build(otel): update vulnerable Go dependencies

[sbaum1994]

TL;DR

• Updates the generated OpenTelemetry collector to use golang.org/x/crypto v0.55.0 and google.golang.org/grpc v1.83.1.
• Keeps both dependency overrides in the OCB manifest so regeneration remains stable.

Additional Details

• Regenerated module files are committed with the source manifest update.
• The collector component set remains unchanged.

For the Reviewer

• Review the OCB replacements and generated module diff together.

For QA

• Ran ./scripts/regenerate-otelcol.sh.
• Ran ./tools/ci/check-otelcol-generated.
• Ran go test ./... in the generated collector module.

Issues

Closes #1465

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for DCO compliance.
• Existing build checks cover the update.
• Documentation is current.

Summary by CodeRabbit

• Chores
  • Updated underlying service dependencies and component versions.
  • Improved version consistency across the OpenTelemetry Collector build configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ba231b17-c1f1-4e87-bb36-50d1c6cf191d

📥 Commits

Reviewing files that changed from the base of the PR and between 9ebb6ed and d92f091.

⛔ Files ignored due to path filters (1)

• src/compute-plane-services/byoo-otel-collector/otelcol/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• src/compute-plane-services/byoo-otel-collector/otel-collector-build.yaml
• src/compute-plane-services/byoo-otel-collector/otelcol/go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The OpenTelemetry Collector build pins golang.org/x/crypto to v0.55.0 and google.golang.org/grpc to v1.83.1. The Go module manifest reflects dependency classifications, indirect requirements, and the golang.org/x/text upgrade.

Changes

OpenTelemetry dependency update

Layer / File(s)	Summary
Collector build override src/compute-plane-services/byoo-otel-collector/otel-collector-build.yaml	The build configuration pins golang.org/x/crypto to v0.55.0 and google.golang.org/grpc to v1.83.1.
Go module manifest src/compute-plane-services/byoo-otel-collector/otelcol/go.mod	The manifest moves several modules to indirect requirements, adds indirect Collector, OpenTelemetry, and Zap modules, upgrades golang.org/x/text to v0.41.0, and records both replacement directives.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d92f0

The change updates vulnerable generated collector dependencies without changing the component set; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The pull request includes an explicit google.golang.org/grpc v1.83.1 override and related dependency updates, but linked issue #1465 only requires the golang.org/x/crypto update and collector regenera…	Remove the unrelated gRPC and associated dependency changes, or link an issue that explicitly requires the google.golang.org/grpc v1.83.1 update and related regeneration.
Linked Issues check	❓ Inconclusive	The OCB manifest pins golang.org/x/crypto to v0.55.0, and otelcol/go.mod shows regenerated dependency changes. Verification of all regenerated module files is inconclusive because otelcol/go.sum was e…	Provide reviewable evidence for the regenerated otelcol/go.sum file or confirm that regeneration did not require changes to it. Focused tests and image builds are non-coding tasks and are not assessed here.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits syntax with the single type build, the scope otel, and a clear subject. The build type accurately describes dependency updates in the OpenTelemetry collect…

Full details: Linked Issues check

Explanation

The OCB manifest pins golang.org/x/crypto to v0.55.0, and otelcol/go.mod shows regenerated dependency changes. Verification of all regenerated module files is inconclusive because otelcol/go.sum was excluded by the !**/*.sum path filter.

Full details: Out of Scope Changes check

Explanation

The pull request includes an explicit google.golang.org/grpc v1.83.1 override and related dependency updates, but linked issue #1465 only requires the golang.org/x/crypto update and collector regeneration. The additional gRPC change is not covered by the linked issue.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Title check

Explanation

The title follows Conventional Commits syntax with the single type build, the scope otel, and a clear subject. The build type accurately describes dependency updates in the OpenTelemetry collector build configuration.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/otel-xcrypto-v0.55.0

---

_{Comment @coderabbitai help to get the list of available commands.}

[sbaum1994]

Risk assessment

Overall risk: Medium. The repository delta is small and dependency-only, but both replace directives override the selected version for every transitive consumer in the generated collector, and the gRPC minor release contains meaningful transport and xDS behavior changes.

• Version changes: golang.org/x/crypto moves from effective v0.54.0 to v0.55.0 (pre-v1 minor), google.golang.org/grpc from effective v1.82.1 to v1.83.1 (minor plus patch), and regeneration selects golang.org/x/text v0.41.0 instead of v0.40.0. Both primary modules retain the same module path and Go 1.25 requirement.
• Change size/nature: 3 generated/build files, +123/−32. The authored change is two OCB dependency overrides; the remaining go.mod/go.sum churn is regeneration and module-graph bookkeeping. No collector components, application code, or configuration templates change.
• Credible failure modes: gRPC 1.83 changes HTTP/2 control-frame throttling, transport buffering, connection handling, and xDS/RBAC behavior; regressions would most likely appear as connection resets/retries, changed authorization-policy behavior, or memory/throughput changes. x/crypto 0.55 is primarily SSH, OCSP/root-bundle, and Poly1305 work; risk is concentrated in dependencies that exercise those paths. The broad graph-level replacements also move the collector beyond versions originally selected by its component dependencies.
• Mitigations: public CI is green for the Bazel collector build, all four collector configuration-validation variants, the performance module, dependency/license checks, and generated dependency documentation. The PR also reports a clean regeneration check and go test ./... in the generated collector module.
• Residual risk / rollout: publish and canary the rebuilt image with representative OTLP/gRPC receive/export traffic (and xDS, if used), watch connection errors/retries plus memory and throughput, then rescan the published digest. Rollback is limited to removing/reverting the two overrides, regenerating the module files, and republishing the prior dependency graph.

Evidence: the public PR diff, gRPC v1.83.0 and v1.83.1 notes, and the x/crypto comparison.

[sbaum1994]

@coderabbitai Both pre-merge flags are accounted for. The gRPC update is intentional remediation for GHSA-vp52-pcj8-j9qc (CVE-2026-84304): google.golang.org/grpc versions through v1.83.0 are affected, and v1.83.1 is the first patched release. I updated #1465 to include that work.

The regenerated otelcol/go.sum is committed in this PR; it records golang.org/x/crypto v0.55.0 and google.golang.org/grpc v1.83.1. Regeneration, generated-file validation, tests, and current CI all pass.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@sbaum1994 Thanks for the clarification. The google.golang.org/grpc v1.83.1 override is required to remediate GHSA-vp52-pcj8-j9qc / CVE-2026-84304. The committed regenerated module files and reported validation results address the pre-merge flags.

---

✏️ Learnings added

Learnt from: sbaum1994
URL: https://github.com/NVIDIA/nvcf/pull/1471

Timestamp: 2026-09-03T08:38:24.196Z
Learning: In `src/compute-plane-services/byoo-otel-collector`, the `google.golang.org/grpc v1.83.1` override remediates `GHSA-vp52-pcj8-j9qc` / `CVE-2026-84304`; versions through `v1.83.0` are affected. The regenerated `otelcol/go.sum` is committed with `golang.org/x/crypto v0.55.0` and `google.golang.org/grpc v1.83.1`.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

[balajinvda]

This PR is included in version 1.64.2.

The release is available on GitHub release.

[balajinvda]

This PR is included in version 1.16.4.

The release is available on GitHub release.

[balajinvda]

This PR is included in version 1.13.4.

The release is available on GitHub release.

[balajinvda]

This PR is included in version 1.8.1.

The release is available on GitHub release.

[balajinvda]

This PR is included in version 0.4.15.

The release is available on GitHub release.

[balajinvda]

This PR is included in version 0.3.3.

The release is available on GitHub release.