Skip to content

[v14] Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.44.0 to 0.46.0#34562

Closed
jentfoo wants to merge 5 commits intobranch/v14from
jent/otelgrpc-v14
Closed

[v14] Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.44.0 to 0.46.0#34562
jentfoo wants to merge 5 commits intobranch/v14from
jent/otelgrpc-v14

Conversation

@jentfoo
Copy link
Copy Markdown
Contributor

@jentfoo jentfoo commented Nov 13, 2023

v14 update of otelgrpc to address CVE-2023-47108. Examples were updated in #34536

dependabot Bot added 2 commits November 13, 2023 13:43
…pc/otelgrpc

Bumps [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.42.0 to 0.46.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.42.0...zpages/v0.46.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…pc/otelgrpc

Bumps [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.42.0 to 0.46.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.42.0...zpages/v0.46.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@jentfoo jentfoo added go Issues related to Go builds/tooling dependencies Pull requests that update a dependency file no-changelog Indicates that a PR does not require a changelog entry labels Nov 13, 2023
@jentfoo jentfoo self-assigned this Nov 13, 2023
Comment thread api/go.mod Outdated
Comment thread api/go.mod Outdated
Comment on lines 19 to 21
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0
go.opentelemetry.io/otel/sdk v1.19.0
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0
go.opentelemetry.io/otel/sdk v1.19.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.20.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.20.0
go.opentelemetry.io/otel/sdk v1.20.0

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure how I can update these. Doing this update results in the following ambiguous import error:

github.com/gravitational/teleport/api/client imports
	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc tested by
	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc.test imports
	google.golang.org/grpc/interop imports
	golang.org/x/oauth2/google imports
	cloud.google.com/go/compute/metadata: ambiguous import: found package cloud.google.com/go/compute/metadata in multiple modules:
	cloud.google.com/go v0.34.0 (/home/mjensen/go/pkg/mod/cloud.google.com/go@v0.34.0/compute/metadata)
	cloud.google.com/go/compute/metadata v0.2.3 (/home/mjensen/go/pkg/mod/cloud.google.com/go/compute/metadata@v0.2.3)

If I specify the metadata version in the go.mod it corrects this error, but if a go mod tidy is ran the manually specified metadata is removed and the error will return.

@rosstimothy or @codingllama is this something you have encountered before?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$ cd api
$ go get cloud.google.com/go/compute/metadata@v0.34.0
$ go mod tidy

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately this runs into the same issue I am running into. The following commands will complete successfully, however the go mod tidy will remove the added record and subsequent go mod tidy's (or builds) will fail.

Comment thread go.mod Outdated
Comment thread go.mod Outdated
Copy link
Copy Markdown
Contributor

@rosstimothy rosstimothy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updates to go.mod look good to me but the linter is complaining about a few additional places that we are using the deprecated interceptors.

@rosstimothy
Copy link
Copy Markdown
Contributor

Superseded by #34803

@jentfoo jentfoo deleted the jent/otelgrpc-v14 branch November 29, 2023 22:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport dependencies Pull requests that update a dependency file go Issues related to Go builds/tooling no-changelog Indicates that a PR does not require a changelog entry size/sm

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants