chore: upgrade go.opentelemetry.io/otel/bridge/opentracing to v1.45.0 (CVE-2026-45404)

Merged
CL
2mo ago
+74-72

Upgrades go.opentelemetry.io/otel/bridge/opentracing from v1.43.0 to v1.45.0 to remediate CVE-2026-45404.

Advisory

CVE-2026-45404 — OpenTelemetry-Go: unsynchronized baggage map can panic under concurrent access (MEDIUM).
bridgeSpan carries an extraBaggageItems map[string]string with no mutex. Span.SetBaggageItem writes it
via updateOtelContext while correlationGetHook reads and iterates it during correlation baggage
propagation. Concurrent use of the same hooked span can hit Go's fatal concurrent map access
(fatal error: concurrent map read and map write) and terminate the process — a DoS for the affected
application. Patched in go.opentelemetry.io/otel/bridge/opentracing 1.45.0.

Change

Narrowest supported remediation: bump the direct go.opentelemetry.io/otel/bridge/opentracing
requirement in go.mod to the patched floor v1.45.0 and re-resolve with go mod tidy. Everything
else in the diff (go.opentelemetry.io/otel/trace/metric → 1.45.0, otel/sdk → 1.44.0,
golang.org/x/net, x/sys, x/sync, x/text, x/crypto, go-logr/logr, google.golang.org/api,
cloud.google.com/go/auth, gax-go/v2, genproto*, and the new felixge/httpsnoop / otelhttp
indirects) is the minimum version set MVS selects for the patched bridge. No source changes and no
resolution overrides were needed.

Note: MVS also raises google.golang.org/grpc from v1.82.1 to v1.83.0 here as a side effect. That is
not a fix for CVE-2026-84304, which needs v1.83.1 — that is handled separately in #24, and this branch
deliberately does not carry that change. Whichever of the two merges second will need a trivial conflict
resolution on the google.golang.org/grpc line in favor of v1.83.1.

Verification

  • go mod verify — all modules verified
  • go list -m go.opentelemetry.io/otel/bridge/opentracing → v1.45.0; go mod graph shows only
    bridge/opentracing@v1.45.0, no pre-1.45 version anywhere in the graph
  • go build ./... — passes
  • go vet ./... — only pre-existing findings (unkeyed struct literals in index/*_test.go, lock copy in
    cmd/zoekt-sourcegraph-indexserver/main.go), unrelated to this change
  • go test ./... -short — all packages pass except internal/e2e, which fails on this runner for an
    environmental reason it reports itself (universal-ctags is missing, scip-ctags not available),
    not because of this upgrade

Fixes SOU-2119

🤖 Generated with Claude Code

[!NOTE]
Low Risk
Low risk: lockfile-only security bump for tracing; main residual risk is transitive version shifts (including grpc 1.83.0) rather than logic changes.

Overview
Dependency-only remediation for CVE-2026-45404: raises the direct go.opentelemetry.io/otel/bridge/opentracing requirement from v1.43.0 to v1.45.0 and refreshes go.sum. That patch fixes unsynchronized baggage map access in the bridge that could panic under concurrent use (used from internal/tracer/opentelemetry.go for OpenTracing→OTel export).

go mod tidy also moves the minimum compatible set—go.opentelemetry.io/otel, trace, and metric to 1.45.0, otel/sdk to 1.44.0, several golang.org/x/* packages, Google auth/API/genproto indirects, opentracing-contrib/go-grpc to 0.1.4, and adds indirect felixge/httpsnoop / otelhttp. google.golang.org/grpc lands at v1.83.0 as an MVS side effect; no application source files change.

Reviewed by Cursor Bugbot for commit 001410fd29effc090d955b241d6c35430931bdee. Bugbot is set up for automated code reviews on this repo. Configure here.