build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0#3
build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0#3dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Bump Evaluation
Version change: go.opentelemetry.io/otel/sdk 1.40.0 -> 1.43.0 (3 minor versions)
Semver bump type: minor (multi-version jump: 1.41.0, 1.42.0, 1.43.0)
Changes (across 3 releases):
- 1.41.0: Baggage W3C compliance fix, Go 1.24 last supported
- 1.42.0: Dropped Go 1.24 (project uses Go 1.26+, no impact), TracerProvider.ForceFlush now joins errors instead of returning first, new semconv v1.40.0
- 1.43.0: attribute.INVALID deprecated in favor of EMPTY, TraceIdRatioBased sampler description changed for spec compliance, per-series start time tracking, HTTP response body capped at 4 MiB (security hardening), race condition fix in lastvalue aggregation
Breaking changes: TraceIdRatioBased sampler description output changed for spec compliance -- not used in this codebase
Security concerns: None negative. Positive: HTTP response body now limited to 4 MiB in OTLP HTTP exporters to mitigate memory exhaustion from malicious/misconfigured servers (#8108). Race condition fix in metric lastvalue aggregation (#8056).
Impact on codebase: All go.opentelemetry.io/otel/* packages are indirect dependencies -- zero .go files in this project import any otel package directly. No usage of attribute.INVALID (deprecated), TraceIdRatioBased (breaking change), or any other affected API found. Changes are transparent to this codebase.
Recommendation: SAFE TO MERGE
Notes: CI checks (build, lint, test, test-e2e, generate) were still in progress at evaluation time. Merge after CI is green.
-- Claude Code
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.40.0 to 1.43.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.43.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
f3444bc to
72e4f3d
Compare
There was a problem hiding this comment.
Dependency Bump Evaluation
Version change: go.opentelemetry.io/otel/sdk 1.40.0 -> 1.43.0 (minor, 3 versions)
Breaking changes: None affecting this project. TraceIdRatioBased description change (noted as breaking behavioral in 1.43.0 changelog) is not used anywhere in this codebase.
Security concerns: None — includes a positive security fix (HTTP response body limit to 4 MiB in OTLP HTTP exporters to mitigate excessive memory usage from misconfigured/malicious servers).
Impact on codebase: No affected patterns found. This dependency is entirely indirect (transitive via controller-runtime). Zero Go source files in the project import or reference any go.opentelemetry.io/otel package. The deprecated attribute.INVALID (replaced by attribute.EMPTY) is not used.
CI status: In progress at time of review — no failures observed.
Recommendation: SAFE TO MERGE
Notes: All changes (new APIs like WithService, DefaultWithContext, WithCardinalityLimitSelector; performance improvements; race condition fixes) are additive or internal to the OTel SDK and do not affect this operator's behavior. Only go.mod and go.sum are modified.
— Claude Code
1 participant
Bumps go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0.
Changelog
Sourced from go.opentelemetry.io/otel/sdk's changelog.
... (truncated)
Commits
9276201Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)61b8c94chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)97a086echore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)5e363delimit response body size for OTLP HTTP exporters (#8108)35214b6Use an absolute path when calling bsd kenv (#8113)290024cfix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)e70658efix: support getBody in otelploghttp (#8096)4afe468fix(deps): update googleapis to 9d38bb4 (#8117)b9ca729chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)69472ecchore(deps): update fossas/fossa-action action to v1.9.0 (#8118)