[xrstf]

Summary

This is to fix the security advisory https://github.com/kcp-dev/kcp/security/dependabot/121.

There are also two more advisories for the client-go and SDK modules in this repo, but using the same logic as in kcp-dev/api-syncagent#137 (comment)

I disagree with this change. The SDK should have the lowest compatible version listed, to increase its usefulness to consumers. Forcing everyone who imports our SDK onto a newer, and in this case even specific, Go version is IMHO the wrong approach. Just like the dependencies in the SDK should be the oldest compatible versions the SDK can work with.

... I did not bump dependencies in those two other modules. It's not up to us to dictate how consumers of our SDK/client-go handle their security updates. I.e. I think the other two security alerts we received should be dismissed (and maybe we configure dependabot to ignore those modules).

What Type of PR Is This?

/kind chore

Release Notes

[CVE-2026-24051] Bump opentelemetry SDK to v1.41.0

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mjudeikis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[xrstf]

/label tide/merge-method-squash

[xrstf]

/retest

[xrstf]

/retest

[kcp-ci-bot]

@xrstf: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kcp-test-e2e-shared	487b759	link	true	/test pull-kcp-test-e2e-shared
pull-kcp-test-e2e-sharded	487b759	link	true	/test pull-kcp-test-e2e-sharded
pull-kcp-test-e2e	487b759	link	true	/test pull-kcp-test-e2e
pull-kcp-test-e2e-multiple-runs	487b759	link	true	/test pull-kcp-test-e2e-multiple-runs

Full PR test history

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[xrstf]

Okay, I am now convinced that this is not a flake 😅

[kcp-ci-bot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.