Skip to content

build (deps): upgrade opentelemetry to 1.62.0 to patch CVE-2026-45292#13304

Merged
blakeli0 merged 2 commits into
googleapis:mainfrom
blakeli0:security/upgrade-opentelemetry-cve-2026-45292
May 29, 2026
Merged

build (deps): upgrade opentelemetry to 1.62.0 to patch CVE-2026-45292#13304
blakeli0 merged 2 commits into
googleapis:mainfrom
blakeli0:security/upgrade-opentelemetry-cve-2026-45292

Conversation

@blakeli0
Copy link
Copy Markdown
Contributor

@blakeli0 blakeli0 commented May 29, 2026

Upgrades opentelemetry.version to 1.62.0 to address CVE-2026-45292 (GHSA-rcgg-9c38-7xpx). This repo is actually NOT affected by this vulnerability but it is a good practice to upgrade it so it does not show up in customers' reports.

Separately, removed unnecessary version declaration of opentelemetry in Spanner.

@blakeli0 blakeli0 requested review from a team as code owners May 29, 2026 18:47
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the OpenTelemetry version to 1.62.0 across several Maven configuration files. It also introduces a dummy comment in LoggingUtils.java to trigger the CI pipeline. The feedback advises removing this dummy comment to avoid unnecessary noise in the codebase, suggesting cleaner alternatives like empty git commits to trigger CI.

@blakeli0 blakeli0 force-pushed the security/upgrade-opentelemetry-cve-2026-45292 branch from 1612acd to e1d2817 Compare May 29, 2026 18:52
@blakeli0 blakeli0 force-pushed the security/upgrade-opentelemetry-cve-2026-45292 branch from e1d2817 to 342a513 Compare May 29, 2026 19:02
@blakeli0 blakeli0 changed the title deps(otel): upgrade opentelemetry to 1.62.0 to patch CVE-2026-45292 build (deps): upgrade opentelemetry to 1.62.0 to patch CVE-2026-45292 May 29, 2026
@blakeli0 blakeli0 requested review from jinseopkim0 and lqiu96 May 29, 2026 20:44
@lqiu96
Copy link
Copy Markdown
Member

lqiu96 commented May 29, 2026

Do we care about this sample's version?

<opentelemetry.version>1.57.0</opentelemetry.version>

@blakeli0
Copy link
Copy Markdown
Contributor Author

Do we care about this sample's version?

<opentelemetry.version>1.57.0</opentelemetry.version>

I don't think it matters much but it is more of a best practice to make all versions update together.

Separately, I also briefly looks into if we can remove the version from bigquery samples as well. I think we probably can because it is not used in between the region tags. Do you have more info about how it is used (not in scope of this PR)?

@blakeli0 blakeli0 merged commit 67fe722 into googleapis:main May 29, 2026
269 of 271 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants