otel-arrow go/v0.60.1 - Go and HTTP/2 dependency updates

otel-arrow go/v0.60.1, published on October 20, 2026, updates Go dependencies, including security updates for the toolchain and HTTP/2 networking code. The release also brings CBOR decoding corrections that deserve attention when reviewing dependency behavior. GitHub does not mark this release as a prerelease.

The full release notes are on the GitHub release page.

Go toolchain and HTTP/2 security updates

The release notes group the work under one dependency update entry. Its linked changes provide the details: #4323 updates the Go toolchain directive from 1.27.1 to 1.27.2. The change carries a security label and references fixes across the standard library, including HTTP handling and TLS. For teams building otel-arrow from source, the selected compiler version belongs in the release review alongside module versions.

The networking update in #4376 moves golang.org/x/net from v0.58.0 to v0.60.0. Its advisory details cover HTTP/2 resource exhaustion, flow control accounting, and an HPACK encoder race that can crash servers. These are concrete reasons to review the dependency refresh. The linked advisories describe upstream failure modes; they do not establish that every otel-arrow deployment exposes those paths.

CBOR decoding changes

The CBOR dependency, github.com/fxamacker/cbor/v2, advances from v2.9.4 to v2.9.6 in #4352. The upstream notes included there describe twelve bug fixes and a behavior change, with no API change.

One correction concerns CBOR null or undefined map keys and values decoded into Go maps with certain scalar types. Previously, decoding could retain a previous entry’s key or value instead of using the zero value. Another change makes null or undefined set a populated interface to nil, replacing the old behavior of retaining its value.

Those details matter when checking decoding expectations in code that uses the updated dependency. If your integration exercises these cases, include them in regression checks. An unchanged API can still produce different decoded values.

Experimental module refresh and release scope

The fourth linked update, #4348, advances golang.org/x/exp from revision 85c1c22 to faecfb2. That entry records a dependency revision change without describing a new otel-arrow capability.

This is dependency maintenance. The release announcement lists no new configuration options or migration procedure. For a review against the preceding Go tag, the notes provide a comparison from go/v0.60.0 to go/v0.60.1. Use that exact range when checking what your build will pick up.

Where to get it

← All updates