fix: upgrade extras/dagger OpenTelemetry SDK to v1.43.0
Closed
CH
3mo ago+22+22+01234567890123456789-8-8-0123456789
Summary
Updated the unused extras/dagger Go module to go.opentelemetry.io/otel/sdk v1.43.0, the first fixed release for GHSA-hfvc-g4fc-pqhx. This also refreshed the module's related OpenTelemetry dependencies and checksums to keep the module graph consistent.
Vulnerability Fixed
GHSA-hfvc-g4fc-pqhx (HIGH): opentelemetry-go BSD kenv command not using an absolute path enables PATH hijacking.
Changes Made
- Bumped
go.opentelemetry.io/otel/sdkinextras/dagger/go.modfromv1.38.0tov1.43.0, the first fixed release identified by the assessment. - Updated the related OpenTelemetry module versions and
go.sumentries inextras/daggerso the dependency graph remains internally consistent after the SDK bump. - Accepted the Go directive update in
extras/dagger/go.modrequired by the resolved module metadata forgo.opentelemetry.io/otel/sdk@v1.43.0.
Verification
Ran syft dir:. -o cyclonedx-json | grype --only-fixed -o json from the repository root and scanned the patched source tree. Outcome: resolved — Grype did not report GHSA-hfvc-g4fc-pqhx, and Syft cataloged go.opentelemetry.io/otel/sdk@v1.43.0 from /extras/dagger/go.mod.