chore(deps): bump go.opentelemetry.io/collector/config/configgrpc from 0.80.0 to 0.102.1 #6
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [go.opentelemetry.io/collector/config/configgrpc](https://github.com/open-telemetry/opentelemetry-collector) from 0.80.0 to 0.102.1. - [Release notes](https://github.com/open-telemetry/opentelemetry-collector/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-collector/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-collector@v0.80.0...v0.102.1) --- updated-dependencies: - dependency-name: go.opentelemetry.io/collector/config/configgrpc dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
|
Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.
Note 🟢 Risk threshold not exceeded. Change Summary (click to expand)The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective. Summary: This code change primarily focuses on updating the Go version used in the project from 1.21 to 1.22.3, as well as updating several key dependencies to their latest versions. These updates are likely to improve the project's security, performance, and compatibility with the latest versions of the Go language and its ecosystem. The updates to the OpenTelemetry and gRPC libraries are particularly noteworthy from an application security perspective, as these are critical components for distributed tracing and monitoring, which are essential for identifying and mitigating security vulnerabilities in complex, distributed applications. Additionally, the update to the Overall, this code change appears to be a routine update to the project's dependencies, with no obvious security concerns. The updates are likely to improve the project's overall security and maintainability. Files Changed:
Powered by DryRun Security |
Bumps go.opentelemetry.io/collector/config/configgrpc from 0.80.0 to 0.102.1.
Release notes
Sourced from go.opentelemetry.io/collector/config/configgrpc's releases.
... (truncated)
Changelog
Sourced from go.opentelemetry.io/collector/config/configgrpc's changelog.
... (truncated)
Commits
7218b4cprepare release 0.102.1 (#10326)10e89bd[configgrpc] Use own compressors for zstd (#10323) (#10324)0ab388b[chore] update go to 1.21.11/1.22.4 (#10321) (#10325)5cbf8be[chore] Prepare release v1.9.0/v0.102.0 (#10293)7dbaebb[confighttp] Apply MaxRequestBodySize to the result of a decompressed body (#...ed767dc[service] remove deprecated Telemetry struct and New func (#10285)e07b297[chore] remove deprecated LoadTLSConfigContext methods (#10284)c30b294[chore] remove deprecated types (#10283)b6510d0[otelcol] Removed deprecatedConfigProviderfield from settings (#10281)d55d042[chore] remove TODO from confmap code (#10278)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.