Skip to content

Address recent CVEs #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mason-sharp merged 1 commit into from
Jul 29, 2026
Merged

Address recent CVEs #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,12 +85,12 @@ require (
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/go-version v1.8.0 // indirect
github.com/in-toto/attestation v1.1.2 // indirect
github.com/in-toto/in-toto-golang v0.10.0 // indirect
github.com/in-toto/attestation v1.2.0 // indirect
github.com/in-toto/in-toto-golang v0.11.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
github.com/jackc/pgio v1.0.0 // indirect
Expand Down Expand Up @@ -136,11 +136,11 @@ require (
github.com/rivo/uniseg v0.4.7 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/shirou/gopsutil/v4 v4.26.2 // indirect
github.com/sigstore/sigstore v1.10.4 // indirect
github.com/sigstore/sigstore-go v1.1.4 // indirect
github.com/sigstore/sigstore v1.10.8 // indirect
github.com/sigstore/sigstore-go v1.2.0 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
github.com/spf13/cobra v1.10.2 // indirect
Expand All @@ -155,21 +155,22 @@ require (
github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.44.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.44.0 // indirect
Comment on lines +164 to +173

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod OpenTelemetry entries =="
rg -n 'go\.opentelemetry\.io/otel' go.mod || true

echo
echo "== Go module docs / require compatibility in repo? =="
rg -n 'Compatibility|SDK|API|OTLP|v1\.4[34]\.0|\.go-version|GOVERSION' go.mod README.md . -g '!vendor' -g '!node_modules' | head -200 || true

echo
echo "== Inspect module cache availability for go1 version and go.mod entries =="
go env GOMOD GOPRIVATE GOPROXY GOSUMDB 2>/dev/null || true
go mod download -json go.opentelemetry.io/[email protected] 2>/tmp/otel_144_cache_err || true
go mod download -json go.opentelemetry.io/otel/[email protected] 2>/tmp/otel_sdk_143_cache_err || true
go mod download -json go.opentelemetry.io/otel/[email protected] 2>/tmp/otel_sdk_144_cache_err || true
cat /tmp/otel_144_cache_err /tmp/otel_sdk_143_cache_err /tmp/otel_sdk_144_cache_err 2>/dev/null || true

Repository: pgEdge/ace

Length of output: 20503

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Download module files with compatible metadata =="
for mod in \
  go.opentelemetry.io/[email protected] \
  go.opentelemetry.io/[email protected] \
  go.opentelemetry.io/otel/[email protected] \
  go.opentelemetry.io/otel/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
do
  echo "--- ${mod}"
  go mod download -json "${mod}" 2>/tmp/module_err || true
  path="$(python3 - <<'PY'
import json,sys
try:
    data=json.load(open('/tmp/module_err'))
    if 'Version' in data:
        print(data['GOVERSION'])
        print(data.get('go-version'))
    else:
        print(data) 2>/tmp/module_err
PY
)"
done

echo
echo "== Re-fetch metadata JSON into temp files for parser =="
tmpdir="$(mktemp -d)"
for mod in \
  go.opentelemetry.io/[email protected] \
  go.opentelemetry.io/[email protected] \
  go.opentelemetry.io/otel/[email protected] \
  go.opentelemetry.io/otel/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected] \
  go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
do
  json="$tmpdir/$(echo "$mod" | sed 's/[^A-Za-z0-9._-]/_/g').json"
  go mod download -json "${mod}" > "$json" 2>/tmp/err 2>&1 || true
done

python3 - <<'PY'
import json, os
tmpdir=os.environ.get('TMPDIR','/tmp')
# Actually parse the files written by previous block; path list is local only, so list by known names would fail.
# Instead use direct json.loads from output captured via shell? Since we cannot return outputs here, this is dead.
PY

Repository: pgEdge/ace

Length of output: 1058

🏁 Script executed:

#!/bin/bash
set -euo pipefail
tmpdir="$(mktemp -d)"

mods=(
  "go.opentelemetry.io/[email protected]"
  "go.opentelemetry.io/[email protected]"
  "go.opentelemetry.io/otel/[email protected]"
  "go.opentelemetry.io/otel/[email protected]"
  "go.opentelemetry.io/otel/[email protected]"
  "go.opentelemetry.io/otel/[email protected]"
  "go.opentelemetry.io/otel/sdk/[email protected]"
  "go.opentelemetry.io/otel/sdk/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]"
  "go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]"
)

python3 - <<'PY' > "$tmpdir/modules"
mods='go.opentelemetry.io/[email protected]
go.opentelemetry.io/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/sdk/[email protected]
go.opentelemetry.io/otel/sdk/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/[email protected]
go.opentelemetry.io/otel/exporters/otlp/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
'.strip().splitlines()
for m in mods:
    print(m)
PY

while IFS= read -r mod; do
  out="$tmpdir/${mod//@/__}.json"
  go mod download -json "$mod" > "$out" 2>&1 || true
done < "$tmpdir/modules"

python3 - <<'PY' "$tmpdir/modules"
import json, sys
tmp=sys.argv[1]
mods=open(sys.argv[1]).read().splitlines()
print("module, version, go.sum, go.mod_version, opentelemetry_api_dep, sdk_explicit_in_go.mod")
for m in mods:
    path=m.replace('@','__')
    p=f"{tmp}/{path}.json"
    data=json.load(open(p))
    if "Error" in data:
        continue
    gomod=f"{data['Dir']}/go.mod"
    gover=data.get('GOVERSION')
    dep_mods={}
    for line in open(gomod):
        line=line.strip()
        if line.startswith("require "):
            pkg=line.split()[1]
            dep_mods[pkg]=line.split()[2]
    print(f"{m}\t{data['Version']}\t{data.get('Sum')}\t{gover}\t{dep_mods.get('go.opentelemetry.io/otel')}\t{dep_mods.get('go.opentelemetry.io/otel/sdk')}")
PY

Repository: pgEdge/ace

Length of output: 307

🏁 Script executed:

#!/bin/bash
set -euo pipefail
tmpdir="$(mktemp -d)"

cat > "$tmpdir/modules.txt" <<'EOF'
go.opentelemetry.io/[email protected]
go.opentelemetry.io/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/[email protected]
go.opentelemetry.io/otel/sdk/[email protected]
go.opentelemetry.io/otel/sdk/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/[email protected]
go.opentelemetry.io/otel/exporters/otlp/[email protected]
go.opentelemetry.io/otel/exporters/otlp/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]
EOF

while IFS= read -r mod; do
  out="$tmpdir/${mod//@/__}.json"
  go mod download -json "$mod" > "$out" 2>&1 || true
done < "$tmpdir/modules.txt"

python3 <<'PY'
import json
mods = open("modules.txt").read().strip().splitlines()
print("module|version|checksum|gomod_version|otel_api_require|otel_sdk_require")
for m in mods:
    p = m.replace('@', '__') + ".json"
    data = json.load(open(p))
    if "Error" in data:
        continue
    gomod = data.get("Dir") + "/go.mod"
    deps = {}
    in_require = False
    for raw in open(gomod):
        line = raw.strip()
        if line == "require (":
            in_require = True
            continue
        if in_require:
            if line == ")":
                break
            if line:
                parts = line.split()
                if len(parts) >= 2:
                    deps[parts[0]] = parts[1]
    print(f"{m}|{data.get('Version')}|{data.get('Sum')}|{data.get('GOVERSION')}|{deps.get('go.opentelemetry.io/otel')}|{deps.get('go.opentelemetry.io/otel/sdk')}")
PY

Repository: pgEdge/ace

Length of output: 2522

🌐 Web query:

OpenTelemetry Go API SDK exporter module version compatibility documentation

💡 Result:

OpenTelemetry Go follows a versioning and compatibility policy aligned with Semantic Versioning 2.0.0 and standard Go module conventions [1][2]. Version Compatibility and Stability Guarantees: 1. Semantic Versioning: OpenTelemetry Go uses semantic versioning for its modules [1][3]. Breaking changes are only introduced in major version increments (e.g., v1.x to v2.x) [4][2]. 2. Public API Stability: Stable packages maintain backward compatibility [4][2]. While new methods may occasionally be added to exported interfaces in minor releases, they are clearly marked with a warning in the documentation [1]. 3. Exporters: Official exporters are maintained to be compatible with the core OpenTelemetry Go API and SDK [5][2]. Plugins and contrib packages are intended to be kept up to date; users should ensure their dependencies align with the versions of the API and SDK they are using [2]. 4. Go Language Compatibility: OpenTelemetry Go supports the currently supported major versions of the Go language (the two most recent major releases) [5][6]. Support for older Go versions is removed following a deprecation and testing cycle [5]. Versioning Specifications: - For modules at v2 or higher, the major version must be included in the module path (e.g., go.opentelemetry.io/otel/v2) and import paths [1]. - Modules at v0 or v1 do not include the major version in the module or import path [1]. - Experimental modules are typically versioned at v0, indicating they are not yet stable [1]. It is recommended to check the official VERSIONING.md file in the main repository for the most current policy details, as individual projects may have specific requirements regarding their contrib repositories [1][7][3].

Citations:

🌐 Web query:

site:github.com/open-telemetry/opentelemetry-go SDK v1.43.0 go.mod require go.opentelemetry.io/otel v1.43.0

💡 Result:

Yes, the SDK version v1.43.0 of the OpenTelemetry Go repository indeed requires go.opentelemetry.io/otel v1.43.0 [1]. The OpenTelemetry Go project released version v1.43.0 on April 3, 2026 [2][3]. This release includes the core API (go.opentelemetry.io/otel) at version 1.43.0, consistent with the SDK's internal versioning [4][1]. The go.mod file for the SDK in this release explicitly specifies this dependency to ensure compatibility across the project modules [1].

Citations:

🌐 Web query:

site:github.com/open-telemetry/opentelemetry-go SDK v1.44.0 go.mod require go.opentelemetry.io/otel v1.44.0 go.opentelemetry.io/otel/sdk v1.44.0

💡 Result:

OpenTelemetry Go SDK version 1.44.0 was released on May 27, 2026 [1][2]. In the opentelemetry-go repository, which uses a monorepo structure, version 1.44.0 applies to the core modules, including go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk [1]. When using these modules in your go.mod file, you would typically require them at the same version to ensure compatibility [1]. For example: require ( go.opentelemetry.io/otel v1.44.0 go.opentelemetry.io/otel/sdk v1.44.0) Key updates in the 1.44.0 release include the addition of ByteSlice and ByteSliceValue functions for the BYTESLICE attribute type [1][3], and a breaking change in go.opentelemetry.io/otel/sdk/metric that implements a default cardinality limit of 2000 for metrics [2].

Citations:

🌐 Web query:

"upgrading" "OpenTelemetry" "SDK" "API" "newer API" "older SDK"

💡 Result:

In the OpenTelemetry ecosystem, the API and SDK are designed with specific compatibility expectations. OpenTelemetry follows strict backward-compatibility rules [1][2][3]. The core principle is that code written against older versions of the API must work with all newer versions of the API [1][4]. Furthermore, instrumentation built against older minor versions of the API continues to function when composed in applications using newer versions [2]. However, the compatibility relationship between a newer API and an older SDK is generally not supported or expected to work [2]. Key points include: 1. SDKs are intended to track the API: Implementations are expected to target the latest version of the API [2]. When new functionality is added to the API (a new minor version), a corresponding SDK version that supports these features is typically released [2]. 2. Older SDKs generally lack support for newer API features: An older SDK version does not inherently understand or implement features introduced in a newer API version [2][5]. If an application uses a newer API version but relies on an older SDK, it may face compilation errors in statically typed languages or runtime errors (e.g., ImportError, NoSuchMethodError) if the application attempts to invoke new API features that the older SDK cannot handle [5][6]. 3. Dependency Management: It is strongly encouraged to keep the API and SDK versions synchronized (often via project-specific BOMs or version matching) to ensure stability [2][7][8]. If you upgrade your API to a newer version, you should also upgrade your SDK to a version that officially supports that API version [2]. 4. Defensive Coding: While some SDKs may attempt to implement defensive imports or runtime checks to avoid crashing when encountering unexpected API environments, this is a implementation detail rather than a guarantee of compatibility [6]. In summary, you should not expect an older SDK to support a newer API version [2]. To ensure application stability and avoid version conflicts, you should keep your SDK up to date with the latest minor versions of the API [2].

Citations:

Align the OpenTelemetry API, SDK, and exporters to one compatible release set.

The API modules are v1.44.0, but the SDK and OTLP exporter modules are still v1.43.0. Keep them all on v1.43.0, or upgrade the SDK and exporters to v1.44.0 so the dependency versions match the intended aligned release set.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 164 - 173, Align the OpenTelemetry dependency versions
in go.mod by using one consistent release across the visible API modules, SDK
modules, and OTLP exporter modules. Either downgrade the v1.44.0 API and related
entries to v1.43.0 or upgrade the v1.43.0 SDK and exporter entries to v1.44.0,
preserving a single compatible version set.

go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
Expand All @@ -181,9 +182,9 @@ require (
golang.org/x/term v0.45.0 // indirect
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/grpc v1.80.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 // indirect
google.golang.org/grpc v1.82.1 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
modernc.org/libc v1.70.0 // indirect
Expand Down
Loading
Loading