fix: bump otel to v1.44.0 and x/text to v0.39.0 for govulncheck - #107
Merged
Conversation
The v2.20.2 release workflow failed govulncheck with two reachable
vulnerabilities:
GO-2026-5970 - infinite loop on invalid input in golang.org/x/text
v0.37.0, reached via http.Get in cmd/healthcheck.
Fixed in v0.39.0.
GO-2026-5158 - uncapped raw baggage header length in
go.opentelemetry.io/otel v1.43.0, reached via the gRPC
baggage propagator. Fixed in v1.44.0.
otel v1.44.0 moves resource.Default() to semconv schema 1.41.0, so the
semconv import in cmd/gubernator had to move with it. Left at v1.40.0,
resource.Merge() rejects the mismatched schema URLs and the daemon dies
at startup with "conflicting Schema URL".
thrawn01
added a commit
that referenced
this pull request
Aug 25, 2026
PR #107 failed this gate twice on the same commit against the same cached master baseline, flagging a different set of benchmarks each time. Run one flagged Concurrent_writes at 2.02x while reads passed; the re-run flagged Concurrent_reads at 5.58x and Concurrent_reads_and_writes_of_existing_keys at 4.86x while writes passed. That diff only bumped otel, x/text and grpc-gateway, and lrucache.go imports none of them. An interleaved local A/B of the two dependency sets over 8 rounds measured geomean +0.01%, with five of six benchmarks statistically indistinguishable. make bench takes one sample per benchmark, and this step compares that single sample against a single cached sample from master. On a shared runner that cannot separate a real regression from scheduler noise, which is why the same commit produced different "regressions" on two runs. Benchmarks still run and alerts still appear in the job summary; they no longer fail the build. Raising the sample count was considered and rejected for now. The action offers no reduction step: extractGoResult emits one entry per output line with no grouping, and findAlerts compares every entry against whichever baseline line matched first, so N samples give N independent chances to trip the threshold rather than one averaged comparison. Making the gate block merges again needs that reduction first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
The
v2.20.2release workflow failed.govulncheckexited 3 on two vulnerabilities it found reachable from our own call graph, which blocks thebuildjob and therefore the container and Helm chart publish:golang.org/x/textv0.37.0. Reached throughhttp.Getatcmd/healthcheck/main.go:69, so a healthcheck against a server returning malformed headers can hang the probe. Fixed in v0.39.0.go.opentelemetry.io/otelv1.43.0 stopped capping the raw baggage header length during parsing. Reached through the gRPC baggage propagator on everyv1Clientcall, so an attacker-suppliedbaggageheader is parsed without a length bound. Fixed in v1.44.0.Nothing changes for users of the library: no API, configuration, or behavior changes, only dependency versions and one import path. After this lands the release needs a re-cut as
v2.20.3— fixing master does not retroactively green thev2.20.2run.Implementation
golang.org/x/textto v0.39.0 and the otel family — core,sdk,trace,metric, and the threeotlptraceexporters — to v1.44.0, keeping the otel modules on a single version.go mod tidypulledgrpc-gateway/v2v2.28.0 → v2.29.0 and the usual transitivegolang.org/x/*andgenprotobumps along with it.semconvimport incmd/gubernator/main.gofromv1.40.0tov1.41.0. This is required, not cosmetic: otel v1.44.0 movesresource.Default()to semconv schema 1.41.0, andresource.Mergerejects a merge across two schema URLs. Left at v1.40.0 the daemon dies at startup withconflicting Schema URL: https://opentelemetry.io/schemas/1.41.0 and https://opentelemetry.io/schemas/1.40.0, which reproduced as a 3-for-3TestCLIfailure. The semconv import has to move in lockstep with every otel minor bump.Verification
govulncheck ./...no longer reports either vulnerability, and flags no third-party module at all.go build ./...andgo vet ./...clean.make testgreen:gubernator26.0s,cluster1.7s,cmd/gubernator3.8s.make lintreports 0 issues.