Skip to content

deps: bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0 - #27

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc-1.46.0
Open

deps: bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc-1.46.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0.

Release notes

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.

... (truncated)

Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
deps: bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrac…
7b7b273 
…egrpc

Bumps [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.46.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.46.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.46.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 17, 2026
@dependabot
dependabot Bot requested review from a team as code owners September 17, 2026 21:05
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 17, 2026
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ❌ 1 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
See the Details below.

Vulnerabilities

go.mod

NameVersionVulnerabilitySeverity
google.golang.org/grpc1.83.1gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headershigh

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
gomod/google.golang.org/grpc 1.83.1 🟢 8.5
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 7SAST tool detected but not run on all commits
gomod/github.com/go-logr/logr 1.4.4 🟢 8
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1019 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 3Found 1/3 approved changesets -- score normalized to 3
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1021 out of 21 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 6 contributing companies or organizations
gomod/github.com/grpc-ecosystem/grpc-gateway/v2 2.30.0 🟢 6
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/29 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases🟢 84 out of the last 5 releases have a total of 4 signed artifacts.
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.70.0 🟢 9
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Signed-Releases🟢 84 out of the last 4 releases have a total of 4 signed artifacts.
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 45 contributing companies or organizations
gomod/go.opentelemetry.io/otel 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlptrace 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/stdout/stdouttrace 1.45.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/metric 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/sdk 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/sdk/metric 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/trace 1.46.0 🟢 9.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/golang.org/x/mod 0.38.0 UnknownUnknown
gomod/golang.org/x/net 0.58.0 UnknownUnknown
gomod/golang.org/x/text 0.41.0 UnknownUnknown
gomod/golang.org/x/tools 0.48.0 UnknownUnknown
gomod/google.golang.org/genproto/googleapis/api 0.0.0-20260819154853-08b0e4226688 🟢 8.2
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3
gomod/google.golang.org/genproto/googleapis/rpc 0.0.0-20260819154853-08b0e4226688 🟢 8.2
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3
gomod/google.golang.org/protobuf 1.36.12 UnknownUnknown

Scanned Files

  • go.mod

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants