chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0

[dependabot]

Bumps go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0.

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

• Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
• Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
• Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
• Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
• Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

• Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
• Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
• Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
• Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

• Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

• Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
• Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
• Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
• Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
• Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
• WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits

• 9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
• 61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
• 97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
• 5e363de limit response body size for OTLP HTTP exporters (#8108)
• 35214b6 Use an absolute path when calling bsd kenv (#8113)
• 290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
• e70658e fix: support getBody in otelploghttp (#8096)
• 4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
• b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
• 69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
gomod/go.opentelemetry.io/otel	1.43.0	🟢 9.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 5 badge detected: Passing SAST 🟢 9 SAST tool detected but not run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/metric	1.43.0	🟢 9.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 5 badge detected: Passing SAST 🟢 9 SAST tool detected but not run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/sdk	1.43.0	🟢 9.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 5 badge detected: Passing SAST 🟢 9 SAST tool detected but not run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/trace	1.43.0	🟢 9.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 5 badge detected: Passing SAST 🟢 9 SAST tool detected but not run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 43 contributing companies or organizations
gomod/golang.org/x/sys	0.42.0	Unknown	Unknown

Scanned Files

• go.mod

[harekrishnarai]

@openreview-byhk what security issues are here ?

[openreview-byhk]

Security Analysis of PR #37 — Dependency Upgrades

This PR is a Dependabot dependency bump that upgrades several OpenTelemetry Go packages and golang.org/x/sys. Here's a breakdown of the security-relevant findings:

---

✅ No Vulnerabilities Found (per Dependency Review)

The automated dependency scan found no known CVEs, license issues, or OpenSSF Scorecard concerns for any of the updated packages.

---

🔍 Security-Relevant Changes in the Upgrades

Despite no flagged CVEs, the changelogs reveal two security-significant fixes included in the otel v1.43.0 upgrade:

1. 🛡️ HTTP Response Body Size Limit (Defense Against Malicious/Misconfigured Servers)

Fixed in otel v1.43.0 (#8108)

The OTLP HTTP exporters (otlptracehttp, otlpmetrichttp, otlploghttp) now limit HTTP response body reads to 4 MiB. Previously, a malicious or misconfigured server could cause unbounded memory consumption by returning a very large response body. This is a real-world resource exhaustion / DoS vector.

Affected old versions: otel/sdk v1.40.0 through v1.42.x

2. 🏁 Race Condition Fix in SDK Metric

Fixed in otel v1.43.0 (#8056)

A race condition in go.opentelemetry.io/otel/sdk/metric's lastvalue aggregation could produce incorrect zero-value metrics. While primarily a correctness issue, race conditions in observability pipelines can obscure security-relevant telemetry (e.g., missed anomaly detection signals).

---

⚠️ golang.org/x/sys — OpenSSF Score Unknown

Package	Old Version	New Version	OpenSSF Score
golang.org/x/sys	v0.40.0	v0.42.0	Unknown

The dependency review flagged golang.org/x/sys as having an unknown OpenSSF Scorecard score. This is a low-level OS syscall abstraction package maintained by the Go team. While no CVEs are flagged, the "Unknown" score means it couldn't be evaluated for supply chain hygiene (pinned deps, branch protection, SAST, etc.).

Risk level: Low — this is a well-known Go standard library companion package, but it's worth noting for completeness.

---

✅ Summary

Issue	Severity	Status After This PR
Unbounded memory via OTLP HTTP response (DoS vector)	🟡 Medium	✅ Fixed by upgrading to otel v1.43.0
Race condition in metric aggregation	🟡 Low-Medium	✅ Fixed by upgrading to otel v1.43.0
golang.org/x/sys unknown OpenSSF score	🔵 Informational	⚠️ No change, acceptable risk

This PR is a net security improvement. The upgrades resolve two meaningful issues (memory exhaustion and a race condition) while introducing no new known vulnerabilities. Merging is recommended.

---

Powered by OpenReview