Package
net-kourier-1.20
Component
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
otel/sdk v1.43.0 — the only fix version for this GHSA per the advisory — cannot be bumped in net-kourier because it introduces otel semconv schema URL v1.40.0, which panics at startup inside knative.dev/pkg's observability/resource.Default when merged with the older schema that knative.dev/pkg itself pins. Kourier panics as:
panic: conflicting Schema URL: https://opentelemetry.io/schemas/1.40.0 and https://opentelemetry.io/schemas/1.37.0
Even bumping to the most recent public knative.dev/pkg pseudoversion (v0.0.0-20260302190359-1f39e94ef003) only shifts the conflict to schemas 1.40.0 vs 1.39.0 (still incompatible — verified via parallel cve-remediation attempts).
Upstream knative.dev/pkg must publish an observability/resource package that speaks otel semconv schema v1.40+ before this can be remediated. Upstream maintainers must implement compatibility to resolve.
Status