golang-opentelemetry-contrib - Debian Package Tracker

general

source: golang-opentelemetry-contrib (main)
version: 1.43.0-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Thomas Goirand [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 0.56.0-5
testing: 1.43.0-1
unstable: 1.43.0-1

versioned links

0.56.0-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.43.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-opentelemetry-contrib-dev

action needed

Marked for autoremoval on 13 October due to golang-github-frankban-quicktest, golang-github-go-git-go-git, golang-github-go-logr-logr, golang-github-google-go-github, golang-github-googleapis-gax-go, golang-github-klauspost-compress, golang-github-prometheus-client-golang: #1146000, #1146192, #1146194, #1146195, #1146199, #1146200, #1146203 high

Version 1.43.0-1 of golang-opentelemetry-contrib is marked for autoremoval from testing on Tue 13 Oct 2026. It depends (transitively) on golang-github-frankban-quicktest, golang-github-go-git-go-git, golang-github-go-logr-logr, golang-github-google-go-github, golang-github-googleapis-gax-go, golang-github-klauspost-compress, golang-github-prometheus-client-golang, affected by #1146000, #1146192, #1146194, #1146195, #1146199, #1146200, #1146203. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-09-04 Last update: 2026-09-17 01:03

A new upstream version is available: 1.46.0 high

A new upstream version 1.46.0 is available, you should consider packaging it.

Created: 2026-05-29 Last update: 2026-09-17 00:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-47256: OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.
CVE-2026-55701: The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

Created: 2026-09-16 Last update: 2026-09-16 20:33

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-47256: OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.
CVE-2026-55701: The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

Created: 2026-09-16 Last update: 2026-09-16 20:33

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 33af0dc4e0205256915416127968fd7484b5eaa5
Merge: 2bf373b8e e690a4d7e
Author: Andrew Lee (李健秋) <ajqlee@debian.org>
Date:   Mon May 25 14:05:15 2026 +0200

    Merge branch 'debian/sid' into 'debian/sid'
    
    New upstream version 1.43.0
    
    See merge request go-team/packages/golang-opentelemetry-contrib!3

https://salsa.debian.org/api/v4/projects/go-team%2Fpackages%2Fgolang-opentelemetry-contrib API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-05-16 Last update: 2026-09-12 03:02

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-05-26 Last update: 2026-05-26 00:02

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-47256: (needs triaging) OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.
CVE-2026-55701: (needs triaging) The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-09-16 Last update: 2026-09-16 20:33

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 1.43.0-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-06-01 Last update: 2026-05-25 18:02

news

[rss feed]

[2026-06-08] golang-opentelemetry-contrib 1.43.0-1 MIGRATED to testing (Debian testing watch)
[2026-05-25] Accepted golang-opentelemetry-contrib 1.43.0-1 (source) into unstable (Juan Manuel Méndez Rey) (signed by: 李健秋 Andrew Lee)
[2026-05-16] Accepted golang-opentelemetry-contrib 1.39.0-3 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2026-03-05] Accepted golang-opentelemetry-contrib 1.39.0-2 (source) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2025-03-08] golang-opentelemetry-contrib 0.56.0-5 MIGRATED to testing (Debian testing watch)
[2025-03-04] Accepted golang-opentelemetry-contrib 0.56.0-5 (source) into unstable (Guillem Jover)
[2024-11-06] golang-opentelemetry-contrib 0.56.0-4 MIGRATED to testing (Debian testing watch)
[2024-11-01] Accepted golang-opentelemetry-contrib 0.56.0-4 (source) into unstable (Reinhard Tartler)
[2024-10-31] Accepted golang-opentelemetry-contrib 0.56.0-3 (source) into unstable (Reinhard Tartler)
[2024-10-21] Accepted golang-opentelemetry-contrib 0.56.0-2 (source) into experimental (Guillem Jover)
[2024-10-21] Accepted golang-opentelemetry-contrib 0.56.0-1 (source) into experimental (Reinhard Tartler)
[2024-08-05] golang-opentelemetry-contrib 0.42.0-2 MIGRATED to testing (Debian testing watch)
[2024-08-03] Accepted golang-opentelemetry-contrib 0.42.0-2 (source) into unstable (Shengjing Zhu)
[2024-06-08] golang-opentelemetry-contrib 0.42.0-1 MIGRATED to testing (Debian testing watch)
[2024-06-06] Accepted golang-opentelemetry-contrib 0.42.0-1 (source) into unstable (Reinhard Tartler)
[2024-06-02] golang-opentelemetry-contrib 0.25.0-2 MIGRATED to testing (Debian testing watch)
[2024-05-31] Accepted golang-opentelemetry-contrib 0.25.0-2 (source) into unstable (Reinhard Tartler)
[2022-10-27] Accepted golang-opentelemetry-contrib 0.25.0-1 (source all) into experimental (Debian FTP Masters) (signed by: Thomas Goirand)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.56.0-5