chore(deps): update module go.opentelemetry.io/otel to v1.42.0 [security] (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel	v1.41.0 → v1.42.0

---

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

CVE-2026-41178 / GHSA-5wrp-cwcj-q835 / GO-2026-5158

More information

Details

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Severity

Unknown

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go/pull/7880

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.42.0: /v0.64.0/v0.18.0/v0.0.16

Compare Source

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
  The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
  See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#​7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#​7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#​7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#​7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#​7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#​7834)

Removed

• Drop support for [Go 1.24]. (#​7984)

What's Changed

• fix changelog protection marker by @​pellared in #​7986
• Drop support for Go 1.24 by @​MrAlias in #​7984
• fix(deps): update golang.org/x by @​renovate[bot] in #​7907
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @​renovate[bot] in #​7981
• chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @​renovate[bot] in #​7989
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.53.0 by @​renovate[bot] in #​7982
• Revert "Revert "Generate semconv/v1.40.0"" by @​MrAlias in #​7985
• support stdlib request.GetBody on metrics by @​marifari-hue in #​7931
• attribute: add TestNotEquivalence and equality operator tests by @​pellared in #​7979
• Refactor benchmark CI by @​XSAM in #​7873
• chore(deps): update module github.com/securego/gosec/v2 to v2.24.7 by @​renovate[bot] in #​7988
• chore(deps): pin codspeedhq/action action to df47568 by @​renovate[bot] in #​7996
• chore(deps): update actions/checkout action to v6.0.2 by @​renovate[bot] in #​7997
• chore(deps): update codspeedhq/action action to v4.11.0 by @​renovate[bot] in #​7999
• Upgrade to semconv/v1.40.0 by @​MrAlias in #​7991
• Regenerate semconv/v1.40.0/MIGRATION.md by @​MrAlias in #​7992
• fix: generated semconv helpers skipping attributes by @​victoraugustolls in #​7964
• Feat: Have SpanContext support the new W3C random flag. by @​nikhilmantri0902 in #​7834
• Semconv metric helper caller-slice mutation fix by @​MrAlias in #​7993
• Fix semconv generated error type to check error chain for custom type declaration by @​MrAlias in #​7994
• refactor: replace uint64 and int32 with atomic types in tests by @​alexandear in #​7941
• chore(deps): update golang.org/x/telemetry digest to 18da590 by @​renovate[bot] in #​8000
• TracerProvider ForceFlush() Error Fix by @​sawamurataxman in #​7856
• log: add error field to Record and make SDK to emit exception attributes by @​iblancasa in #​7924
• chore(deps): update dependency codespell to v2.4.2 by @​renovate[bot] in #​8003
• chore(deps): update github/codeql-action action to v4.32.6 by @​renovate[bot] in #​8004
• chore(deps): update codspeedhq/action action to v4.11.1 by @​renovate[bot] in #​8001
• fix(deps): update module google.golang.org/grpc to v1.79.2 by @​renovate[bot] in #​8007
• chore(deps): update module github.com/mgechev/revive to v1.15.0 by @​renovate[bot] in #​8009
• chore(deps): update golang.org/x/telemetry digest to e526e8a by @​renovate[bot] in #​8010
• Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 by @​pellared in #​8006

New Contributors

• @​marifari-hue made their first contribution in #​7931
• @​victoraugustolls made their first contribution in #​7964
• @​sawamurataxman made their first contribution in #​7856
• @​iblancasa made their first contribution in #​7924

Full Changelog: open-telemetry/opentelemetry-go@v1.41.0...v1.42.0

---

Configuration

📅 Schedule: (in timezone Asia/Taipei)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel/metric	v1.41.0 -> v1.42.0
go.opentelemetry.io/otel/trace	v1.41.0 -> v1.42.0