[Backport 3.7] Align repository-gcs OpenTelemetry dependencies (CVE-2026-45292) - #22614
Open
nishthm wants to merge 1 commit into
Open
[Backport 3.7] Align repository-gcs OpenTelemetry dependencies (CVE-2026-45292)#22614nishthm wants to merge 1 commit into
nishthm wants to merge 1 commit into
Conversation
Backport of opensearch-project#22579 to the 3.7 branch to address CVE-2026-45292. Aligns the OpenTelemetry runtime dependencies used by repository-gcs with the versions already managed by the OpenSearch version catalog. The plugin previously pinned opentelemetry-api and opentelemetry-context to 1.47.0, overriding the repository-wide 1.62.0 version. Using the catalog avoids that drift and resolves the OpenTelemetry runtime dependencies to 1.62.0 (>= 1.62.0 which is the fix threshold for CVE-2026-45292). Adds opentelemetry-common to the license SHA registry to match the catalog bundle. The dependency verification SHAs are regenerated accordingly. Validation: - ./gradlew :plugins:repository-gcs:updateShas -Pcrypto.standard=FIPS-140-3 - ./gradlew :plugins:repository-gcs:dependencyInsight --dependency opentelemetry-api --configuration runtimeClasspath -Pcrypto.standard=FIPS-140-3 -> resolves to 1.62.0 - ./gradlew :plugins:repository-gcs:dependencyInsight --dependency opentelemetry-context --configuration runtimeClasspath -Pcrypto.standard=FIPS-140-3 -> resolves to 1.62.0 Signed-off-by: Nishtha Mittal <nishthamittal04@gmail.com>
nishthm
requested review from
a team,
Bukhtawar,
alchemist51,
andrross,
ashking94,
dbwiddis,
gbbafna,
jed326,
kotwanikunal,
mch2,
msfroh,
owaiskazi19,
peternied,
reta,
sachinpkale,
saratvemulapalli,
shwetathareja and
sohami
as code owners
July 30, 2026 22:29
Contributor
PR Code Analyzer ❗AI-powered 'Code-Diff-Analyzer' found issues on commit 734db2f. ⛔ Hard block: Issues at Medium severity or above will block this PR from merging.
The table above displays the top 10 most important findings. Pull Requests Author(s): Please update your Pull Request according to the report above. Repository Maintainer(s): You can Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of #22579 to the 3.7 branch to address CVE-2026-45292.
Aligns the OpenTelemetry runtime dependencies used by
repository-gcswith the versions already managed by the OpenSearch version catalog. The plugin previously pinnedopentelemetry-apiandopentelemetry-contextto 1.47.0, overriding the repository-wide 1.62.0 version. Using the catalog resolves these runtime dependencies to 1.62.0 (>= the fix threshold for CVE-2026-45292).Adds
opentelemetry-commonto the license SHA registry. Dependency verification SHAs are regenerated viaupdateShas.Related Issues
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.