opentelemetry-collector-contrib/0.120.1-r1: cve remediation

[octo-sts]

opentelemetry-collector-contrib/0.120.1-r1: fix CVE-2019-3826

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/opentelemetry-collector-contrib.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error: "invalid version: module contains a go.mod file, so module path must match major version ("github.com/prometheus/prometheus/v2")"

• Error Category: Dependency

• Failure Point: go/bump step when trying to update prometheus dependency

• Root Cause Analysis: The error occurs because the Prometheus module uses semantic versioning (v2+) which requires the major version in the import path. The current specification "@v2.7.1" doesn't match this requirement.

• Suggested Fix:
Update the prometheus dependency line in the melange.yaml to:

  - uses: go/bump
    with:
      deps: |-
        github.com/golang-jwt/jwt/[email protected]
        github.com/go-jose/go-jose/[email protected]
        github.com/prometheus/prometheus/[email protected]

• Explanation: In Go modules with major version 2 or higher, the major version must be part of the module path (not just the version tag) according to Go's semantic import versioning rules. The fix adds "/v2" to the module path to correctly match Prometheus's module declaration.

• Additional Notes:

• This is a common issue when dealing with Go modules that use semantic versioning v2+
• The other dependencies are correctly specified with their version suffixes
• The error is purely about module path formatting, not compatibility

• References:

• Go Modules Reference: https://go.dev/ref/mod#major-version-suffixes
• Prometheus Go client library versioning: https://github.com/prometheus/client_golang#version-notice