[mergify]

Motivation/summary

this PR updates the apm-data to v1.23.0 https://github.com/elastic/apm-data/releases/tag/v1.23.0 which includes the added support for semconv 1.33

Checklist

• Update CHANGELOG.asciidoc
• Documentation has been updated

For functional changes, consider:

• Is it observable through the addition of either logging or metrics?
• Is its use being published in telemetry to enable product improvement?
• Have system tests been added to avoid regression?

How to test these changes

1. Run es on docker container
   shdocker compose up -d elasticsearch
2. compile and run apm-server binary from this branch
3. to help with sending an otlp trace with the help of ai I have added the following convenient go script

import (
      "context"
      "time"

      "go.opentelemetry.io/otel/attribute"
      "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
      sdktrace "go.opentelemetry.io/otel/sdk/trace"
      "go.opentelemetry.io/otel/trace"
)

func main() {
      ctx := context.Background()
      exp, _ := otlptracegrpc.New(ctx, otlptracegrpc.WithEndpoint("127.0.0.1:8200"), otlptracegrpc.WithInsecure())
      tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exp, sdktrace.WithBatchTimeout(time.Millisecond)))
      tracer := tp.Tracer("manual-verify")

      ctx, root := tracer.Start(ctx, "txn", trace.WithSpanKind(trace.SpanKindServer))
      _, child := tracer.Start(ctx, "db_call", trace.WithSpanKind(trace.SpanKindClient), trace.WithAttributes(
              attribute.String("db.system.name", "elasticsearch"), // should be supported now with semconv 1.33
      ))
      child.End()
      root.End()
      tp.Shutdown(ctx)
}

4. execute the script to send a trace
5. curl es for the indexed data

curl -s -u <user>:<password> "http://localhost:9200/traces-apm*/_search" \
  -H 'Content-Type: application/json' \
  -d '{"query":{"term":{"span.name":"db_call"}}}' | \
  jq '.hits.hits[0]._source.span | {type, subtype, db}'

you should see the following as a response of the curl request

{
  "type": "db",
  "subtype": "elasticsearch",
  "db": {
    "type": "elasticsearch"
  }

Related issues

Fixes: #20248

---

This is an automatic backport of pull request #22375 done by Mergify.

[mergify]

Cherry-pick of 378a4a7 has failed:

On branch mergify/bp/9.6/pr-22375
Your branch is up to date with 'origin/9.6'.

You are currently cherry-picking commit 378a4a7.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   NOTICE-fips.txt
	modified:   NOTICE.txt
	modified:   go.sum

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   go.mod

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[Copilot]

🟡 Changes recommended

Unresolved merge-conflict markers in go.mod make the module invalid, blocking Go builds and tests.

1 open issue

• Resolve go.mod merge conflict to restore Go module loading · New

What changed in this PR

This backport updates APM Server 9.6 to apm-data v1.23.0, adding support for OpenTelemetry semantic conventions 1.33 and recognition of stable database span attributes.

Changes:

• Updates apm-data to v1.23.0 and opentelemetry-lib to v0.49.0.
• Refreshes dependency checksums and standard/FIPS license notices.

File	Description
NOTICE.txt	Updates dependency versions in standard license notices.
NOTICE-fips.txt	Updates dependency versions in FIPS license notices.
go.sum	Records checksums for the upgraded dependencies.
go.mod	Updates dependency requirements for the backport.

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR bumps github.com/elastic/apm-data to v1.23.0 (with transitive beats/opentelemetry-lib changes), but overall risk is high because go.mod currently contains unresolved merge-conflict markers and does not parse.

github.com/elastic/apm-data v1.22.2 → v1.23.0

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found in PR state: go.mod is malformed (go.mod:11, go.mod:14, go.mod:17) due to conflict markers, causing module parsing failure
Testable in PR	⚠️ Blocked until go.mod is fixed (go list ./... fails immediately)

Changelog highlights (v1.22.2 → v1.23.0)

Release notes mention dependency updates (grpc/protobuf/otel-lib) and semconv v1.33.0 support. No CVE/GHSA/security-fix entries were called out in the release body.

Usage in this repository

Widely used across ingestion/publishing/sampling paths, including internal/beater/*, internal/publish/*, internal/telemetry/*, and x-pack/apm-server/sampling/* via modelpb, modeljson, input, and modelprocessor packages.

Compatibility assessment

Upstream notes do not indicate direct API removals for the imported apm-data packages used here. However, current PR content is not compatible as-is because unresolved conflict markers in go.mod prevent dependency resolution/build validation.

github.com/elastic/beats/v7 v7.0.0-alpha2.0.20261019215014-1f94b9713b9c → v7.0.0-alpha2.0.20261020133521-8e42ed4a20b6

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found in PR state (same malformed go.mod conflict issue)
Testable in PR	⚠️ Blocked until go.mod is fixed

Changelog highlights (old → new)

This is a pseudo-version commit bump. Detailed upstream release-note body for the exact pseudo-version was unavailable via MCP; local diff confirms only the version pin change.

Usage in this repository

Extensively used across internal/beatcmd/*, internal/beater/*, internal/elasticsearch/*, internal/publish/*, and x-pack/apm-server/* (libbeat management, outputs, monitoring, pipeline, status, and related packages).

Compatibility assessment

Given broad direct usage, this bump should be validated with normal PR CI after resolving go.mod. No CVE/security-fix notes were available from local metadata.

github.com/elastic/opentelemetry-lib (indirect) v0.39.0 → v0.49.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found for direct repo usage (indirect dependency; no direct imports found)
Testable in PR	⚠️ Blocked until go.mod is fixed

Changelog highlights (v0.39.0 → v0.49.0)

Release notes for v0.49.0 show dependency updates (OTel Collector and golang.org/x/tools). No CVE/GHSA/security-fix entries were called out.

Usage in this repository

No direct imports found; appears only as an indirect dependency entry in go.mod.

Compatibility assessment

As an indirect module with no direct imports, risk is generally lower, but full compatibility still depends on successful module resolution/build after go.mod conflict cleanup.

Labels Applied

No labels applied (oblt-aw/ai/merge-ready not applied): current overall risk is high due to unresolved conflict markers in go.mod, which prevent module parsing and validation.

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

TL;DR

Buildkite packaging failed on both x86_64 and aarch64 because go.mod in the PR head contains unresolved merge-conflict markers. Resolve the conflict in go.mod, then rerun the packaging jobs.

Remediation

• Resolve conflict markers in go.mod (the <<<<<<< HEAD / ======= / >>>>>>> block around github.com/elastic/apm-data and github.com/elastic/beats/v7) and commit the resolved dependency versions.
• Re-run Buildkite Package x86_64 and Package aarch64 (snapshot + staging) to confirm go mod parsing and Docker package build succeed.

Investigation details

Root Cause

go mod parsing fails before packaging starts because go.mod at PR head is syntactically invalid due to unresolved merge-conflict markers (around lines 11-17).

Evidence

• Build: https://buildkite.com/elastic/apm-server-package/builds/13484
• Jobs/steps: Package x86_64 and Package aarch64 (.buildkite/scripts/package.sh snapshot|staging)
• Key log excerpt:
  • go: errors parsing go.mod:
  • go.mod:11: malformed module path "<<<<<<<": invalid char '<'
  • go.mod:14: usage: require module/path v1.2.3
  • go.mod:17: usage: require module/path v1.2.3
• PR-head go.mod content includes conflict markers:
  • <<<<<<< HEAD
  • =======
  • >>>>>>> 378a4a7 (bump apm-data to v1.23.0 (#22375))

Verification

• Focused local validation commands: not run (workflow scope was log/root-cause analysis from pre-fetched Buildkite artifacts).
• Checked for open flaky-test issues in elastic/apm-server: none found.

Follow-up

After resolving go.mod, if packaging still fails, capture the next failing step; current Docker golang: base-image error appears downstream from the failed go.mod parse.

---

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for this dependency backport.

No open issues 🎉

1 resolved since last review

• Resolve go.mod merge conflict to restore Go module loading

_{Review effort: Balanced}

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 4337cb0

History

• 💔 Build #13484 failed 6d13b80

cc @aelnahas

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR updates Go dependency github.com/elastic/apm-data (v1.22.2 → v1.23.0) and its transitive github.com/elastic/opentelemetry-lib (v0.39.0 → v0.49.0); overall risk is low.

Dependency 1: github.com/elastic/apm-data v1.22.2 → v1.23.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found
Testable in PR	✅ Yes — CI includes pull_request trigger (.github/workflows/ci.yml)

Changelog highlights (v1.22.2 → v1.23.0)

• Added semconv v1.33.0 support.
• Internal dependency updates (including grpc/protobuf/opentelemetry-lib).
• No CVE/GHSA/security-fix entries were called out in release notes.
• CVE-focused assessment: changes appear additive/compatibility-oriented for telemetry schema support; no auth/crypto/permission-scope regressions were identified from release metadata.

Usage in this repository

apm-data is widely used across ingestion/model paths, including:

• internal/beater/api/mux.go (input, input/elasticapm, modelpb, modelprocessor)
• internal/beater/otlp/{grpc.go,http.go} (input/otlp, modelpb)
• internal/publish/pub.go (modeljson, modelpb)
• x-pack/apm-server/main.go and sampling packages (modelpb, modelprocessor)

Import concentration indicates heavy use of model/modelpb, with no direct reliance on removed APIs observed in this PR.

Compatibility assessment

• Semver bump is minor within major v1 (1.22.2 → 1.23.0).
• No code changes in this PR were required beyond module/NOTICE updates.
• Targeted compile validation passed:
  • go test ./internal/beater/... ./internal/publish ./internal/model/modelprocessor ./internal/agentcfg ./internal/telemetry ./x-pack/apm-server/... -run TestDoesNotExist ✅
• No break detected against consumed packages/APIs.

Dependency 2: github.com/elastic/opentelemetry-lib v0.39.0 → v0.49.0 (indirect)

Ecosystem: Go

Check	Result
Breaking changes	✅ None found
Testable in PR	✅ Yes — validated via compile path above

Changelog highlights (v0.39.0 → v0.49.0)

• Release notes indicate dependency refreshes (OTel collector deps and tooling updates).
• No CVE/GHSA/security-fix entries were called out in release notes.
• CVE-focused assessment: no direct evidence of newly exposed attack surface for this repo; update remains transitive and infrastructure-focused.

Usage in this repository

No direct imports of github.com/elastic/opentelemetry-lib were found in repository Go files; this is a transitive dependency update pulled via apm-data.

Compatibility assessment

Given no direct calls/imports in this repo and successful compile checks across apm-data integration points, compatibility risk is low.

Labels Applied

• oblt-aw/ai/merge-ready — applied (overall low risk, no detected breaking usage impact, ecosystem checks passed for this Go-only bump).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

Automerge skipped

Automerge skipped this pull request because the update-beats collection is not enabled for this repository.

To allow automerge for this kind of update, enable the matching collection under Automerge on the Control Plane Dashboard (the oblt-aw/dashboard issue). See Automerge dependency collections for what each collection covers.

See Opt in or opt out for how to enable or disable Automerge collections on the Control Plane Dashboard.

Collections currently enabled for automerge: github-actions, pre-commit

Changed files considered:

• NOTICE-fips.txt
• NOTICE.txt
• go.mod
• go.sum

[mergify]

✅ Merged into 9.6 as 8971d25 at 19:51 UTC

9 min in the queue, 8 min of it CI.

So far

• ✅ Entered the queue Thu 5 Nov, 19:42 · rule default · triggered by rule squash and merge backport PRs after CI passes
• ✅ Passed · draft merge queue: merged #22381: [9.6] (backport #22375) bump apm-data to v1.23.0 #22387
• ✅ Merged 19:51 · 8971d25 · squash

9 merge conditions met

• check-success=CLA
• check-success=lint
• check-success=system-test
• check-success=test (macos-latest)
• github-review-approved · required by GitHub repository ruleset rule 9.*, GitHub repository ruleset rule [org] Require a PR for Renovate and GitHub repository ruleset rule [org] Require a PR
• any of:
  • check-success=test (windows-2025)
  • check-success=test (windows-latest)
• any of · required by GitHub repository ruleset rule 9.*:
  • check-success = lint
  • check-neutral = lint
  • check-skipped = lint
• any of · required by GitHub repository ruleset rule 9.*:
  • check-success = buildkite/docs-build-pr
  • check-neutral = buildkite/docs-build-pr
  • check-skipped = buildkite/docs-build-pr
• any of · required by GitHub repository ruleset rule 9.*:
  • check-success = CLA
  • check-neutral = CLA
  • check-skipped = CLA

_{Times in UTC · dashboard · how the merge queue works}