[mergify]

Motivation/summary

this PR updates the apm-data to v1.23.0 https://github.com/elastic/apm-data/releases/tag/v1.23.0 which includes the added support for semconv 1.33

Checklist

• Update CHANGELOG.asciidoc
• Documentation has been updated

For functional changes, consider:

• Is it observable through the addition of either logging or metrics?
• Is its use being published in telemetry to enable product improvement?
• Have system tests been added to avoid regression?

How to test these changes

1. Run es on docker container
   shdocker compose up -d elasticsearch
2. compile and run apm-server binary from this branch
3. to help with sending an otlp trace with the help of ai I have added the following convenient go script

import (
      "context"
      "time"

      "go.opentelemetry.io/otel/attribute"
      "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
      sdktrace "go.opentelemetry.io/otel/sdk/trace"
      "go.opentelemetry.io/otel/trace"
)

func main() {
      ctx := context.Background()
      exp, _ := otlptracegrpc.New(ctx, otlptracegrpc.WithEndpoint("127.0.0.1:8200"), otlptracegrpc.WithInsecure())
      tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exp, sdktrace.WithBatchTimeout(time.Millisecond)))
      tracer := tp.Tracer("manual-verify")

      ctx, root := tracer.Start(ctx, "txn", trace.WithSpanKind(trace.SpanKindServer))
      _, child := tracer.Start(ctx, "db_call", trace.WithSpanKind(trace.SpanKindClient), trace.WithAttributes(
              attribute.String("db.system.name", "elasticsearch"), // should be supported now with semconv 1.33
      ))
      child.End()
      root.End()
      tp.Shutdown(ctx)
}

4. execute the script to send a trace
5. curl es for the indexed data

curl -s -u <user>:<password> "http://localhost:9200/traces-apm*/_search" \
  -H 'Content-Type: application/json' \
  -d '{"query":{"term":{"span.name":"db_call"}}}' | \
  jq '.hits.hits[0]._source.span | {type, subtype, db}'

you should see the following as a response of the curl request

{
  "type": "db",
  "subtype": "elasticsearch",
  "db": {
    "type": "elasticsearch"
  }

Related issues

Fixes: #20248

---

This is an automatic backport of pull request #22375 done by Mergify.

[mergify]

Cherry-pick of 378a4a7 has failed:

On branch mergify/bp/9.4/pr-22375
Your branch is up to date with 'origin/9.4'.

You are currently cherry-picking commit 378a4a7.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   NOTICE-fips.txt
	modified:   NOTICE.txt
	modified:   go.sum

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   go.mod

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR updates Go dependencies (github.com/elastic/apm-data and related transitive pins), but it currently has a high-risk compatibility issue: unresolved merge-conflict markers in go.mod make the module file invalid and go commands fail.

Dependency 1: github.com/elastic/apm-data v1.22.2 → v1.23.0

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found (details below)
Testable in PR	✅ Yes

Changelog highlights (v1.22.2 → v1.23.0)

Release notes for v1.23.0 mention dependency updates (including gRPC/protobuf/otel-related bumps) and semconv v1.33.0 support. No explicit CVE/GHSA entries or breaking API removals were called out.

Usage in this repository

Widely used across ingestion and processing paths (52 Go files), including modelpb, modelprocessor, input/elasticapm, and input/otlp (for example: internal/beater/api/mux.go, internal/beater/otlp/http.go, internal/beater/server.go, x-pack/apm-server/main.go).

Compatibility assessment

Local validation fails before compilation due to unresolved conflict markers in go.mod around the bumped lines:

• go.mod:11 contains <<<<<<< HEAD
• go.mod:14 / go.mod:17 conflict delimiters

go test ./... fails with:

• go.mod:11: malformed module path "<<<<<<<": invalid char '<'
• go.mod:14: usage: require module/path v1.2.3
• go.mod:17: usage: require module/path v1.2.3

This is a breaking integration issue for the PR as submitted.

Dependency 2: github.com/elastic/opentelemetry-lib v0.39.0 → v0.49.0 (indirect)

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found (details below)
Testable in PR	✅ Yes

Changelog highlights (v0.39.0 → v0.49.0)

Available release notes for v0.49.0 mention OTel Collector dependency bumps and tooling updates. No explicit CVE/GHSA entries or breaking changes were called out in those notes.

Usage in this repository

No direct imports found in .go files; referenced as an indirect module in go.mod/go.sum.

Compatibility assessment

Although this is indirect and likely low impact by itself, the same go.mod conflict state blocks all module resolution/testing, so PR compatibility cannot be validated until conflict markers are resolved.

Dependency 3: github.com/elastic/beats/v7 pseudo-version line changed in conflicted go.mod block

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found (details below)
Testable in PR	✅ Yes

Changelog highlights

This appears inside the unresolved conflict block (c64f75eeac36 vs 8e42ed4a20b6) rather than a clean resolved bump. Because go.mod is invalid, this cannot be treated as a safe/complete upgrade.

Usage in this repository

Directly imported across runtime/command paths (32 Go files), especially under internal/beatcmd/*, internal/beater/*, internal/publish/*, and x-pack/apm-server/*.

Compatibility assessment

Given the unresolved merge conflict in go.mod, compatibility for this dependency change cannot be validated in current PR state.

Labels Applied

No labels applied (oblt-aw/ai/merge-ready not applied because risk is high and compatibility checks fail in current PR state).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the dependency backport.

No open issues 🎉

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR bumps github.com/elastic/apm-data v1.22.2 → v1.23.0 (and transitive github.com/elastic/opentelemetry-lib v0.39.0 → v0.49.0); overall risk is low and oblt-aw/ai/merge-ready was applied.

Dependency 1: github.com/elastic/apm-data v1.22.2 → v1.23.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found for consumed APIs
Testable in PR	✅ Yes — CI runs on pull_request (.github/workflows/ci.yml)

Changelog highlights (v1.22.2 → v1.23.0)

• Upstream release notes include dependency refreshes and semconv v1.33.0 support.
• No explicit CVE/GHSA entries or security advisories were called out in the release body.
• Security-impacting behavior changes (authn/authz, crypto/TLS, permission model) were not indicated in the release notes.

Usage in this repository

Used broadly in runtime ingestion and model processing paths, e.g.:

• internal/beater/api/mux.go (input, input/elasticapm, modelpb, modelprocessor)
• internal/beater/otlp/http.go (input/otlp, modelpb, modelprocessor)
• internal/publish/pub.go (modeljson, modelpb)
• x-pack/apm-server/main.go (modelpb, modelprocessor)

Repository search shows widespread usage (github.com/elastic/apm-data imports across many Go files), so compatibility was checked against release notes for removed/deprecated interfaces; none were identified.

Compatibility assessment

• This is a minor Go module bump within major v1.
• No upstream breaking-change notice for consumed interfaces.
• Existing PR CI is pull-request-testable, reducing integration risk.
• Overall effect appears additive/maintenance-oriented with low regression risk for current usage.

Dependency 2: github.com/elastic/opentelemetry-lib v0.39.0 → v0.49.0

Ecosystem: Go (indirect/transitive)

Check	Result
Breaking changes	✅ None found for this repository (no direct imports)
Testable in PR	✅ Yes — covered by pull_request CI workflows

Changelog highlights (v0.39.0 → v0.49.0)

• In this PR, the bump appears as a transitive update via apm-data.
• Upstream v0.49.0 notes mention OTel Collector dependency updates and tooling updates.
• No explicit CVE/GHSA entries were listed in the release body consumed for this review.

Usage in this repository

• No direct github.com/elastic/opentelemetry-lib imports were found in repository Go sources.
• Dependency is present as // indirect in go.mod, so impact is mediated through direct dependencies.

Compatibility assessment

• Because there are no direct imports, break risk to repository code is low.
• Any behavior change would need to surface through apm-data; no such incompatibility is indicated in release notes.

Labels Applied

• oblt-aw/ai/merge-ready — risk assessed as low, no breaking changes identified for repository usage, and CI is PR-testable.

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

Automerge skipped

Automerge skipped this pull request because the update-beats collection is not enabled for this repository.

To allow automerge for this kind of update, enable the matching collection under Automerge on the Control Plane Dashboard (the oblt-aw/dashboard issue). See Automerge dependency collections for what each collection covers.

See Opt in or opt out for how to enable or disable Automerge collections on the Control Plane Dashboard.

Collections currently enabled for automerge: github-actions, pre-commit

Changed files considered:

• NOTICE-fips.txt
• NOTICE.txt
• go.mod
• go.sum

[github-actions]

TL;DR

Buildkite packaging is failing on both x86_64 and aarch64 because module metadata is out of sync for PR head 59d945f, and make apm-server runs with -mod=readonly. Run go mod tidy on the PR branch and commit the resulting module file changes.

Remediation

• On branch mergify/bp/9.4/pr-22375, run go mod tidy and commit all resulting updates (typically go.mod/go.sum).
• Re-run .buildkite/scripts/package.sh snapshot and .buildkite/scripts/package.sh staging to confirm packaging passes.

Investigation details

Root Cause

This is a dependency metadata drift failure (not infrastructure). The package jobs fail at Docker build step make apm-server with readonly module mode, indicating the checked-in module files are not in the exact state required by the current dependency graph.

Recent PR commit 59d945f3caa56f928d7ea9c4e92c371b7230c259 modifies go.mod (including github.com/elastic/apm-data v1.23.0 at go.mod:11), and CI then reports required module-file updates during compile.

Evidence

• Build: https://buildkite.com/elastic/apm-server-package/builds/13495
• Jobs/steps: Package x86_64 and Package aarch64 (snapshot + staging)
• Key log excerpt (both logs):
  • go: updates to go.mod needed, disabled by -mod=readonly; to update it:
  • go mod tidy
  • make[1]: *** [Makefile:76: apm-server-build] Error 1
  • make: *** [Makefile:113: apm-server] Error 2

Verification

• Direct code/build execution against PR SHA was not run in this environment.
• Performed log + commit inspection; no open flaky-test issue matched this failure mode.

Follow-up

• If go mod tidy yields no diff locally, compare Go toolchain version and GOFLAGS with the Buildkite image, then regenerate module files under matching toolchain.

---

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the dependency backport adding support for newer OpenTelemetry database-span attributes.

No open issues 🎉

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR updates Go dependencies (github.com/elastic/apm-data v1.22.2 → v1.23.0, plus transitive go-elasticsearch and opentelemetry-lib bumps); overall risk is low with no repo-impacting breaking changes identified.

github.com/elastic/apm-data v1.22.2 → v1.23.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in current repo usage
Testable in PR	✅ Yes (.github/workflows/ci.yml runs on pull_request and executes make test / integration test jobs)

Changelog highlights (v1.22.2 → v1.23.0)

• Release includes dependency refreshes (grpc/protobuf/otel-related updates) and semconv v1.33.0 support.
• No upstream release-note entries indicating removed APIs or required config changes for this repo usage.
• CVE/security assessment: no CVE/GHSA IDs called out in the release notes; changes appear maintenance/compatibility oriented.

Usage in this repository

Widely used in ingestion/model paths, including:

• internal/beater/* (OTLP + intake flow via input, modelpb, modelprocessor)
• internal/publish/pub.go (modeljson, modelpb)
• x-pack/apm-server/sampling/* and x-pack/apm-server/aggregation/lsm.go

These are stable package paths (modelpb, modelprocessor, input/*) and remain compatible with this minor bump.

Compatibility assessment

• Minor version bump (1.22.2 → 1.23.0), no Go module major-path change.
• No evidence of deprecated/removed APIs affecting consumed imports.
• Runtime behavior impact expected to be low.

github.com/elastic/go-elasticsearch/v8 v8.19.6 → v8.19.7 (transitive in this PR)

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in current repo usage
Testable in PR	✅ Yes (pull_request CI executes unit/integration test jobs)

Changelog highlights (v8.19.6 → v8.19.7)

• Upstream release notes describe typed API spec refresh for 8.19 client.
• CVE/security assessment: no CVE/GHSA entries in release notes.

Usage in this repository

Used primarily in system/integration testing and typed API helpers, e.g.:

• systemtest/elasticsearch.go, systemtest/*_test.go (esapi, esutil)
• integrationservertest/internal/elasticsearch/client.go and related asserts (typedapi/...)

Compatibility assessment

• Patch bump within major v8; no module path change.
• Typed API updates are consistent with existing typed API usage in test/integration paths.

github.com/elastic/opentelemetry-lib v0.39.0 → v0.49.0 (transitive in this PR)

Ecosystem: Go

Check	Result
Breaking changes	✅ None found for this repository (no direct imports detected)
Testable in PR	✅ Yes (covered by pull_request CI on module graph/build/tests)

Changelog highlights (v0.39.0 → v0.49.0)

• Upstream release notes for v0.49.0 indicate dependency/tooling refreshes (OTel Collector deps and golang.org/x/tools updates).
• CVE/security assessment: no CVE/GHSA entries in release notes.

Usage in this repository

• No direct github.com/elastic/opentelemetry-lib imports found in this repo’s Go source.
• Update appears transitive via apm-data dependency graph.

Compatibility assessment

• Because usage is transitive and no direct API consumption exists here, compatibility risk is low.

Labels Applied

• oblt-aw/ai/merge-ready — applied (overall low risk, no breaking usage impact found, and PR-context CI testability is present).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 3f76f33

History

• 💔 Build #13495 failed 59d945f
• 💔 Build #13486 failed 5505e79

cc @aelnahas

[mergify]

✅ Merged into 9.4 as 379a278 at 20:34 UTC

9 min in the queue, 8 min of it CI.

So far

• ✅ Entered the queue Thu 5 Nov, 20:25 · rule default · triggered by rule squash and merge backport PRs after CI passes
• ✅ Passed · draft merge queue: merged #22383: [9.4] (backport #22375) bump apm-data to v1.23.0 #22389
• ✅ Merged 20:34 · 379a278 · squash

9 merge conditions met

• check-success=CLA
• check-success=lint
• check-success=system-test
• check-success=test (macos-latest)
• github-review-approved · required by GitHub repository ruleset rule 9.*, GitHub repository ruleset rule [org] Require a PR for Renovate and GitHub repository ruleset rule [org] Require a PR
• any of:
  • check-success=test (windows-2025)
  • check-success=test (windows-latest)
• any of · required by GitHub repository ruleset rule 9.*:
  • check-success = lint
  • check-neutral = lint
  • check-skipped = lint
• any of · required by GitHub repository ruleset rule 9.*:
  • check-success = buildkite/docs-build-pr
  • check-neutral = buildkite/docs-build-pr
  • check-skipped = buildkite/docs-build-pr
• any of · required by GitHub repository ruleset rule 9.*:
  • check-success = CLA
  • check-neutral = CLA
  • check-skipped = CLA

_{Times in UTC · dashboard · how the merge queue works}