Closed
Conversation
pepol
requested review from
a team,
Noroth,
SkArchon,
StarpTech,
devsergiy and
endigma
as code owners
This comment was marked as outdated.
This comment was marked as outdated.
Contributor
WalkthroughBumps and pins of Go module dependencies across demo and router modules: OpenTelemetry, gRPC/protobuf/genproto, golang.org/x/*, plus added/removed indirects and new Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Router-nonroot image scan passed✅ No security vulnerabilities found in image: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@demo/pkg/subgraphs/projects/go.mod`:
- Line 38: Update the pinned module go.opentelemetry.io/otel/sdk from v1.39.0 to
v1.40.0 (or later) in the go.mod entry for go.opentelemetry.io/otel/sdk, then
run a module update (for example: go get go.opentelemetry.io/otel/sdk@v1.40.0)
and go mod tidy to refresh the go.sum; finally run the test/build to ensure no
breakages after the upgrade.
In `@router-plugin/go.mod`:
- Line 15: The go.mod entry for the OpenTelemetry SDK
(go.opentelemetry.io/otel/sdk) is pinned to the vulnerable v1.39.0; update that
module version to v1.40.0 or later (e.g., v1.40.0+) in the go.mod, then run the
Go module tooling (go get or go mod tidy) to refresh go.sum and vendor artifacts
and ensure builds/tests pass; look for the module identifier
"go.opentelemetry.io/otel/sdk" to locate and change the version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c2583eed-adbc-444d-8bd1-b2640794e89a
⛔ Files ignored due to path filters (3)
demo/go.sumis excluded by!**/*.sumdemo/pkg/subgraphs/projects/go.sumis excluded by!**/*.sumrouter-plugin/go.sumis excluded by!**/*.sum
📒 Files selected for processing (3)
demo/go.moddemo/pkg/subgraphs/projects/go.modrouter-plugin/go.mod
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2684 +/- ##
==========================================
- Coverage 63.10% 62.89% -0.22%
==========================================
Files 245 245
Lines 26273 26273
==========================================
- Hits 16580 16524 -56
- Misses 8352 8393 +41
- Partials 1341 1356 +15 🚀 New features to boost your workflow:
|
pepol
force-pushed
the
peter/eng-9280-vanta-remediate-critical-vulnerabilities-identified-in
branch
from
9309067 to
2b65300
Compare
pepol
force-pushed
the
peter/eng-9280-vanta-remediate-critical-vulnerabilities-identified-in
branch
from
86c8245 to
b57d279
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@demo/go.mod`:
- Around line 191-208: The replace block currently pins multiple OpenTelemetry
modules (notably go.opentelemetry.io/otel/sdk) to v1.28.0 which is vulnerable;
remove or modify the replace directives so go.opentelemetry.io/otel/sdk can
resolve to v1.40.0+ and eliminate the security downgrade. Update code
referencing renamed attributes (the comment "Do not upgrade, it renames
attributes we rely on") to the newer API surface in the modules that actually
changed, and if any specific module must remain pinned due to breaking changes,
only keep replace entries for those exact packages (not
go.opentelemetry.io/otel/sdk) so the SDK resolves to >= v1.40.0; ensure the
replace block and module declarations reflect these selective pins and run go
mod tidy / go test to verify compatibility.
In `@demo/pkg/subgraphs/projects/go.mod`:
- Around line 48-65: The replace block is forcing go.opentelemetry.io/otel/sdk
(and other otel modules) down to v1.28.0 which reinstates a vulnerable version;
update the replace directives so go.opentelemetry.io/otel/sdk is pinned to
v1.40.0 or later (or remove the sdk replace entirely) and only keep replace
entries for modules that truly require older versions (e.g., keep replaces for
go.opentelemetry.io/contrib/* if needed), ensuring go.opentelemetry.io/otel/sdk
remains >= v1.40.0 to avoid GHSA-9h8m-3fm2-qjrq/CVE-2026-24051.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f1a4cf36-3a2c-4567-a899-817c70d6518e
⛔ Files ignored due to path filters (3)
demo/go.sumis excluded by!**/*.sumdemo/pkg/subgraphs/projects/go.sumis excluded by!**/*.sumrouter-plugin/go.sumis excluded by!**/*.sum
📒 Files selected for processing (3)
demo/go.moddemo/pkg/subgraphs/projects/go.modrouter-plugin/go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
- router-plugin/go.mod
Comment on lines
+191
to
+208
| // Do not upgrade, it renames attributes we rely on | ||
| replace ( | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 | ||
| go.opentelemetry.io/contrib/propagators/b3 => go.opentelemetry.io/contrib/propagators/b3 v1.23.0 | ||
| go.opentelemetry.io/contrib/propagators/jaeger => go.opentelemetry.io/contrib/propagators/jaeger v1.23.0 | ||
| go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.28.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.23.1 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.23.1 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.23.1 | ||
| go.opentelemetry.io/otel/exporters/prometheus => go.opentelemetry.io/otel/exporters/prometheus v0.50.0 | ||
| go.opentelemetry.io/otel/metric => go.opentelemetry.io/otel/metric v1.28.0 | ||
| go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.28.0 | ||
| go.opentelemetry.io/otel/sdk/metric => go.opentelemetry.io/otel/sdk/metric v1.28.0 | ||
| go.opentelemetry.io/otel/trace => go.opentelemetry.io/otel/trace v1.28.0 | ||
| go.opentelemetry.io/proto/otlp => go.opentelemetry.io/proto/otlp v1.1.0 | ||
| ) |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify which OpenTelemetry SDK version is actually resolved after the replace directives
cd demo
go list -m go.opentelemetry.io/otel/sdk
go list -m go.opentelemetry.io/otel
go list -m go.opentelemetry.io/otel/metric
go list -m go.opentelemetry.io/otel/traceRepository: wundergraph/cosmo
Length of output: 370
🏁 Script executed:
#!/bin/bash
# Check the demo/go.mod file structure and key lines
echo "=== Checking demo/go.mod file size and content ==="
wc -l demo/go.mod
echo -e "\n=== Lines 1-30 (checking for require declarations) ==="
head -30 demo/go.mod
echo -e "\n=== Lines 160-170 (checking context around line 165-167) ==="
sed -n '160,170p' demo/go.mod
echo -e "\n=== Lines 15-20 (checking lines 17, 19) ==="
sed -n '15,20p' demo/go.mod
echo -e "\n=== Lines 185-210 (checking replace block around 191-208) ==="
sed -n '185,210p' demo/go.modRepository: wundergraph/cosmo
Length of output: 4335
Critical security issue: replace directives downgrade to vulnerable v1.28.0.
The replace block forces resolution to go.opentelemetry.io/otel/sdk v1.28.0 (line 211), which is vulnerable to GHSA-9h8m-3fm2-qjrq (CVE-2026-24051, PATH hijacking on macOS/Darwin). This overrides the declared requirements for go.opentelemetry.io/otel v1.40.0 (line 18) and go.opentelemetry.io/otel/sdk v1.40.0 (line 20).
The comment "Do not upgrade, it renames attributes we rely on" indicates breaking API changes in newer OpenTelemetry versions. You must update the codebase to handle the renamed attributes in v1.40.0+ and remove the vulnerable replace directives, or selectively pin only the modules with genuine breaking changes while allowing go.opentelemetry.io/otel/sdk to resolve to v1.40.0 or later.
Per project guidelines, every go.mod must ensure go.opentelemetry.io/otel/sdk resolves to v1.40.0 or later. This module was deferred from the prior security fix and requires resolution.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@demo/go.mod` around lines 191 - 208, The replace block currently pins
multiple OpenTelemetry modules (notably go.opentelemetry.io/otel/sdk) to v1.28.0
which is vulnerable; remove or modify the replace directives so
go.opentelemetry.io/otel/sdk can resolve to v1.40.0+ and eliminate the security
downgrade. Update code referencing renamed attributes (the comment "Do not
upgrade, it renames attributes we rely on") to the newer API surface in the
modules that actually changed, and if any specific module must remain pinned due
to breaking changes, only keep replace entries for those exact packages (not
go.opentelemetry.io/otel/sdk) so the SDK resolves to >= v1.40.0; ensure the
replace block and module declarations reflect these selective pins and run go
mod tidy / go test to verify compatibility.
Comment on lines
+48
to
+65
| // Do not upgrade, it renames attributes we rely on | ||
| replace ( | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 | ||
| go.opentelemetry.io/contrib/propagators/b3 => go.opentelemetry.io/contrib/propagators/b3 v1.23.0 | ||
| go.opentelemetry.io/contrib/propagators/jaeger => go.opentelemetry.io/contrib/propagators/jaeger v1.23.0 | ||
| go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.28.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.23.1 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.23.1 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.23.1 | ||
| go.opentelemetry.io/otel/exporters/prometheus => go.opentelemetry.io/otel/exporters/prometheus v0.50.0 | ||
| go.opentelemetry.io/otel/metric => go.opentelemetry.io/otel/metric v1.28.0 | ||
| go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.28.0 | ||
| go.opentelemetry.io/otel/sdk/metric => go.opentelemetry.io/otel/sdk/metric v1.28.0 | ||
| go.opentelemetry.io/otel/trace => go.opentelemetry.io/otel/trace v1.28.0 | ||
| go.opentelemetry.io/proto/otlp => go.opentelemetry.io/proto/otlp v1.1.0 | ||
| ) |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify which OpenTelemetry SDK version is actually resolved after the replace directives
cd demo/pkg/subgraphs/projects
go list -m go.opentelemetry.io/otel/sdk
go list -m go.opentelemetry.io/otel
go list -m go.opentelemetry.io/otel/metric
go list -m go.opentelemetry.io/otel/traceRepository: wundergraph/cosmo
Length of output: 370
Pin go.opentelemetry.io/otel/sdk to v1.40.0 or later; the replace directives are downgrading to the vulnerable v1.28.0.
The replace block at lines 48–65 forces all OpenTelemetry modules to v1.28.0, overriding the v1.40.0 declarations in lines 32–38. This downgrades go.opentelemetry.io/otel/sdk to a version vulnerable to GHSA-9h8m-3fm2-qjrq (CVE-2026-24051, PATH hijacking on macOS/Darwin).
The comment "Do not upgrade, it renames attributes we rely on" suggests breaking changes in newer versions. Either update the codebase to work with v1.40.0+ or selectively pin only the modules with breaking changes while keeping go.opentelemetry.io/otel/sdk at v1.40.0 or later.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@demo/pkg/subgraphs/projects/go.mod` around lines 48 - 65, The replace block
is forcing go.opentelemetry.io/otel/sdk (and other otel modules) down to v1.28.0
which reinstates a vulnerable version; update the replace directives so
go.opentelemetry.io/otel/sdk is pinned to v1.40.0 or later (or remove the sdk
replace entirely) and only keep replace entries for modules that truly require
older versions (e.g., keep replaces for go.opentelemetry.io/contrib/* if
needed), ensuring go.opentelemetry.io/otel/sdk remains >= v1.40.0 to avoid
GHSA-9h8m-3fm2-qjrq/CVE-2026-24051.
|
This PR was marked stale due to lack of activity. It will be closed in 14 days. |
|
Closed as inactive. Feel free to reopen if this PR is still being worked on. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Checklist
Open Source AI Manifesto
This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.