Pull upstream for fixing vulnerability - #76
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR pulls newer upstream dependencies (OpenTelemetry Collector/contrib and related libraries) to address a reported vulnerability, and updates the Lambda collector codebase to remain compatible with upstream API/semantic convention changes.
Changes:
- Bumps OpenTelemetry Collector/contrib and assorted transitive dependencies across modules (
v0.156.0→v0.158.0,v1.62.0→v1.64.0, etc.). - Updates cold start correlation to support the semantic conventions rename from
faas.executiontofaas.invocation_id, with added test coverage. - Adds lifecycle startup-duration logging and tests for the new log field.
Reviewed changes
Copilot reviewed 15 out of 21 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| collector/receiver/telemetryapireceiver/go.mod | Updates receiver module dependencies to newer upstream versions. |
| collector/receiver/telemetryapireceiver/go.sum | Refreshes dependency checksums for the receiver module after upgrades. |
| collector/receiver/telemetryapireceiver/config_test.go | Switches config validation helper and adjusts expected config behavior for types. |
| collector/processor/decoupleprocessor/go.mod | Updates processor module dependencies to newer upstream versions. |
| collector/processor/decoupleprocessor/go.sum | Large go.sum cleanup/refresh consistent with upgraded dependency graph. |
| collector/processor/decoupleprocessor/config_test.go | Switches config validation from xconfmap.Validate to confmap.Validate. |
| collector/processor/coldstartprocessor/README.md | Updates documentation to reference faas.invocation_id (and legacy fallback). |
| collector/processor/coldstartprocessor/processor.go | Implements dual-key lookup (faas.invocation_id and legacy faas.execution) for pairing. |
| collector/processor/coldstartprocessor/processor_test.go | Updates semconv usage, xxhash import, and adds coverage for invocation-id pairing. |
| collector/processor/coldstartprocessor/go.mod | Updates coldstartprocessor deps and moves to go.opentelemetry.io/otel semconv. |
| collector/processor/coldstartprocessor/go.sum | Updates coldstartprocessor checksum set after dependency changes. |
| collector/processor/coldstartprocessor/doc.go | Updates package docs to reference faas.invocation_id (and legacy fallback). |
| collector/main.go | Captures process start time and passes it into lifecycle manager construction. |
| collector/lambdacomponents/go.mod | Upgrades bundled component set to newer Collector/contrib versions and related deps. |
| collector/internal/tools/go.mod | Upgrades tooling dependency to golangci-lint/v2 and refreshes toolchain deps. |
| collector/internal/lifecycle/manager.go | Accepts startTime and logs a startup_duration when startup completes. |
| collector/internal/lifecycle/manager_test.go | Adds tests asserting startup-duration log behavior and improves goroutine-safe assertions. |
| collector/go.mod | Upgrades top-level collector module deps to newer Collector/contrib versions and related deps. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
52
to
55
| name: "all types", | ||
| id: component.NewIDWithName(component.MustNewType("telemetryapi"), "1"), | ||
| expected: createExpectedConfig([]string{}), | ||
| expected: createExpectedConfig([]string{platform, function, extension}), | ||
| }, |
| return err | ||
| } | ||
|
|
||
| lm.logger.Info("OpenTelemetry Lambda extension startup complete", zap.Duration("startup_duration", time.Since(lm.startTime))) |
Comment on lines
+18
to
+19
| // It reads the following of incoming Lambda execution spans, identified by the faas.invocation_id | ||
| // attribute (or faas.execution, the name it replaced in semantic conventions v1.19.0): |
Comment on lines
9
to
+10
| This processor associates cold start information generated by the [telemetryapireceiver](../../receiver/telemetryapireceiver) with incoming span data processed by | ||
| the Collector extension. It reads the following of incoming Lambda execution spans identified by the `faas.execution` attribute: | ||
| the Collector extension. It reads the following of incoming Lambda execution spans, identified by the `faas.invocation_id` attribute (or `faas.execution`, the name it replaced in semantic conventions v1.19.0): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pulled upstream code 2026-08-20 for fixing vulnerability.
Related to
https://swicloud.atlassian.net/browse/NH-145364
https://swicloud.atlassian.net/browse/NH-146403