#6964 Bump OTel SDK to v1.40.0 and fix semconv schema conflict Pull request opened by jmonty42 Tracking issue Addresses CVE-2025-22870 (PATH Hijacking Arbitrary Code Execution) in

<http://go.opentelemetry.io/otel/sdk|go.opentelemetry.io/otel/sdk>

< v1.40.0. Why are the changes needed? The OTel SDK is pinned at v1.37.0 across this repo, which is affected by a high-severity PATH hijacking vulnerability. Bumping to v1.40.0 resolves this. Additionally,

flytestdlib/otelutils/factory.go

has a hardcoded

semconv/v1.26.0

import that doesn't match the SDK's own semconv version. When

resource.Merge()

combines

resource.Default()

(which uses the SDK's semconv) with a user-created resource (using the hardcoded semconv), the mismatched schema URLs cause a panic. This has been latent since the original OTel instrumentation was added and would surface any time the SDK version drifts from the hardcoded semconv. What changes were proposed in this pull request? 1. Bump OTel SDK from v1.37.0 to v1.40.0 across all 9 Go modules (root, flytestdlib, flyteadmin, flytepropeller, flyteplugins, datacatalog, flyteidl, flytecopilot, flytectl). 2. Fix hardcoded semconv import in `flytestdlib/otelutils/factory.go`:

semconv/v1.26.0

→

semconv/v1.39.0

to match the SDK's own semconv version, preventing the schema URL conflict in

resource.Merge()

. 3. Companion packages (grpc, protobuf, genproto, auto/sdk) were also bumped by the Go module resolver. How was this patch tested? •

go build ./...

from root — compiles cleanly •

go test ./...

in

flytestdlib

— all 33 test packages pass, including

otelutils

which previously failed with

conflicting Schema URL: <https://opentelemetry.io/schemas/1.39.0> and <https://opentelemetry.io/schemas/1.26.0>

•

go test ./...

from root — passes •

go mod tidy

in all 9 modules — no issues • Verified schema version mapping: • OTel SDK v1.37.0 →

semconv/v1.34.0

→ schema

1.34.0

• OTel SDK v1.40.0 →

semconv/v1.39.0

→ schema

1.39.0

Labels • security: Dependency bump to fix high-severity vulnerability. Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. flyteorg/flyte