chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0#3589
chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0#3589mdelapenya merged 5 commits intotestcontainers:mainfrom
Conversation
Fixes 12 Dependabot alerts for CVE in OpenTelemetry Go SDK (PATH Hijacking, high severity). Bumps otel/sdk from various versions < 1.40.0 to v1.41.0 across root and 12 modules. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for testcontainers-go ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
Summary by CodeRabbitRelease Notes
WalkthroughSystematic dependency version updates across the root module and 70+ submodules: added indirect Changes
Sequence Diagram(s)(Skipped — change set is dependency/version updates without new multi-component control flow.) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
modules/forgejo/go.mod (1)
57-60: Consider updating otlptrace to v1.41.0 for consistency with other OTEL packages.The otlptrace exporter is at v1.40.0 while core OTEL packages (otel, metric, trace) are at v1.41.0. Since v1.41.0 is available and released, updating would align versions across the module. The security fix (GHSA-9h8m-3fm2-qjrq) is already present in v1.40.0, so this is a consistency improvement rather than a critical fix.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@modules/forgejo/go.mod` around lines 57 - 60, Update the otlptrace dependency in go.mod so its version matches the other OpenTelemetry packages: change the go.opentelemetry.io/otel/exporters/otlp/otlptrace entry from v1.40.0 to v1.41.0; ensure go.mod is tidied (run go mod tidy) and verify builds/tests pass after updating otlptrace.go.mod (1)
30-30: Acknowledge upstream OpenTelemetry SDK security fix while noting limited practical impact.The update to
go.opentelemetry.io/otel/sdk v1.41.0addresses GHSA-9h8m-3fm2-qjrq (PATH hijacking vulnerability), which is patched in v1.40.0+. However, this vulnerability only affects macOS hosts via the Host ID resource detector; testcontainers-go's compose module runs Linux CI and does not use the Host ID detector, so the practical risk impact is negligible. This version bump flows from upstreamdocker/compose/v5dependencies and cannot be independently overridden in this module.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 30, The xxhash dependency update is a transitive dependency resulting from the upstream go.opentelemetry.io/otel/sdk update to v1.41.0, which addresses a security vulnerability (GHSA-9h8m-3fm2-qjrq). Ensure that go.mod and go.sum are properly updated by running go mod tidy to resolve all transitive dependencies from the updated OpenTelemetry SDK. While the security fix should be acknowledged in the commit message or documentation, note that the practical risk impact to this project is limited since the vulnerability only affects macOS Host ID resource detection, which is not used in the Linux-based CI environment for testcontainers-go's compose module, and this version bump cannot be independently overridden as it flows from upstream dependencies.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@modules/mongodb/go.mod`:
- Line 64: The otlptrace exporter version in this module
(go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0) is out of sync with
core OTEL v1.41.0; update the root module's dependency on the otlptracehttp
package to v1.41.0 or newer so child modules (including the modules/mongodb
go.mod) inherit the correct exporter version, then run dependency resolution (go
mod tidy / vendor refresh) at the root and re-run builds to ensure the updated
otlptrace (otlptracehttp -> otlptrace) version is propagated to modules/mongodb
and other downstream modules.
In `@modules/ollama/go.mod`:
- Around line 58-63: Update the otlp HTTP trace exporter dependency to match the
other OpenTelemetry packages by changing the version of
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from v1.31.0 to
v1.41.0 in the go.mod entry so all otel modules (including otel, trace, metric,
and otlptracehttp) use v1.41.0 and receive the same fixes; locate the go.mod
line referencing go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
and bump its version to v1.41.0, then run go mod tidy to update the lock files.
---
Nitpick comments:
In `@go.mod`:
- Line 30: The xxhash dependency update is a transitive dependency resulting
from the upstream go.opentelemetry.io/otel/sdk update to v1.41.0, which
addresses a security vulnerability (GHSA-9h8m-3fm2-qjrq). Ensure that go.mod and
go.sum are properly updated by running go mod tidy to resolve all transitive
dependencies from the updated OpenTelemetry SDK. While the security fix should
be acknowledged in the commit message or documentation, note that the practical
risk impact to this project is limited since the vulnerability only affects
macOS Host ID resource detection, which is not used in the Linux-based CI
environment for testcontainers-go's compose module, and this version bump cannot
be independently overridden as it flows from upstream dependencies.
In `@modules/forgejo/go.mod`:
- Around line 57-60: Update the otlptrace dependency in go.mod so its version
matches the other OpenTelemetry packages: change the
go.opentelemetry.io/otel/exporters/otlp/otlptrace entry from v1.40.0 to v1.41.0;
ensure go.mod is tidied (run go mod tidy) and verify builds/tests pass after
updating otlptrace.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7afdf1ed-d417-48dc-93e7-638b082e8e9b
⛔ Files ignored due to path filters (65)
examples/nginx/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.summodules/aerospike/go.sumis excluded by!**/*.summodules/arangodb/go.sumis excluded by!**/*.summodules/artemis/go.sumis excluded by!**/*.summodules/azure/go.sumis excluded by!**/*.summodules/azurite/go.sumis excluded by!**/*.summodules/cassandra/go.sumis excluded by!**/*.summodules/chroma/go.sumis excluded by!**/*.summodules/clickhouse/go.sumis excluded by!**/*.summodules/cockroachdb/go.sumis excluded by!**/*.summodules/compose/go.sumis excluded by!**/*.summodules/consul/go.sumis excluded by!**/*.summodules/couchbase/go.sumis excluded by!**/*.summodules/databend/go.sumis excluded by!**/*.summodules/dind/go.sumis excluded by!**/*.summodules/dockermcpgateway/go.sumis excluded by!**/*.summodules/dockermodelrunner/go.sumis excluded by!**/*.summodules/dolt/go.sumis excluded by!**/*.summodules/dynamodb/go.sumis excluded by!**/*.summodules/elasticsearch/go.sumis excluded by!**/*.summodules/etcd/go.sumis excluded by!**/*.summodules/forgejo/go.sumis excluded by!**/*.summodules/gcloud/go.sumis excluded by!**/*.summodules/grafana-lgtm/go.sumis excluded by!**/*.summodules/inbucket/go.sumis excluded by!**/*.summodules/influxdb/go.sumis excluded by!**/*.summodules/k3s/go.sumis excluded by!**/*.summodules/k6/go.sumis excluded by!**/*.summodules/kafka/go.sumis excluded by!**/*.summodules/localstack/go.sumis excluded by!**/*.summodules/mariadb/go.sumis excluded by!**/*.summodules/meilisearch/go.sumis excluded by!**/*.summodules/memcached/go.sumis excluded by!**/*.summodules/milvus/go.sumis excluded by!**/*.summodules/minio/go.sumis excluded by!**/*.summodules/mockserver/go.sumis excluded by!**/*.summodules/mongodb/go.sumis excluded by!**/*.summodules/mssql/go.sumis excluded by!**/*.summodules/mysql/go.sumis excluded by!**/*.summodules/nats/go.sumis excluded by!**/*.summodules/nebulagraph/go.sumis excluded by!**/*.summodules/neo4j/go.sumis excluded by!**/*.summodules/ollama/go.sumis excluded by!**/*.summodules/openfga/go.sumis excluded by!**/*.summodules/openldap/go.sumis excluded by!**/*.summodules/opensearch/go.sumis excluded by!**/*.summodules/pinecone/go.sumis excluded by!**/*.summodules/postgres/go.sumis excluded by!**/*.summodules/pulsar/go.sumis excluded by!**/*.summodules/qdrant/go.sumis excluded by!**/*.summodules/rabbitmq/go.sumis excluded by!**/*.summodules/redis/go.sumis excluded by!**/*.summodules/redpanda/go.sumis excluded by!**/*.summodules/registry/go.sumis excluded by!**/*.summodules/scylladb/go.sumis excluded by!**/*.summodules/socat/go.sumis excluded by!**/*.summodules/solace/go.sumis excluded by!**/*.summodules/surrealdb/go.sumis excluded by!**/*.summodules/toxiproxy/go.sumis excluded by!**/*.summodules/valkey/go.sumis excluded by!**/*.summodules/vault/go.sumis excluded by!**/*.summodules/vearch/go.sumis excluded by!**/*.summodules/weaviate/go.sumis excluded by!**/*.summodules/yugabytedb/go.sumis excluded by!**/*.sum
📒 Files selected for processing (66)
examples/nginx/go.modgo.modmodules/aerospike/go.modmodules/arangodb/go.modmodules/artemis/go.modmodules/azure/go.modmodules/azurite/go.modmodules/cassandra/go.modmodules/chroma/go.modmodules/clickhouse/go.modmodules/cockroachdb/go.modmodules/compose/go.modmodules/consul/go.modmodules/couchbase/go.modmodules/databend/go.modmodules/dind/go.modmodules/dockermcpgateway/go.modmodules/dockermodelrunner/go.modmodules/dolt/go.modmodules/dynamodb/go.modmodules/elasticsearch/go.modmodules/etcd/go.modmodules/forgejo/go.modmodules/gcloud/go.modmodules/grafana-lgtm/go.modmodules/inbucket/go.modmodules/influxdb/go.modmodules/k3s/go.modmodules/k6/go.modmodules/kafka/go.modmodules/localstack/go.modmodules/mariadb/go.modmodules/meilisearch/go.modmodules/memcached/go.modmodules/milvus/go.modmodules/minio/go.modmodules/mockserver/go.modmodules/mongodb/go.modmodules/mssql/go.modmodules/mysql/go.modmodules/nats/go.modmodules/nebulagraph/go.modmodules/neo4j/go.modmodules/ollama/go.modmodules/openfga/go.modmodules/openldap/go.modmodules/opensearch/go.modmodules/pinecone/go.modmodules/postgres/go.modmodules/pulsar/go.modmodules/qdrant/go.modmodules/rabbitmq/go.modmodules/redis/go.modmodules/redpanda/go.modmodules/registry/go.modmodules/scylladb/go.modmodules/socat/go.modmodules/solace/go.modmodules/surrealdb/go.modmodules/tidb/go.modmodules/toxiproxy/go.modmodules/valkey/go.modmodules/vault/go.modmodules/vearch/go.modmodules/weaviate/go.modmodules/yugabytedb/go.mod
💤 Files with no reviewable changes (1)
- modules/tidb/go.mod
Addresses CodeRabbit review: aligns the root module's otlptracehttp exporter with the otel/sdk v1.41.0 bump. Runs tidy across all modules to propagate transitive dependency updates. Note: otlptrace remains at lower versions in some child modules because Go's MVS pins indirect deps to the minimum version required by the dependency graph. These have no associated CVE. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…m-v2 * upstream/main: (269 commits) chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#3560) chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0 (#3589) feat: add TiDB module (#3575) feat: add Forgejo module (#3556) feat: improve container conflict detection (#3574) chore(deps): bump go to 1.25 everywhere (#3572) chore(pulsar): bump base image to 4.x, replacing the wait for log strategy with wait for listening port (deterministic) (#3573) chore(deps): bump github.com/sigstore/sigstore in /modules/compose (#3571) chore(compose): update to compose-v5 (#3568) chore(deps): bump github.com/modelcontextprotocol/go-sdk (#3557) chore(deps): bump mkdocs-codeinclude-plugin from 0.2.1 to 0.3.1 (#3561) chore: update usage metrics (2026-03-02) (#3565) chore(deps): bump mkdocs-include-markdown-plugin from 7.2.0 to 7.2.1 (#3562) chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/grafana-lgtm (#3563) chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/toxiproxy (#3564) feat(azure): add lowkey vault container (#3542) feat(chroma): update to chroma 1.x (#3552) chore(deps): bump mkdocs-include-markdown-plugin from 7.2.0 to 7.2.1 (#3547) chore(deps): bump tj-actions/changed-files from 47.0.0 to 47.0.1 (#3546) chore(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 (#3545) ...
…archive-temp * upstream/main: chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#3560) chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0 (#3589) feat: add TiDB module (#3575) feat: add Forgejo module (#3556) feat: improve container conflict detection (#3574) chore(deps): bump go to 1.25 everywhere (#3572) chore(pulsar): bump base image to 4.x, replacing the wait for log strategy with wait for listening port (deterministic) (#3573) chore(deps): bump github.com/sigstore/sigstore in /modules/compose (#3571) chore(compose): update to compose-v5 (#3568) chore(deps): bump github.com/modelcontextprotocol/go-sdk (#3557) chore(deps): bump mkdocs-codeinclude-plugin from 0.2.1 to 0.3.1 (#3561) chore: update usage metrics (2026-03-02) (#3565) chore(deps): bump mkdocs-include-markdown-plugin from 7.2.0 to 7.2.1 (#3562) chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/grafana-lgtm (#3563) chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/toxiproxy (#3564)
…lugin * upstream/main: chore(deps): bump golang.org/x/mod in /modules/localstack (#3587) chore(deps): bump golang.org/x/mod in /modules/elasticsearch (#3585) chore(deps): bump golang.org/x/mod in /modules/redpanda (#3588) chore(deps): bump golang.org/x/mod in /modules/kafka (#3586) chore(deps): bump github.com/shirou/gopsutil/v4 from 4.25.12 to 4.26.2 (#3576) chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.2.0 (#3548) chore(deps): bump github.com/moby/term from 0.5.0 to 0.5.2 (#3081) chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#3560) chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0 (#3589) feat: add TiDB module (#3575)
* upstream/main: chore(deps): bump golang.org/x/mod in /modules/localstack (#3587) chore(deps): bump golang.org/x/mod in /modules/elasticsearch (#3585) chore(deps): bump golang.org/x/mod in /modules/redpanda (#3588) chore(deps): bump golang.org/x/mod in /modules/kafka (#3586) chore(deps): bump github.com/shirou/gopsutil/v4 from 4.25.12 to 4.26.2 (#3576) chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.2.0 (#3548) chore(deps): bump github.com/moby/term from 0.5.0 to 0.5.2 (#3081) chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#3560) chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0 (#3589)
…-action * upstream/main: (22 commits) chore(deps): bump golang.org/x/mod in /modules/localstack (#3587) chore(deps): bump golang.org/x/mod in /modules/elasticsearch (#3585) chore(deps): bump golang.org/x/mod in /modules/redpanda (#3588) chore(deps): bump golang.org/x/mod in /modules/kafka (#3586) chore(deps): bump github.com/shirou/gopsutil/v4 from 4.25.12 to 4.26.2 (#3576) chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.2.0 (#3548) chore(deps): bump github.com/moby/term from 0.5.0 to 0.5.2 (#3081) chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#3560) chore(deps): bump go.opentelemetry.io/otel/sdk to v1.41.0 (#3589) feat: add TiDB module (#3575) feat: add Forgejo module (#3556) feat: improve container conflict detection (#3574) chore(deps): bump go to 1.25 everywhere (#3572) chore(pulsar): bump base image to 4.x, replacing the wait for log strategy with wait for listening port (deterministic) (#3573) chore(deps): bump github.com/sigstore/sigstore in /modules/compose (#3571) chore(compose): update to compose-v5 (#3568) chore(deps): bump github.com/modelcontextprotocol/go-sdk (#3557) chore(deps): bump mkdocs-codeinclude-plugin from 0.2.1 to 0.3.1 (#3561) chore: update usage metrics (2026-03-02) (#3565) chore(deps): bump mkdocs-include-markdown-plugin from 7.2.0 to 7.2.1 (#3562) ...
Summary
go.opentelemetry.io/otel/sdkto v1.41.0 across root module and 12 submodulesTest plan
🤖 Generated with Claude Code