Skip to content

chore: Update module go.opentelemetry.io/otel/sdk/log to v0.21.0 [SECURITY] - #86

Open
renovate[bot] wants to merge 2 commits into
masterfrom
renovate/go-go.opentelemetry.io-otel-sdk-log-vulnerability
Open

renovate[bot] wants to merge 2 commits into
masterfrom
renovate/go-go.opentelemetry.io-otel-sdk-log-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Makes the OpenTelemetry log exporter family resolve consistently on v0.21.0, so the driver no longer pulls a v0.20.0 exporter set alongside the v0.21.0 otel/log and sdk/log modules.
  • Fixes the compile failures (undefined: api.KeyValue, undefined: log.Value) that broke the package build and made the test, lint and codecov checks fail on this PR.
  • Lets applications built on the driver consume the patched sdk/log release that resolves the BatchingProcessor busy-spin denial of service (CVE-2026-81872).

Why

The base of this PR bumped go.opentelemetry.io/otel/sdk/log and go.opentelemetry.io/otel/log to v0.21.0, but left the three exporter modules at v0.20.0. The exporters build directly against the shared log API types, so the mismatched versions produced undefined: api.KeyValue and undefined: log.Value compile errors and the driver failed to build for every consumer.

This aligns otlploggrpc, otlploghttp and stdoutlog on v0.21.0 so the whole OTel log stack moves together. Only go.mod and go.sum change: no public API, configuration key or query behavior is affected, so existing Goravel applications keep working after a routine dependency update.

// Before: the v0.20.0 exporter modules broke the driver's module graph, so the
// project failed to compile with "undefined: api.KeyValue" before this ever ran.
if err := facades.Orm().Query().Create(&models.User{
	Name: ctx.Request().Input("name"),
}); err != nil {
	return ctx.Response().Json(http.StatusInternalServerError, http.Json{
		"error": err.Error(),
	})
}

// After: the exporter family is aligned on v0.21.0, so this compiles and writes
// to the SQL Server connection exactly as before.

@renovate
renovate Bot requested a review from a team as a code owner October 13, 2026 11:53
@renovate
renovate Bot enabled auto-merge (squash) October 13, 2026 11:53
@renovate

renovate Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
go.opentelemetry.io/otel/log v0.20.0 -> v0.21.0

renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
@renovate
renovate Bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-log-vulnerability branch from 34e7e10 to 7b24ad4 Compare October 13, 2026 18:34
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
@renovate
renovate Bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-log-vulnerability branch from 7b24ad4 to a60d6df Compare October 13, 2026 22:27
@renovate
renovate Bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-log-vulnerability branch from a60d6df to 416345c Compare October 14, 2026 00:54
Bumps otlploggrpc, otlploghttp and stdoutlog from v0.20.0 to v0.21.0 so the OTel log exporter family matches the already-updated otel/log and sdk/log v0.21.0, fixing the CI build failures (undefined: api.KeyValue / log.Value) on this PR.
@renovate

renovate Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant