#6965 Bump OTel SDK to v1.40.0 and fix semconv schema conflict Pull request opened by jmonty42 Tracking issue Addresses CVE-2025-22870 (PATH Hijacking Arbitrary Code Execution) in

<http://go.opentelemetry.io/otel/sdk|go.opentelemetry.io/otel/sdk>

< v1.40.0. Mirror of #6964 for the

v2

branch. Why are the changes needed? The OTel SDK is pinned at v1.37.0 via replace directives, which is affected by a high-severity PATH hijacking vulnerability. Bumping to v1.40.0 resolves this. Additionally,

flytestdlib/otelutils/factory.go

has a hardcoded

semconv/v1.24.0

import that doesn't match the SDK's own semconv version. When

resource.Merge()

combines

resource.Default()

(which uses the SDK's semconv) with a user-created resource (using the hardcoded semconv), the mismatched schema URLs cause a panic. This has been latent since the original OTel instrumentation was added and would surface any time the SDK version drifts from the hardcoded semconv. What changes were proposed in this pull request? 1. Bump OTel SDK from v1.37.0 to v1.40.0 — updated all 9 replace directives and direct/indirect dependencies in the root

go.mod

. 2. Fix hardcoded semconv import in `flytestdlib/otelutils/factory.go`:

semconv/v1.24.0

→

semconv/v1.39.0

to match the SDK's own semconv version, preventing the schema URL conflict in

resource.Merge()

. How was this patch tested? •

go mod tidy

— no issues •

go test ./flytestdlib/otelutils/...

— passes, including

TestRegisterTracerProviderWithContext

which previously would fail with

conflicting Schema URL

•

go test ./flytestdlib/...

— all packages pass (two pre-existing flaky tests in

config/tests

and

promutils/labeled

confirmed failing on base

v2

branch as well) • Verified schema version mapping: • OTel SDK v1.37.0 →

semconv/v1.34.0

→ schema

1.34.0

• OTel SDK v1.40.0 →

semconv/v1.39.0

→ schema

1.39.0

Labels • security: Dependency bump to fix high-severity vulnerability. Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. •

main

• #6583 • #6965 👈 flyteorg/flyte