Sync Collecting Fix Commits: Sun Aug 9 09:30:52 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/opentelemetry-collector-contrib-9ed38303.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/open-telemetry/opentelemetry-collector-contrib",
   "vulnerabilities": {
+    "GHSA-2464-8J7C-4CJM": {
+      "a2efabcd6a871b7180ea9f5621bab433d0f03bb6": "[chore] [receiver/prometheusreceiver] Fix mitchellh/mapstructure vulnerability (#45773)\n\n#### Description\n\nFixes the mitchellh/mapstructure vulnerability (GHSA-2464-8j7c-4cjm) in\nthe prometheusreceiver and its dependent modules by bumping upstream\ndependencies.\n\n**Dependency bumps:**\n- Bump `hashicorp/consul/api` from v1.32.1 to v1.33.4 (pulled\ntransitively via prometheus)\n- `hashicorp/consul/api` v1.33.4 requires Go 1.25.7, causing 18 module\nmanifests to update from Go 1.25.0\n- Bump `hashicorp/serf` from v0.10.1 to v0.10.4 (pulled transitively via\nprometheus)\n\n**Why this approach?**\n\nThe vulnerable `mitchellh/mapstructure` was pulled in transitively\nthrough `consul/api` \u2192 `hashicorp/serf` \u2192 `mitchellh/mapstructure`\n\nBumping `hashicorp/consul/api` and `hashicorp/serf` eliminates the\ndirect `mitchellh/mapstructure` usage in those libraries.\n\n#### Link to tracking issue\nFixes #44360\n\n#### Documentation\n\nN/A \u2014 no user-facing documentation changes needed. This is a\ndependency-only security fix.\n\n---------\n\nSigned-off-by: Arve Knudsen <arve.knudsen@gmail.com>\nCo-authored-by: Tyler Helmuth <12352919+TylerHelmuth@users.noreply.github.com>"
+    },
     "CVE-2026-56852": {
       "a6afcb08ce1211e5321d22c49600a86cb62be379": "Update prom/prometheus Docker tag to v3.13.2 (#50023)\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [prom/prometheus](https://redirect.github.com/prometheus/prometheus) |\npatch | `v3.13.1` \u2192 `v3.13.2` |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check the [Dependency\nDashboard](../issues/20907) for more information.\n\n---\n\n### Release Notes\n\n<details>\n<summary>prometheus/prometheus (prom/prometheus)</summary>\n\n###\n[`v3.13.2`](https://redirect.github.com/prometheus/prometheus/releases/tag/v3.13.2):\n3.13.2 / 2026-07-29\n\n[Compare\nSource](https://redirect.github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2)\n\n#### What's Changed\n\n- \\[SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and\ngoogle.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf).\n[#&#8203;19290](https://redirect.github.com/prometheus/prometheus/issues/19290)\nby [@&#8203;krajorama](https://redirect.github.com/krajorama)\n- \\[BUGFIX] PromQL: Preallocate the active query tracker file to avoid\nSIGBUS crashes when the data disk is full.\n[#&#8203;19289](https://redirect.github.com/prometheus/prometheus/issues/19289)\nby [@&#8203;akshajrawat](https://redirect.github.com/akshajrawat)\n\n**Full Changelog**:\n<https://github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2>\n\n</details>\n\n---\n\n### Configuration\n\n\ud83d\udcc5 **Schedule**: (UTC)\n\n- Branch creation\n  - \"on tuesday\"\n- Automerge\n  - At any time (no schedule defined)\n\n\ud83d\udea6 **Automerge**: Disabled by config. Please merge this manually once you\nare satisfied.\n\n\u267b **Rebasing**: Whenever PR becomes conflicted, or you tick the\nrebase/retry checkbox.\n\n\ud83d\udd15 **Ignore**: Close this PR and you won't be reminded about this update\nagain.\n\n---\n\n- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check\nthis box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).\nView the [repository job\nlog](https://developer.mend.io/github/open-telemetry/opentelemetry-collector-contrib).\n\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbm92YXRlYm90Il19-->\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Yang Song <yang.song@datadoghq.com>"
     },