Merge branch 'main' into dependabot/go_modules/internal/tools/github.…

…com/golangci/golangci-lint-1.45.2
open-telemetry · Mar 28, 2022 · 8a6c3d3 · 8a6c3d3
2 parents 8df3d0d + 0a7cf5a
commit 8a6c3d3
Show file tree

Hide file tree

Showing 15 changed files with 2,085 additions and 61 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,11 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Security
+
+- Upgrade `go.opentelemetry.io/proto/otlp` from `v0.12.0` to `v0.12.1`.
+  This includes an indirect upgrade of `github.com/grpc-ecosystem/grpc-gateway` which resolves [a vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2019-11254) from `gopkg.in/yaml.v2` in version `v2.2.3`. (#2724, #TBD)
+
 ## [1.6.0/0.28.0] - 2022-03-23
 
 ### ⚠️ Notice ⚠️

diff --git a/example/otel-collector/go.sum b/example/otel-collector/go.sum
diff --git a/exporters/otlp/otlpmetric/go.mod b/exporters/otlp/otlpmetric/go.mod
@@ -10,7 +10,7 @@ require (
 	go.opentelemetry.io/otel/metric v0.28.0
 	go.opentelemetry.io/otel/sdk v1.6.0
 	go.opentelemetry.io/otel/sdk/metric v0.28.0
-	go.opentelemetry.io/proto/otlp v0.12.0
+	go.opentelemetry.io/proto/otlp v0.12.1
 	google.golang.org/grpc v1.45.0
 	google.golang.org/protobuf v1.27.1
 )

diff --git a/exporters/otlp/otlpmetric/go.sum b/exporters/otlp/otlpmetric/go.sum
diff --git a/exporters/otlp/otlpmetric/otlpmetricgrpc/go.mod b/exporters/otlp/otlpmetric/otlpmetricgrpc/go.mod
@@ -10,8 +10,8 @@ require (
 	go.opentelemetry.io/otel/metric v0.28.0
 	go.opentelemetry.io/otel/sdk v1.6.0
 	go.opentelemetry.io/otel/sdk/metric v0.28.0
-	go.opentelemetry.io/proto/otlp v0.12.0
-	google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013
+	go.opentelemetry.io/proto/otlp v0.12.1
+	google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1
 	google.golang.org/grpc v1.45.0
 	google.golang.org/protobuf v1.27.1
 )

diff --git a/exporters/otlp/otlpmetric/otlpmetricgrpc/go.sum b/exporters/otlp/otlpmetric/otlpmetricgrpc/go.sum
diff --git a/exporters/otlp/otlpmetric/otlpmetrichttp/go.mod b/exporters/otlp/otlpmetric/otlpmetrichttp/go.mod
@@ -7,7 +7,7 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.6.0
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.28.0
 	go.opentelemetry.io/otel/sdk v1.6.0
-	go.opentelemetry.io/proto/otlp v0.12.0
+	go.opentelemetry.io/proto/otlp v0.12.1
 	google.golang.org/protobuf v1.27.1
 )
 

diff --git a/exporters/otlp/otlpmetric/otlpmetrichttp/go.sum b/exporters/otlp/otlpmetric/otlpmetrichttp/go.sum
diff --git a/exporters/otlp/otlptrace/go.mod b/exporters/otlp/otlptrace/go.mod
@@ -9,7 +9,7 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.6.0
 	go.opentelemetry.io/otel/sdk v1.6.0
 	go.opentelemetry.io/otel/trace v1.6.0
-	go.opentelemetry.io/proto/otlp v0.12.0
+	go.opentelemetry.io/proto/otlp v0.12.1
 	google.golang.org/grpc v1.45.0
 	google.golang.org/protobuf v1.27.1
 )

diff --git a/exporters/otlp/otlptrace/go.sum b/exporters/otlp/otlptrace/go.sum
diff --git a/exporters/otlp/otlptrace/otlptracegrpc/go.mod b/exporters/otlp/otlptrace/otlptracegrpc/go.mod
@@ -8,9 +8,9 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.6.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.6.0
 	go.opentelemetry.io/otel/sdk v1.6.0
-	go.opentelemetry.io/proto/otlp v0.12.0
+	go.opentelemetry.io/proto/otlp v0.12.1
 	go.uber.org/goleak v1.1.12
-	google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013
+	google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1
 	google.golang.org/grpc v1.45.0
 	google.golang.org/protobuf v1.27.1
 )

diff --git a/exporters/otlp/otlptrace/otlptracegrpc/go.sum b/exporters/otlp/otlptrace/otlptracegrpc/go.sum
diff --git a/exporters/otlp/otlptrace/otlptracehttp/go.mod b/exporters/otlp/otlptrace/otlptracehttp/go.mod
@@ -9,7 +9,7 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.6.0
 	go.opentelemetry.io/otel/sdk v1.6.0
 	go.opentelemetry.io/otel/trace v1.6.0
-	go.opentelemetry.io/proto/otlp v0.12.0
+	go.opentelemetry.io/proto/otlp v0.12.1
 	google.golang.org/protobuf v1.27.1
 )
 

diff --git a/exporters/otlp/otlptrace/otlptracehttp/go.sum b/exporters/otlp/otlptrace/otlptracehttp/go.sum
diff --git a/sdk/resource/config.go b/sdk/resource/config.go
@@ -110,7 +110,16 @@ func WithOSDescription() Option {
 }
 
 // WithProcess adds all the Process attributes to the configured Resource.
-// See individual WithProcess* functions to configure specific attributes.
+//
+// Warning! This option will include process command line arguments. If these
+// contain sensitive information it will be included in the exported resource.
+//
+// This option is equivalent to calling WithProcessPID,
+// WithProcessExecutableName, WithProcessExecutablePath,
+// WithProcessCommandArgs, WithProcessOwner, WithProcessRuntimeName,
+// WithProcessRuntimeVersion, and WithProcessRuntimeDescription. See each
+// option function for information about what resource attributes each
+// includes.
 func WithProcess() Option {
 	return WithDetectors(
 		processPIDDetector{},
@@ -143,7 +152,11 @@ func WithProcessExecutablePath() Option {
 }
 
 // WithProcessCommandArgs adds an attribute with all the command arguments (including
-// the command/executable itself) as received by the process the configured Resource.
+// the command/executable itself) as received by the process to the configured
+// Resource.
+//
+// Warning! This option will include process command line arguments. If these
+// contain sensitive information it will be included in the exported resource.
 func WithProcessCommandArgs() Option {
 	return WithDetectors(processCommandArgsDetector{})
 }