Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.20.0 to 0.46.0

[dependabot]

Bumps go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.20.0 to 0.46.0.

Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc's releases.

Release v0.36.2

Changed

• Upgrade dependencies of the OpenTelemetry Go Metric SDK to use the new v0.32.2 release
• Avoid getting a new Tracer for every RPC in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#2835)
• Conditionally compute message size for tracing events using proto v2 API rather than legacy v1 API in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#2647)

Deprecated

• The Inject function in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc is deprecated. (#2838)
• The Extract function in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc is deprecated. (#2838)

Release v0.36.1

Changed

• Upgrade dependencies of the OpenTelemetry Go Metric SDK to use the new v0.32.1 release.

Release v0.36.0

Changed

• Upgrade dependencies of the OpenTelemetry Go Metric SDK to use the new v0.32.0 release. (#2781, #2756, #2758, #2760, #2762)

Release v0.24.0

0.24.0 - 2021-09-21

Update dependency on the go.opentelemetry.io/otel project to v1.0.0.

v0.23.0

0.23.0 - 2021-09-09

Added

• Add WithoutSubSpans, WithRedactedHeaders, WithoutHeaders, and WithInsecureHeaders options for otelhttptrace.NewClientTrace. (#879)

Changed

• Split go.opentelemetry.io/contrib/propagators module into b3, jaeger, ot modules. (#985)
• otelmongodb span attributes, name and span status now conform to specification. (#769)
• Migrated EC2 resource detector support from root module go.opentelemetry.io/contrib/detectors/aws to a separate EC2 resource detector module go.opentelemetry.io/contrib/detectors/aws/ec2 (#1017)
• Add cloud.provider and cloud.platform to AWS detectors. (#1043)
• otelhttptrace.NewClientTrace now redacts known sensitive headers by default. (#879)

Fixed

• Fix span not marked as error in otelhttp.Transport when RoundTrip fails with an error. (#950)

Release v0.22.0

Added

• Add the zpages span processor. (#894)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc's changelog.

[1.21.0/0.46.0/0.15.0/0.1.0] - 2023-11-10

Added

• Add "go.opentelemetry.io/contrib/samplers/jaegerremote".WithSamplingStrategyFetcher which sets custom fetcher implementation. (#4045)
• Add "go.opentelemetry.io/contrib/config" package that includes configuration models generated via go-jsonschema. (#4376)
• Add NewSDK function to "go.opentelemetry.io/contrib/config". The initial implementation only returns noop providers. (#4414)
• Add metrics support (No-op, OTLP and Prometheus) to go.opentelemetry.io/contrib/exporters/autoexport. (#4229, #4479)
• Add support for console span exporter and metrics exporter in go.opentelemetry.io/contrib/exporters/autoexport. (#4486)
• Set unit and description on all instruments in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#4500)
• Add metric support for grpc.StatsHandler in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#4356)
• Expose the name of the scopes in all instrumentation libraries as ScopeName. (#4448)

Changed

• Dropped compatibility testing for [Go 1.19]. The project no longer guarantees support for this version of Go. (#4352)
• Upgrade dependencies of OpenTelemetry Go to use the new v1.20.0/v0.43.0 release. (#4546)
• In go.opentelemetry.io/contrib/exporters/autoexport, Option was renamed to SpanOption. The old name is deprecated but continues to be supported as an alias. (#4229)

Deprecated

• The interceptors (UnaryClientInterceptor, StreamClientInterceptor, UnaryServerInterceptor, StreamServerInterceptor, WithInterceptorFilter) are deprecated. Use stats handlers (NewClientHandler, NewServerHandler) instead. (#4534)

Fixed

• The go.opentelemetry.io/contrib/samplers/jaegerremote sampler does not panic when the default HTTP round-tripper (http.DefaultTransport) is not *http.Transport. (#4045)
• The UnaryServerInterceptor in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc now sets gRPC status code correctly for the rpc.server.duration metric. (#4481)
• The NewClientHandler, NewServerHandler in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc now honor otelgrpc.WithMessageEvents options. (#4536)

[1.20.0/0.45.0/0.14.0] - 2023-09-28

Added

• Set the description for the rpc.server.duration metric in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#4302)
• Add NewServerHandler and NewClientHandler that return a grpc.StatsHandler used for gRPC instrumentation in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#3002)
• Add new Prometheus bridge module in go.opentelemetry.io/contrib/bridges/prometheus. (#4227)

Changed

• Upgrade dependencies of OpenTelemetry Go to use the new v1.19.0/v0.42.0/v0.0.7 release.
• Use grpc.StatsHandler for gRPC instrumentation in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/example. (#4325)

Removed

• The net.sock.peer.* and net.peer.* high cardinality attributes are removed from the metrics generated by go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#4322)

[1.19.0/0.44.0/0.13.0] - 2023-09-12

Added

... (truncated)

Commits

• b4b06bc Release v1.21.0/v0.46.0/v0.15.0/v0.1.0 (#4546)
• c1ac303 config: Prepare module for release (#4541)
• fe68fe9 host: fix typo (#4540)
• 016b46f otelgrpc: Use net.Listen in TestStatsHandler (#4538)
• 23bd4ed otelgrpc: Deprecate interceptors in favor of stats handlers (#4534)
• a3b16ae Expose instrumentation scope name (#4448)
• 2b69029 otelgrpc: Fix stats handlers to honor WithMessageEvents option (#4536)
• f6aeb0d otelgrpc: Stablize TestInterceptors (#4535)
• b44dfc9 otelgrpc: Remove high cardinality metric attributes (#4322)
• 2a5fe23 otelgrpc: Refine tests to use a net socket instead of a buffer (#4503)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[priyaselvaganesan]

We verified that the vulnerable code path is not used in our repository. The wavefront-kubernetes-adapter repository only uses the UnaryClientInterceptor function and not the affected UnaryServerInterceptor function through the indirect dependency of go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0 external library.

Also, in order for us to upgrade the go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc indirect dependency from v0.20.0 to v0.46.0, we need to wait for our direct dependency (open source respository - kubernetes-sigs/custom-metrics-apiserver) to provide with the CVE fixes. We are waiting for a new version from kubernetes-sigs/custom-metrics-apiserver as tracked in this Github issue #60.

We are closing this PR/dependabot alert confirming that we will not be vulnerable to the CVE-2023-47108.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.