Repository navigation
Bump go.opentelemetry.io/otel/sdk from 1.36.0 to 1.43.0 - #7
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.36.0 to 1.43.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Greptile SummaryThis Dependabot PR bumps Confidence Score: 4/5Safe to merge after confirming the Go 1.25 toolchain bump was intentional. The dependency update itself is routine and backed by a 98% Dependabot compatibility score, with no breaking API changes in otel v1.x. The P1 flag is the unannounced go.mod — confirm the
|
| Filename | Overview |
|---|---|
| go.mod | Updates otel suite to v1.43.0, testify to v1.11.1, x/sys to v0.42.0; also bumps the go directive from 1.24.0 to 1.25.0, which raises the minimum Go version for consumers |
| go.sum | Corresponding checksum updates for all bumped dependencies; no issues found |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[go.opentelemetry.io/otel/sdk\n1.36.0 → 1.43.0] --> B[otel/trace\n1.37.0 → 1.43.0]
A --> C[otel/metric\n1.37.0 → 1.43.0]
A --> D[otel/sdk/metric\n1.36.0 → 1.43.0]
A --> E[otel v1.43.0]
A --> F[auto/sdk\n1.1.0 → 1.2.1]
subgraph unchanged["⚠️ Not updated"]
G[exporters/otlp/otlptrace v1.29.0]
H[exporters/otlp/otlptracehttp v1.27.0]
I[exporters/stdout/stdoutmetric v1.36.0]
J[contrib/detectors/gcp v1.36.0]
end
subgraph other["Other bumps"]
K[stretchr/testify\n1.10.0 → 1.11.1]
L[golang.org/x/sys\n0.38.0 → 0.42.0]
M[go directive\n1.24.0 → 1.25.0]
end
style M fill:#ff9999
style unchanged fill:#fff3cd
Prompt To Fix All With AI
This is a comment left during a code review.
Path: go.mod
Line: 3
Comment:
**Unexpected Go toolchain version bump**
The `go` directive was raised from `1.24.0` to `1.25.0`. Since Go 1.21, this directive acts as a minimum toolchain requirement — any consumer of this library will need Go 1.25+ to build it. This is a breaking change for users on older toolchains and is unrelated to the otel/sdk version bump described in the PR title. Was this intentional?
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: go.mod
Line: 66-75
Comment:
**Partial otel exporter upgrade**
The core otel packages jump to v1.43.0, but several exporter/contrib packages remain behind:
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0`
- `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0`
Within otel's v1.x line the API is backward compatible, so this should compile. However, keeping the exporters 7–16 minor versions behind the SDK means you miss bug fixes (including the 4 MiB HTTP response body limit from #8108 in `otlptracehttp`) that were landed in the exporter packages alongside the SDK. Consider bumping these to v1.43.0 as well.
How can I resolve this? If you propose a fix, please make it concise.Reviews (1): Last reviewed commit: "Bump go.opentelemetry.io/otel/sdk from 1..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| module github.com/golang-migrate/migrate/v4 | ||
|
|
||
| go 1.24.0 | ||
| go 1.25.0 |
There was a problem hiding this comment.
The go directive was raised from 1.24.0 to 1.25.0. Since Go 1.21, this directive acts as a minimum toolchain requirement — any consumer of this library will need Go 1.25+ to build it. This is a breaking change for users on older toolchains and is unrelated to the otel/sdk version bump described in the PR title. Was this intentional?
Prompt To Fix With AI
This is a comment left during a code review.
Path: go.mod
Line: 3
Comment:
**Unexpected Go toolchain version bump**
The `go` directive was raised from `1.24.0` to `1.25.0`. Since Go 1.21, this directive acts as a minimum toolchain requirement — any consumer of this library will need Go 1.25+ to build it. This is a breaking change for users on older toolchains and is unrelated to the otel/sdk version bump described in the PR title. Was this intentional?
How can I resolve this? If you propose a fix, please make it concise.| github.com/zeebo/errs v1.4.0 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.1.0 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect | ||
| go.opentelemetry.io/otel v1.37.0 // indirect | ||
| go.opentelemetry.io/otel v1.43.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.37.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.37.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.43.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.43.0 // indirect | ||
| go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect |
There was a problem hiding this comment.
The core otel packages jump to v1.43.0, but several exporter/contrib packages remain behind:
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0
Within otel's v1.x line the API is backward compatible, so this should compile. However, keeping the exporters 7–16 minor versions behind the SDK means you miss bug fixes (including the 4 MiB HTTP response body limit from #8108 in otlptracehttp) that were landed in the exporter packages alongside the SDK. Consider bumping these to v1.43.0 as well.
Prompt To Fix With AI
This is a comment left during a code review.
Path: go.mod
Line: 66-75
Comment:
**Partial otel exporter upgrade**
The core otel packages jump to v1.43.0, but several exporter/contrib packages remain behind:
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0`
- `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0`
Within otel's v1.x line the API is backward compatible, so this should compile. However, keeping the exporters 7–16 minor versions behind the SDK means you miss bug fixes (including the 4 MiB HTTP response body limit from #8108 in `otlptracehttp`) that were landed in the exporter packages alongside the SDK. Consider bumping these to v1.43.0 as well.
How can I resolve this? If you propose a fix, please make it concise.
Bumps go.opentelemetry.io/otel/sdk from 1.36.0 to 1.43.0.
Changelog
Sourced from go.opentelemetry.io/otel/sdk's changelog.
... (truncated)
Commits
9276201Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)61b8c94chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)97a086echore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)5e363delimit response body size for OTLP HTTP exporters (#8108)35214b6Use an absolute path when calling bsd kenv (#8113)290024cfix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)e70658efix: support getBody in otelploghttp (#8096)4afe468fix(deps): update googleapis to 9d38bb4 (#8117)b9ca729chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)69472ecchore(deps): update fossas/fossa-action action to v1.9.0 (#8118)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.