#8693)
  • c65d435 Merge commit from fork
  • 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
  • 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
  • a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
  • 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
  • cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
  • e814a72 Merge commit from fork
  • bfd8eb7 chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#8687)
  • 48db2c6 chore(deps): update github/codeql-action action to v4.37.5 (#8692)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 25, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 25, 2026 10:33
@dependabot dependabot Bot added go Pull requests that update go code dependencies Pull requests that update a dependency file labels Sep 25, 2026
@greptile-apps

greptile-apps Bot commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

PR author is not in the allowed authors list.

@dependabot
chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace
81f013a 
Bumps [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) from 1.43.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.45.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/cli/go.opentelemetry.io/otel/exporters/otlp/otlptrace-1.45.0 branch from 1d74539 to 81f013a Compare September 25, 2026 11:48
@github-actions

github-actions Bot commented Sep 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Capslock capability diff: cli

  • Base: main (3c4d20f1eec349a8baf55a92f1622f2d3e0b9ee7)
  • Baseline: generated from base revision
  • New high-signal capabilities (EXEC / NETWORK / FILES / SYSTEM_CALLS / ARBITRARY_EXECUTION / MODIFY_SYSTEM_STATE): 9
  • Likely package moves: 7, lower signal: 7, no longer present: 14

🚨 Review closely: 9 new high-signal capability use(s)

A dependency gaining one of these without a matching change in what it does is the
signature of a compromised release. Read each call path before merging.

  • go.opentelemetry.io/otel/sdk/internal/attrnorm gained ARBITRARY_EXECUTION
                       github.com/cosmos/ibc/cli/internal/otel.WrapConnectHandler
otel.go:95:52          connectrpc.com/otelconnect.NewInterceptor
interceptor.go:56:42   (*go.opentelemetry.io/otel/sdk/trace.TracerProvider).Tracer
provider.go:153:26     go.opentelemetry.io/otel/sdk/internal/attrnorm.Set
dedup.go:118:25        go.opentelemetry.io/otel/attribute.NewSet
set.go:210:28          go.opentelemetry.io/otel/attribute.NewSetWithFiltered
set.go:262:17          go.opentelemetry.io/otel/attribute.newSet
set.go:361:16          go.opentelemetry.io/otel/attribute.hashKVs
hash.go:40:13          go.opentelemetry.io/otel/attribute.hashKV
hash.go:53:14          (go.opentelemetry.io/otel/attribute/internal/xxhash.Hash).String
xxhash.go:54:27        (*github.com/cespare/xxhash/v2.Digest).WriteString
xxhash_unsafe.go:46:9  (*github.com/cespare/xxhash/v2.Digest).Write
xxhash.go:101:20       github.com/cespare/xxhash/v2.writeBlocks
  • go.opentelemetry.io/otel/sdk/metric/internal/attrnorm gained ARBITRARY_EXECUTION
                       github.com/cosmos/ibc/cli/internal/otel.New
otel.go:73:25          go.opentelemetry.io/contrib/instrumentation/runtime.Start
runtime.go:71:32       (*go.opentelemetry.io/otel/sdk/metric.MeterProvider).Meter
provider.go:80:26      go.opentelemetry.io/otel/sdk/metric/internal/attrnorm.Set
dedup.go:118:25        go.opentelemetry.io/otel/attribute.NewSet
set.go:210:28          go.opentelemetry.io/otel/attribute.NewSetWithFiltered
set.go:262:17          go.opentelemetry.io/otel/attribute.newSet
set.go:361:16          go.opentelemetry.io/otel/attribute.hashKVs
hash.go:40:13          go.opentelemetry.io/otel/attribute.hashKV
hash.go:53:14          (go.opentelemetry.io/otel/attribute/internal/xxhash.Hash).String
xxhash.go:54:27        (*github.com/cespare/xxhash/v2.Digest).WriteString
xxhash_unsafe.go:46:9  (*github.com/cespare/xxhash/v2.Digest).Write
xxhash.go:101:20       github.com/cespare/xxhash/v2.writeBlocks
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained ARBITRARY_EXECUTION (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                           github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43             go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34         go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41     go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67  go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30          (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30            (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28             (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11             (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16             (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38            (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68         (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16         go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19  (github.com/go-logr/logr.Logger).Error
logr.go:301:14             (*github.com/go-logr/logr.slogSink).Error
slogsink.go:77:7           (*github.com/go-logr/logr.slogSink).log
slogsink.go:93:22          (*github.com/rs/zerolog.SlogHandler).Handle
slog.go:71:11              (*github.com/rs/zerolog.Event).Msg
event.go:119:7             (*github.com/rs/zerolog.Event).msg
event.go:160:19            (*github.com/rs/zerolog.Event).write
event.go:89:27             (github.com/rs/zerolog.LevelWriterAdapter).WriteLevel
writer.go:27:17            (github.com/rs/zerolog.ConsoleWriter).Write
console.go:172:22          (*bytes.Buffer).WriteTo
buffer.go:279:18           (*github.com/ethereum/go-ethereum/crypto/keccak.state).Write
sha3.go:129:13             (*github.com/ethereum/go-ethereum/crypto/keccak.state).permute
sha3.go:86:13              github.com/ethereum/go-ethereum/crypto/keccak.keccakF1600
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained FILES (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                           github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43             go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34         go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41     go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67  go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30          (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30            (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28             (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11             (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16             (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38            (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68         (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16         go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19  (github.com/go-logr/logr.Logger).Error
logr.go:301:14             (*github.com/go-logr/logr.slogSink).Error
slogsink.go:77:7           (*github.com/go-logr/logr.slogSink).log
slogsink.go:93:22          (*log/slog.JSONHandler).Handle
json_handler.go:89:31      (*log/slog.commonHandler).handle
handler.go:322:21          (*os.File).Write
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained MODIFY_SYSTEM_STATE/ENV (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                                 github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43                   go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34               go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41           go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67        go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30                (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29                  (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30                  (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28                   (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11                   (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16                   (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22                  (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38                  (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68               (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16               go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19        (github.com/go-logr/logr.Logger).Error
logr.go:301:14                   (*github.com/go-logr/logr.slogSink).Error
slogsink.go:77:7                 (*github.com/go-logr/logr.slogSink).log
slogsink.go:93:22                (*go.opentelemetry.io/contrib/bridges/otelslog.Handler).Handle
handler.go:194:15                (*go.opentelemetry.io/otel/sdk/log.logger).Emit
logger.go:56:26                  (*go.opentelemetry.io/otel/sdk/log.logger).newRecord
logger.go:120:18                 (*go.opentelemetry.io/otel/log.Record).WalkAttributes
record.go:128:8                  (*go.opentelemetry.io/otel/sdk/log.logger).newRecord$1
logger.go:125:26                 (*go.opentelemetry.io/otel/sdk/log.Record).AddAttributes
record.go:238:27                 sync.OnceFunc$1
                                 sync.OnceFunc$1$1
oncefunc.go:33:7                 google.golang.org/grpc/internal/stats.defaultCleanUp$1
metrics_recorder_list.go:153:14  github.com/cometbft/cometbft/libs/cli.PrepareBaseCmd$1
setup.go:29:37                   github.com/cometbft/cometbft/libs/cli.initEnv
setup.go:49:13                   github.com/cometbft/cometbft/libs/cli.copyEnvVars
setup.go:68:14                   os.Setenv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained MODIFY_SYSTEM_STATE/LOGGING (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                                 github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43                   go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34               go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41           go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67        go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30                (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29                  (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30                  (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28                   (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11                   (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16                   (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22                  (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38                  (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68               (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16               go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19        (github.com/go-logr/logr.Logger).Error
logr.go:301:14                   (*github.com/go-logr/logr.slogSink).Error
slogsink.go:77:7                 (*github.com/go-logr/logr.slogSink).log
slogsink.go:93:22                (*go.opentelemetry.io/contrib/bridges/otelslog.Handler).Handle
handler.go:194:15                (*go.opentelemetry.io/otel/sdk/log.logger).Emit
logger.go:56:26                  (*go.opentelemetry.io/otel/sdk/log.logger).newRecord
logger.go:120:18                 (*go.opentelemetry.io/otel/log.Record).WalkAttributes
record.go:128:8                  (*go.opentelemetry.io/otel/sdk/log.logger).newRecord$1
logger.go:125:26                 (*go.opentelemetry.io/otel/sdk/log.Record).AddAttributes
record.go:238:27                 sync.OnceFunc$1
                                 sync.OnceFunc$1$1
oncefunc.go:33:7                 google.golang.org/grpc/internal/stats.defaultCleanUp$1
metrics_recorder_list.go:153:14  github.com/cosmos/ibc/cli/cmd/ibc.init#1$1
main.go:48:18                    log/slog.SetDefault
logger.go:73:15                  log.SetFlags
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained MODIFY_SYSTEM_STATE/SIGNALS (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                           github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43             go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34         go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41     go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67  go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30          (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30            (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28             (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11             (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16             (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38            (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68         (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16         go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19  (github.com/go-logr/logr.Logger).Error
logr.go:301:14             (*github.com/go-logr/logr/funcr.fnlogger).Error
                           (github.com/go-logr/logr/funcr.fnlogger).Error
funcr.go:187:31            (github.com/go-logr/logr/funcr.Formatter).FormatError
funcr.go:901:26            (os/signal.signalError).Error
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained NETWORK (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                           github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43             go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34         go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41     go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67  go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30          (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30            (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28             (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11             (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16             (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38            (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68         (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16         go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19  (github.com/go-logr/logr.Logger).Error
logr.go:301:14             (*github.com/go-logr/logr/funcr.fnlogger).Error
                           (github.com/go-logr/logr/funcr.fnlogger).Error
funcr.go:187:31            (github.com/go-logr/logr/funcr.Formatter).FormatError
funcr.go:901:26            (github.com/cometbft/cometbft/p2p.ErrRejected).Error
errors.go:45:22            (*net.pipe).RemoteAddr
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained SYSTEM_CALLS (the same capability left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv in this diff, so this may be a package move -- confirm the pairing)
                           github.com/cosmos/ibc/cli/internal/otel.newSimpleMeterProvider
otel.go:127:43             go.opentelemetry.io/otel/exporters/prometheus.New
exporter.go:115:34         go.opentelemetry.io/otel/sdk/metric.NewManualReader
manual_reader.go:56:41     go.opentelemetry.io/otel/sdk/metric/internal/observ.NewInstrumentation
instrumentation.go:105:67  go.opentelemetry.io/otel/semconv/v1.43.0/otelconv.NewSDKMetricReaderCollectionDuration
metric.go:1956:30          (*go.opentelemetry.io/otel/sdk/metric.meter).Float64Histogram
meter.go:289:29            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookupHistogram
meter.go:782:30            (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup
cache.go:78:28             (*go.opentelemetry.io/otel/sdk/metric.cache[go.opentelemetry.io/otel/sdk/metric.instID, go.opentelemetry.io/otel/sdk/metric.valAndErr[*go.opentelemetry.io/otel/sdk/metric.float64Inst]]).Lookup
cache.go:33:11             (*go.opentelemetry.io/otel/sdk/metric.cacheWithErr[go.opentelemetry.io/otel/sdk/metric.instID, *go.opentelemetry.io/otel/sdk/metric.float64Inst]).Lookup$1
cache.go:79:16             (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).lookup$1
meter.go:771:22            (go.opentelemetry.io/otel/sdk/metric.float64InstProvider).aggs
meter.go:734:38            (go.opentelemetry.io/otel/sdk/metric.resolver[float64]).Aggregators
pipeline.go:681:68         (*go.opentelemetry.io/otel/sdk/metric.inserter[float64]).readerDefaultAggregation
pipeline.go:339:16         go.opentelemetry.io/otel/internal/global.Error
internal_logging.go:50:19  (github.com/go-logr/logr.Logger).Error
logr.go:301:14             (*github.com/go-logr/logr.slogSink).Error
slogsink.go:77:7           (*github.com/go-logr/logr.slogSink).log
slogsink.go:93:22          (*github.com/rs/zerolog.SlogHandler).Handle
slog.go:71:11              (*github.com/rs/zerolog.Event).Msg
event.go:119:7             (*github.com/rs/zerolog.Event).msg
event.go:160:19            (*github.com/rs/zerolog.Event).write
event.go:89:27             (github.com/rs/zerolog.LevelWriterAdapter).WriteLevel
writer.go:27:17            (github.com/rs/zerolog.ConsoleWriter).Write
console.go:172:22          (*bytes.Buffer).WriteTo
buffer.go:279:18           (*github.com/cockroachdb/pebble/vfs.syncingFile).Write
syncing_file.go:61:19      (*github.com/cockroachdb/pebble/vfs.syncingFile).preallocate
syncing_file.go:89:22      (*github.com/cockroachdb/pebble/vfs.linuxFile).Preallocate
default_linux.go:61:23     golang.org/x/sys/unix.Fallocate

Likely a package move: 7 capability use(s)

The same capability disappeared from another package in this diff, which is what a
vendored or renamed package looks like rather than new privilege. Heuristic, so
confirm the pairing makes sense.

  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained CGO, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained OPERATING_SYSTEM, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained READ_SYSTEM_STATE, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained REFLECT, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained RUNTIME, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained UNANALYZED, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv
  • go.opentelemetry.io/otel/semconv/v1.43.0/otelconv gained UNSAFE_POINTER, which left go.opentelemetry.io/otel/semconv/v1.41.0/otelconv

Lower signal: 7 capability use(s)

These describe the Capslock analysis more than they describe privilege.

  • go.opentelemetry.io/otel/sdk/internal/attrnorm gained REFLECT
  • go.opentelemetry.io/otel/sdk/metric/internal/attrnorm gained REFLECT
  • go.opentelemetry.io/otel/semconv/internal/metricpool gained REFLECT
  • go.opentelemetry.io/otel/semconv/v1.43.0 gained REFLECT
  • go.opentelemetry.io/otel/semconv/v1.43.0 gained UNANALYZED
  • go.opentelemetry.io/otel/sdk/internal/attrnorm gained UNSAFE_POINTER
  • go.opentelemetry.io/otel/sdk/metric/internal/attrnorm gained UNSAFE_POINTER

No longer present: 14 capability use(s)

Reported for completeness; removing code legitimately drops capabilities.

  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses ARBITRARY_EXECUTION
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses CGO
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses FILES
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses MODIFY_SYSTEM_STATE/ENV
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses MODIFY_SYSTEM_STATE/LOGGING
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses MODIFY_SYSTEM_STATE/SIGNALS
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses NETWORK
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses OPERATING_SYSTEM
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses READ_SYSTEM_STATE
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses REFLECT
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses RUNTIME
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses SYSTEM_CALLS
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses UNANALYZED
  • go.opentelemetry.io/otel/semconv/v1.41.0/otelconv no longer uses UNSAFE_POINTER

@github-actions

github-actions Bot commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Vulnerable dependencies

3 advisories across 3 libraries need attention, 2 accepted.

🚨 Needs attention

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc

In use: v1.43.0 — reached from cli, e2e

Advisory CVE Fixed in Summary
GO-2026-6505 CVE-2026-81870 v1.45.0 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc

In use: v0.19.0 — reached from cli, e2e

Advisory CVE Fixed in Summary
GO-2026-6508 CVE-2026-81871 v0.21.0 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc

go.opentelemetry.io/otel/sdk/log

In use: v0.19.0 — reached from cli, e2e

Advisory CVE Fixed in Summary
GO-2026-6615 CVE-2026-81872 v0.21.0 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log

Run make vulncheck for the call paths. Either upgrade the library, or add the
advisory to .govulncheck-ignore with a reason if no fix exists yet.

Accepted

Listed in .govulncheck-ignore with a reason.

github.com/pion/dtls/v2

In use: v2.2.12 — reached from cli, e2e

Advisory CVE Fixed in Summary
GO-2026-4479 CVE-2026-26014 no fix yet Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

golang.org/x/crypto

In use: v0.56.0 — reached from cli, e2e

Advisory CVE Fixed in Summary
GO-2026-5932 — no fix yet The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

From make vulncheck-json on this run: logs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dianab-cl