deps(go): bump 9 backend modules (otel, k8s, prometheus, gorm, oidc, x/*) - #344
Conversation
…x/*) Consolidates the open Dependabot Go PRs into one change: - go.opentelemetry.io/otel 1.44.0 -> 1.45.0 (+ otlp log/trace/metric exporters bumped in lockstep; sdk/log 0.20.0 -> 0.21.0 moved the log API, so otlploggrpc must move too) - k8s.io/api, client-go, apimachinery 0.36.2 -> 0.36.3 - github.com/prometheus/client_golang 1.23.2 -> 1.24.1 - golang.org/x/sync 0.21.0 -> 0.22.0, golang.org/x/crypto 0.53.0 -> 0.54.0 - github.com/coreos/go-oidc/v3 3.19.0 -> 3.20.0 - gorm.io/gorm 1.31.1 -> 1.31.2 go mod tidy + go vet + go build + go test -short all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe backend Go module updates direct and indirect dependency versions. No dependencies are added or removed, and no exported entities change. ChangesGo dependency updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR consolidates multiple Dependabot updates by bumping several backend Go module dependencies (OpenTelemetry, Kubernetes client libraries, Prometheus, GORM, OIDC, and golang.org/x/*) and refreshing the module lockfiles accordingly.
Changes:
- Update
backend/go.modto the newer versions for otel (+ OTLP exporters), k8s.io libs, Prometheus client,x/sync,x/crypto, go-oidc, and gorm. - Regenerate
backend/go.sumchecksums to match the updated dependency graph aftergo mod tidy.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| backend/go.mod | Bumps direct/indirect dependency versions for the backend Go module. |
| backend/go.sum | Updates module checksums to align with the new dependency set. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/go.mod`:
- Line 26: Update the go.opentelemetry.io/otel/exporters/prometheus dependency
in go.mod from v0.66.0 to v0.67.0, then regenerate go.sum so its checksums and
transitive module entries match the updated dependency.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6b97b016-0103-425c-9571-90bc020e4c1e
⛔ Files ignored due to path filters (1)
backend/go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
backend/go.mod
| go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 | ||
| go.opentelemetry.io/otel/exporters/prometheus v0.66.0 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== backend/go.mod relevant lines =="
if [ -f backend/go.mod ]; then
nl -ba backend/go.mod | sed -n '1,45p'
else
echo "backend/go.mod not found"
fi
echo
echo "== OpenTelemetry dependency declarations in backend/go.mod =="
rg 'go\.opentelemetry\.io/otel|exporters/prometheus|v1\.45\.0|v0\.66\.0|v0\.67\.0' backend/go.mod || true
echo
echo "== Go module proxies: Prometheus exporter versions =="
for v in v0.66.0 v0.67.0; do
echo "-- $v --"
curl -sS "https://proxy.golang.org/go.opentelemetry.io/otel/exporters/prometheus/@v/${v}.mod" || echo "PROXY_ERROR_${v}"
done
echo
echo "== Go module APIs: parse direct required versions =="
python3 - <<'PY'
import urllib.request
for v in ["v0.66.0", "v0.67.0"]:
url=f"https://proxy.golang.org/go.opentelemetry.io/otel/exporters/prometheus/@v/{v}.mod"
data=urllib.request.urlopen(url, timeout=15).read().decode()
lines={}
for line in data.splitlines():
parts=line.split()
if len(parts)>=2 and parts[0] in ["require","require(","replaced"]:
key=parts[1]
val=parts[2] if len(parts)>=3 else ""
lines.setdefault(key, []).append([line.strip(),val])
print(f"## {v}")
for key in ["go.opentelemetry.io/otel","go.opentelemetry.io/otel/metric","go.opentelemetry.io/otel/trace","github.com/prometheus/client_golang","github.com/prometheus/common","go.opentelemetry.io/otel/sdk/metric"]:
if key in lines:
for row in lines[key]:
print(f"{key}: {row[1]}")
PYRepository: omattsson/k8s-stack-manager
Length of output: 241
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== backend/go.mod relevant lines =="
if [ -f backend/go.mod ]; then
awk '{printf "%6d %s\n", NR, $0}' backend/go.mod | sed -n '1,45p'
else
echo "backend/go.mod not found"
fi
echo
echo "== OpenTelemetry dependency declarations in backend/go.mod =="
grep -nE 'go\.opentelemetry\.io/otel|exporters/prometheus|v1\.45\.0|v0\.66\.0|v0\.67\.0' backend/go.mod || true
echo
echo "== Go module proxies: Prometheus exporter versions =="
for v in v0.66.0 v0.67.0; do
echo "-- $v --"
curl -sS --max-time 20 "https://proxy.golang.org/go-opentelemetry-io/otel/exporters/prometheus/@v/${v}.mod" || echo "PROXY_ERROR_${v}"
done
echo
echo "== Go module APIs: parse direct required versions =="
python3 - <<'PY'
# Use Go module proxy slashes for paths containing slashes.
import urllib.request
def proxy_path(path):
return "https://proxy.golang.org/" + "/".join(part.replace("/", "-slash-") for part in path.split("/")[:7]) + "/@v/"
for v in ["v0.66.0", "v0.67.0"]:
path="go.opentelemetry.io/otel/exporters/prometheus/@v/" + v + ".mod"
url="https://proxy.golang.org/go-opentelemetry-io/otel/exporters/prometheus/@v/" + v + ".mod"
data=urllib.request.urlopen(url, timeout=20).read().decode()
lines={}
for line in data.splitlines():
parts=line.split()
if len(parts)>=2:
key=parts[1]
val=parts[2] if len(parts)>=3 else ""
if key in ["go.opentelemetry.io/otel","go.opentelemetry.io/otel/metric","go.opentelemetry.io/otel/trace","github.com/prometheus/client_golang","github.com/prometheus/common","go.opentelemetry.io/otel/sdk/metric"]:
lines.setdefault(key, []).append([line.strip(),val])
print(f"## {v}")
for key in ["go.opentelemetry.io/otel","go.opentelemetry.io/otel/metric","go.opentelemetry.io/otel/trace","github.com/prometheus/client_golang","github.com/prometheus/common","go.opentelemetry.io/otel/sdk/metric"]:
if key in lines:
for row in lines[key]:
print(f"{key}: {row[1]}")
else:
print(f"{key}: absent")
PYRepository: omattsson/k8s-stack-manager
Length of output: 5664
🌐 Web query:
OpenTelemetry Go modules compatibility table v1.45.0 exporters/prometheus v0.67.0 go.opentelemetry.io/otel/exporters/prometheus v0.66.0
💡 Result:
In OpenTelemetry Go, there is no single, static compatibility table that maps specific versions of different modules [1]. Instead, compatibility between OpenTelemetry Go modules is guaranteed only for releases derived from the same repository commit [1]. Regarding the specific versions mentioned: - The Prometheus exporter module go.opentelemetry.io/otel/exporters/prometheus reached version v0.66.0 on May 27, 2026 [2]. - Subsequently, version v0.67.0 of this exporter was released on August 3, 2026 [3]. Because OpenTelemetry Go modules are versioned independently, you cannot rely on version numbers alone to determine compatibility [1]. To ensure all modules in your project are compatible, the project maintainers recommend using the versions released together in the same official OpenTelemetry Go release [1][4]. You can identify these sets by checking the official release notes [4] or the versions.yaml file in the project repository [5], which groups compatible module versions for each release cycle.
Citations:
- 1: Document compatibility between modules open-telemetry/opentelemetry-go#3806
- 2: https://pkg.go.dev/go.opentelemetry.io/otel/exporters/prometheus
- 3: https://releasealert.dev/github/open-telemetry/opentelemetry-go
- 4: https://github.com/open-telemetry/opentelemetry-go/releases
- 5: https://github.com/open-telemetry/opentelemetry-go/blob/main/versions.yaml
🌐 Web query:
github.com open-telemetry opentelemetry-go releases v1.45.0 versions.yaml go.opentelemetry.io/otel/exporters/prometheus
💡 Result:
The release v1.45.0 of the opentelemetry-go project, published on August 3, 2026, encompasses multiple component versions [1][2][3]. Specifically, the Prometheus exporter (go.opentelemetry.io/otel/exporters/prometheus) is part of the experimental metrics module set, which was updated to version v0.67.0 in this release [1][3]. The repository uses a versions.yaml file to manage these grouped releases [4]. While the stable core modules (like go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk) are versioned at v1.45.0, the Prometheus exporter follows the versioning of the experimental metrics group [1][3][4]. As of the v1.45.0 release, the Prometheus exporter is at version v0.67.0 [1][3].
Citations:
- 1: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0
- 2: https://newreleases.io/project/github/open-telemetry/opentelemetry-go/release/v1.45.0
- 3: https://releasealert.dev/github/open-telemetry/opentelemetry-go
- 4: https://github.com/open-telemetry/opentelemetry-go/blob/main/versions.yaml
Align the Prometheus exporter with OpenTelemetry v1.45.0.
backend/go.mod uses OpenTelemetry v1.45.0, but go.opentelemetry.io/otel/exporters/prometheus still uses v0.66.0. That module belongs to the experimental metrics group, which was released as v0.67.0 in the v1.45.0 release.
Update line 26 to v0.67.0 and regenerate backend/go.sum.
Proposed fix
- go.opentelemetry.io/otel/exporters/prometheus v0.66.0
+ go.opentelemetry.io/otel/exporters/prometheus v0.67.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go.opentelemetry.io/otel/exporters/prometheus v0.66.0 | |
| go.opentelemetry.io/otel/exporters/prometheus v0.67.0 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/go.mod` at line 26, Update the
go.opentelemetry.io/otel/exporters/prometheus dependency in go.mod from v0.66.0
to v0.67.0, then regenerate go.sum so its checksums and transitive module
entries match the updated dependency.
Consolidates open Dependabot Go PRs: #340 #339 #332 #330 #329 #326 #321 #319 #317 #307.
go.opentelemetry.io/otel1.44.0→1.45.0 (+ otlp log/trace/metric exporters in lockstep — sdk/log 0.20→0.21 moved the log API so otlploggrpc must move too)k8s.io/{api,client-go,apimachinery}0.36.2→0.36.3prometheus/client_golang1.23.2→1.24.1golang.org/x/sync0.21→0.22,golang.org/x/crypto0.53→0.54coreos/go-oidc/v33.19→3.20,gorm.io/gorm1.31.1→1.31.2Local:
go mod tidy,go vet,go build,go test -shortall pass.🤖 Generated with Claude Code
Summary by CodeRabbit