chore(otel-collector): upgrade to v0.140.0 and Go 1.25, fixes security issues (#7304)

Co-authored-by: Gemini <gemini@google.com>

Author: adambenhassen

.changeset/beefy-grand-bazaar.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Upgrade OpenTelemetry Collector to v0.140.0 (from v0.122.0) and Go to 1.25 (from 1.23). This includes updating all collector component dependencies and adapting the hive auth extension for API compatibility changes.

docker/configs/otel-collector/builder-config.yaml

@@ -1,30 +1,30 @@
 dist:
-  version: 0.122.0
+  version: 0.140.0
   name: otelcol-custom
   description: Custom OTel Collector distribution
   output_path: ./otelcol-custom
 
 receivers:
-  - gomod: go.opentelemetry.io/collector/receiver/otlpreceiver v0.122.0
+  - gomod: go.opentelemetry.io/collector/receiver/otlpreceiver v0.140.0
 
 processors:
-  - gomod: go.opentelemetry.io/collector/processor/batchprocessor v0.122.0
-  - gomod: go.opentelemetry.io/collector/processor/memorylimiterprocessor v0.122.0
+  - gomod: go.opentelemetry.io/collector/processor/batchprocessor v0.140.0
+  - gomod: go.opentelemetry.io/collector/processor/memorylimiterprocessor v0.140.0
   - gomod:
       github.com/open-telemetry/opentelemetry-collector-contrib/processor/attributesprocessor
-      v0.122.0
+      v0.140.0
   - gomod:
-      github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor v0.122.0
+      github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor v0.140.0
 
 exporters:
-  - gomod: go.opentelemetry.io/collector/exporter/debugexporter v0.122.0
+  - gomod: go.opentelemetry.io/collector/exporter/debugexporter v0.140.0
   - gomod:
-      github.com/open-telemetry/opentelemetry-collector-contrib/exporter/clickhouseexporter v0.122.0
+      github.com/open-telemetry/opentelemetry-collector-contrib/exporter/clickhouseexporter v0.140.0
 
 extensions:
   - gomod:
       github.com/open-telemetry/opentelemetry-collector-contrib/extension/healthcheckextension
-      v0.122.0
+      v0.140.0
   - gomod: github.com/graphql-hive/console/docker/configs/otel-collector/extension-hiveauth v0.0.0
     path: ./extension-hiveauth
     name: hiveauthextension # when using local extensions, package name is required, otherwise you get "missing import path"

docker/configs/otel-collector/extension-hiveauth/extension.go

@@ -16,14 +16,18 @@ import (
 	"github.com/patrickmn/go-cache"
 	"go.opentelemetry.io/collector/client"
 	"go.opentelemetry.io/collector/component"
+	"go.opentelemetry.io/collector/extension"
 	"go.opentelemetry.io/collector/extension/extensionauth"
 	"go.uber.org/zap"
 	"golang.org/x/sync/singleflight"
 	"go.opentelemetry.io/otel/metric"
 	"go.opentelemetry.io/otel/attribute"
 )
 
-var _ extensionauth.Server = (*hiveAuthExtension)(nil)
+var (
+	_ extension.Extension = (*hiveAuthExtension)(nil)
+	_ extensionauth.Server = (*hiveAuthExtension)(nil)
+)
 
 var _ client.AuthData = (*authData)(nil)
 
@@ -269,7 +273,7 @@ func newHiveAuthExtension(
 	logger *zap.Logger,
 	cfg component.Config,
 	telemetrySettings component.TelemetrySettings,
-) (extensionauth.Server, error) {
+) (extension.Extension, error) {
 	c, ok := cfg.(*Config)
 	if !ok {
 		return nil, errors.New("invalid configuration")

docker/configs/otel-collector/extension-hiveauth/generated_package_test.go

@@ -1,51 +1,52 @@
 module github.com/graphql-hive/console/docker/configs/otel-collector/extension-hiveauth
 
-go 1.23.0
+go 1.25
 
 require (
 	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/stretchr/testify v1.10.0
-	go.opentelemetry.io/collector/client v1.28.0
-	go.opentelemetry.io/collector/component v1.28.0
-	go.opentelemetry.io/collector/component/componenttest v0.122.0
-	go.opentelemetry.io/collector/confmap v1.28.0
-	go.opentelemetry.io/collector/extension v1.28.0
-	go.opentelemetry.io/collector/extension/extensionauth v0.122.0
-	go.opentelemetry.io/collector/extension/extensiontest v0.122.0
+	github.com/stretchr/testify v1.11.1
+	go.opentelemetry.io/collector/client v1.46.0
+	go.opentelemetry.io/collector/component v1.46.0
+	go.opentelemetry.io/collector/component/componenttest v0.140.0
+	go.opentelemetry.io/collector/confmap v1.46.0
+	go.opentelemetry.io/collector/extension v1.46.0
+	go.opentelemetry.io/collector/extension/extensionauth v1.46.0
+	go.opentelemetry.io/collector/extension/extensiontest v0.140.0
+	go.opentelemetry.io/otel v1.38.0
+	go.opentelemetry.io/otel/metric v1.38.0
 	go.uber.org/goleak v1.3.0
-	go.uber.org/zap v1.27.0
-	golang.org/x/sync v0.12.0
+	go.uber.org/zap v1.27.1
+	golang.org/x/sync v0.18.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
-	github.com/knadh/koanf/maps v0.1.1 // indirect
-	github.com/knadh/koanf/providers/confmap v0.1.0 // indirect
-	github.com/knadh/koanf/v2 v2.1.2 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/knadh/koanf/maps v0.1.2 // indirect
+	github.com/knadh/koanf/providers/confmap v1.0.0 // indirect
+	github.com/knadh/koanf/v2 v2.3.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/collector/featuregate v1.28.0 // indirect
-	go.opentelemetry.io/collector/pdata v1.28.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	go.opentelemetry.io/collector/featuregate v1.46.0 // indirect
+	go.opentelemetry.io/collector/pdata v1.46.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/net v0.37.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
-	google.golang.org/grpc v1.71.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	google.golang.org/grpc v1.76.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )