Repository navigation
chore(deps): bump OpenTelemetry to v1.46.0 (GO-2026-6505) - #123
Merged
Merged
Conversation
govulncheck fails CI on GO-2026-6505 (OTLP exporter config logging can leak endpoint URLs), reachable through the forge dashboard's tracing setup. It is fixed in v1.45.0; every PR has failed the Security job since it was published. Bumps the OpenTelemetry modules together to v1.46.0 -- sdk, otlptrace, otlptracehttp, and with them otel/metric/trace and contrib otelhttp v0.70.0 -- rather than one per Dependabot PR (#116, #117, #118), which leaves the set at mixed versions in between. All are indirect.
juicycleff
requested review from
juicycleff
and
a balanced review from Copilot
and removed request for
Copilot
October 6, 2026 23:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI's Security job (govulncheck) now fails on every PR because of GO-2026-6505: the OTLP exporter's config logging can leak endpoint URLs into info logs. It's reachable through the forge dashboard's tracing setup and is fixed in
v1.45.0.mainlast passed CI on 6 Sep, before the advisory was published.What
All OpenTelemetry modules bumped together to
v1.46.0(all are indirect dependencies):otel/sdkotel/exporters/otlp/otlptraceotel/exporters/otlp/otlptrace/otlptracehttpotel,otel/metric,otel/tracecontrib/.../otelhttpGo's version resolution also moved
proto/otlp,grpc-gateway,genprotoandprotobufto the versions these require.This supersedes Dependabot #116, #117 and #118, which each move one module and leave the set at mixed versions in between. They can be closed once this merges.
Verification
go build ./...,go vet ./...andgo test ./...are green. govulncheck runs in CI.Unblocks #122 (organization role rank checks), whose Security job fails only on this.
🤖 Generated with Claude Code