Zipkin Go Versions Save

What's Changed

• Documented Security/CVE policy and added trivy scanning workflow
• Documented Go version policy as latest-2, currently Go 1.20, 1.21, 1.22
• Updated go.mod to address CVEs (notably grpc)
• @php-lsys fixed a race condition for instrumentation that mutate tags after finishing the span

Full Changelog: https://github.com/openzipkin/zipkin-go/compare/v0.4.2...v0.4.3

What's Changed

• chore(deps): bump sarama to v1.40.0 by @dnwe in https://github.com/openzipkin/zipkin-go/pull/214
• update gha bumping go version matrix, fix codecov by @basvanbeek in https://github.com/openzipkin/zipkin-go/pull/215
• bump dependencies by @basvanbeek in https://github.com/openzipkin/zipkin-go/pull/216

New Contributors

• @dnwe made their first contribution in https://github.com/openzipkin/zipkin-go/pull/214

Full Changelog: https://github.com/openzipkin/zipkin-go/compare/v0.4.1...v0.4.2

This release bumps some dependencies to fix CVE's and testing with Go 1.17, 1.18, and 1.19.

This release adds Baggage functionality:

• Baggage interface for the Zipkin Span Context Data model
• Baggage implementation using explicit field registration
• Baggage support for the bundled HTTP and gRPC middlewares

Mostly housekeeping and fixes for this release.

• feat(tracer): adds support for isNoop check on spans. (#181)
• fix(propagation/b3): fix incorrect parsing of a single b3 header (#190)
• chore(examples): makes examples use its own go.mod (#191)
• bump(reporter/amqp): move to migrated and official library github.com/rabbitmq/amqp091-go (#199)
• qa: license date updates, linter fixes, test fixes (#203, #204)
• updated dependencies and regenerated protobuf files (#208)

Thanks all that participated including but not limited to @jcchavezs, @nosan, and @SteelPhase.

Removes the optional configuration for enable sampling on reporter calls until we get a use case where users want to enable tracing in such calls. This is, all reporter calls will be unsampled always.

Adds B3:0 header to HTTP Reporter to mitigate trace reporting amplification Updates proto handling to newer packages

See https://github.com/openzipkin/zipkin-go/pull/176

• fix(reporter/kafka): fixes the SpanSerializer option usage. (#156)
• feat(reporter/http): uses an interface for http client (#155)
• docs(reporter/kafka): adds more information about tweaking the producer (#158)
• Duration order consistency when multiplying number by time unit (#160)
• feat(json-format): lowercase span name and service name as per swagger definition (#166)
• Update generated proto code to latest protoc (#165)
• Don't include the http.status_code when 2xx in server. (#167)
• Add support for RemoteEndpoint in transport/client. (#170)

Thanks for the contributions: @dengliming @jcchavezs @anuraaga @maxifom

This release fixes HTTP reporter potential unbounded goroutine creation (see #146). Thanks to @skaslev for this great improvement.

This release:

• improved RequestSampler logic for HTTP Server Middleware
• Go map[string]string convenience container for proper B3 serialization/deserialization with non natively supported headers