Skip to content

Upgrade OTEL to v1.20.0#2579

Merged
pkwarren merged 3 commits intomainfrom
pkw/update-otel
Nov 13, 2023
Merged

Upgrade OTEL to v1.20.0#2579
pkwarren merged 3 commits intomainfrom
pkw/update-otel

Conversation

@pkwarren
Copy link
Member

@pkwarren pkwarren commented Nov 13, 2023

The latest version of OTEL requires embedding the
embedded.TracerProvider interface going forward in any implementations. Instead of implementing/extending TracerProvider, instead return a separate Closer.

The latest version of OTEL requires embedding the
embedded.TracerProvider interface going forward in any implementations.
var _ io.Closer = &tracerProviderCloser{}

type tracerProviderCloser struct {
// https://pkg.go.dev/go.opentelemetry.io/otel/trace#hdr-API_Implementations
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Otel is the strangest package. How is this interface implemented? It contains an unexported method, so my understanding is that it can never be implemented outside of otel/trace/embedded.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree - pushed a follow up which will get us out of the business of implementing our own TracerProvider and instead just return a separate io.Closer to allow shutting down the tracer provider.

@pkwarren pkwarren merged commit 92ef372 into main Nov 13, 2023
@pkwarren pkwarren deleted the pkw/update-otel branch November 13, 2023 16:06
@r-n-o
Copy link

r-n-o commented Nov 13, 2023

@pkwarren thanks for merging this so quickly! This PR unblocks a security upgrade for projects using buf: GHSA-8pgv-569h-w5rw 🎉

Do you have a sense for when the next release of bufbuild/buf will be?

@pkwarren
Copy link
Member Author

Do you have a sense for when the next release of bufbuild/buf will be?

We haven't planned the next release yet - it is usually on demand as needed.

How are you consuming buf? If via a go module, you can just do a go get ...@main to pull the latest version (with this fix). The CLI binary itself has no dependencies on opentelemetry-go-contrib, so doesn't need to be rebuilt with a fix for GHSA-8pgv-569h-w5rw.

@bufdev
Copy link
Member

bufdev commented Nov 13, 2023

Of note, installing from sources is not recommended, we recommend you install from the binaries for exactly this reason.

@r-n-o
Copy link

r-n-o commented Nov 13, 2023

@pkwarren that's right, we're consuming via go module. go get github.com/bufbuild/buf/cmd/buf@main did the trick, thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants