tempo v3.0.4 security dependency updates

{
  "id": "875f2fb8c882901f686549a5adc077bf69b25b2056f6b8988aa19ec40a896d7f",
  "url": "https://github.com/grafana/tempo/releases/tag/v3.0.4",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "tempo v3.0.4 security dependency updates",
    "summary": "tempo v3.0.4 updates Go and several Go dependencies to versions listed in the release notes, alongside OpenTelemetry log modules. The notes identify associated CVEs but do not explicitly state that this release fixes any particular CVE.",
    "evidence": "Security deps: Update Go to 1.26.9",
    "products": [
      {
        "name": {
          "value": "tempo",
          "evidence": "Release notes from tempo"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v3.0.4",
            "evidence": "v3.0.4"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Go",
          "evidence": "Update Go to 1.26.9"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.26.9",
            "evidence": "Update Go to 1.26.9"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "google.golang.org/grpc",
          "evidence": "google.golang.org/grpc to v1.83.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v1.83.2",
            "evidence": "google.golang.org/grpc to v1.83.2"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "github.com/apache/thrift",
          "evidence": "github.com/apache/thrift to v0.24.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.24.0",
            "evidence": "github.com/apache/thrift to v0.24.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "golang.org/x/net",
          "evidence": "golang.org/x/net to v0.60.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.60.0",
            "evidence": "golang.org/x/net to v0.60.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "golang.org/x/text",
          "evidence": "golang.org/x/text to v0.42.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.42.0",
            "evidence": "golang.org/x/text to v0.42.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "golang.org/x/crypto",
          "evidence": "golang.org/x/crypto to v0.57.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.57.0",
            "evidence": "golang.org/x/crypto to v0.57.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "OpenTelemetry log modules",
          "evidence": "the OpenTelemetry log modules to v0.21.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.21.0",
            "evidence": "the OpenTelemetry log modules to v0.21.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-56858",
        "evidence": "CVE-2026-56858"
      },
      {
        "value": "CVE-2026-56862",
        "evidence": "CVE-2026-56862"
      },
      {
        "value": "CVE-2026-56860",
        "evidence": "CVE-2026-56860"
      },
      {
        "value": "CVE-2026-56859",
        "evidence": "CVE-2026-56859"
      },
      {
        "value": "CVE-2026-56853",
        "evidence": "CVE-2026-56853"
      },
      {
        "value": "CVE-2026-33818",
        "evidence": "CVE-2026-33818"
      },
      {
        "value": "CVE-2026-97031",
        "evidence": "CVE-2026-97031"
      },
      {
        "value": "CVE-2026-94440",
        "evidence": "CVE-2026-94440"
      },
      {
        "value": "CVE-2026-78669",
        "evidence": "CVE-2026-78669"
      },
      {
        "value": "CVE-2026-78667",
        "evidence": "CVE-2026-78667"
      },
      {
        "value": "CVE-2026-78660",
        "evidence": "CVE-2026-78660"
      },
      {
        "value": "CVE-2026-78659",
        "evidence": "CVE-2026-78659"
      },
      {
        "value": "CVE-2026-84445",
        "evidence": "CVE-2026-84445"
      },
      {
        "value": "CVE-2026-84304",
        "evidence": "CVE-2026-84304"
      },
      {
        "value": "CVE-2026-43871",
        "evidence": "CVE-2026-43871"
      },
      {
        "value": "CVE-2026-39821",
        "evidence": "CVE-2026-39821"
      },
      {
        "value": "CVE-2026-46600",
        "evidence": "CVE-2026-46600"
      },
      {
        "value": "CVE-2026-56851",
        "evidence": "CVE-2026-56851"
      },
      {
        "value": "CVE-2026-56854",
        "evidence": "CVE-2026-56854"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-grafana-tempo",
  "document_id": 21324,
  "published_at": "2026-10-16T20:12:21+00:00"
}