Recommend moving to go.opentelemetry.io/proto/[email protected]

[awilcots]

Due to a dependabot alert I've noticed that this package is using an older version of go.opentelemetry.io/proto/otlp (v0.7.0) resulting in usage of a vulnerable version of gopkg.in/yaml.v2 version v2.2.3, CVE-2019-11254. go.opentelemetry.io/proto/otlp has recently updated their dependancies to address the concern, so there should is a fresh version to update to in this.

To help against consumers of this package being vulnerable, I'd recommend moving to go.opentelemetry.io/proto/[email protected]

[alecholmez]

Thanks for the issue! Just opened this PR to address this: #549

[kyessenov]

Does this need to be patched in envoy, too https://github.com/envoyproxy/envoy/blob/b2d449eb1f130d9f8d01af4ef2da89416b2157db/api/bazel/repository_locations.bzl#L103?
I assume this is some extra code, not generated protobufs?

[moderation]

See envoyproxy/envoy#20281

[awilcots]

Since this has been updated, I've noticed that a new version hasn't been created. Is there a timeline y'all have for putting out a new version with the updated dependency (understandably with other changes as well)?

[alecholmez]

@awilcots I would like to land this feature: #544 and then cut a release. I'm low bandwidth right now but will hopefully have something ready soon.

[awilcots]

Understood, I can understand not having very much bandwidth. Thank you for getting back and your candor.