Update otel-lambda submodule and collector deps to v0.48.0 (CVE remediation) - #1135
Merged
alexperez52 merged 1 commit intoJun 23, 2026
Conversation
…emediation - Update opentelemetry-lambda submodule to commit 7067947 (OTel Collector v0.151.0) - Bump adot/collector/lambdacomponents deps: OTel v0.138.0 -> v0.151.0 - Update Go directive: 1.24.0 -> 1.26.2 - Update adot/collector/VERSION to v0.48.0 - Fix test: exportersCount 6 -> 8 (otlp_grpc/otlp_http aliases in v0.151.0) Addresses 27 CVEs including: - CVE-2025-68121 (critical, go/stdlib) - CVE-2026-33186 (critical, google.golang.org/grpc) - 10 high severity in go/stdlib, golang.org/x/net Key dependency upgrades: - google.golang.org/grpc: v1.76.0 -> v1.80.0 - golang.org/x/net: v0.44.0 -> v0.53.0 - golang.org/x/crypto: v0.42.0 -> v0.50.0 sim: https://t.corp.amazon.com/V2153606376
alexperez52
approved these changes
Jun 22, 2026
|
Is there any info when layers with this change are going to be published? |
|
Hi, thanks for taking the time to do the updates. We are waiting for the release of the updated Lambda layers as well, especially the |
This was referenced Jul 9, 2026
priyankaDhingra
added a commit
that referenced
this pull request
Aug 3, 2026
…ctory, go/nodejs trace validation, Go CI) (#1138) * ci: Update Go version in all workflows from 1.24.3 to 1.26.2 PR #1135 bumped Go from 1.24.0 to 1.26.2 in go.mod files (adot/collector/lambdacomponents, opentelemetry-lambda submodule). The GitHub Actions workflows still referenced Go ~1.24.3 via actions/setup-go, causing build/runtime failures in the soak tests because the installed Go toolchain was too old for the go directive. Update all 8 workflow files to use go-version: '~1.26.2' to match the project's go.mod requirements. * fix(nodejs): Repair soak-test terraform and expected trace for OTel v0.151.0 The OTel Collector v0.151.0 submodule bump introduced two nodejs-only breakages in the soak/integration tests: 1. Terraform "Unsupported argument": upstream nodejs/sample-apps/aws-sdk/deploy/wrapper was refactored to build layer ARNs internally from published layer versions and no longer accepts collector_layer_arn / sdk_layer_arn. Rework the integration test to instantiate terraform-aws-modules/lambda/aws + api-gateway-proxy directly and attach the locally-built layers, mirroring the python test. Go and Java deploy modules still accept the ARN inputs and are unchanged. 2. TraceValidator "data model not matched": the upstream nodejs sample app switched its AWS call from S3 ListBuckets to STS GetCallerIdentity. Update the expected trace template accordingly. Java/Go samples still use S3. sim: https://taskei.amazon.dev/tasks/PROMET-11975 * fix(collector): remove deprecated telemetry.metrics.address for OTel v0.151.0 The collector v0.151.0 bump surfaced a runtime INIT/invoke failure across soak jobs: - java-agent: FUNCTION_ERROR_INIT_FAILURE during provisioned-concurrency warm-up (surfaces as the aws_lambda_provisioned_concurrency_config waiter erroring) - go/python/java wrappers: sample app returns HTTP 500, so no trace is produced and TraceValidator reports "data model not matched" Both paths share the collector extension. The ADOT config override retained `service.telemetry.metrics.address: localhost:8888`, a field deprecated in collector v0.123.0 and dropped by upstream in the v0.151.0 default config. Upstream opentelemetry-collector issue #3911 documents this field causing port conflicts and collector crashes, which would crash the Lambda extension and produce the observed INIT/invoke failures. Remove the telemetry block from the default ADOT collector config and the java-agent integration test's inline config to realign with upstream v0.151.0. NOT YET VERIFIED: soak cannot be run locally (deploys real Lambdas) and the failing run's CloudWatch logs were already torn down. A soak run is required to confirm this resolves the INIT failures. sim: https://taskei.amazon.dev/tasks/PROMET-11975 * fix(collector): set required Telemetry factory for OTel Collector v0.151.0 v0.151.0 made otelcol.Factories.Telemetry a required field. The ADOT lambdacomponents builder (adot/collector/lambdacomponents/default.go), which patch-upstream.sh copies over the submodule, did not set it, so the collector extension failed at INIT ("otelcol.Factories.Telemetry must not be nil") -> Extension.InitError on every invoke -> instrumented Lambdas returned HTTP 500 with no trace in soak (go/python/java-wrapper) and java-agent FUNCTION_ERROR_INIT_FAILURE. Set Telemetry: otelconftelemetry.NewFactory(), mirroring upstream lambdacomponents/custom.go, and add the collector/service require via go mod tidy. Ref: V2153606376 * fix(soak): update go-wrapper expected trace for OTel v0.151.0 span naming The rebuilt go sample app (opentelemetry-lambda submodule @ v0.151.0) emits new span names via updated otelaws/otelhttp instrumentation, which flow to X-Ray inferred-segment names: - S3 AWS SDK call: inferred segment S3 -> S3.ListBuckets - HTTP client call: inferred segment api.github.com -> HTTP GET The inferred S3 segment no longer carries origin/aws.operation, so those fields are dropped. Regenerated from the real trace in soak run 29127081461. * fix(soak): nodejs sample app must return _X_AMZN_TRACE_ID for validator The nodejs aws-sdk sample app returned a caller-identity JSON payload, so the soak trace validator could not extract a trace ID (trace_id=null) and never fetched the trace, failing with 'data model not matched'. Mirror the go/python sample apps: still call STS GetCallerIdentity (to emit the STS segment) but return process.env._X_AMZN_TRACE_ID as the response body. Placed under adot/ so patch-upstream.sh (cp -rf adot/* opentelemetry-lambda/) overrides the submodule sample app at build time. * fix(soak): correct go-wrapper expected trace segment order for v0.151.0 The soak TraceValidator matches strictly by flattened index key ([N].name), and orders actual segments by start_time. In the v0.151.0 trace the inferred S3.ListBuckets segment sorts to index [3] (between the instrumented segment and the Lambda::Function segment), not [4]. The prior fix renamed correctly but left S3 at [4], colliding stored [3]=lambda-go.* with actual [3]=S3.ListBuckets. Reorder: S3.ListBuckets at [3], lambda-go.* at [4]. * debug(java-wrapper): instrument awssdk-autoconfigure interceptor [TEMP] Temporary [ADOT-DEBUG] diagnostics to localize why AWS SDK calls are not traced in wrapper mode (PROMET-11975). Logs: (1) static block = SPI class loaded, (2) constructor = captured GlobalOpenTelemetry + TracerProvider class, (3) beforeExecution = interceptor actually invoked per SDK call. Distinguishes 'never registered' vs 'noop OTel' vs 'not attached' vs 'span dropped'. Revert before release. * debug(java-wrapper): log active span context in beforeExecution [TEMP] Interceptor is confirmed registered/attached with a real tracer, yet no S3 span lands in the Lambda X-Ray trace. Add active SpanContext dump (valid/ sampled/traceId) at beforeExecution to test the context-propagation hypothesis (orphaned root span). Revert before release. * Revert "debug(java-wrapper): log active span context in beforeExecution [TEMP]" This reverts commit 2e85c32. * Revert "debug(java-wrapper): instrument awssdk-autoconfigure interceptor [TEMP]" This reverts commit ade4b80.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update ADOT Lambda layer dependencies to align with ADOT Collector v0.48.0, addressing multiple CVEs reported in the published layer
aws-otel-collector-amd64-ver-0-117-0.Changes
opentelemetry-lambdasubmodule to commit7067947(OTel Collector v0.151.0)adot/collector/lambdacomponents/go.moddeps from v0.138.0 to v0.151.0adot/collector/VERSIONto v0.48.0Key Dependency Upgrades
CVEs Addressed
This update addresses 27 CVEs (2 critical, 10 high, 15 medium) across go/stdlib, google.golang.org/grpc, golang.org/x/net, and golang.org/x/crypto packages.
Testing
go mod tidycompleted successfullygo test ./...passes