From fa181309f4da772ef79b8dc27b5987cee5d0552f Mon Sep 17 00:00:00 2001 From: Rodrigo Sampaio Vaz Date: Thu, 9 Jul 2026 12:16:10 -0400 Subject: [PATCH] Update OpenTelemetry dependencies to v1.44.0 Bump indirect OpenTelemetry API/SDK modules in the agent and vendored SDK module to address reported CVEs, including the SDK module's required Go directive update for OTel v1.44.0. Update golang image to include latest update of the os package The vuln target scanned bin/fleetint with -mode=binary. The binary is built with -ldflags '-s', which strips the symbol table, so govulncheck cannot tell which packages are linked and falls back to module-level matching. GO-2026-5932 marks the x/crypto openpgp packages as unmaintained in every version with no fixed release, so the check failed even though nothing in the agent imports openpgp. Switch to source mode (govulncheck ./...), which does precise import and call-graph analysis. It reports GO-2026-5932 as informational only and still fails the build if code actually reaches a vulnerable symbol. The fleetint prerequisite is dropped since the binary is no longer needed for the scan. Signed-off-by: Rodrigo Sampaio Vaz --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- .golangci.yml | 2 +- CONTRIBUTING.md | 2 +- Dockerfile | 2 +- Dockerfile.citests | 4 ++-- Makefile | 4 ++-- docs/development.md | 2 +- go.mod | 7 +++++-- go.sum | 24 +++++++++++------------ third_party/fleet-intelligence-sdk/go.mod | 6 ++++-- third_party/fleet-intelligence-sdk/go.sum | 24 +++++++++++------------ 12 files changed, 43 insertions(+), 38 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0a78ad27..846fab7e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,7 +7,7 @@ on: branches: [ main, 'release/**' ] env: - GO_VERSION: '1.26.4' + GO_VERSION: '1.26.5' GOFLAGS: '-trimpath' permissions: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 927d0ef7..aee56e3d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,7 +6,7 @@ on: - 'v*' # Triggers on version tags like v1.0.0, v2.1.3, etc. env: - GO_VERSION: '1.26.4' + GO_VERSION: '1.26.5' permissions: contents: write # Needed for creating GitHub releases diff --git a/.golangci.yml b/.golangci.yml index 32ff19e9..8a6e8550 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,6 +1,6 @@ version: "2" run: - go: 1.26.4 + go: 1.26.5 linters: default: none enable: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 01725e16..6d9e3185 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -7,7 +7,7 @@ Please start all enhancement, bugfix, or change requests by opening a GitHub iss ## Development ### Prerequisites -- Go 1.26.4+ (see `go.mod`) +- Go 1.26.5+ (see `go.mod`) - Make - golangci-lint (optional locally, required in CI) diff --git a/Dockerfile b/Dockerfile index 7adb9a08..aad5766f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ ARG DCGM_VERSION="4.4.2-1-ubuntu22.04" -FROM golang:1.26.4 AS build +FROM golang:1.26.5 AS build RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates \ diff --git a/Dockerfile.citests b/Dockerfile.citests index 227bf94e..8fc1f7df 100644 --- a/Dockerfile.citests +++ b/Dockerfile.citests @@ -16,7 +16,7 @@ # Run specific package tests: # docker run --rm fleet-intelligence-agent:test go test -v ./internal/... # -FROM golang:1.26.4 +FROM golang:1.26.5 ARG TARGETARCH @@ -46,7 +46,7 @@ RUN if [ "${TARGETARCH}" = "amd64" ]; then \ fi # Install golangci-lint (matches CI / make lint) -RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b /usr/local/bin +RUN curl -sSfL https://golangci-lint.run/install.sh | sh -s v2.12.2 # Install govulncheck up front (avoids runtime installs as non-root user) RUN go install golang.org/x/vuln/cmd/govulncheck@latest && mv /go/bin/govulncheck /usr/local/bin/govulncheck diff --git a/Makefile b/Makefile index 0f033614..a92c61b4 100644 --- a/Makefile +++ b/Makefile @@ -150,13 +150,13 @@ test: ## run tests with coverage @echo "Coverage report generated: coverage/coverage.html" @$(GO) tool cover -func=coverage/coverage.out | tail -1 -vuln: fleetint ## run vulnerability check +vuln: ## run vulnerability check @echo "Running vulnerability check..." @if ! command -v govulncheck >/dev/null 2>&1; then \ echo "Installing govulncheck..."; \ $(GO) install golang.org/x/vuln/cmd/govulncheck@latest; \ fi - @govulncheck -mode=binary ./bin/fleetint + @govulncheck ./... clean: ## clean up binaries and build artifacts @echo "Cleaning up..." diff --git a/docs/development.md b/docs/development.md index 27ffc528..c376dfc2 100644 --- a/docs/development.md +++ b/docs/development.md @@ -11,7 +11,7 @@ cd fleet-intelligence-agent ### Prerequisites -- **Go**: 1.26.4 +- **Go**: 1.26.5 - **GoReleaser**: For building packages (install from [goreleaser.com](https://goreleaser.com/install/)) - **For ARM64 cross-compilation** (optional): `gcc-aarch64-linux-gnu` and `g++-aarch64-linux-gnu` diff --git a/go.mod b/go.mod index f21f8939..b268a75f 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/NVIDIA/fleet-intelligence-agent -go 1.26.4 +go 1.26.5 require ( github.com/NVIDIA/fleet-intelligence-sdk v0.0.0-00010101000000-000000000000 @@ -78,7 +78,7 @@ require ( github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.65.0 // indirect github.com/quic-go/qpack v0.6.0 // indirect - github.com/quic-go/quic-go v0.57.0 // indirect + github.com/quic-go/quic-go v0.59.1 // indirect github.com/rivo/uniseg v0.4.4 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/shirou/gopsutil/v4 v4.26.2 // indirect @@ -94,6 +94,9 @@ require ( github.com/vishvananda/netns v0.0.4 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/sdk v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect diff --git a/go.sum b/go.sum index 67fd4380..62a86785 100644 --- a/go.sum +++ b/go.sum @@ -160,8 +160,8 @@ github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzM github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8= github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII= -github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE= -github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s= +github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic= +github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= @@ -215,16 +215,16 @@ github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= -go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= -go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= -go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= -go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.opentelemetry.io/proto/otlp v1.8.0 h1:fRAZQDcAFHySxpJ1TwlA1cJ4tvcrw7nXl9xWWC8N5CE= go.opentelemetry.io/proto/otlp v1.8.0/go.mod h1:tIeYOeNBU4cvmPqpaji1P+KbB4Oloai8wN4rWzRrFF0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= diff --git a/third_party/fleet-intelligence-sdk/go.mod b/third_party/fleet-intelligence-sdk/go.mod index 56364217..604b620b 100644 --- a/third_party/fleet-intelligence-sdk/go.mod +++ b/third_party/fleet-intelligence-sdk/go.mod @@ -1,6 +1,6 @@ module github.com/NVIDIA/fleet-intelligence-sdk -go 1.24.13 +go 1.25.0 require ( github.com/NVIDIA/go-dcgm v0.0.0-20260214140307-ad5d86fe3d32 @@ -20,7 +20,7 @@ require ( github.com/stretchr/testify v1.11.1 go.uber.org/zap v1.27.0 golang.org/x/crypto v0.46.0 - golang.org/x/sys v0.39.0 + golang.org/x/sys v0.45.0 google.golang.org/grpc v1.79.3 gopkg.in/natefinch/lumberjack.v2 v2.2.1 k8s.io/api v0.32.0 @@ -76,6 +76,8 @@ require ( github.com/vishvananda/netns v0.0.4 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect diff --git a/third_party/fleet-intelligence-sdk/go.sum b/third_party/fleet-intelligence-sdk/go.sum index 9cc1ecd7..c044efda 100644 --- a/third_party/fleet-intelligence-sdk/go.sum +++ b/third_party/fleet-intelligence-sdk/go.sum @@ -154,16 +154,16 @@ github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= -go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= -go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= -go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= -go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= @@ -210,8 +210,8 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= -golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=