Skip to content

[bug] v5.8.0 can cause go.sum hash validation issue #340

@jackgopack4

Description

@jackgopack4

in opentelemetry-collector-contrib, we updated to datadog-go/[email protected] via renovate bot.
However it appears that a previous hashsum may have existed prior to the most recent tags, and we started to get issues with go mod tidy causing a security validation issue (see linked issue for details).

I am wondering if it would be possible to release a v5.8.0-hotfix or v5.8.1 or something.

Alternatively (or additionally), it might make sense to retract v5.8.0 to prevent users from running into this issue accidentally (I believe this is just a line in the gomod: https://go.dev/ref/mod#go-mod-file-retract).

This is not urgent; downgrading to the commit hash version (v5.7.1-20250924111842-1a07cfc4b5e7) seems to fix it for now anyway.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions