fix(otel): update x/crypto to v0.56.0

[sbaum1994]

TL;DR

Update the generated OpenTelemetry Collector module to use golang.org/x/crypto v0.56.0, which fixes GO-2026-6354 and GO-2026-6355.

Additional Details

• Raise the authoritative OCB replacement from v0.55.0 to v0.56.0.
• Regenerate the checked-in collector go.mod and go.sum.
• Raise the collector workspace and generated module minimum from Go 1.25 to Go 1.26 because x/crypto v0.56.0 requires Go 1.26. The image Dockerfiles already build with Go 1.26.2.
• Keep the collector component set and runtime configuration unchanged.
• golang.org/x/crypto remains under BSD-3-Clause, which is already allowed. No new dependency or NOTICE update is required.

For the Reviewer

Please focus on the OCB replacement and the generated module metadata. The go directive change is required by the updated module rather than an independent toolchain migration.

For QA

• make test passed for every Go module in the subtree.
• make validate-otelconfig passed all generated configuration validation. Runtime startup checks were skipped by the existing script on macOS.
• ./scripts/regenerate-otelcol.sh passed on a second run and produced no additional drift.
• ./tools/ci/check-go-version passed.
• go version -m _output/bin/otelcol-contrib reports golang.org/x/crypto => v0.56.0.
• The documented make lint target is not present in this subtree's Makefile. A direct lint run reports existing findings in unchanged Go source files; this PR changes only dependency metadata.

No additional QA is needed beyond the normal image build and scan.

Issues

Closes #1608

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Chores
  • Updated the OpenTelemetry Collector build configuration to use newer Go language and cryptography library versions.

[sbaum1994]

Risk assessment

Overall risk: Low to moderate.

• Change size: Four dependency metadata files change, with six insertions and six deletions. No collector components, application source, configuration templates, or image entrypoints change.
• Dependency scope: golang.org/x/crypto moves one patch release from v0.55.0 to v0.56.0. Both collector images build the same checked-in otelcol module, so the replacement applies consistently to both artifacts.
• Security effect: v0.56.0 is the first fixed release for GO-2026-6354 and GO-2026-6355, both denial-of-service issues in x/crypto/ssh.
• Compatibility risk: x/crypto v0.56.0 raises its minimum Go version to 1.26. The generated module and workspace now declare Go 1.26. Both Docker builder stages already use Go 1.26.2, and the collector compiled successfully with Go 1.26.3 locally.
• Supply-chain impact: This updates an existing BSD-3-Clause dependency. It adds no dependency, license, component, or NOTICE change.
• Validation: Full subtree module tests and all generated configuration validation passed. Regeneration was idempotent, the Go-version consistency check passed, and binary build metadata reports golang.org/x/crypto => v0.56.0.

Residual risk is concentrated in the non-hermetic Bazel collector build, which uses the host Go executable. That CI host must provide Go 1.26 or newer; the normal image build should confirm this. Runtime startup validation was not exercised locally because the existing validation script skips it on non-Linux hosts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1cd7aea6-0bbc-4cae-8711-523a2fbbcd61

📥 Commits

Reviewing files that changed from the base of the PR and between ed688b4 and f584415.

⛔ Files ignored due to path filters (2)

• src/compute-plane-services/byoo-otel-collector/go.work is excluded by !**/*.work
• src/compute-plane-services/byoo-otel-collector/otelcol/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• src/compute-plane-services/byoo-otel-collector/otel-collector-build.yaml
• src/compute-plane-services/byoo-otel-collector/otelcol/go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The OpenTelemetry Collector build configuration and module metadata now declare Go 1.26.0 and replace golang.org/x/crypto with v0.56.0.

Changes

OpenTelemetry dependency update

Layer / File(s)	Summary
Collector build metadata src/compute-plane-services/byoo-otel-collector/otel-collector-build.yaml, src/compute-plane-services/byoo-otel-collector/otelcol/go.mod	The module declares Go 1.26.0. Both replacement declarations use golang.org/x/crypto v0.56.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to f5844

The collector now builds with Go 1.26 and x/crypto v0.56.0, addressing the dependency update while retaining the existing component configuration. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The reviewed changes update the OCB replacement and generated go.mod to x/crypto v0.56.0. Full compliance cannot be verified because go.sum and go.work are excluded by path filters, and those files ar…	Review the excluded files src/compute-plane-services/byoo-otel-collector/otelcol/go.sum and src/compute-plane-services/byoo-otel-collector/go.work, or provide equivalent evidence that module metadata was regenerated and the required Go vers…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses the required Conventional Commits format, includes the required scope for a fix, and accurately describes the x/crypto security update.
Out of Scope Changes check	✅ Passed	The Go version update supports the x/crypto v0.56.0 upgrade, and the reported changes remain within the linked issue scope. No unrelated code changes are identified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The reviewed changes update the OCB replacement and generated go.mod to x/crypto v0.56.0. Full compliance cannot be verified because go.sum and go.work are excluded by path filters, and those files are relevant to regenerated module metadata and the Go version update.

Resolution

Review the excluded files src/compute-plane-services/byoo-otel-collector/otelcol/go.sum and src/compute-plane-services/byoo-otel-collector/go.work, or provide equivalent evidence that module metadata was regenerated and the required Go version changes are complete. Confirm the reported binary, generated-output, and test validations.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1608-otel-x-crypto

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

🎉 This PR is included in version byoo-otel-collector-v0.2.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀