Skip to content

chore(deps): bump OpenTelemetry SDK to v1.44.0 / v0.20.0#517

Open
nickytd wants to merge 1 commit into
masterfrom
bump-otel-sdk
Open

chore(deps): bump OpenTelemetry SDK to v1.44.0 / v0.20.0#517
nickytd wants to merge 1 commit into
masterfrom
bump-otel-sdk

Conversation

@nickytd

@nickytd nickytd commented Jun 27, 2026

Copy link
Copy Markdown
Collaborator

How to categorize this PR?

/kind cleanup
/area logging
/area open-source

What this PR does / why we need it:

Bumps the OpenTelemetry Go SDK family from v1.43.0/v0.19.0 to v1.44.0/v0.20.0 (single upstream release v1.44.0/v0.66.0/v0.20.0, published 2026-05-27).

Modules upgraded:

Module From To
go.opentelemetry.io/otel v1.43.0 v1.44.0
go.opentelemetry.io/otel/sdk v1.43.0 v1.44.0
go.opentelemetry.io/otel/sdk/metric v1.43.0 v1.44.0
go.opentelemetry.io/otel/trace v1.43.0 v1.44.0
go.opentelemetry.io/otel/log v0.19.0 v0.20.0
go.opentelemetry.io/otel/sdk/log v0.19.0 v0.20.0
go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 v0.20.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 v0.20.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 v0.20.0
go.opentelemetry.io/otel/exporters/prometheus v0.65.0 v0.66.0

The bump is API-compatible — only go.mod and go.sum change.

Notable upstream fixes pulled in (full changelog):

  • Memory leak fixotlploghttp and otlpmetrichttp now correctly replay gzipped request bodies on HTTP redirects. The previous behavior could leak pooled gzip writer buffers per redirected request under sustained load behind a redirecting proxy/ingress. This plugin enables gzip by default, so the fix directly applies.
  • GC improvements in semconv — pooled slices and cached objects are now cleared after release so they can be garbage collected.
  • Prometheus exporter — fix concurrent Collect data race when WithResourceAsConstantLabels is configured (not triggered by current usage, but a relevant hardening since we use the Prometheus exporter for OTLP metrics passthrough).
  • All OTLP exporters gain a new WithMaxRequestSize option, defaulted to 64 MiB. Oversized requests are non-retryable.
  • Security advisories addressed upstream: GHSA-995v-fvrw-c78m (schema file descriptor leak) and GHSA-5wrp-cwcj-q835 (baggage extraction log flooding).

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Heads-up — not triggered by current usage, but worth knowing for future work:

  • sdk/metric in v1.44.0 applies a default cardinality limit of 2000 per instrument (previously unlimited). Attribute sets beyond the limit are folded into a synthetic set tagged otel.metric.overflow=true. If we ever produce per-shoot/per-namespace label combinations exceeding 2000 on a single meter, set WithCardinalityLimit(0) on the meter provider in pkg/client/otlp/metrics_setup.go to restore the old behavior.
  • attribute.Value.Emit() is deprecated in favor of Value.String(). We don't currently call it.

Verified locally:

go build ./...

passes clean. No source changes were necessary.

Release note:

Bump OpenTelemetry Go SDK to v1.44.0 / v0.20.0, picking up a memory-leak fix in the OTLP/HTTP exporter (gzip body replay on redirect), GC improvements in semconv, and a Prometheus exporter data-race fix.

@gardener-prow gardener-prow Bot added kind/cleanup Something that is not needed anymore and can be cleaned up area/logging Logging related area/open-source Open Source (community, enablement, contributions, conferences, CNCF, etc.) related cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 27, 2026
@gardener-prow

gardener-prow Bot commented Jun 27, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dnaeon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@nickytd nickytd requested a review from iypetrov June 27, 2026 11:42
@gardener-prow gardener-prow Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 27, 2026
Upgrades the OpenTelemetry Go SDK family:

- go.opentelemetry.io/otel               v1.43.0 -> v1.44.0
- go.opentelemetry.io/otel/sdk           v1.43.0 -> v1.44.0
- go.opentelemetry.io/otel/sdk/metric    v1.43.0 -> v1.44.0
- go.opentelemetry.io/otel/trace         v1.43.0 -> v1.44.0
- go.opentelemetry.io/otel/log           v0.19.0 -> v0.20.0
- go.opentelemetry.io/otel/sdk/log       v0.19.0 -> v0.20.0
- go.opentelemetry.io/otel/sdk/log/logtest        v0.19.0 -> v0.20.0
- go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 -> v0.20.0
- go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 -> v0.20.0
- go.opentelemetry.io/otel/exporters/prometheus    v0.65.0 -> v0.66.0

Notable upstream fixes pulled in:

- otlploghttp/otlpmetrichttp: replay gzipped request body on redirect,
  fixing a pooled-gzip-writer leak under sustained load behind a
  redirecting proxy.
- semconv: clear cached/pooled slices to enable GC.
- prometheus exporter: fix concurrent Collect data race when
  WithResourceAsConstantLabels is used.
- All OTLP exporters gain WithMaxRequestSize (default 64 MiB).

Heads-up (not triggered by current usage, but worth noting):
sdk/metric now applies a default cardinality limit of 2000. Use
WithCardinalityLimit(0) on the meter provider to restore unlimited
cardinality if needed.
@gardener-prow gardener-prow Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/logging Logging related area/open-source Open Source (community, enablement, contributions, conferences, CNCF, etc.) related cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. kind/cleanup Something that is not needed anymore and can be cleaned up size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant