dependabot[bot]
c7411aeaba
build(deps): bump the go-dependencies group with 2 updates ( #1634 )
...
Bumps the go-dependencies group with 2 updates:
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
and [golang.org/x/mod](https://github.com/golang/mod ).
Updates `github.com/google/go-containerregistry` from 0.22.0 to 0.22.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.22.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Reject non-canonical IP literals in all SSRF guards by <a
href="https://github.com/shaggyinsomniac "><code>@shaggyinsomniac</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2426 ">google/go-containerregistry#2426</a></li>
<li>daemon: fix stale docker/docker reference in WithClient docs by <a
href="https://github.com/BobDu "><code>@BobDu</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2428 ">google/go-containerregistry#2428</a></li>
<li>build(deps): bump the go-deps group across 2 directories with 4
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2422 ">google/go-containerregistry#2422</a></li>
<li>authn: do not overwrite AuthConfig.Auth when username and password
are empty by <a
href="https://github.com/nileshpatil6 "><code>@nileshpatil6</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2420 ">google/go-containerregistry#2420</a></li>
<li>build(deps): bump the actions group across 1 directory with 8
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2423 ">google/go-containerregistry#2423</a></li>
<li>Support pulling images by sha512 digest by <a
href="https://github.com/BobDu "><code>@BobDu</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2427 ">google/go-containerregistry#2427</a></li>
<li>Allow empty label and annotation values in crane mutate by <a
href="https://github.com/theadsingh "><code>@theadsingh</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2418 ">google/go-containerregistry#2418</a></li>
<li>fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml by <a
href="https://github.com/tprussak "><code>@tprussak</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2434 ">google/go-containerregistry#2434</a></li>
<li>validate: support index attestation manifests and empty configs by
<a href="https://github.com/Subserial "><code>@Subserial</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2414 ">google/go-containerregistry#2414</a></li>
<li>name: improve error when parsing a reference with a URL scheme by <a
href="https://github.com/locker95 "><code>@locker95</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2431 ">google/go-containerregistry#2431</a></li>
<li>fix(build): install binaries to /ko-app and add to PATH (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2424 ">#2424</a>)
by <a href="https://github.com/tprussak "><code>@tprussak</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2436 ">google/go-containerregistry#2436</a></li>
<li>fix(release): honor declared Go toolchain by <a
href="https://github.com/rksharma-owg "><code>@rksharma-owg</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2435 ">google/go-containerregistry#2435</a></li>
<li>remote: apply checkRedirectSSRF to writer-side HTTP clients by <a
href="https://github.com/locker95 "><code>@locker95</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2432 ">google/go-containerregistry#2432</a></li>
<li>flatten: preserve config and layer media types when flattening by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2438 ">google/go-containerregistry#2438</a></li>
<li>fix(mutate): make Time layer updates lazy by <a
href="https://github.com/amarkdotdev "><code>@amarkdotdev</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2429 ">google/go-containerregistry#2429</a></li>
<li>build(deps): bump the go-deps group across 2 directories with 3
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2439 ">google/go-containerregistry#2439</a></li>
<li>remote: copy manifest annotations to referrers fallback tag
descriptors by <a
href="https://github.com/codysoyland "><code>@codysoyland</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2441 ">google/go-containerregistry#2441</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shaggyinsomniac "><code>@shaggyinsomniac</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2426 ">google/go-containerregistry#2426</a></li>
<li><a href="https://github.com/BobDu "><code>@BobDu</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2428 ">google/go-containerregistry#2428</a></li>
<li><a
href="https://github.com/nileshpatil6 "><code>@nileshpatil6</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2420 ">google/go-containerregistry#2420</a></li>
<li><a
href="https://github.com/theadsingh "><code>@theadsingh</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2418 ">google/go-containerregistry#2418</a></li>
<li><a href="https://github.com/locker95 "><code>@locker95</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2431 ">google/go-containerregistry#2431</a></li>
<li><a
href="https://github.com/rksharma-owg "><code>@rksharma-owg</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2435 ">google/go-containerregistry#2435</a></li>
<li><a
href="https://github.com/codysoyland "><code>@codysoyland</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2441 ">google/go-containerregistry#2441</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1 ">https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8a72a424fdhttps://redirect.github.com/google/go-containerregistry/issues/2441 ">#2441</a>)</li>
<li><a
href="5765c35e18https://redirect.github.com/google/go-containerregistry/issues/2439 ">#2439</a>)</li>
<li><a
href="969402f936https://redirect.github.com/google/go-containerregistry/issues/2429 ">#2429</a>)</li>
<li><a
href="25c682edd9https://redirect.github.com/google/go-containerregistry/issues/2438 ">#2438</a>)</li>
<li><a
href="79af990692https://redirect.github.com/google/go-containerregistry/issues/2432 ">#2432</a>)</li>
<li><a
href="4b9b3c7e30https://redirect.github.com/google/go-containerregistry/issues/2435 ">#2435</a>)</li>
<li><a
href="e033b9cb1fhttps://redirect.github.com/google/go-containerregistry/issues/2424 ">#2424</a>)
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2436 ">#2436</a>)</li>
<li><a
href="8bd7902fc8https://redirect.github.com/google/go-containerregistry/issues/2431 ">#2431</a>)</li>
<li><a
href="163134d628https://redirect.github.com/google/go-containerregistry/issues/2414 ">#2414</a>)</li>
<li><a
href="44f7ea307ehttps://redirect.github.com/google/go-containerregistry/issues/2434 ">#2434</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/mod` from 0.40.0 to 0.41.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d0a27b2d4ad12008c62dhttps://github.com/golang/mod/compare/v0.40.0...v0.41.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-16 18:01:34 +03:00
dependabot[bot]
1d1eb91e51
build(deps): bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in the go-dependencies group ( #1619 )
...
Bumps the go-dependencies group with 1 update:
[github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc ).
Updates `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases ">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>oidc: ignore JWKs with unsupported key types rather than failing by
<a href="https://github.com/nicoske "><code>@nicoske</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/499 ">coreos/go-oidc#499</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/nicoske "><code>@nicoske</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/499 ">coreos/go-oidc#499</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0 ">https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c914bd3803https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-05 22:44:08 +03:00
dependabot[bot]
30ca36e42e
build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 ( #1576 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.9 to 0.22.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.22.0</h2>
<h2>What's Changed</h2>
<ul>
<li>mutate: let Time and Canonical take tarball.LayerOption by <a
href="https://github.com/mzihlmann "><code>@mzihlmann</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2403 ">google/go-containerregistry#2403</a></li>
<li>build: add multi-architecture Cloud Build configurations for crane,
gcrane, and krane by <a
href="https://github.com/tprussak "><code>@tprussak</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2412 ">google/go-containerregistry#2412</a></li>
<li>remote: resolve push-check credentials against the repository by <a
href="https://github.com/mzihlmann "><code>@mzihlmann</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2411 ">google/go-containerregistry#2411</a></li>
<li>Allow single-character repository paths by <a
href="https://github.com/semx "><code>@semx</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2407 ">google/go-containerregistry#2407</a></li>
<li>fix: add missing substitutions and workspace cleanup to new build
files by <a
href="https://github.com/tprussak "><code>@tprussak</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2413 ">google/go-containerregistry#2413</a></li>
<li>remote: retry failed Puller and Pusher initialization by <a
href="https://github.com/iahsanGill "><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2406 ">google/go-containerregistry#2406</a></li>
<li>build(deps): bump the actions group across 1 directory with 8
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2405 ">google/go-containerregistry#2405</a></li>
<li>build(deps): bump the go-deps group across 1 directory with 3
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2415 ">google/go-containerregistry#2415</a></li>
<li>go.mod: bump Go version + add toolchain directive to replace
.go-version file by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2416 ">google/go-containerregistry#2416</a></li>
<li>fix: Fix new build options and provenance by <a
href="https://github.com/tprussak "><code>@tprussak</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2417 ">google/go-containerregistry#2417</a></li>
<li>fix(build): unify new build flow into cloudbuild_v2.yaml by <a
href="https://github.com/tprussak "><code>@tprussak</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2419 ">google/go-containerregistry#2419</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mzihlmann "><code>@mzihlmann</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2403 ">google/go-containerregistry#2403</a></li>
<li><a href="https://github.com/tprussak "><code>@tprussak</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2412 ">google/go-containerregistry#2412</a></li>
<li><a href="https://github.com/semx "><code>@semx</code></a> made their
first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2407 ">google/go-containerregistry#2407</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10 ">https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3f4ff3ca60https://redirect.github.com/google/go-containerregistry/issues/2419 ">#2419</a>)</li>
<li><a
href="c6b5acd7d4https://redirect.github.com/google/go-containerregistry/issues/2 ">#2</a>...</li>
<li><a
href="8f4a85dbcf548156007chttps://redirect.github.com/google/go-containerregistry/issues/2415 ">#2415</a>)</li>
<li><a
href="5b5c27267ahttps://redirect.github.com/google/go-containerregistry/issues/2405 ">#2405</a>)</li>
<li><a
href="66dd45462bhttps://redirect.github.com/google/go-containerregistry/issues/2406 ">#2406</a>)</li>
<li><a
href="3f47f91d59https://redirect.github.com/google/go-containerregistry/issues/2413 ">#2413</a>)</li>
<li><a
href="4cb3583322https://redirect.github.com/google/go-containerregistry/issues/2407 ">#2407</a>)</li>
<li><a
href="82cc4281cdhttps://redirect.github.com/google/go-containerregistry/issues/2411 ">#2411</a>)</li>
<li><a
href="97815aa161https://github.com/google/go-containerregistry/compare/v0.21.9...v0.22.0 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-05 21:46:07 +03:00
dependabot[bot]
e166f76f06
build(deps): bump the opentelemetry group across 1 directory with 6 updates ( #1607 )
...
Bumps the opentelemetry group with 2 updates in the / directory:
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib )
and
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go ).
Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.70.0 to 0.71.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md ">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.46.0/2.5.3/0.71.0/0.37.3/0.26.0/0.20.1/0.16.3/0.18.0] -
2026-08-25</h2>
<p>This release is the last to support [Go 1.25].
The next release will require at least [Go 1.26].</p>
<h3>Added</h3>
<ul>
<li>Add support for the <code>aws.ec2</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9139 ">#9139</a>)</li>
<li>Support testing of [Go 1.27]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9524 ">#9524</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/docker</code>, a
resource detector for Docker, ported from
<code>processor/resourcedetectionprocessor/internal/docker</code> in
opentelemetry-collector-contrib. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9001 ">#9001</a>)</li>
<li>Add <code>S3AttributeBuilder</code> to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws</code>
that sets S3-specific span attributes following the OpenTelemetry S3
semantic conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9292 ">#9292</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
Use <code>github.com/labstack/echo-opentelemetry</code> instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9136 ">#9136</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Record <code>error.type</code> attribute on server spans in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code>
when a request is cancelled or ends in a 5xx error. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9387 ">#9387</a>)</li>
<li>Report <code>ot-baggage-*</code> extraction errors from
<code>go.opentelemetry.io/contrib/propagators/ot</code> to
<code>otel.Handle</code> instead of silently discarding them, while
still attaching the successfully parsed baggage members to the context.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9395 ">#9395</a>)</li>
<li>Set <code>error.type</code> on the
<code>rpc.client.call.duration</code> and
<code>rpc.server.call.duration</code> metrics in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
when the RPC fails with a non-OK status, per the RPC semantic
conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9429 ">#9429</a>)</li>
<li>Reject OTLP exporter headers with an empty <code>name</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>,
<code>go.opentelemetry.io/contrib/otelconf/x</code>, and
<code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code>, instead of
forwarding invalid header names to OTLP exporters. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9102 ">#9102</a>)</li>
<li><code>go.opentelemetry.io/contrib/detectors/aws/lambda</code> no
longer returns an error when run outside of an AWS Lambda environment,
matching the no-op behavior of other resource detectors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9464 ">#9464</a>)</li>
<li>Convert Prometheus untyped metrics to OTLP Gauges in
<code>go.opentelemetry.io/contrib/bridges/prometheus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9099 ">#9099</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c4c6248ec2https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9563 ">#9563</a>)</li>
<li><a
href="11c8a13e600458b9df1d638a0d59445089aa5de9a50857b305aa4f4a577cccbbc14b559312464aaf36c3b00660https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.70.0...zpages/v0.71.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel's
releases</a>.</em></p>
<blockquote>
<h2>v1.46.0/v0.68.0/v0.22.0/v0.0.19</h2>
<p>This release is the last to support <a
href="https://go.dev/doc/go1.25 ">Go 1.25</a>.
The next release will require at least <a
href="https://go.dev/doc/go1.26 ">Go 1.26</a>.</p>
<h3>Added</h3>
<ul>
<li>Support testing of <a href="https://go.dev/doc/go1.27 ">Go 1.27</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update github/codeql-action action to v4.37.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8697 ">open-telemetry/opentelemetry-go#8697</a></li>
<li>chore(deps): update module go.opentelemetry.io/collector/featuregate
to v1.64.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8698 ">open-telemetry/opentelemetry-go#8698</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to bdd03c3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8699 ">open-telemetry/opentelemetry-go#8699</a></li>
<li>fix(deps): update module go.opentelemetry.io/collector/pdata to
v1.64.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8700 ">open-telemetry/opentelemetry-go#8700</a></li>
<li>chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2
to v2.30.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8701 ">open-telemetry/opentelemetry-go#8701</a></li>
<li>chore(deps): update module github.com/rogpeppe/go-internal to
v1.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8702 ">open-telemetry/opentelemetry-go#8702</a></li>
<li>chore(deps): update module github.com/cloudflare/circl to v1.6.5 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8703 ">open-telemetry/opentelemetry-go#8703</a></li>
<li>Record processor.{span,log}.processed before invoking the exporter
in simple processors by <a
href="https://github.com/cijothomas "><code>@cijothomas</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8705 ">open-telemetry/opentelemetry-go#8705</a></li>
<li>perf(sdk/metric): reduce benchmark suite execution time (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8683 ">#8683</a>)
by <a href="https://github.com/dashpole "><code>@dashpole</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8688 ">open-telemetry/opentelemetry-go#8688</a></li>
<li>chore(deps): update codspeedhq/action action to v5.0.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8710 ">open-telemetry/opentelemetry-go#8710</a></li>
<li>attempt 2: Lazily compute filtered and dropped attributes by <a
href="https://github.com/dashpole "><code>@dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8598 ">open-telemetry/opentelemetry-go#8598</a></li>
<li>fix(deps): update googleapis to c8921c7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8712 ">open-telemetry/opentelemetry-go#8712</a></li>
<li>chore(deps): update module github.com/santhosh-tekuri/jsonschema/v6
to v6.0.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8708 ">open-telemetry/opentelemetry-go#8708</a></li>
<li>chore(deps): update github.com/charmbracelet/ultraviolet digest to
402eeaa by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8716 ">open-telemetry/opentelemetry-go#8716</a></li>
<li>chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8715 ">open-telemetry/opentelemetry-go#8715</a></li>
<li>chore(deps): update mvdan.cc/unparam digest to a64391f by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8717 ">open-telemetry/opentelemetry-go#8717</a></li>
<li>fix(deps): update golang.org/x to a8b543c by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8720 ">open-telemetry/opentelemetry-go#8720</a></li>
<li>fix(deps): update googleapis to ec0a776 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8719 ">open-telemetry/opentelemetry-go#8719</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25</h2>
<p>This release is the last to support [Go 1.25].
The next release will require at least [Go 1.26].</p>
<h3>Added</h3>
<ul>
<li>Support testing of [Go 1.27]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="58db4c898fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8858 ">#8858</a>)</li>
<li><a
href="524fc3c25fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8853 ">#8853</a>)</li>
<li><a
href="3b8ef6f6eahttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8854 ">#8854</a>)</li>
<li><a
href="cfbeab547fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8753 ">#8753</a>)</li>
<li><a
href="3599b59720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8855 ">#8855</a>)</li>
<li><a
href="08d52dc720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li><a
href="d720f5af01https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li><a
href="80fe23bd77https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8816 ">#8816</a>)</li>
<li><a
href="5337812ca9https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8851 ">#8851</a>)</li>
<li><a
href="2f73a3efdehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8841 ">#8841</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.45.0...v1.46.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.67.0 to
0.68.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25</h2>
<p>This release is the last to support [Go 1.25].
The next release will require at least [Go 1.26].</p>
<h3>Added</h3>
<ul>
<li>Support testing of [Go 1.27]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="58db4c898fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8858 ">#8858</a>)</li>
<li><a
href="524fc3c25fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8853 ">#8853</a>)</li>
<li><a
href="3b8ef6f6eahttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8854 ">#8854</a>)</li>
<li><a
href="cfbeab547fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8753 ">#8753</a>)</li>
<li><a
href="3599b59720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8855 ">#8855</a>)</li>
<li><a
href="08d52dc720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li><a
href="d720f5af01https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li><a
href="80fe23bd77https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8816 ">#8816</a>)</li>
<li><a
href="5337812ca9https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8851 ">#8851</a>)</li>
<li><a
href="2f73a3efdehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8841 ">#8841</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/metric/x/v0.67.0...metric/x/v0.68.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/metric` from 1.45.0 to 1.46.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel/metric's
releases</a>.</em></p>
<blockquote>
<h2>v1.46.0/v0.68.0/v0.22.0/v0.0.19</h2>
<p>This release is the last to support <a
href="https://go.dev/doc/go1.25 ">Go 1.25</a>.
The next release will require at least <a
href="https://go.dev/doc/go1.26 ">Go 1.26</a>.</p>
<h3>Added</h3>
<ul>
<li>Support testing of <a href="https://go.dev/doc/go1.27 ">Go 1.27</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update github/codeql-action action to v4.37.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8697 ">open-telemetry/opentelemetry-go#8697</a></li>
<li>chore(deps): update module go.opentelemetry.io/collector/featuregate
to v1.64.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8698 ">open-telemetry/opentelemetry-go#8698</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to bdd03c3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8699 ">open-telemetry/opentelemetry-go#8699</a></li>
<li>fix(deps): update module go.opentelemetry.io/collector/pdata to
v1.64.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8700 ">open-telemetry/opentelemetry-go#8700</a></li>
<li>chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2
to v2.30.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8701 ">open-telemetry/opentelemetry-go#8701</a></li>
<li>chore(deps): update module github.com/rogpeppe/go-internal to
v1.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8702 ">open-telemetry/opentelemetry-go#8702</a></li>
<li>chore(deps): update module github.com/cloudflare/circl to v1.6.5 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8703 ">open-telemetry/opentelemetry-go#8703</a></li>
<li>Record processor.{span,log}.processed before invoking the exporter
in simple processors by <a
href="https://github.com/cijothomas "><code>@cijothomas</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8705 ">open-telemetry/opentelemetry-go#8705</a></li>
<li>perf(sdk/metric): reduce benchmark suite execution time (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8683 ">#8683</a>)
by <a href="https://github.com/dashpole "><code>@dashpole</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8688 ">open-telemetry/opentelemetry-go#8688</a></li>
<li>chore(deps): update codspeedhq/action action to v5.0.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8710 ">open-telemetry/opentelemetry-go#8710</a></li>
<li>attempt 2: Lazily compute filtered and dropped attributes by <a
href="https://github.com/dashpole "><code>@dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8598 ">open-telemetry/opentelemetry-go#8598</a></li>
<li>fix(deps): update googleapis to c8921c7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8712 ">open-telemetry/opentelemetry-go#8712</a></li>
<li>chore(deps): update module github.com/santhosh-tekuri/jsonschema/v6
to v6.0.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8708 ">open-telemetry/opentelemetry-go#8708</a></li>
<li>chore(deps): update github.com/charmbracelet/ultraviolet digest to
402eeaa by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8716 ">open-telemetry/opentelemetry-go#8716</a></li>
<li>chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8715 ">open-telemetry/opentelemetry-go#8715</a></li>
<li>chore(deps): update mvdan.cc/unparam digest to a64391f by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8717 ">open-telemetry/opentelemetry-go#8717</a></li>
<li>fix(deps): update golang.org/x to a8b543c by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8720 ">open-telemetry/opentelemetry-go#8720</a></li>
<li>fix(deps): update googleapis to ec0a776 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8719 ">open-telemetry/opentelemetry-go#8719</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25</h2>
<p>This release is the last to support [Go 1.25].
The next release will require at least [Go 1.26].</p>
<h3>Added</h3>
<ul>
<li>Support testing of [Go 1.27]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="58db4c898fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8858 ">#8858</a>)</li>
<li><a
href="524fc3c25fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8853 ">#8853</a>)</li>
<li><a
href="3b8ef6f6eahttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8854 ">#8854</a>)</li>
<li><a
href="cfbeab547fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8753 ">#8753</a>)</li>
<li><a
href="3599b59720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8855 ">#8855</a>)</li>
<li><a
href="08d52dc720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li><a
href="d720f5af01https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li><a
href="80fe23bd77https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8816 ">#8816</a>)</li>
<li><a
href="5337812ca9https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8851 ">#8851</a>)</li>
<li><a
href="2f73a3efdehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8841 ">#8841</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.45.0...v1.46.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/sdk` from 1.45.0 to 1.46.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel/sdk's
releases</a>.</em></p>
<blockquote>
<h2>v1.46.0/v0.68.0/v0.22.0/v0.0.19</h2>
<p>This release is the last to support <a
href="https://go.dev/doc/go1.25 ">Go 1.25</a>.
The next release will require at least <a
href="https://go.dev/doc/go1.26 ">Go 1.26</a>.</p>
<h3>Added</h3>
<ul>
<li>Support testing of <a href="https://go.dev/doc/go1.27 ">Go 1.27</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update github/codeql-action action to v4.37.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8697 ">open-telemetry/opentelemetry-go#8697</a></li>
<li>chore(deps): update module go.opentelemetry.io/collector/featuregate
to v1.64.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8698 ">open-telemetry/opentelemetry-go#8698</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to bdd03c3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8699 ">open-telemetry/opentelemetry-go#8699</a></li>
<li>fix(deps): update module go.opentelemetry.io/collector/pdata to
v1.64.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8700 ">open-telemetry/opentelemetry-go#8700</a></li>
<li>chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2
to v2.30.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8701 ">open-telemetry/opentelemetry-go#8701</a></li>
<li>chore(deps): update module github.com/rogpeppe/go-internal to
v1.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8702 ">open-telemetry/opentelemetry-go#8702</a></li>
<li>chore(deps): update module github.com/cloudflare/circl to v1.6.5 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8703 ">open-telemetry/opentelemetry-go#8703</a></li>
<li>Record processor.{span,log}.processed before invoking the exporter
in simple processors by <a
href="https://github.com/cijothomas "><code>@cijothomas</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8705 ">open-telemetry/opentelemetry-go#8705</a></li>
<li>perf(sdk/metric): reduce benchmark suite execution time (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8683 ">#8683</a>)
by <a href="https://github.com/dashpole "><code>@dashpole</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8688 ">open-telemetry/opentelemetry-go#8688</a></li>
<li>chore(deps): update codspeedhq/action action to v5.0.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8710 ">open-telemetry/opentelemetry-go#8710</a></li>
<li>attempt 2: Lazily compute filtered and dropped attributes by <a
href="https://github.com/dashpole "><code>@dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8598 ">open-telemetry/opentelemetry-go#8598</a></li>
<li>fix(deps): update googleapis to c8921c7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8712 ">open-telemetry/opentelemetry-go#8712</a></li>
<li>chore(deps): update module github.com/santhosh-tekuri/jsonschema/v6
to v6.0.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8708 ">open-telemetry/opentelemetry-go#8708</a></li>
<li>chore(deps): update github.com/charmbracelet/ultraviolet digest to
402eeaa by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8716 ">open-telemetry/opentelemetry-go#8716</a></li>
<li>chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8715 ">open-telemetry/opentelemetry-go#8715</a></li>
<li>chore(deps): update mvdan.cc/unparam digest to a64391f by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8717 ">open-telemetry/opentelemetry-go#8717</a></li>
<li>fix(deps): update golang.org/x to a8b543c by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8720 ">open-telemetry/opentelemetry-go#8720</a></li>
<li>fix(deps): update googleapis to ec0a776 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8719 ">open-telemetry/opentelemetry-go#8719</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25</h2>
<p>This release is the last to support [Go 1.25].
The next release will require at least [Go 1.26].</p>
<h3>Added</h3>
<ul>
<li>Support testing of [Go 1.27]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811 ">#8811</a>)</li>
<li>Support <code>http/json</code> protocol in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273 ">#8273</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775 ">#8775</a>,
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831 ">#8831</a>)</li>
<li>Add <code>Hasher</code> struct and methods in
<code>go.opentelemetry.io/otel/attribute</code> to compute authoritative
<code>Distinct</code> hashes incrementally for attribute filtering and
deduplication. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Lazily evaluate filtered and dropped attributes on measurement hot
paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid
unnecessary attribute set allocations. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598 ">#8598</a>)</li>
<li>Add <code>ErrExporterShutdown</code> to
<code>go.opentelemetry.io/otel/sdk/log</code> and return it from the
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
exporters when <code>Export</code> is called after
<code>Shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773 ">#8773</a>)</li>
<li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling
<code>Logger.Enabled</code> is optional and that cached results can
become stale. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764 ">#8764</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Export dropped attribute counts in OTLP log records from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829 ">#8829</a>)</li>
<li>Name span events created from OpenTracing logs after the
<code>event</code> log field, falling back to <code>log</code>, instead
of always using an empty name in
<code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648 ">#8648</a>)</li>
<li>Count exception attributes omitted due to the attribute count limit
as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796 ">#8796</a>)</li>
<li>Prevent log record and instrumentation scope attributes with empty
keys from reaching processors and exporters in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797 ">#8797</a>)</li>
<li>Fix a data race when span attributes are read concurrently in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706 ">#8706</a>)</li>
<li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil
receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792 ">#8792</a>)</li>
<li>The simple span and log processors record
<code>otel.sdk.processor.{span,log}.processed</code> when the record is
submitted to the exporter instead of after the export completes, and no
longer set <code>error.type</code> from the export outcome, in
<code>go.opentelemetry.io/otel/sdk/trace</code> and
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705 ">#8705</a>)</li>
<li>Prevent <code>Resource.MarshalLog</code> from panicking on nil
resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758 ">#8758</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="58db4c898fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8858 ">#8858</a>)</li>
<li><a
href="524fc3c25fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8853 ">#8853</a>)</li>
<li><a
href="3b8ef6f6eahttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8854 ">#8854</a>)</li>
<li><a
href="cfbeab547fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8753 ">#8753</a>)</li>
<li><a
href="3599b59720https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8855 ">#8855</a>)</li>
<li><a
href="08d52dc720https://redirect.github.com/op ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-05 21:39:42 +03:00
dependabot[bot]
d08e70b32a
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1 ( #1608 )
...
Bumps
[github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go )
from 1.14.0 to 1.14.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases ">github.com/Azure/azure-sdk-for-go/sdk/azidentity's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azidentity/v1.14.1</h2>
<h2>1.14.1 (2026-08-27)</h2>
<h3>Other Changes</h3>
<ul>
<li>Upgraded dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="920e79a166https://redirect.github.com/Azure/azure-sdk-for-go/issues/27473 ">#27473</a>)</li>
<li><a
href="d86ae78bd6https://redirect.github.com/Azure/azure-sdk-for-go/issues/27471 ">#27471</a>)</li>
<li><a
href="33dd768d27https://redirect.github.com/Azure/azure-sdk-for-go/issues/27422 ">#27422</a>)</li>
<li><a
href="a27ca57b4dhttps://redirect.github.com/Azure/azure-sdk-for-go/issues/27466 ">#27466</a>)</li>
<li><a
href="af75eb0f828dcff8c382e4569f1adf7069bf802d5ceffcea63https://redirect.github.com/Azure/azure-sdk-for-go/issues/27460 ">#27460</a>)</li>
<li><a
href="663b6ce414https://redirect.github.com/Azure/azure-sdk-for-go/issues/27324 ">#27324</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.14.0...sdk/azidentity/v1.14.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-05 21:14:11 +03:00
dependabot[bot]
57b19e27d2
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 ( #1616 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from
1.82.1 to 1.83.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases ">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.83.1</h2>
<h1>Security</h1>
<ul>
<li>xds/rbac: Fix a bug where nested <code>Principal</code> or
<code>Permission</code> rules with <code>:scheme</code> or
<code>grpc-</code> prefixed header matchers were not rejected, which
could cause DENY rules to fail open. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9258 ">#9258</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug "><code>@nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where the <code>host</code> header matcher was
not being replaced with <code>:authority</code> in nested
<code>Principal</code> or <code>Permission</code> rules. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9258 ">#9258</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug "><code>@nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where a header matcher whose name was not
lowercase, such as <code>X-Role</code>, matched no header, which could
cause DENY rules to fail open. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9332 ">#9332</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/alimony "><code>@alimony</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where a <code>:scheme</code> or
<code>grpc-</code> prefixed header matcher was accepted when its name
was not lowercase. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9332 ">#9332</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/alimony "><code>@alimony</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where a <code>Host</code> header matcher was not
replaced with <code>:authority</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9332 ">#9332</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/alimony "><code>@alimony</code></a></li>
</ul>
</li>
</ul>
<h1>Performance</h1>
<ul>
<li>transport: Restrict memory overhead of buffering small data frames.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9331 ">#9331</a>)</li>
</ul>
<h2>Release 1.83.0</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from connections when flooded by HTTP/2 frames
to mitigate resource exhaustion. The default value for this limit is 100
frames, excluding DATA and HEADERS, and may be changed by setting
environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
<li>xds: Fix panic when parsing route header matchers configured with
empty <code>exact_match</code>, <code>prefix_match</code>, or
<code>suffix_match</code> strings. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223 ">#9223</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>xds/googlec2p: Enable DirectPath over Interconnect support for
on-premises clients via the <code>force-xds</code> target URI query
parameter. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9133 ">#9133</a>)</li>
<li>xds: Enable xDS configuration to control which fields get propagated
from ORCA backend metric reports to LRS load reports. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9145 ">#9145</a>)</li>
<li>authz: Add <code>OnPolicyUpdate</code> callback to
<code>FileWatcherOptions</code> to notify when an authz policy is loaded
or updated. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9142 ">#9142</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/hnefatl "><code>@hnefatl</code></a></li>
</ul>
</li>
<li>xds: Add support for the GCP Authentication HTTP Filter, which
automatically fetches and attaches GCP Service Account Identity JWT
tokens to outgoing RPCs.
<ul>
<li>This feature can be enabled by setting environment variable
<code>GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9119 ">#9119</a>)</li>
</ul>
</li>
<li>xds: Add support for xDS-based HTTP CONNECT proxies.
<ul>
<li>This feature can be enabled by setting environment variable
<code>GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9151 ">#9151</a>)</li>
</ul>
</li>
<li>xds: Add support for <code>contains_match</code> in route header
matchers. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223 ">#9223</a>)</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>credentials/alts: Fix panic when processing malformed frames by
validating that the message frame length exceeds the message type field
size. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9197 ">#9197</a>)</li>
<li>grpc: Fix compilation on Plan 9 targets (<code>GOOS=plan9</code>),
broken since v1.81.0. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9255 ">#9255</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/Yusufihsangorgel "><code>@Yusufihsangorgel</code></a></li>
</ul>
</li>
</ul>
<h2>Release 1.82.2</h2>
<h1>Security</h1>
<ul>
<li>server: Reject requests missing both <code>:authority</code> and
<code>Host</code> headers with HTTP 400 and status
<code>Internal</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/pull/9365 ">grpc/grpc-go#9365</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1550d9e0cdhttps://redirect.github.com/grpc/grpc-go/issues/9336 ">#9336</a>)</li>
<li><a
href="ebba6f3f1bhttps://redirect.github.com/grpc/grpc-go/issues/9258 ">#9258</a>
and <a
href="https://redirect.github.com/grpc/grpc-go/issues/9332 ">#9332</a>
into v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9335 ">#9335</a>)</li>
<li><a
href="8cfeca0e1ehttps://redirect.github.com/grpc/grpc-go/issues/9331 ">#9331</a> to
v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9333 ">#9333</a>)</li>
<li><a
href="dec6951305https://redirect.github.com/grpc/grpc-go/issues/9229 ">#9229</a>)</li>
<li><a
href="4c226daff8https://redirect.github.com/grpc/grpc-go/issues/9228 ">#9228</a>)</li>
<li><a
href="c198988aa9https://redirect.github.com/grpc/grpc-go/issues/9279 ">#9279</a>)</li>
<li><a
href="8ce3ebf24ahttps://redirect.github.com/grpc/grpc-go/issues/9263 ">#9263</a>)</li>
<li><a
href="e39384978chttps://redirect.github.com/grpc/grpc-go/issues/9240 ">#9240</a>)</li>
<li><a
href="2a112a82f5https://redirect.github.com/grpc/grpc-go/issues/9142 ">#9142</a>)</li>
<li><a
href="1a80fca960https://redirect.github.com/grpc/grpc-go/issues/9216 ">#9216</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-09-05 21:03:44 +03:00
dependabot[bot]
6036804f1c
build(deps): bump the opentelemetry group across 1 directory with 6 updates ( #1530 )
...
Bumps the opentelemetry group with 2 updates in the / directory:
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib )
and
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go ).
Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.69.0 to 0.70.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md ">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] -
2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/contrib/detectors/ibmcloud/vpc</code>,
a new resource detector for IBM Cloud VPC virtual server instances,
ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>cloud.account.id</code>, <code>cloud.resource_id</code>,
<code>host.id</code>, <code>host.image.id</code>,
<code>host.image.name</code>, <code>host.name</code>, and
<code>host.type</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9011 ">#9011</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/k8sapi</code>, a new
resource detector that queries the Kubernetes API. Detects
<code>k8s.node.name</code> and <code>k8s.node.uid</code> when
<code>K8S_NODE_NAME</code> is set via the downward API, and
<code>k8s.cluster.uid</code> derived from the kube-system namespace UID
(works on any Kubernetes distribution). (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9108 ">#9108</a>)</li>
<li>Add new <code>elasticbeanstalk</code> resource detector for AWS
Elastic Beanstalk, ported from
<code>processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk</code>
in opentelemetry-collector-contrib. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8993 ">#8993</a>)</li>
<li>The resource created by
<code>go.opentelemetry.io/contrib/otelconf</code> now includes <a
href="https://pkg.go.dev/go.opentelemetry.io/otel/sdk/resource#Default ">default
SDK attributes</a>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8990 ">#8990</a>)</li>
<li>Add support for the <code>aws.ecs</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8915 ">#8915</a>)</li>
<li>Add support for the <code>aws.eks</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9138 ">#9138</a>)</li>
<li>Add support for the <code>azure.vm</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9074 ">#9074</a>)</li>
<li>Add support for the <code>gcp</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9137 ">#9137</a>)</li>
<li>Add
<code>go.opentelemetry.io/contrib/detectors/azure/azureappservice</code>,
a new resource detector for Azure App Service. Detects
<code>cloud.*</code>, <code>service.name</code>,
<code>azure.resource_group.name</code>,
<code>azure.app_service.instance.id</code>, and
<code>deployment.environment.name</code> from the <code>WEBSITE_*</code>
and <code>REGION_NAME</code> environment variables. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9289 ">#9289</a>)</li>
<li>Add <code>azurecontainerapps</code> resource detector for Azure
Container Apps. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8939 ">#8939</a>)</li>
<li>Add
<code>go.opentelemetry.io/contrib/detectors/azure/azurefunctions</code>,
a new resource detector for Azure Functions. Detects
<code>cloud.*</code>, <code>service.name</code>,
<code>azure.resource_group.name</code>, <code>faas.instance</code>, and
<code>deployment.environment.name</code> from the
<code>FUNCTIONS_*</code>, <code>WEBSITE_*</code>,
<code>CONTAINER_NAME</code>, and <code>REGION_NAME</code> environment
variables. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9290 ">#9290</a>)</li>
<li>Add <code>NewResourceDetector</code> along with the
<code>WithAttributeFilter</code> and <code>WithTagKeyFilter</code>
options in
<code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code>.
<code>WithAttributeFilter</code> restricts the returned resource to the
attributes the filter accepts. <code>WithTagKeyFilter</code> opts in to
<code>azure.tag.<name></code> attributes for the VM tags whose
keys satisfy the provided predicate; no VM tags are emitted without it.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162 ">#9162</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/vultr</code> — a new
resource detector for Vultr Cloud Compute instances, ported from
<code>processor/resourcedetectionprocessor/internal/vultr</code> in
<code>opentelemetry-collector-contrib</code>. Detects
<code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>host.id</code>, and
<code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8995 ">#8995</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.43.0</code>, including updates across instrumentation and
detector modules.
See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.43.0 ">semantic-conventions
v1.43.0 release</a> for complete details. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9337 ">#9337</a>)</li>
<li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.42.0</code>, including updates across instrumentation and
detector modules.
See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.42.0 ">semantic-conventions
v1.42.0 release</a> for complete details. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9196 ">#9196</a>)</li>
<li>Use direct normalized-key lookups in <code>Carrier.Get</code> and
<code>Carrier.Keys</code> in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9112 ">#9112</a>)</li>
<li>Update log bridge conversions to use attribute key-values instead of
the removed log key-values in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code>,
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>,
<code>go.opentelemetry.io/contrib/bridges/otelslog</code>, and
<code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9180 ">#9180</a>)</li>
<li>The <code>Version()</code> function in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>
has been replaced by <code>const Version</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9076 ">#9076</a>)</li>
<li>Set <code>error.type</code> attribute instead of adding
<code>exception</code> span events in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8977 ">#8977</a>)</li>
<li>Prefer the gRPC dial target over the resolved peer IP for the
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8904 ">#8904</a>)</li>
<li>The detector in
<code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code> now
also detects <code>cloud.account.id</code>,
<code>cloud.availability_zone</code>, <code>azure.vm.name</code>,
<code>azure.vm.size</code>, <code>azure.vm.scaleset.name</code>, and
<code>azure.resource_group.name</code>, and prefers
<code>osProfile.computerName</code> for <code>host.name</code> (falling
back to the VM name), reconciling it with the collector-contrib Azure
resource detector. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162 ">#9162</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix Prometheus reader resource label filter configuration in
<code>go.opentelemetry.io/contrib/otelconf/v0.2.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9062 ">#9062</a>)</li>
<li>Apply
<code>resource.detection/development.attributes.included</code> and
<code>excluded</code> filtering to resource detector attributes in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9131 ">#9131</a>)</li>
<li>Honor the context configured with <code>WithContext</code> when
constructing resources in
<code>go.opentelemetry.io/contrib/otelconf</code> and
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9160 ">#9160</a>)</li>
<li>Handle nil response bodies from custom <code>RoundTripper</code>
implementations in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
without panicking. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9184 ">#9184</a>)</li>
<li>Fix incorrect (overestimated) sum calculation for runtime histograms
in <code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9063 ">#9063</a>)</li>
<li>Fix <code>Severity.UnmarshalText</code> round trip for positive
<code>FATAL</code> offsets above the named range in
<code>go.opentelemetry.io/contrib/processors/minsev</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9197 ">#9197</a>)</li>
<li>Reduce binary size by fetching ConfigMaps via
<code>rest.HTTPClientFor</code> instead of the Kubernetes clientset in
<code>go.opentelemetry.io/contrib/detectors/aws/eks</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9284 ">#9284</a>)</li>
<li><code>TextMapPropagator</code> in
<code>go.opentelemetry.io/contrib/propagators/autoprop</code> returns
the no-op propagator for empty input, matching the behavior of
<code>none</code>. An unknown <code>OTEL_PROPAGATORS</code> value still
returns an error with a nil propagator so
<code>NewTextMapPropagator</code> falls back to the default TraceContext
and Baggage propagators instead of disabling propagation. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9163 ">#9163</a>)</li>
<li>Preserve error-valued attributes nested in a group as grouped
attributes instead of silently dropping them in
<code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9238 ">#9238</a>)</li>
<li>Fix a data race in
<code>go.opentelemetry.io/contrib/bridges/otelslog</code> where
concurrent <code>Handle</code> calls could corrupt each other's log
attributes because <code>kvBuffer.KeyValues</code> returned a slice
aliasing a shared buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9229 ">#9229</a>)</li>
<li>Avoid a panic in
<code>go.opentelemetry.io/contrib/bridges/otelzap</code> when a
malformed error field contains a nil or non-error value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9068 ">#9068</a>)</li>
<li>Use <code>azure.container_app.instance.id</code> instead of
<code>service.instance.id</code> for the replica name detected by
<code>go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9208 ">#9208</a>)</li>
<li>Preserve the underlying metadata errors returned with partial
resources from <code>go.opentelemetry.io/contrib/detectors/gcp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9069 ">#9069</a>)</li>
<li>Copy <code>MultipartForm</code> back to the request
<code>otelmux.Middleware</code> was given after the wrapped handler
returns, so <code>net/http</code> can find and remove the temp files
<code>ParseMultipartForm</code> created on the context-derived request
copy, when <code>otelmux.Middleware</code> wraps a handler directly, in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
This does not cover a handler panic, nor the common
<code>router.Use(...)</code> integration, where
<code>gorilla/mux</code>'s own routing step makes an additional request
copy the middleware cannot write back through; see <a
href="https://redirect.github.com/gorilla/mux/pull/777 ">gorilla/mux#777</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9361 ">#9361</a>)</li>
<li>Report the <code>b3</code> header from <code>Fields()</code> for the
default <code>B3Unspecified</code> single-header injection encoding,
matching what <code>Inject</code> writes, in
<code>go.opentelemetry.io/contrib/propagators/b3</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9273 ">#9273</a>)</li>
<li>Fix <code>go.opentelemetry.io/contrib/propagators/aws/xray</code>
producing deterministic trace and span IDs when the seed read from
<code>crypto/rand</code> silently failed, by switching to
<code>math/rand/v2</code>'s concurrency-safe top-level generator. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9359 ">#9359</a>)</li>
<li>Strip connection number suffix from connection ID in
<code>go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo</code>
to prevent unbounded metric cardinality. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9352 ">#9352</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c8a87a60bahttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9413 ">#9413</a>)</li>
<li><a
href="cde125c563https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9384 ">#9384</a>)</li>
<li><a
href="88572a7662https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9409 ">#9409</a>)</li>
<li><a
href="e4f511a0f3https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9410 ">#9410</a>)</li>
<li><a
href="265eb0b5fehttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9317 ">#9317</a>)</li>
<li><a
href="941ba46979ededd3b571https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9406 ">#9406</a>)</li>
<li><a
href="7c6e819d4ehttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9405 ">#9405</a>)</li>
<li><a
href="ec1e544a0dhttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9403 ">#9403</a>)</li>
<li><a
href="5d7e16aa11https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9402 ">#9402</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.69.0...zpages/v0.70.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.45.0/v0.67.0/v0.21.0/v0.0.18</h2>
<h2>Overview</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124 ">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251 ">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445 ">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454 ">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.42.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484 ">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532 ">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.43.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628 ">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306 ">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511 ">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620 ">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556 ">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309 ">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383 ">#8383</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124 ">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251 ">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445 ">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454 ">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.42.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484 ">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532 ">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.43.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628 ">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306 ">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511 ">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620 ">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556 ">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309 ">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383 ">#8383</a>)</li>
<li>Fix a memory leak in the <code>Reservoir</code> implementation in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code>, where storing
the full <code>context.Context</code> pinned large objects such as gRPC
transport buffers. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8389 ">#8389</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="93a693edeehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8693 ">#8693</a>)</li>
<li><a
href="c65d435b43223f9fdce4https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8685 ">#8685</a>)</li>
<li><a
href="06272bc491https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8694 ">#8694</a>)</li>
<li><a
href="a4f238f57637140e7882https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8690 ">#8690</a>)</li>
<li><a
href="cef0855960https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8689 ">#8689</a>)</li>
<li><a
href="e814a7281fbfd8eb7f85https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8687 ">#8687</a>)</li>
<li><a
href="48db2c659chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8692 ">#8692</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.66.0 to
0.67.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124 ">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251 ">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445 ">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454 ">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.42.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484 ">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532 ">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.43.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628 ">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306 ">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511 ">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620 ">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556 ">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309 ">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383 ">#8383</a>)</li>
<li>Fix a memory leak in the <code>Reservoir</code> implementation in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code>, where storing
the full <code>context.Context</code> pinned large objects such as gRPC
transport buffers. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8389 ">#8389</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="93a693edeehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8693 ">#8693</a>)</li>
<li><a
href="c65d435b43223f9fdce4https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8685 ">#8685</a>)</li>
<li><a
href="06272bc491https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8694 ">#8694</a>)</li>
<li><a
href="a4f238f57637140e7882https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8690 ">#8690</a>)</li>
<li><a
href="cef0855960https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8689 ">#8689</a>)</li>
<li><a
href="e814a7281fbfd8eb7f85https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8687 ">#8687</a>)</li>
<li><a
href="48db2c659chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8692 ">#8692</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/metric/x/v0.66.0...metric/x/v0.67.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel/metric's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.45.0/v0.67.0/v0.21.0/v0.0.18</h2>
<h2>Overview</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124 ">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251 ">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445 ">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453 ">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454 ">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471 ">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.42.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484 ">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532 ">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.43.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628 ">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306 ">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511 ">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538 ">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620 ">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490 ">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556 ">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309 ">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383 ">#8383</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability me...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-08-21 01:48:19 +03:00
dependabot[bot]
3c1ee7d272
build(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 ( #1531 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.8 to 0.21.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.9</h2>
<h2>What's Changed</h2>
<ul>
<li>actions: pin slsa generator by version by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2395 ">google/go-containerregistry#2395</a></li>
<li>fix: prevent data race on scope refreshes within remote.writer by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2396 ">google/go-containerregistry#2396</a></li>
<li>fix: remove '.' from unsafe path prefixes by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2400 ">google/go-containerregistry#2400</a></li>
<li>build(deps): bump the actions group with 3 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2398 ">google/go-containerregistry#2398</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9 ">https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7b32099eb1https://redirect.github.com/google/go-containerregistry/issues/2398 ">#2398</a>)</li>
<li><a
href="2a4447d669https://redirect.github.com/google/go-containerregistry/issues/2400 ">#2400</a>)</li>
<li><a
href="43cc3e8e7dhttps://redirect.github.com/google/go-containerregistry/issues/2396 ">#2396</a>)</li>
<li><a
href="7775aab7adhttps://redirect.github.com/google/go-containerregistry/issues/2395 ">#2395</a>)</li>
<li>See full diff in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-08-21 01:48:09 +03:00
dependabot[bot]
4ec2ed3f9f
build(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 ( #1552 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.38.0 to
0.40.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d3398d06de57549bfb0d96f62ae6e913be9020bbhttps://github.com/golang/mod/compare/v0.38.0...v0.40.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-20 22:47:32 +03:00
dependabot[bot]
91cc4aed20
build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 ( #1554 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify )
from 1.11.1 to 1.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stretchr/testify/releases ">github.com/stretchr/testify's
releases</a>.</em></p>
<blockquote>
<h2>v1.12.0</h2>
<h2>What's Changed</h2>
<h3>Functional Changes</h3>
<ul>
<li>assert: make *AssertionFunc types just aliases by <a
href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1563 ">stretchr/testify#1563</a></li>
</ul>
<h3>Fixes</h3>
<ul>
<li>mock: avoid panic when expected type is nil in Arguments.Diff by <a
href="https://github.com/mutaiib "><code>@mutaiib</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1775 ">stretchr/testify#1775</a></li>
<li>mock: revert to pre-v1.11.0 argument matching behavior for mutating
stringers by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1786 ">stretchr/testify#1786</a></li>
<li>suite: validate method signatures and continue execution for valid
tests by <a
href="https://github.com/vyas-git "><code>@vyas-git</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1665 ">stretchr/testify#1665</a></li>
<li>assert.PanicsWithError: report error message by <a
href="https://github.com/olivergondza "><code>@olivergondza</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1400 ">stretchr/testify#1400</a></li>
<li>assert: IsIncreasing et al can return false w/out failing by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1787 ">stretchr/testify#1787</a></li>
<li>add type to error message of assert.Same by <a
href="https://github.com/egawata "><code>@egawata</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1792 ">stretchr/testify#1792</a></li>
<li>mock.AssertExpectationsForObjects fix panic with wrong testObject
type. by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1795 ">stretchr/testify#1795</a></li>
<li>assert: truncate very long objects in test failure messages by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1646 ">stretchr/testify#1646</a></li>
<li>assert: fix NotSubset error messages using %#v instead of %q (fixes
<a
href="https://redirect.github.com/stretchr/testify/issues/1800 ">#1800</a>)
by <a href="https://github.com/nghiack7 "><code>@nghiack7</code></a> in
<a
href="https://redirect.github.com/stretchr/testify/pull/1888 ">stretchr/testify#1888</a></li>
<li>suite: prevent panic when SetupTest skips with HandleStats by <a
href="https://github.com/blackwell-systems "><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1877 ">stretchr/testify#1877</a></li>
</ul>
<h3>Documentation, Build & CI</h3>
<ul>
<li>CI: test also with Go 1.23 by <a
href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1783 ">stretchr/testify#1783</a></li>
<li>Vendor unmaintained github.com/pmezard/go-difflib by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1708 ">stretchr/testify#1708</a></li>
<li>Promote ccoVeille to maintainer by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1784 ">stretchr/testify#1784</a></li>
<li>build(deps): bump actions/setup-go from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/stretchr/testify/pull/1790 ">stretchr/testify#1790</a></li>
<li>assert.YAMLEq: Document mutlidoc behavior by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1791 ">stretchr/testify#1791</a></li>
<li>_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports
by <a href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1782 ">stretchr/testify#1782</a></li>
<li>doc: remove ineffective inline code blocks by <a
href="https://github.com/brackendawson "><code>@brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1714 ">stretchr/testify#1714</a></li>
<li>Tag generated assertions as non-generated in new .gitattributes by
<a href="https://github.com/ubunatic "><code>@ubunatic</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1815 ">stretchr/testify#1815</a></li>
<li>chore: vendor go-spew from <a
href="https://github.com/davecgh/go-spew ">https://github.com/davecgh/go-spew </a>
by <a href="https://github.com/ccoVeille "><code>@ccoVeille</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1827 ">stretchr/testify#1827</a></li>
<li>require: fix godoc generation for assertions returning a bool by <a
href="https://github.com/Baxromumarov "><code>@Baxromumarov</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1850 ">stretchr/testify#1850</a></li>
<li>docs(require): correct example usage to use assert.CollectT
(require.CollectT does not exist) by <a
href="https://github.com/a2not "><code>@a2not</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1821 ">stretchr/testify#1821</a></li>
<li>docs: Fix EventuallyWithTf documentation with proper placement of
formatting arguments by <a
href="https://github.com/a2not "><code>@a2not</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1842 ">stretchr/testify#1842</a></li>
<li>EMERITUS.md: add <a
href="https://github.com/tylerb "><code>@tylerb</code></a> by <a
href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1812 ">stretchr/testify#1812</a></li>
<li>CI: test also with Go 1.24 by <a
href="https://github.com/alexandear "><code>@alexandear</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1856 ">stretchr/testify#1856</a></li>
<li>deps: bump objx to v0.5.3 and remove dependency cycle issue by <a
href="https://github.com/ccoVeille "><code>@ccoVeille</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1823 ">stretchr/testify#1823</a></li>
<li>CI: upgrade GitHub Actions and pin hashes by <a
href="https://github.com/SuperQ "><code>@SuperQ</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1883 ">stretchr/testify#1883</a></li>
<li>CI: add _readme-gofmt tool to reformat Go code in README by <a
href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1889 ">stretchr/testify#1889</a></li>
<li>CI: add check of GitHub Action pinned hashes against tag by <a
href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1885 ">stretchr/testify#1885</a></li>
<li>_codegen: modernize by <a
href="https://github.com/dolmen "><code>@dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1890 ">stretchr/testify#1890</a></li>
<li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/stretchr/testify/pull/1906 ">stretchr/testify#1906</a></li>
<li>mock: Mock.Return does not exist anymore by <a
href="https://github.com/Kentzo "><code>@Kentzo</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1905 ">stretchr/testify#1905</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mutaiib "><code>@mutaiib</code></a> made
their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1775 ">stretchr/testify#1775</a></li>
<li><a href="https://github.com/vyas-git "><code>@vyas-git</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1665 ">stretchr/testify#1665</a></li>
<li><a
href="https://github.com/olivergondza "><code>@olivergondza</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1400 ">stretchr/testify#1400</a></li>
<li><a href="https://github.com/egawata "><code>@egawata</code></a> made
their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1792 ">stretchr/testify#1792</a></li>
<li><a href="https://github.com/ubunatic "><code>@ubunatic</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1815 ">stretchr/testify#1815</a></li>
<li><a
href="https://github.com/Baxromumarov "><code>@Baxromumarov</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1850 ">stretchr/testify#1850</a></li>
<li><a href="https://github.com/a2not "><code>@a2not</code></a> made
their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1821 ">stretchr/testify#1821</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="001eb7946bhttps://redirect.github.com/stretchr/testify/issues/1905 ">#1905</a>
from Kentzo/patch-1</li>
<li><a
href="ad40f384b1https://redirect.github.com/stretchr/testify/issues/1906 ">#1906</a>
from stretchr/dependabot/github_actions/actions/chec...</li>
<li><a
href="3bae01746bf8c01f33a312f8b5612ehttps://redirect.github.com/stretchr/testify/issues/1563 ">#1563</a>
from stretchr/make-AssertionFunc-types-aliases</li>
<li><a
href="a11649e427dc20f41986https://redirect.github.com/stretchr/testify/issues/1890 ">#1890</a>
from stretchr/dolmen/codegen-modernize</li>
<li><a
href="098f8d75b3d2699bed69a463c8caf3https://redirect.github.com/stretchr/testify/issues/1885 ">#1885</a>
from stretchr/dolmen/ci-check-ghactions-hashes</li>
<li>Additional commits viewable in <a
href="https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-20 22:47:02 +03:00
dependabot[bot]
34f0bb99f3
build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 ( #1491 )
...
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go )
from 1.32.0 to 1.33.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases ">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>video: v1.33.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/video/v1.32.0...video/v1.33.0 ">1.33.0</a>
(2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>o11y:</strong> Regenerate clients for LRO tracing (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/20107 ">#20107</a>)
(<a
href="779074edd2https://github.com/googleapis/google-cloud-go/compare/kms/v1.32.0...kms/v1.33.0 ">1.33.0</a>
(2026-07-23)</h2>
<h3>Features</h3>
<ul>
<li>Update API sources and regenerate (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/20188 ">#20188</a>)
(<a
href="104e0de4fbhttps://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md ">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.32.0...documentai/v1.33.0 ">1.33.0</a>
(2024-08-20)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Add support for Go 1.23 iterators (<a
href="84461c0ba44f63392822https://redirect.github.com/googleapis/google-cloud-go/issues/20195 ">#20195</a>)</li>
<li><a
href="09acbb37a3https://redirect.github.com/googleapis/google-cloud-go/issues/20117 ">#20117</a>)</li>
<li><a
href="0b4eb72ef1https://redirect.github.com/googleapis/google-cloud-go/issues/20206 ">#20206</a>)</li>
<li><a
href="bcbf71431dhttps://redirect.github.com/googleapis/google-cloud-go/issues/20204 ">#20204</a>)</li>
<li><a
href="6e776ebe4ahttps://redirect.github.com/googleapis/google-cloud-go/issues/20205 ">#20205</a>)</li>
<li><a
href="f0c7260f65https://redirect.github.com/googleapis/google-cloud-go/issues/20014 ">#20014</a>)</li>
<li><a
href="a466345926a9990b4e81https://redirect.github.com/googleapis/google-cloud-go/issues/20203 ">#20203</a>)</li>
<li><a
href="104e0de4fbhttps://redirect.github.com/googleapis/google-cloud-go/issues/20188 ">#20188</a>)</li>
<li><a
href="8dfb2b4267https://redirect.github.com/googleapis/google-cloud-go/issues/20200 ">#20200</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.32.0...kms/v1.33.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 01:30:21 +03:00
dependabot[bot]
4e1f96a716
build(deps): bump github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1 ( #1489 )
...
Bumps
[github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma )
from 2.39.0 to 2.39.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/danielgtaylor/huma/releases ">github.com/danielgtaylor/huma/v2's
releases</a>.</em></p>
<blockquote>
<h1>v2.39.1</h1>
<h2>Overview</h2>
<p>A patch release: correctness fixes for resolvers, validation, and
response handling, plus a dependency refresh.</p>
<h3>Response Status Visible to Middleware Again</h3>
<p><code>WithContext</code> context propagation in v2.39.0 copied the
response status by value, so middleware that called
<code>WithContext</code> and then read <code>Status()</code> after
<code>next()</code> always saw <code>0</code> instead of the status the
handler set, breaking access logging and telemetry. The status is now
shared by every context copy across all adapters, restoring the pre-2.39
invariant while keeping context propagation intact. (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1081 ">#1081</a>)</p>
<h3>Resolvers & Defaults in Arrays and Maps</h3>
<ul>
<li>Nested resolvers now run for fixed-size arrays
(<code>[2]Item</code>), not just slices (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1076 ">#1076</a>)</li>
<li>A resolver on a named collection type (e.g. <code>type Coords
[2]float64</code>) no longer panics, and is no longer conflated with a
resolver on its element type, which previously ran the element's
resolver twice and the collection's never (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1082 ">#1082</a>)</li>
<li>Values reached through a map are now written back after being
walked, so applying a default no longer panics with <code>reflect:
reflect.Value.Set using unaddressable value</code> and resolver
mutations are no longer silently discarded (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1082 ">#1082</a>)</li>
</ul>
<h3>Stricter <code>email</code> and <code>uri</code> Formats</h3>
<p>Validation for two string formats is tighter, so payloads that
previously passed may now return <code>422</code>:</p>
<ul>
<li><code>email</code> / <code>idn-email</code> accept an addr-spec
only; full mailbox forms with a display name (<code>Name
<user@example.com></code>) are rejected</li>
<li><code>uri</code> / <code>iri</code> require an absolute URI with a
non-empty scheme, while relative references remain valid under
<code>uri-reference</code> / <code>iri-reference</code> (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1068 ">#1068</a>)</li>
</ul>
<h3>Validation Robustness</h3>
<ul>
<li>An unresolvable schema <code>$ref</code> during
<code>Validate</code> now reports <code>expected schema $ref to resolve:
...</code> instead of panicking on a nil dereference, covering
discriminators and <code>map[string]any</code> /
<code>map[any]any</code> values (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1065 ">#1065</a>)</li>
<li>Named numeric slice parameters (e.g. <code>type IDs []int64</code>)
are built with their declared element type and validated with item,
length, and uniqueness constraints intact (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1074 ">#1074</a>)</li>
</ul>
<h2>Other Fixes</h2>
<ul>
<li>Resolver errors that wrap a <code>HeadersError</code> now contribute
their headers to the response, matching the handler error path (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1070 ">#1070</a>)</li>
<li>A nil interface response body no longer panics in the schema link
transformer (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1072 ">#1072</a>)</li>
<li>Dependencies updated (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/1066 ">#1066</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>fix: do not panic on unresolved schema $ref during Validate by <a
href="https://github.com/baiyuxi930826 "><code>@baiyuxi930826</code></a>
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1065 ">danielgtaylor/huma#1065</a></li>
<li>chore: update dependencies by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1066 ">danielgtaylor/huma#1066</a></li>
<li>fix: tighten format email and uri validation by <a
href="https://github.com/baiyuxi930826 "><code>@baiyuxi930826</code></a>
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1068 ">danielgtaylor/huma#1068</a></li>
<li>fix: preserve wrapped resolver error metadata by <a
href="https://github.com/ggmolly "><code>@ggmolly</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1070 ">danielgtaylor/huma#1070</a></li>
<li>fix: handle nil interface response bodies by <a
href="https://github.com/ggmolly "><code>@ggmolly</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1072 ">danielgtaylor/huma#1072</a></li>
<li>fix: parse named numeric slice parameters by <a
href="https://github.com/ggmolly "><code>@ggmolly</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1074 ">danielgtaylor/huma#1074</a></li>
<li>fix: share response status across WithContext copies by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1081 ">danielgtaylor/huma#1081</a></li>
<li>fix: run nested resolvers in fixed arrays by <a
href="https://github.com/ggmolly "><code>@ggmolly</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1076 ">danielgtaylor/huma#1076</a></li>
<li>fix: distinguish collection and element matches when walking input
by <a href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1082 ">danielgtaylor/huma#1082</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/baiyuxi930826 "><code>@baiyuxi930826</code></a>
made their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1065 ">danielgtaylor/huma#1065</a></li>
<li><a href="https://github.com/ggmolly "><code>@ggmolly</code></a> made
their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1070 ">danielgtaylor/huma#1070</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1 ">https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="198225eaachttps://redirect.github.com/danielgtaylor/huma/issues/1082 ">#1082</a>)</li>
<li><a
href="5961f0a01dhttps://redirect.github.com/danielgtaylor/huma/issues/1076 ">#1076</a>)</li>
<li><a
href="85aad8ffbdhttps://redirect.github.com/danielgtaylor/huma/issues/1081 ">#1081</a>)</li>
<li><a
href="22a3cb0100https://redirect.github.com/danielgtaylor/huma/issues/1074 ">#1074</a>)</li>
<li><a
href="ac9959c059https://redirect.github.com/danielgtaylor/huma/issues/1072 ">#1072</a>)</li>
<li><a
href="b659c7472chttps://redirect.github.com/danielgtaylor/huma/issues/1070 ">#1070</a>)</li>
<li><a
href="14aea2fe3dhttps://redirect.github.com/danielgtaylor/huma/issues/1068 ">#1068</a>)</li>
<li><a
href="bba0d542c4https://redirect.github.com/danielgtaylor/huma/issues/1066 ">#1066</a>)</li>
<li><a
href="e114668342https://redirect.github.com/danielgtaylor/huma/issues/1065 ">#1065</a>)</li>
<li>See full diff in <a
href="https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 01:29:42 +03:00
dependabot[bot]
4000b09953
build(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 ( #1507 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.7 to 0.21.8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.8</h2>
<p>The artifacts attached to this release are missing SLSA provenance,
see <a
href="https://redirect.github.com/google/go-containerregistry/issues/2390 ">#2390</a>.</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump the go-deps group across 1 directory with 3
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2353 ">google/go-containerregistry#2353</a></li>
<li>build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in
/cmd/krane by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2367 ">google/go-containerregistry#2367</a></li>
<li>build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in
/pkg/authn/k8schain by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2368 ">google/go-containerregistry#2368</a></li>
<li>build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in
/pkg/authn/kubernetes by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2363 ">google/go-containerregistry#2363</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 7
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2377 ">google/go-containerregistry#2377</a></li>
<li>build(deps): bump the actions group across 1 directory with 5
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2375 ">google/go-containerregistry#2375</a></li>
<li>Reject unsafe Windows archive paths in Extract by <a
href="https://github.com/Haihan-Jiang "><code>@Haihan-Jiang</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2330 ">google/go-containerregistry#2330</a></li>
<li>feat(goreleaser): add loong64 build support for crane/gcrane/krane
by <a
href="https://github.com/xuxiaowei-com-cn "><code>@xuxiaowei-com-cn</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2358 ">google/go-containerregistry#2358</a></li>
<li>Document tag and digest reference semantics by <a
href="https://github.com/Haihan-Jiang "><code>@Haihan-Jiang</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2325 ">google/go-containerregistry#2325</a></li>
<li>remote: release pull limiter slot when body is read to EOF by <a
href="https://github.com/knQzx "><code>@knQzx</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2373 ">google/go-containerregistry#2373</a></li>
<li>tarball: bounds-check layer index in uncompressed LayerByDiffID by
<a
href="https://github.com/arpitjain099 "><code>@arpitjain099</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2370 ">google/go-containerregistry#2370</a></li>
<li>authn: read Podman auth from XDG config by <a
href="https://github.com/vigneshakaviki "><code>@vigneshakaviki</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2379 ">google/go-containerregistry#2379</a></li>
<li>transport: per-host bearer token exchange on cross-host redirect by
<a href="https://github.com/amitzig "><code>@amitzig</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2360 ">google/go-containerregistry#2360</a></li>
<li>mutate: bounds-check layer index when building rebase addendums by
<a
href="https://github.com/arpitjain099 "><code>@arpitjain099</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2371 ">google/go-containerregistry#2371</a></li>
<li>fix(daemon): copy ExposedPorts from source config in
computeImageConfig by <a
href="https://github.com/x64vps "><code>@x64vps</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2356 ">google/go-containerregistry#2356</a></li>
<li>feat(remote): add WithReferrersTagFallback option by <a
href="https://github.com/kevinmdavis "><code>@kevinmdavis</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2366 ">google/go-containerregistry#2366</a></li>
<li>mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract
by <a href="https://github.com/sadmanf "><code>@sadmanf</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2372 ">google/go-containerregistry#2372</a></li>
<li>tarball: use correct file extension for zstd/uncompressed by <a
href="https://github.com/milas "><code>@milas</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2382 ">google/go-containerregistry#2382</a></li>
<li>build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in
the go-deps group across 1 directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2380 ">google/go-containerregistry#2380</a></li>
<li>actions: update actions to be pinned by hash by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2384 ">google/go-containerregistry#2384</a></li>
<li>Bump go version to 1.26.5 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2388 ">google/go-containerregistry#2388</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/xuxiaowei-com-cn "><code>@xuxiaowei-com-cn</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2358 ">google/go-containerregistry#2358</a></li>
<li><a href="https://github.com/knQzx "><code>@knQzx</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2373 ">google/go-containerregistry#2373</a></li>
<li><a
href="https://github.com/arpitjain099 "><code>@arpitjain099</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2370 ">google/go-containerregistry#2370</a></li>
<li><a
href="https://github.com/vigneshakaviki "><code>@vigneshakaviki</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2379 ">google/go-containerregistry#2379</a></li>
<li><a href="https://github.com/amitzig "><code>@amitzig</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2360 ">google/go-containerregistry#2360</a></li>
<li><a href="https://github.com/x64vps "><code>@x64vps</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2356 ">google/go-containerregistry#2356</a></li>
<li><a
href="https://github.com/kevinmdavis "><code>@kevinmdavis</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2366 ">google/go-containerregistry#2366</a></li>
<li><a href="https://github.com/sadmanf "><code>@sadmanf</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2372 ">google/go-containerregistry#2372</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8 ">https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2ea098f4b1https://redirect.github.com/google/go-containerregistry/issues/2388 ">#2388</a>)</li>
<li><a
href="ec2e586877https://redirect.github.com/google/go-containerregistry/issues/2386 ">#2386</a>)</li>
<li><a
href="ab819b62e8https://redirect.github.com/google/go-containerregistry/issues/2385 ">#2385</a>)</li>
<li><a
href="eed9a206c1https://redirect.github.com/google/go-containerregistry/issues/2384 ">#2384</a>)</li>
<li><a
href="8a97709675https://redirect.github.com/google/go-containerregistry/issues/2380 ">#2380</a>)</li>
<li><a
href="d04bf7d851https://redirect.github.com/google/go-containerregistry/issues/2382 ">#2382</a>)</li>
<li><a
href="4d13d5326ehttps://redirect.github.com/google/go-containerregistry/issues/2372 ">#2372</a>)</li>
<li><a
href="af2603f63fhttps://redirect.github.com/google/go-containerregistry/issues/2366 ">#2366</a>)</li>
<li><a
href="fb196956b1https://redirect.github.com/google/go-containerregistry/issues/2356 ">#2356</a>)</li>
<li><a
href="0c9d9110e2https://redirect.github.com/google/go-containerregistry/issues/2371 ">#2371</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 01:28:11 +03:00
Radoslav Dimitrov
0b5cc0f6a9
build(deps): consolidate open dependabot updates ( #1482 )
...
Consolidates the five open dependabot PRs into a single change so they
can be reviewed and merged together. Each bump was reproduced against
current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA
pins applied for the actions group), rather than merging the individual
branches, to avoid stale `go.sum` conflicts.
## Root module (`go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 |
| `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 |
| `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 |
## Deploy module (`deploy/go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449
|
## GitHub Actions (#1476 )
- `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`,
`deploy-production.yml`, `deploy-staging.yml`
- `actions/download-artifact` v4 → v8.0.1 in
`close-invalid-publish-prs.yml`
`go mod tidy` re-resolved transitive dependencies in both modules
accordingly.
## Verification
- `go build ./...` passes (root + deploy)
- `go vet ./...` passes
- `govulncheck ./...` reports no `golang.org/x/text` finding (the
GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0)
## Follow-up
Once this merges, the five superseded PRs (#1479 , #1475 , #1474 , #1449 ,
#1476 ) can be closed.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-27 06:13:53 -04:00
Radoslav Dimitrov
8d3517519f
fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) ( #1481 )
...
## Problem
The **Build, Lint, and Validate** CI job is failing on every open PR
(#1480 , #1474 , #1449 ) and on `main`. The failing step is `govulncheck`:
```
Vulnerability #1 : GO-2026-5970
Infinite loop on invalid input in golang.org/x/text
Found in: golang.org/x/text@v0.38.0
Fixed in: golang.org/x/text@v0.39.0
```
This is **not** caused by any of those PRs' changes —
`govulncheck-action` fetches the live vulnerability database at runtime,
so when GO-2026-5970 was published, every branch based on the current
`main` started failing. The vulnerable symbol is reachable via:
- `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do`
- `database.NewTestDB` → `pgx.Connect`
so the scan exits with code 3.
## Fix
Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the
fixed `v0.39.0` and `go mod tidy`.
## Verification
- `govulncheck ./...` no longer reports GO-2026-5970 (confirmed
locally).
- `go build ./...` passes.
## Note
The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also <
v0.39.0. It is a separate module and is **not** scanned by this CI job
(govulncheck runs `./...` in the root module only), so it does not block
CI. Worth a follow-up bump for hygiene, but out of scope here.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-27 06:03:12 -04:00
dependabot[bot]
2271214bd8
build(deps): bump cloud.google.com/go/kms from 1.31.0 to 1.32.0 ( #1447 )
...
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go )
from 1.31.0 to 1.32.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases ">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>kms: v1.32.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.31.0...kms/v1.32.0 ">1.32.0</a>
(2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>o11y:</strong> Regenerate clients for LRO tracing (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/20107 ">#20107</a>)
(<a
href="779074edd2https://redirect.github.com/googleapis/google-cloud-go/issues/20109 ">#20109</a>)
(<a
href="4314d30500https://github.com/googleapis/google-cloud-go/compare/retail/v1.31.0...retail/v1.32.0 ">1.32.0</a>
(2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>o11y:</strong> Regenerate clients for LRO tracing (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/20107 ">#20107</a>)
(<a
href="779074edd2https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md ">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.31.0...documentai/v1.32.0 ">1.32.0</a>
(2024-08-08)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> A new field
<code>gen_ai_model_info</code> is added to message
<code>.google.cloud.documentai.v1.ProcessorVersion</code> (<a
href="649c075d53649c075d535b32644eb806584bf5dfhttps://redirect.github.com/googleapis/google-cloud-go/issues/14427 ">#14427</a>)</li>
<li><a
href="74eab64d1bhttps://redirect.github.com/googleapis/google-cloud-go/issues/14426 ">#14426</a>)</li>
<li><a
href="ec20708bfbhttps://redirect.github.com/googleapis/google-cloud-go/issues/14326 ">#14326</a>)</li>
<li><a
href="5b553fe5b5https://redirect.github.com/googleapis/google-cloud-go/issues/14380 ">#14380</a>)</li>
<li><a
href="f4b10eef3ahttps://redirect.github.com/googleapis/google-cloud-go/issues/14421 ">#14421</a>)</li>
<li><a
href="dc245af519https://redirect.github.com/googleapis/google-cloud-go/issues/14320 ">#14320</a>)</li>
<li><a
href="cfdd7bad68e2d578ca0chttps://redirect.github.com/googleapis/google-cloud-go/issues/14416 ">#14416</a>)</li>
<li><a
href="56e1a627d5https://redirect.github.com/googleapis/google-cloud-go/issues/14413 ">#14413</a>)</li>
<li><a
href="5ca653ac3ehttps://github.com/googleapis/google-cloud-go/compare/kms/v1.31.0...dlp/v1.32.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 05:53:48 -04:00
dependabot[bot]
5da9b4c8bf
build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 ( #1433 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from
0.51.0 to 0.52.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a1c0d992983c7c86938f533fb3f7e4abbc44d451e052873987b61cf853a89c2cd33e8d890731877dffd87b48784e7a7384echttps://github.com/golang/crypto/compare/v0.51.0...v0.52.0 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 17:06:10 -04:00
dependabot[bot]
5cc44d091c
build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 ( #1429 )
...
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc )
from 3.19.0 to 3.20.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases ">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>oidc: modernize with new Go APIs by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/487 ">coreos/go-oidc#487</a></li>
<li>oidc: improve documentation for APIs by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/488 ">coreos/go-oidc#488</a></li>
<li>SECURITY.md: add a security policy and point to project-level
reporting by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/489 ">coreos/go-oidc#489</a></li>
<li>oidc: ignore JWKs with unknown signing algorithms rather than
failing by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/491 ">coreos/go-oidc#491</a></li>
<li>readme: update README and docs by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/492 ">coreos/go-oidc#492</a></li>
<li>oidc: add API for determining when issuer URLs mismatch by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/493 ">coreos/go-oidc#493</a></li>
<li>oidc: add constants for "email" and "profile"
scopes by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/494 ">coreos/go-oidc#494</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0 ">https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="75dfa5c062a89f0468cc6a69b6d27ef9049c99072f178e0a9db3bc7daa570db90530b3https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 15:52:55 -04:00
dependabot[bot]
f3162dbc1e
build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 ( #1428 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.37.0 to
0.38.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="792ac169a9fe2ec04f7chttps://github.com/golang/mod/compare/v0.37.0...v0.38.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 15:52:31 -04:00
dependabot[bot]
dda760f0a9
build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 ( #1373 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.6 to 0.21.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.7</h2>
<h2>What's Changed</h2>
<ul>
<li>tarball: return error instead of panicking on missing
rootfs.diff_ids by <a
href="https://github.com/iahsanGill "><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2304 ">google/go-containerregistry#2304</a></li>
<li>gcrane: honor --platform flag in copy by <a
href="https://github.com/iahsanGill "><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2307 ">google/go-containerregistry#2307</a></li>
<li>mutate: verify layer digests in Extract and Time by <a
href="https://github.com/momenashrafff "><code>@momenashrafff</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2303 ">google/go-containerregistry#2303</a></li>
<li>tarball: close layer readers during Write by <a
href="https://github.com/nandbhat "><code>@nandbhat</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2308 ">google/go-containerregistry#2308</a></li>
<li>build(deps): bump the actions group across 1 directory with 2
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2311 ">google/go-containerregistry#2311</a></li>
<li>build(deps): bump github.com/docker/cli from 29.4.3+incompatible to
29.5.2+incompatible in the go-deps group across 1 directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2312 ">google/go-containerregistry#2312</a></li>
<li>BUGFIX: Fail with error when read exceeds maximum by <a
href="https://github.com/inteon "><code>@inteon</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2328 ">google/go-containerregistry#2328</a></li>
<li>build(deps): bump the actions group across 1 directory with 2
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2327 ">google/go-containerregistry#2327</a></li>
<li>fix(name): anchor loopback registry detection by <a
href="https://github.com/rohan-patnaik "><code>@rohan-patnaik</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2314 ">google/go-containerregistry#2314</a></li>
<li>Reject symlinks in OCI layout blobs by <a
href="https://github.com/mosskappa "><code>@mosskappa</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2306 ">google/go-containerregistry#2306</a></li>
<li>fix(crane): avoid creating export tar on pull failure by <a
href="https://github.com/Haihan-Jiang "><code>@Haihan-Jiang</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2318 ">google/go-containerregistry#2318</a></li>
<li>feat(kubernetes): allow ignoring pull secrets by <a
href="https://github.com/rohan-patnaik "><code>@rohan-patnaik</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2315 ">google/go-containerregistry#2315</a></li>
<li>fix(name): preserve localhost registry references by <a
href="https://github.com/rohan-patnaik "><code>@rohan-patnaik</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2316 ">google/go-containerregistry#2316</a></li>
<li>pkg/registry: export ErrNotFound by <a
href="https://github.com/malt3 "><code>@malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2176 ">google/go-containerregistry#2176</a></li>
<li>pkg/registry: export RedirectError by <a
href="https://github.com/malt3 "><code>@malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2177 ">google/go-containerregistry#2177</a></li>
<li>build(deps): bump the go-deps group across 1 directory with 2
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2343 ">google/go-containerregistry#2343</a></li>
<li>build(deps): bump the actions group across 1 directory with 2
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2344 ">google/go-containerregistry#2344</a></li>
<li>fix: prevent SSRF in google.List() pagination by <a
href="https://github.com/tufstraka "><code>@tufstraka</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2332 ">google/go-containerregistry#2332</a></li>
<li>internal/gzip: fix goroutine leak in ReadCloserLevel by <a
href="https://github.com/amarkdotdev "><code>@amarkdotdev</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2347 ">google/go-containerregistry#2347</a></li>
<li>fix(transport): apply refreshed bearer token after cross-host
redirect by <a
href="https://github.com/64johnlee "><code>@64johnlee</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2337 ">google/go-containerregistry#2337</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 4
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2348 ">google/go-containerregistry#2348</a></li>
<li>fix(tarball): normalize paths when matching files by <a
href="https://github.com/bstoll "><code>@bstoll</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2334 ">google/go-containerregistry#2334</a></li>
<li>transport: do not re-attach bearer token after cross-host redirect
by <a href="https://github.com/evilgensec "><code>@evilgensec</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2349 ">google/go-containerregistry#2349</a></li>
<li>Bump CI go version to 1.26.4 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2350 ">google/go-containerregistry#2350</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/momenashrafff "><code>@momenashrafff</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2303 ">google/go-containerregistry#2303</a></li>
<li><a href="https://github.com/nandbhat "><code>@nandbhat</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2308 ">google/go-containerregistry#2308</a></li>
<li><a href="https://github.com/inteon "><code>@inteon</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2328 ">google/go-containerregistry#2328</a></li>
<li><a
href="https://github.com/rohan-patnaik "><code>@rohan-patnaik</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2314 ">google/go-containerregistry#2314</a></li>
<li><a href="https://github.com/mosskappa "><code>@mosskappa</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2306 ">google/go-containerregistry#2306</a></li>
<li><a
href="https://github.com/Haihan-Jiang "><code>@Haihan-Jiang</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2318 ">google/go-containerregistry#2318</a></li>
<li><a href="https://github.com/tufstraka "><code>@tufstraka</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2332 ">google/go-containerregistry#2332</a></li>
<li><a
href="https://github.com/amarkdotdev "><code>@amarkdotdev</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2347 ">google/go-containerregistry#2347</a></li>
<li><a href="https://github.com/64johnlee "><code>@64johnlee</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2337 ">google/go-containerregistry#2337</a></li>
<li><a href="https://github.com/bstoll "><code>@bstoll</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2334 ">google/go-containerregistry#2334</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7 ">https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c68d899782https://redirect.github.com/google/go-containerregistry/issues/2350 ">#2350</a>)</li>
<li><a
href="da61d865f8https://redirect.github.com/google/go-containerregistry/issues/2349 ">#2349</a>)</li>
<li><a
href="09fe1e5528https://redirect.github.com/google/go-containerregistry/issues/2334 ">#2334</a>)</li>
<li><a
href="5baa399d09https://redirect.github.com/google/go-containerregistry/issues/2348 ">#2348</a>)</li>
<li><a
href="97a8a17e27https://redirect.github.com/google/go-containerregistry/issues/2337 ">#2337</a>)</li>
<li><a
href="e9634975f4https://redirect.github.com/google/go-containerregistry/issues/2347 ">#2347</a>)</li>
<li><a
href="02649eab0dhttps://redirect.github.com/google/go-containerregistry/issues/2332 ">#2332</a>)</li>
<li><a
href="7204b401d3https://redirect.github.com/google/go-containerregistry/issues/2344 ">#2344</a>)</li>
<li><a
href="4cfaa93eb4https://redirect.github.com/google/go-containerregistry/issues/2343 ">#2343</a>)</li>
<li><a
href="6849394e8ahttps://redirect.github.com/google/go-containerregistry/issues/2177 ">#2177</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 02:43:06 -04:00
dependabot[bot]
12b31e9d09
build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 ( #1374 )
...
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc )
from 3.18.0 to 3.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases ">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Key refresh should set <code>no-cache</code> to get most up to
date keys by <a
href="https://github.com/Yanni8 "><code>@Yanni8</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485 ">coreos/go-oidc#485</a></li>
<li>oidc: add support for validating back-channel logout tokens by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/486 ">coreos/go-oidc#486</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Yanni8 "><code>@Yanni8</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485 ">coreos/go-oidc#485</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0 ">https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4204f0b2b0f77e01c509https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 02:42:46 -04:00
dependabot[bot]
39e33b5d16
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 ( #1375 )
...
Bumps
[github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go )
from 1.13.1 to 1.14.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases ">github.com/Azure/azure-sdk-for-go/sdk/azidentity's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azidentity/v1.14.0</h2>
<h2>1.14.0 (2026-06-15)</h2>
<h3>Breaking Changes</h3>
<blockquote>
<p>These changes affect only code written against a beta version such as
v1.14.0-beta.3</p>
</blockquote>
<ul>
<li>Removed
<code>WorkloadIdentityCredentialOptions.EnableAzureProxy</code>.
It will return in v1.15.0-beta.1</li>
</ul>
<h3>Bugs Fixed</h3>
<ul>
<li><code>AzureDeveloperCLICredential</code> improved reporting of error
messages returned from <code>azd</code></li>
</ul>
<h3>Other Changes</h3>
<ul>
<li>Returned <code>azidentity</code> errors include links to the
troubleshooting guide when appropriate</li>
<li>This module now requires a minimum Go version of 1.25</li>
<li>Upgraded dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0495c205a1https://redirect.github.com/Azure/azure-sdk-for-go/issues/23293 ">#23293</a>)</li>
<li><a
href="217edee7echttps://redirect.github.com/Azure/azure-sdk-for-go/issues/23292 ">#23292</a>)</li>
<li><a
href="023c88f9f1https://redirect.github.com/Azure/azure-sdk-for-go/issues/23290 ">#23290</a>)</li>
<li><a
href="17f3361700https://redirect.github.com/Azure/azure-sdk-for-go/issues/23271 ">#23271</a>)</li>
<li><a
href="f5f32342c2https://redirect.github.com/Azure/azure-sdk-for-go/issues/23288 ">#23288</a>)</li>
<li><a
href="d707091074https://redirect.github.com/Azure/azure-sdk-for-go/issues/23289 ">#23289</a>)</li>
<li><a
href="84d213cff1https://redirect.github.com/Azure/azure-sdk-for-go/issues/23 ">#23</a>...</li>
<li><a
href="ea67e9c718https://redirect.github.com/Azure/azure-sdk-for-go/issues/23270 ">#23270</a>)</li>
<li><a
href="40dad0a8cbhttps://redirect.github.com/Azure/azure-sdk-for-go/issues/23287 ">#23287</a>)</li>
<li><a
href="a368082ee3https://redirect.github.com/Azure/azure-sdk-for-go/issues/23286 ">#23286</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azidentity/v1.13.1...sdk/azcore/v1.14.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 02:42:30 -04:00
dependabot[bot]
227621f1d0
build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 ( #1334 )
...
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx ) from 5.9.2
to 5.10.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md ">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.10.0 (June 3, 2026)</h1>
<p>This release includes a significant amount of hardening against
malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds
binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds
<code>require_auth</code> to restrict which authentication
methods a server may use (mitigating downgrade attacks under
<code>sslmode=prefer</code>), and ensures cancellation requests are
sent over TLS when the original connection used TLS.</p>
<h2>Features</h2>
<ul>
<li>Add <code>require_auth</code> to restrict accepted server
authentication methods (Sean Chittenden at CrowdStrike, Inc.)</li>
<li>Add <code>ParseConfigOptions.ConnStringAllowedKeys</code> to
restrict allowed connection string keys (Sean Chittenden at CrowdStrike,
Inc.)</li>
<li>Add <code>StructArgs</code> and <code>StrictStructArgs</code> for
<code>@</code>-named queries (Tubelight30)</li>
<li>Add <code>ErrConnClosed</code> sentinel error and unwrap it from
<code>connLockError</code> (Charlie Tonneslan)</li>
<li>pgxpool: check if connection is expired before acquire
(arthurdotwork)</li>
</ul>
<h2>Security Hardening</h2>
<ul>
<li>Encrypt <code>CancelRequest</code> connection when the primary
connection used TLS (Sean Chittenden at CrowdStrike, Inc.)</li>
<li>Cap server-supplied SCRAM iteration count (Sean Chittenden at
CrowdStrike, Inc.)</li>
<li>Default Frontend max message body length to ~1 GiB (Sean Chittenden
at CrowdStrike, Inc.)</li>
<li>Bound hstore binary decode against malicious server input (Sean
Chittenden at CrowdStrike, Inc.)</li>
<li>Bound array binary decode element length against remaining message
bytes (Sean Chittenden at CrowdStrike, Inc.)</li>
<li>Bound array element count against remaining message bytes (Sean
Chittenden at CrowdStrike, Inc.)</li>
<li>Bound range, multirange, and tsvector binary decoders (Sean
Chittenden at CrowdStrike, Inc.)</li>
<li>Document secure connection configuration (Sean Chittenden at
CrowdStrike, Inc.)</li>
<li>Fix panic on malformed geometric text; return an error instead
(MaIII)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>Fix scanning <code>"char"</code> (OID 18) into
<code>*string</code> in binary format (luongs3)</li>
<li>Fix handling of typed-nil <code>driver.Valuer</code> in array and
composite codecs (Donncha Fahy)</li>
<li>Fix <code>CopyData.Data</code> hex decoding in
<code>UnmarshalJSON</code> (Charlie Tonneslan)</li>
<li>Fix data race when context is cancelled during connect</li>
<li>Fix <code>parseKeywordValueSettings</code> rejecting trailing
whitespace (alliasgher)</li>
<li>pgconn: preserve full error chain in
<code>normalizeTimeoutError</code> (Charlie Tonneslan)</li>
<li>pgconn: use a fresh context for the fallback connection in
<code>connectPreferred</code> (Charlie Tonneslan)</li>
<li>pgxpool: fix <code>MaxLifetimeDestroyCount</code> and ping order for
acquire-time expiry check</li>
<li>Add missing error check of <code>rows.Err</code> to load types (Jen
Altavilla)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7293fb11121ade285284b4d6d4d1be0639b37f8fb28e65b0c3cd1f389d37ff27b5bbeaa6002e12a844f61732ec1a976f7bb9https://github.com/jackc/pgx/compare/v5.9.2...v5.10.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-04 16:03:35 -04:00
dependabot[bot]
78bc7006b0
build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group ( #1332 )
...
Bumps the opentelemetry group with 1 update:
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib ).
Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.68.0 to 0.69.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases ">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>error.type</code> attribute to
<code>http.client.request.duration</code> for transport failures in
<code>otelhttp</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801 ">#8801</a>)</li>
<li>Add examples for prometheus compatibility document. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716 ">#8716</a>)</li>
<li>Add support for <code>cardinality_limits</code> in
<code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885 ">#8885</a>)</li>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913 ">#8913</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a
new resource detector for Hetzner Cloud servers, ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>host.id</code>, and <code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979 ">#8979</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Set error field as <code>record.SetErr</code> instead of a plain
attribute in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776 ">#8776</a>)</li>
<li>Set the "error" field (e.g. created via
<code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain
attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719 ">#8719</a>)</li>
<li>Set fields implementing <code>error</code> interface from
<code>slog</code> records as <code>record.SetErr</code> instead of plain
attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774 ">#8774</a>)</li>
<li>Set emitted errors in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record
errors (<code>Record.SetErr</code>) instead of
<code>exception.message</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775 ">#8775</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix header attributes lost when using sub-spans in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797 ">#8797</a>)</li>
<li>Validate <code>encoding</code> configuration for OTLP HTTP exporters
in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772 ">#8772</a>)</li>
<li>Remove the custom body wrapper from the request's body after the
request is processed to allow body type comparisons with the original
type in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914 ">#6914</a>)</li>
<li>Unknown or empty HTTP methods now report "_OTHER" instead
of "GET" across all HTTP instrumentations to align with
OpenTelemetry semantic conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868 ">#8868</a>)</li>
<li>The default span name formatter in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
now conforms to the OpenTelemetry HTTP semantic conventions for server
span names. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871 ">#8871</a>)
<ul>
<li>The default span name is now <code>{method} {route}</code> (e.g.
<code>GET /foo/{id}</code>) when a route pattern is available, or
<code>{method}</code> (e.g. <code>GET</code>) otherwise.</li>
</ul>
</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the deprecated <code>WithSpanOptions</code> option in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991 ">#8991</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>otelconf: validate encoding configuration for OTLP HTTP exporters by
<a href="https://github.com/sonalgaud12 "><code>@sonalgaud12</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8772 ">open-telemetry/opentelemetry-go-contrib#8772</a></li>
<li>fix(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to
v1.99.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8780 ">open-telemetry/opentelemetry-go-contrib#8780</a></li>
<li>chore(deps): update prom/prometheus docker tag to v3.11.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8779 ">open-telemetry/opentelemetry-go-contrib#8779</a></li>
<li>otellogrus: Set error field as <code>record.SetErr</code> by <a
href="https://github.com/sonalgaud12 "><code>@sonalgaud12</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8778 ">open-telemetry/opentelemetry-go-contrib#8778</a></li>
<li>chore(deps): update module golang.org/x/sys to v0.43.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8783 ">open-telemetry/opentelemetry-go-contrib#8783</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to 93c7c8a by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8786 ">open-telemetry/opentelemetry-go-contrib#8786</a></li>
<li>chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8787 ">open-telemetry/opentelemetry-go-contrib#8787</a></li>
<li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.23
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8788 ">open-telemetry/opentelemetry-go-contrib#8788</a></li>
<li>chore(deps): update golang.org/x by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8791 ">open-telemetry/opentelemetry-go-contrib#8791</a></li>
<li>chore(deps): update actions/github-script action to v9 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8795 ">open-telemetry/opentelemetry-go-contrib#8795</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8794 ">open-telemetry/opentelemetry-go-contrib#8794</a></li>
<li>otelzap: set error field as record.SetErr by <a
href="https://github.com/iblancasa "><code>@iblancasa</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8719 ">open-telemetry/opentelemetry-go-contrib#8719</a></li>
<li>fix(deps): update golang.org/x to 746e56f by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8796 ">open-telemetry/opentelemetry-go-contrib#8796</a></li>
<li>chore(deps): update module golang.org/x/arch to v0.26.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8798 ">open-telemetry/opentelemetry-go-contrib#8798</a></li>
<li>Check if otelgrpc metrics are enabled by <a
href="https://github.com/dashpole "><code>@dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8792 ">open-telemetry/opentelemetry-go-contrib#8792</a></li>
<li>chore(deps): update actions/upload-artifact action to v7.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8800 ">open-telemetry/opentelemetry-go-contrib#8800</a></li>
<li>Check instrument enabled in deprecatedruntime by <a
href="https://github.com/dashpole "><code>@dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8793 ">open-telemetry/opentelemetry-go-contrib#8793</a></li>
<li>chore(deps): update module github.com/ashanbrown/forbidigo/v2 to
v2.3.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8804 ">open-telemetry/opentelemetry-go-contrib#8804</a></li>
<li>chore(deps): update module github.com/ashanbrown/makezero/v2 to
v2.2.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8802 ">open-telemetry/opentelemetry-go-contrib#8802</a></li>
<li>chore(deps): update module github.com/manuelarte/funcorder to v0.6.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8803 ">open-telemetry/opentelemetry-go-contrib#8803</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md ">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] -
2026-05-28</h2>
<h3>Added</h3>
<ul>
<li>Add <code>error.type</code> attribute to
<code>http.client.request.duration</code> for transport failures in
<code>otelhttp</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801 ">#8801</a>)</li>
<li>Add examples for prometheus compatibility document. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716 ">#8716</a>)</li>
<li>Add support for <code>cardinality_limits</code> in
<code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885 ">#8885</a>)</li>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913 ">#8913</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a
new resource detector for Hetzner Cloud servers, ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>host.id</code>, and <code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979 ">#8979</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Set error field as <code>record.SetErr</code> instead of a plain
attribute in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776 ">#8776</a>)</li>
<li>Set the "error" field (e.g. created via
<code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain
attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719 ">#8719</a>)</li>
<li>Set fields implementing <code>error</code> interface from
<code>slog</code> records as <code>record.SetErr</code> instead of plain
attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774 ">#8774</a>)</li>
<li>Set emitted errors in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record
errors (<code>Record.SetErr</code>) instead of
<code>exception.message</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775 ">#8775</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix header attributes lost when using sub-spans in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797 ">#8797</a>)</li>
<li>Validate <code>encoding</code> configuration for OTLP HTTP exporters
in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772 ">#8772</a>)</li>
<li>Remove the custom body wrapper from the request's body after the
request is processed to allow body type comparisons with the original
type in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914 ">#6914</a>)</li>
<li>Unknown or empty HTTP methods now report "_OTHER" instead
of "GET" across all HTTP instrumentations to align with
OpenTelemetry semantic conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868 ">#8868</a>)</li>
<li>The default span name formatter in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
now conforms to the OpenTelemetry HTTP semantic conventions for server
span names. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871 ">#8871</a>)
<ul>
<li>The default span name is now <code>{method} {route}</code> (e.g.
<code>GET /foo/{id}</code>) when a route pattern is available, or
<code>{method}</code> (e.g. <code>GET</code>) otherwise.</li>
</ul>
</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the deprecated <code>WithSpanOptions</code> option in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991 ">#8991</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="03b2bcdb54https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9033 ">#9033</a>)</li>
<li><a
href="80c46d4037https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9034 ">#9034</a>)</li>
<li><a
href="51f292197dhttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9026 ">#9026</a>)</li>
<li><a
href="db82162f1bhttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9031 ">#9031</a>)</li>
<li><a
href="5a3e533d8chttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9032 ">#9032</a>)</li>
<li><a
href="c67843c753https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914 ">#6914</a>)</li>
<li><a
href="c0a4135228https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8785 ">#8785</a>)</li>
<li><a
href="a51a86790ehttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885 ">#8885</a>)</li>
<li><a
href="dead6e50fchttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8994 ">#8994</a>)</li>
<li><a
href="979ce18575https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9030 ">#9030</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-04 16:02:25 -04:00
dependabot[bot]
5d91ce7c2e
build(deps): bump the opentelemetry group with 5 updates ( #1311 )
2026-05-31 03:23:00 -04:00
dependabot[bot]
3a8e5428db
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 ( #1312 )
2026-05-31 03:22:40 -04:00
Radoslav Dimitrov
66cc039fac
build(deps): bump golang.org/x/net to v0.55.0 ( #1308 )
...
## Summary
- Bumps `golang.org/x/net` from v0.53.0 to v0.55.0 to fix
[GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026 ) (failure to reject
ASCII-only Punycode-encoded labels in `golang.org/x/net/idna`).
- govulncheck flagged the vuln via `auth.DefaultHTTPKeyFetcher.FetchKey`
→ `http.Client.Do` → `idna.ToASCII` at
`internal/api/handlers/v0/auth/http.go:191`.
- Also brings in associated `x/crypto`, `x/sys`, `x/text` bumps via `go
mod tidy`.
This unblocks open dependabot PRs (e.g. #1298 ) that are failing CI on
the same govulncheck finding despite not touching the root module.
## Test plan
- [x] `go build ./...`
- [x] `govulncheck` no longer reports GO-2026-5026 locally
- [ ] CI passes
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-25 07:02:10 -04:00
dependabot[bot]
3a8d268a87
build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 ( #1296 )
...
Bumps
[github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma )
from 2.37.3 to 2.38.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/danielgtaylor/huma/releases ">github.com/danielgtaylor/huma/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.38.0</h2>
<h2>Overview</h2>
<h3>Fiber v3</h3>
<p>This release adds support for Fiber v3. Dedicated v2 functions have
been added to ensure support for both.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix header regression by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1007 ">danielgtaylor/huma#1007</a></li>
<li>feat(humafiber): add Fiber v3 support by <a
href="https://github.com/wheinze "><code>@wheinze</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/962 ">danielgtaylor/huma#962</a></li>
<li>Accept empty base64 inputs by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1013 ">danielgtaylor/huma#1013</a></li>
<li>chore(deps): bump github.com/gofiber/fiber/v3 from 3.1.0 to 3.2.0 by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1018 ">danielgtaylor/huma#1018</a></li>
<li>Propagate underlying context to GET/PUT requests in the autopatch
handler by <a
href="https://github.com/alixinne "><code>@alixinne</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1019 ">danielgtaylor/huma#1019</a></li>
<li>chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.12 to
2.52.13 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1022 ">danielgtaylor/huma#1022</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/wheinze "><code>@wheinze</code></a> made
their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/962 ">danielgtaylor/huma#962</a></li>
<li><a href="https://github.com/alixinne "><code>@alixinne</code></a>
made their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/1019 ">danielgtaylor/huma#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.3...v2.38.0 ">https://github.com/danielgtaylor/huma/compare/v2.37.3...v2.38.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c3f1651842https://redirect.github.com/danielgtaylor/huma/issues/1022 ">#1022</a>)</li>
<li><a
href="0dc6f40339https://redirect.github.com/danielgtaylor/huma/issues/1 ">#1</a>...</li>
<li><a
href="ce91c48843https://redirect.github.com/danielgtaylor/huma/issues/1018 ">#1018</a>)</li>
<li><a
href="8fb47ee68ahttps://redirect.github.com/danielgtaylor/huma/issues/1013 ">#1013</a>)</li>
<li><a
href="e2db596bb5https://redirect.github.com/danielgtaylor/huma/issues/962 ">#962</a>)</li>
<li><a
href="b2d8a3a98ahttps://redirect.github.com/danielgtaylor/huma/issues/1007 ">#1007</a>)</li>
<li>See full diff in <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.3...v2.38.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-25 06:42:29 -04:00
dependabot[bot]
b90f63f52c
build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 ( #1295 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.5 to 0.21.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: update dependencies to use new azure sdk components by <a
href="https://github.com/gaganhr94 "><code>@gaganhr94</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2262 ">google/go-containerregistry#2262</a></li>
<li>transport: restore resp.Body in retryError so CheckError can parse
it by <a
href="https://github.com/alliasgher "><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2264 ">google/go-containerregistry#2264</a></li>
<li>pkg/registry: return 202 Accepted for PATCH chunk uploads by <a
href="https://github.com/alliasgher "><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2265 ">google/go-containerregistry#2265</a></li>
<li>Follow OCI distribution spec for artifactType and annotations by <a
href="https://github.com/malt3 "><code>@malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2269 ">google/go-containerregistry#2269</a></li>
<li>actions: attach Codecov token to coverage tests on main by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2270 ">google/go-containerregistry#2270</a></li>
<li>remote: use DeleteScope (with "delete" action) for
manifest deletion by <a
href="https://github.com/alliasgher "><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2266 ">google/go-containerregistry#2266</a></li>
<li>remote: limit concurrent layer pulls by <a
href="https://github.com/gnix0 "><code>@gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2271 ">google/go-containerregistry#2271</a></li>
<li>pkg/registry: reject corrupt disk blobs by <a
href="https://github.com/gnix0 "><code>@gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2272 ">google/go-containerregistry#2272</a></li>
<li>mutate: close layer readers during export by <a
href="https://github.com/gnix0 "><code>@gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2277 ">google/go-containerregistry#2277</a></li>
<li>crane/flatten: preserve image media type when flattening by <a
href="https://github.com/alliasgher "><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2267 ">google/go-containerregistry#2267</a></li>
<li>build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1
in the actions group across 1 directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2273 ">google/go-containerregistry#2273</a></li>
<li>build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2278 ">google/go-containerregistry#2278</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 6
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2280 ">google/go-containerregistry#2280</a></li>
<li>Replace go-homedir with os.UserHomeDir by <a
href="https://github.com/jammie-jelly "><code>@jammie-jelly</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2282 ">google/go-containerregistry#2282</a></li>
<li>pkg/name: only treat .localhost as non-HTTPS, not .local by <a
href="https://github.com/blackwell-systems "><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2281 ">google/go-containerregistry#2281</a></li>
<li>transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL
by <a href="https://github.com/marwan9696 "><code>@marwan9696</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2285 ">google/go-containerregistry#2285</a></li>
<li>test(mutate): add Extract round-trip test for filesystem object
preservation by <a
href="https://github.com/blackwell-systems "><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2283 ">google/go-containerregistry#2283</a></li>
<li>experiments: remove deprecated support for estargz by <a
href="https://github.com/thaJeztah "><code>@thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2288 ">google/go-containerregistry#2288</a></li>
<li>build(deps): bump aws-actions/configure-aws-credentials from 6.1.0
to 6.1.1 in the actions group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2289 ">google/go-containerregistry#2289</a></li>
<li>fix: limit HTTP response body reads to prevent OOM by <a
href="https://github.com/evilgensec "><code>@evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2296 ">google/go-containerregistry#2296</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 6
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2297 ">google/go-containerregistry#2297</a></li>
<li>transport: block redirects from token server to private/link-local
addresses (SSRF fix) by <a
href="https://github.com/evilgensec "><code>@evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2292 ">google/go-containerregistry#2292</a></li>
<li>pkg/v1/mutate: preserve relative symlinks that stay within rootfs in
Extract by <a
href="https://github.com/anishesg "><code>@anishesg</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2279 ">google/go-containerregistry#2279</a></li>
<li>validate: skip non-layer layers by <a
href="https://github.com/imjasonh "><code>@imjasonh</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2298 ">google/go-containerregistry#2298</a></li>
<li>remote: validate foreign layer URLs to prevent SSRF (fixes <a
href="https://redirect.github.com/google/go-containerregistry/issues/2259 ">#2259</a>)
by <a href="https://github.com/evilgensec "><code>@evilgensec</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2293 ">google/go-containerregistry#2293</a></li>
<li>remote: block SSRF via private-IP Location headers in blob uploads
by <a
href="https://github.com/adilburaksen "><code>@adilburaksen</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2295 ">google/go-containerregistry#2295</a></li>
<li>fix(mutate): preserve config blob and layers for non-Docker OCI
artifacts by <a
href="https://github.com/blackwell-systems "><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2286 ">google/go-containerregistry#2286</a></li>
<li>fix: preserve per-occurrence layer identity in mutate.Image.Layers()
by <a href="https://github.com/iahsanGill "><code>@iahsanGill</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2299 ">google/go-containerregistry#2299</a></li>
<li>transport: retry HTTP 429 (Too Many Requests) by <a
href="https://github.com/iahsanGill "><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2301 ">google/go-containerregistry#2301</a></li>
<li>transport: allow bearer realm at same host:port as registry by <a
href="https://github.com/iahsanGill "><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2302 ">google/go-containerregistry#2302</a></li>
<li>Update go version to 1.26.3 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2300 ">google/go-containerregistry#2300</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gaganhr94 "><code>@gaganhr94</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2262 ">google/go-containerregistry#2262</a></li>
<li><a
href="https://github.com/alliasgher "><code>@alliasgher</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2264 ">google/go-containerregistry#2264</a></li>
<li><a href="https://github.com/malt3 "><code>@malt3</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2269 ">google/go-containerregistry#2269</a></li>
<li><a href="https://github.com/gnix0 "><code>@gnix0</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2271 ">google/go-containerregistry#2271</a></li>
<li><a
href="https://github.com/blackwell-systems "><code>@blackwell-systems</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2281 ">google/go-containerregistry#2281</a></li>
<li><a
href="https://github.com/marwan9696 "><code>@marwan9696</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2285 ">google/go-containerregistry#2285</a></li>
<li><a href="https://github.com/anishesg "><code>@anishesg</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2279 ">google/go-containerregistry#2279</a></li>
<li><a
href="https://github.com/adilburaksen "><code>@adilburaksen</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2295 ">google/go-containerregistry#2295</a></li>
<li><a
href="https://github.com/iahsanGill "><code>@iahsanGill</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2299 ">google/go-containerregistry#2299</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6 ">https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="53f7e39e15https://redirect.github.com/google/go-containerregistry/issues/2300 ">#2300</a>)</li>
<li><a
href="bf87c3bfe4https://redirect.github.com/google/go-containerregistry/issues/2302 ">#2302</a>)</li>
<li><a
href="c55facddfbhttps://redirect.github.com/google/go-containerregistry/issues/2301 ">#2301</a>)</li>
<li><a
href="68a569e4a0https://redirect.github.com/google/go-containerregistry/issues/2299 ">#2299</a>)</li>
<li><a
href="35b354b436https://redirect.github.com/google/go-containerregistry/issues/2 ">#2</a>...</li>
<li><a
href="e5983f2a67https://redirect.github.com/google/go-containerregistry/issues/2295 ">#2295</a>)</li>
<li><a
href="6dad820da7https://redirect.github.com/google/go-containerregistry/issues/2259 ">#2259</a>)
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2293 ">#2293</a>)</li>
<li><a
href="78bdf1b7e2https://redirect.github.com/google/go-containerregistry/issues/2298 ">#2298</a>)</li>
<li><a
href="c29d91cdc3a70d75a691https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-25 06:42:13 -04:00
dependabot[bot]
1d36806960
build(deps): bump golang.org/x/mod from 0.35.0 to 0.36.0 ( #1271 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.35.0 to
0.36.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="643da9ba74ccc3cdf529ab30318032https://github.com/golang/mod/compare/v0.35.0...v0.36.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-11 05:10:51 -04:00
dependabot[bot]
d93f8f78a0
build(deps): bump cloud.google.com/go/kms from 1.30.0 to 1.31.0 ( #1263 )
...
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go )
from 1.30.0 to 1.31.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases ">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>kms: v1.31.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.30.0...kms/v1.31.0 ">v1.31.0</a>
(2026-05-07)</h2>
<h2>retail: v1.31.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/retail/v1.30.0...retail/v1.31.0 ">v1.31.0</a>
(2026-05-07)</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md ">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.5...documentai/v1.31.0 ">1.31.0</a>
(2024-08-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> A new field <code>imageless_mode</code>
is added to message
<code>.google.cloud.documentai.v1.ProcessRequest</code> (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/10615 ">#10615</a>)
(<a
href="97fa56008a97fa56008ahttps://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.4...documentai/v1.30.5 ">1.30.5</a>
(2024-07-24)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Update dependencies (<a
href="257c40bd6dhttps://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.3...documentai/v1.30.4 ">1.30.4</a>
(2024-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Bump google.golang.org/grpc@v1.64.1 (<a
href="8ecc4e9622https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.2...documentai/v1.30.3 ">1.30.3</a>
(2024-07-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Bump google.golang.org/api@v0.187.0 (<a
href="8fa9e398e5https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.1...documentai/v1.30.2 ">1.30.2</a>
(2024-06-26)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Enable new auth lib (<a
href="b95805f4c8https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.0...documentai/v1.30.1 ">1.30.1</a>
(2024-06-20)</h2>
<h3>Documentation</h3>
<ul>
<li><strong>documentai:</strong> Update the comment to add a note about
<code>documentai.processors.create</code> permission (<a
href="4fa43082519a44b31c75https://redirect.github.com/googleapis/google-cloud-go/issues/14406 ">#14406</a>)</li>
<li><a
href="18a3318e01db45f2d9b6https://redirect.github.com/googleapis/google-cloud-go/issues/14319 ">#14319</a>)</li>
<li><a
href="124ffd3b68e247d48b88https://redirect.github.com/googleapis/google-cloud-go/issues/14393 ">#14393</a>)</li>
<li><a
href="ece84abc19https://redirect.github.com/googleapis/google-cloud-go/issues/14392 ">#14392</a>)</li>
<li><a
href="ecf9783b6ehttps://redirect.github.com/googleapis/google-cloud-go/issues/14390 ">#14390</a>)</li>
<li><a
href="70b47d20b8https://redirect.github.com/googleapis/google-cloud-go/issues/14389 ">#14389</a>)</li>
<li><a
href="95c53a6540https://redirect.github.com/googleapis/google-cloud-go/issues/14333 ">#14333</a>)</li>
<li><a
href="df22e9e38ehttps://redirect.github.com/googleapis/google-cloud-go/issues/14385 ">#14385</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.30.0...dlp/v1.31.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-05-08 07:56:59 -04:00
Radoslav Dimitrov
f5fe2e97f6
build(deps): bump golang.org/x/net from v0.52.0 to v0.53.0 ( #1269 )
...
## Summary
Bumps `golang.org/x/net` from `v0.52.0` to `v0.53.0` to address
`GO-2026-4918` (HTTP/2 transport infinite loop on bad
`SETTINGS_MAX_FRAME_SIZE`). `go mod tidy` also pulls
`golang.org/x/crypto` to v0.50.0 and `golang.org/x/text` to v0.36.0.
## Why now
`govulncheck` is failing on `main` and every open Dependabot PR (#1263 ,
#1264 , #1265 ) after the 2026-05 Go security release. The findings split
into:
- **One we control** — `golang.org/x/net@v0.52.0` → fixed in `v0.53.0`.
Addressed here.
- **Six stdlib findings** (`GO-2026-4986`, `4982`, `4980`, `4977`,
`4971`, and the stdlib half of `4918`) — all fixed in `go1.26.3`. We
deliberately do **not** pin a Go patch in the workflow: `go-version:
'stable'` will pick up `1.26.3` automatically once the
`actions/go-versions` manifest catches up, with no workflow maintenance.
## Test plan
- [x] `go build ./...`
- [x] `go vet ./...`
- [x] `GOTOOLCHAIN=go1.26.3 govulncheck ./...` → "No vulnerabilities
found."
🤖 Generated with [Claude Code](https://claude.com/claude-code )
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-08 07:33:10 -04:00
dependabot[bot]
648da259b0
build(deps): bump github.com/caarlos0/env/v11 from 11.4.0 to 11.4.1 ( #1236 )
...
Bumps [github.com/caarlos0/env/v11](https://github.com/caarlos0/env )
from 11.4.0 to 11.4.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/caarlos0/env/releases ">github.com/caarlos0/env/v11's
releases</a>.</em></p>
<blockquote>
<h2>v11.4.1</h2>
<h2>Changelog</h2>
<h3>Bug fixes</h3>
<ul>
<li>6daeb06ac7e3c9532a7eaa5768d45917393b7480: fix: use Key instead of
OwnKey in rawEnvVars to properly reference existing defaults in complex
structs (<a
href="https://redirect.github.com/caarlos0/env/issues/412 ">#412</a>) (<a
href="https://github.com/AndrewChubatiuk "><code>@AndrewChubatiuk</code></a>)</li>
</ul>
<h3>Documentation updates</h3>
<ul>
<li>1ff55e6c9733833ce75d62b345916a407dbe4158: docs: adaptive starchart
(<a href="https://redirect.github.com/caarlos0/env/issues/416 ">#416</a>)
(<a
href="https://github.com/alexandear "><code>@alexandear</code></a>)</li>
</ul>
<h3>Other work</h3>
<ul>
<li>cf4a9682420b025e44b4773fd7ee0be48bb68b2f: ci(deps): bump the actions
group with 3 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/411 ">#411</a>) (<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot])</li>
<li>33faf6f333c2c3dacef2991825f8e03960a2c0cb: ci(deps): bump the actions
group with 3 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/417 ">#417</a>) (<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot])</li>
<li>0cb635b62488f4d310809a82a8832cedc9aa94eb: ci(deps): bump the actions
group with 6 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/415 ">#415</a>) (<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot])</li>
<li>a72d89a8930fc800372a6a338a1acf33e5cc3a56: ci: update release config
(<a href="https://github.com/caarlos0 "><code>@caarlos0</code></a>)</li>
</ul>
<hr />
<p><em>Released with <a href="https://goreleaser.com/pro ">GoReleaser
Pro</a>!</em></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a72d89a8936daeb06ac733faf6f333https://redirect.github.com/caarlos0/env/issues/417 ">#417</a>)</li>
<li><a
href="1ff55e6c97https://redirect.github.com/caarlos0/env/issues/416 ">#416</a>)</li>
<li><a
href="0cb635b624https://redirect.github.com/caarlos0/env/issues/415 ">#415</a>)</li>
<li><a
href="cf4a968242https://redirect.github.com/caarlos0/env/issues/411 ">#411</a>)</li>
<li>See full diff in <a
href="https://github.com/caarlos0/env/compare/v11.4.0...v11.4.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-04 06:12:19 -04:00
dependabot[bot]
46bbe0dba3
build(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 ( #1233 )
...
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go )
from 1.29.0 to 1.30.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases ">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>kms: v1.30.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.29.0...kms/v1.30.0 ">v1.30.0</a>
(2026-04-30)</h2>
<h2>retail: v1.30.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/retail/v1.29.0...retail/v1.30.0 ">v1.30.0</a>
(2026-04-30)</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md ">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.29.0...documentai/v1.30.0 ">1.30.0</a>
(2024-06-05)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Make Layout Parser generally available
in V1 (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/10286 ">#10286</a>)
(<a
href="92dc381da254d941a9a3https://redirect.github.com/googleapis/google-cloud-go/issues/14330 ">#14330</a>)</li>
<li><a
href="22d0749f8fhttps://redirect.github.com/googleapis/google-cloud-go/issues/14328 ">#14328</a>)</li>
<li><a
href="751febd843https://redirect.github.com/googleapis/google-cloud-go/issues/14193 ">#14193</a>)</li>
<li><a
href="a70f04f178https://redirect.github.com/googleapis/google-cloud-go/issues/14327 ">#14327</a>)</li>
<li><a
href="9e2b3f5700https://redirect.github.com/googleapis/google-cloud-go/issues/14325 ">#14325</a>)</li>
<li><a
href="e0760b51f4https://redirect.github.com/googleapis/google-cloud-go/issues/14289 ">#14289</a>)</li>
<li><a
href="71df27f882https://redirect.github.com/googleapis/google-cloud-go/issues/14317 ">#14317</a>)</li>
<li><a
href="a6efdbfd6chttps://redirect.github.com/googleapis/google-cloud-go/issues/14323 ">#14323</a>)</li>
<li><a
href="22cda56eddhttps://redirect.github.com/googleapis/google-cloud-go/issues/14315 ">#14315</a>)</li>
<li><a
href="1720392adehttps://redirect.github.com/googleapis/google-cloud-go/issues/14231 ">#14231</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.29.0...dlp/v1.30.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-01 03:19:24 -04:00
dependabot[bot]
cc48844ebc
build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 ( #1188 )
...
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx ) from 5.9.1
to 5.9.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md ">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.9.2 (April 18, 2026)</h1>
<p>Fix SQL Injection via placeholder confusion with dollar quoted string
literals (GHSA-j88v-2chj-qfwx)</p>
<p>SQL injection can occur when:</p>
<ol>
<li>The non-default simple protocol is used.</li>
<li>A dollar quoted string literal is used in the SQL query.</li>
<li>That query contains text that would be would be interpreted outside
as a placeholder outside of a string literal.</li>
<li>The value of that placeholder is controllable by the attacker.</li>
</ol>
<p>e.g.</p>
<pre lang="go"><code>attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`,
pgx.QueryExecModeSimpleProtocol, attackValue)
</code></pre>
<p>This is unlikely to occur outside of a contrived scenario.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0aeabbcf1160644f8491a5680bc945https://redirect.github.com/jackc/pgx/issues/2531 ">#2531</a> from
dolmen-go/godoc-add-links</li>
<li><a
href="e34e45240008c9bb1f0d96b4dbdfd0acf88e0065https://redirect.github.com/jackc/pgx/issues/2526 ">#2526</a> from
abrightwell/abrightwell-min-proto</li>
<li><a
href="2f81f1fc03https://github.com/jackc/pgx/compare/v5.9.1...v5.9.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-21 05:02:43 -04:00
dependabot[bot]
0c5dde243b
build(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 ( #1162 )
2026-04-14 05:19:36 -04:00
dependabot[bot]
1e83267610
build(deps): bump cloud.google.com/go/kms from 1.27.0 to 1.29.0 ( #1163 )
2026-04-14 05:19:09 -04:00
dependabot[bot]
07fa85f68b
build(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 ( #1140 )
...
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc )
from 3.17.0 to 3.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases ">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>.github: configure dependabot by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/477 ">coreos/go-oidc#477</a></li>
<li>.github: update go versions in CI by <a
href="https://github.com/ericchiang "><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/480 ">coreos/go-oidc#480</a></li>
<li>build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/coreos/go-oidc/pull/478 ">coreos/go-oidc#478</a></li>
<li>build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/coreos/go-oidc/pull/479 ">coreos/go-oidc#479</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0 ">https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da6b3bfca87f806942157271de57583ccf20fdc4https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-04-09 18:16:23 -04:00
dependabot[bot]
607d52ff20
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 ( #1114 )
...
Bumps
[github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose ) from
4.1.3 to 4.1.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-jose/go-jose/releases ">github.com/go-jose/go-jose/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.4</h2>
<h2>What's Changed</h2>
<p>Fixes Panic in JWE decryption. See <a
href="https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8 ">https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8 </a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4 ">https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0e59876635ddffdbcec8https://redirect.github.com/go-jose/go-jose/issues/213 ">#213</a>)</li>
<li>See full diff in <a
href="https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-04-09 14:20:12 -04:00
dependabot[bot]
5f81cf3336
build(deps): bump cloud.google.com/go/kms from 1.26.0 to 1.27.0 ( #1111 )
...
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go )
from 1.26.0 to 1.27.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases ">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>kms: v1.27.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.26.0...kms/v1.27.0 ">v1.27.0</a>
(2026-04-02)</h2>
<h2>retail: v1.27.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/retail/v1.26.0...retail/v1.27.0 ">v1.27.0</a>
(2026-04-02)</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md ">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.26.1...documentai/v1.27.0 ">1.27.0</a>
(2024-04-15)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Support a new Layout Processor in
Document AI (<a
href="2cdc40a0b4https://github.com/googleapis/google-cloud-go/compare/documentai/v1.26.0...documentai/v1.26.1 ">1.26.1</a>
(2024-03-14)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Update protobuf dep to v1.33.0 (<a
href="30b038d8ca25c3f2dfcfb64e8dcf0ahttps://redirect.github.com/googleapis/google-cloud-go/issues/13116 ">#13116</a>)</li>
<li><a
href="ddc086c9e3c79db96ce2https://redirect.github.com/googleapis/google-cloud-go/issues/13101 ">#13101</a>)</li>
<li><a
href="b041315902https://redirect.github.com/googleapis/google-cloud-go/issues/13112 ">#13112</a>)</li>
<li><a
href="a75de408e8https://redirect.github.com/googleapis/google-cloud-go/issues/13110 ">#13110</a>)</li>
<li><a
href="3cf5269fachttps://redirect.github.com/googleapis/google-cloud-go/issues/13109 ">#13109</a>)</li>
<li><a
href="7663fdce36https://redirect.github.com/googleapis/google-cloud-go/issues/13 ">#13</a>...</li>
<li><a
href="8ebb89625chttps://redirect.github.com/googleapis/google-cloud-go/issues/13107 ">#13107</a>)</li>
<li><a
href="befb302203https://redirect.github.com/googleapis/google-cloud-go/issues/13 ">#13</a>...</li>
<li><a
href="1930511848https://redirect.github.com/googleapis/google-cloud-go/issues/13089 ">#13089</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.26.0...dlp/v1.27.0 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-04-09 14:19:50 -04:00
dependabot[bot]
53af38ee38
build(deps): bump the opentelemetry group across 1 directory with 6 updates ( #1134 )
...
Bumps the opentelemetry group with 2 updates in the / directory:
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib )
and
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go ).
Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.67.0 to 0.68.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases ">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>v1.43.0 / v2.5.0 / v0.68.0 / v0.37.0 / v0.23.0 / v0.18.0 / v0.16.0 /
v0.15.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8660 ">#8660</a>)</li>
<li>Add support to set the configuration file via
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639 ">#8639</a>)</li>
<li>Add support for <code>service</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8674 ">#8674</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in tracer provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8687 ">#8687</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in logger provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8686 ">#8686</a>)</li>
<li>Add support for <code>server.address</code> and
<code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723 ">#8723</a>)</li>
<li>Add support for <code>OTEL_SEMCONV_STABILITY_OPT_IN</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
Supported values are <code>rpc</code> (default), <code>rpc/dup</code>
and <code>rpc/old</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8726 ">#8726</a>)</li>
<li>Add the <code>http.route</code> metric attribute to
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8632 ">#8632</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Prepend <code>_</code> to the normalized environment variable name
when the key starts with a digit in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, ensuring
POSIX compliance. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8678 ">#8678</a>)</li>
<li>Move experimental types from
<code>go.opentelemetry.io/contrib/otelconf</code> to
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529 ">#8529</a>)</li>
<li>Normalize cached environment variable names in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, aligning
<code>Carrier.Keys</code> output with the carrier's normalized key
format. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761 ">#8761</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Fix <code>go.opentelemetry.io/contrib/otelconf</code> Prometheus
reader converting OTel dot-style label names (e.g.
<code>service.name</code>) to underscore-style
(<code>service_name</code>) in <code>target_info</code> when both
<code>without_type_suffix</code> and <code>without_units</code> are set.
Use <code>NoTranslation</code> instead of
<code>UnderscoreEscapingWithoutSuffixes</code> to preserve dot-style
label names while still suppressing metric name suffixes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763 ">#8763</a>)</li>
<li>Limit the request body size at 1MB in
<code>go.opentelemetry.io/contrib/zpages</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8656 ">#8656</a>)</li>
<li>Fix server spans using the client's address and port for
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723 ">#8723</a>)</li>
</ul>
<h2>Removed</h2>
<ul>
<li>Host ID resource detector has been removed when configuring the
<code>host</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8581 ">#8581</a>)</li>
</ul>
<h2>Deprecated</h2>
<ul>
<li>Deprecate <code>OTEL_EXPERIMENTAL_CONFIG_FILE</code> in favour of
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639 ">#8639</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update module github.com/jgautheron/goconst to v1.9.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8651 ">open-telemetry/opentelemetry-go-contrib#8651</a></li>
<li>chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8652 ">open-telemetry/opentelemetry-go-contrib#8652</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to e526e8a by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8647 ">open-telemetry/opentelemetry-go-contrib#8647</a></li>
<li>chore(deps): update module k8s.io/klog/v2 to v2.140.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8650 ">open-telemetry/opentelemetry-go-contrib#8650</a></li>
<li>chore(deps): update module github.com/mgechev/revive to v1.14.0 by
<a href="https://github.com/mmorel-35 "><code>@mmorel-35</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8646 ">open-telemetry/opentelemetry-go-contrib#8646</a></li>
<li>chore(deps): update module github.com/mgechev/revive to v1.15.0 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8539 ">open-telemetry/opentelemetry-go-contrib#8539</a></li>
<li>chore: fix noctx issues by <a
href="https://github.com/mmorel-35 "><code>@mmorel-35</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8645 ">open-telemetry/opentelemetry-go-contrib#8645</a></li>
<li>chore(deps): update golang.org/x by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8655 ">open-telemetry/opentelemetry-go-contrib#8655</a></li>
<li>chore(deps): update module codeberg.org/chavacava/garif to v0.2.1 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8654 ">open-telemetry/opentelemetry-go-contrib#8654</a></li>
<li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.21
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8653 ">open-telemetry/opentelemetry-go-contrib#8653</a></li>
<li>fix(deps): update module go.opentelemetry.io/proto/otlp to v1.10.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8657 ">open-telemetry/opentelemetry-go-contrib#8657</a></li>
<li>Limit the number of bytes read from the zpages body by <a
href="https://github.com/dmathieu "><code>@dmathieu</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8656 ">open-telemetry/opentelemetry-go-contrib#8656</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8648 ">open-telemetry/opentelemetry-go-contrib#8648</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8661 ">open-telemetry/opentelemetry-go-contrib#8661</a></li>
<li>chore(deps): update github.com/securego/gosec/v2 digest to 8895462
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8663 ">open-telemetry/opentelemetry-go-contrib#8663</a></li>
<li>otelconf: support OTEL_CONFIG_FILE as it is no longer experimental
by <a href="https://github.com/codeboten "><code>@codeboten</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8639 ">open-telemetry/opentelemetry-go-contrib#8639</a></li>
<li>chore(deps): update module github.com/sonatard/noctx to v0.5.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8664 ">open-telemetry/opentelemetry-go-contrib#8664</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md ">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/2.5.0/0.68.0/0.37.0/0.23.0/0.18.0/0.16.0/0.15.0] -
2026-04-03</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8660 ">#8660</a>)</li>
<li>Add support to set the configuration file via
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639 ">#8639</a>)</li>
<li>Add support for <code>service</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8674 ">#8674</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in tracer provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8687 ">#8687</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in logger provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8686 ">#8686</a>)</li>
<li>Add support for <code>server.address</code> and
<code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723 ">#8723</a>)</li>
<li>Add support for <code>OTEL_SEMCONV_STABILITY_OPT_IN</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
Supported values are <code>rpc</code> (default), <code>rpc/dup</code>
and <code>rpc/old</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8726 ">#8726</a>)</li>
<li>Add the <code>http.route</code> metric attribute to
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8632 ">#8632</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Prepend <code>_</code> to the normalized environment variable name
when the key starts with a digit in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, ensuring
POSIX compliance. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8678 ">#8678</a>)</li>
<li>Move experimental types from
<code>go.opentelemetry.io/contrib/otelconf</code> to
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529 ">#8529</a>)</li>
<li>Normalize cached environment variable names in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, aligning
<code>Carrier.Keys</code> output with the carrier's normalized key
format. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761 ">#8761</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix <code>go.opentelemetry.io/contrib/otelconf</code> Prometheus
reader converting OTel dot-style label names (e.g.
<code>service.name</code>) to underscore-style
(<code>service_name</code>) in <code>target_info</code> when both
<code>without_type_suffix</code> and <code>without_units</code> are set.
Use <code>NoTranslation</code> instead of
<code>UnderscoreEscapingWithoutSuffixes</code> to preserve dot-style
label names while still suppressing metric name suffixes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763 ">#8763</a>)</li>
<li>Limit the request body size at 1MB in
<code>go.opentelemetry.io/contrib/zpages</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8656 ">#8656</a>)</li>
<li>Fix server spans using the client's address and port for
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723 ">#8723</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Host ID resource detector has been removed when configuring the
<code>host</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8581 ">#8581</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>OTEL_EXPERIMENTAL_CONFIG_FILE</code> in favour of
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639 ">#8639</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="45977a4b9chttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8769 ">#8769</a>)</li>
<li><a
href="0fcc1524d1eaba3cdaa1https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776 ">#8776</a>)</li>
<li><a
href="6df430c480https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8771 ">#8771</a>)</li>
<li><a
href="ae90e3237ehttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763 ">#8763</a>)</li>
<li><a
href="f202c3f800https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529 ">#8529</a>)</li>
<li><a
href="8ddaecee1chttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8764 ">#8764</a>)</li>
<li><a
href="c7c03a47d4https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8766 ">#8766</a>)</li>
<li><a
href="717a85a203https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761 ">#8761</a>)</li>
<li><a
href="ad990b6d55https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8765 ">#8765</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.67.0...zpages/v0.68.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel` from 1.42.0 to 1.43.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag ">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012 ">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642 ">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051 ">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060 ">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855 ">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039 ">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067 ">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073 ">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased ">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027 ">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056 ">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128 ">#8128</a>)</li>
<li><a
href="61b8c9466chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131 ">#8131</a>)</li>
<li><a
href="97a086e82fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122 ">#8122</a>)</li>
<li><a
href="5e363de517https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><a
href="35214b6013https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li><a
href="290024ceafhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121 ">#8121</a>)</li>
<li><a
href="e70658e098https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
<li><a
href="4afe468e3bhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117 ">#8117</a>)</li>
<li><a
href="b9ca729776https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115 ">#8115</a>)</li>
<li><a
href="69472ec56chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118 ">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.42.0...v1.43.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.64.0 to
0.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel/exporters/prometheus's
releases</a>.</em></p>
<blockquote>
<h2>v1.43.0/v0.65.0/v0.19.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag ">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012 ">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642 ">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051 ">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060 ">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855 ">#7855</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Refactor slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039 ">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067 ">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073 ">#8073</a>)</li>
</ul>
<h2>Deprecated</h2>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased ">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027 ">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056 ">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update module github.com/jgautheron/goconst to v1.9.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8014 ">open-telemetry/opentelemetry-go#8014</a></li>
<li>fix(deps): update github.com/opentracing-contrib/go-grpc/test digest
to 190d7d4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8013 ">open-telemetry/opentelemetry-go#8013</a></li>
<li>chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8016 ">open-telemetry/opentelemetry-go#8016</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8011 ">open-telemetry/opentelemetry-go#8011</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8023 ">open-telemetry/opentelemetry-go#8023</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8020 ">open-telemetry/opentelemetry-go#8020</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag ">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012 ">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642 ">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051 ">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060 ">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855 ">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039 ">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067 ">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073 ">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased ">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027 ">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056 ">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128 ">#8128</a>)</li>
<li><a
href="61b8c9466chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131 ">#8131</a>)</li>
<li><a
href="97a086e82fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122 ">#8122</a>)</li>
<li><a
href="5e363de517https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><a
href="35214b6013https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li><a
href="290024ceafhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121 ">#8121</a>)</li>
<li><a
href="e70658e098https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
<li><a
href="4afe468e3bhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117 ">#8117</a>)</li>
<li><a
href="b9ca729776https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115 ">#8115</a>)</li>
<li><a
href="69472ec56chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118 ">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/exporters/prometheus/v0.64.0...exporters/prometheus/v0.65.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/metric` from 1.42.0 to 1.43.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag ">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012 ">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642 ">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051 ">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060 ">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855 ">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039 ">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067 ">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073 ">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased ">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027 ">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056 ">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128 ">#8128</a>)</li>
<li><a
href="61b8c9466chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131 ">#8131</a>)</li>
<li><a
href="97a086e82fhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122 ">#8122</a>)</li>
<li><a
href="5e363de517https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><a
href="35214b6013https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113 ">#8113</a>)</li>
<li><a
href="290024ceafhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121 ">#8121</a>)</li>
<li><a
href="e70658e098https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096 ">#8096</a>)</li>
<li><a
href="4afe468e3bhttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117 ">#8117</a>)</li>
<li><a
href="b9ca729776https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115 ">#8115</a>)</li>
<li><a
href="69472ec56chttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118 ">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.42.0...v1.43.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag ">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012 ">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642 ">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051 ">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060 ">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855 ">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039 ">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067 ">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073 ">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038 ">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased ">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027 ">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056 ">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108 ">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opent ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 05:33:36 -04:00
dependabot[bot]
81bc5ff653
build(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 ( #1131 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.3 to 0.21.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.4</h2>
<h2>What's Changed</h2>
<ul>
<li>go.mod: do not make a viral minimum go version by <a
href="https://github.com/howardjohn "><code>@howardjohn</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2237 ">google/go-containerregistry#2237</a></li>
<li>Avoid pruning absolute links from extracted and flattened images by
<a href="https://github.com/Subserial "><code>@Subserial</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2241 ">google/go-containerregistry#2241</a></li>
<li>Bump the go-deps group across 3 directories with 5 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2245 ">google/go-containerregistry#2245</a></li>
<li>fix: update to go1.25.8, and use separate .go-version file by <a
href="https://github.com/thaJeztah "><code>@thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2246 ">google/go-containerregistry#2246</a></li>
<li>Bump CI go version to 1.26.1 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2242 ">google/go-containerregistry#2242</a></li>
<li>Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group
by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2240 ">google/go-containerregistry#2240</a></li>
<li>fork distribution client v3 auth-challenge as an internal package
(squashed) by <a
href="https://github.com/thaJeztah "><code>@thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2248 ">google/go-containerregistry#2248</a></li>
<li>transport: validate Bearer realm URL to prevent SSRF by <a
href="https://github.com/evilgensec "><code>@evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2243 ">google/go-containerregistry#2243</a></li>
<li>revert path traversal and symlink escape from <a
href="https://redirect.github.com/google/go-containerregistry/issues/2227 ">#2227</a>
by <a href="https://github.com/Subserial "><code>@Subserial</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2250 ">google/go-containerregistry#2250</a></li>
<li>Fix pkg/v1/google/auth tests for arm64 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2085 ">google/go-containerregistry#2085</a></li>
<li>goreleaser: Update goreleaser config and GH action by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2253 ">google/go-containerregistry#2253</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/evilgensec "><code>@evilgensec</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2243 ">google/go-containerregistry#2243</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4 ">https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e8813dd0a0https://redirect.github.com/google/go-containerregistry/issues/2253 ">#2253</a>)</li>
<li><a
href="e90447d319https://redirect.github.com/google/go-containerregistry/issues/2085 ">#2085</a>)</li>
<li><a
href="0d0368c2a5https://redirect.github.com/google/go-containerregistry/issues/2250 ">#2250</a>)</li>
<li><a
href="a2f47d4202https://redirect.github.com/google/go-containerregistry/issues/2243 ">#2243</a>)</li>
<li><a
href="19a36cd8c4c612a9b20ahttps://redirect.github.com/google/go-containerregistry/issues/2240 ">#2240</a>)</li>
<li><a
href="8f92f59fd6https://redirect.github.com/google/go-containerregistry/issues/2242 ">#2242</a>)</li>
<li><a
href="c99e7cf68bhttps://redirect.github.com/google/go-containerregistry/issues/2246 ">#2246</a>)</li>
<li><a
href="0794660d72https://redirect.github.com/google/go-containerregistry/issues/2245 ">#2245</a>)</li>
<li><a
href="4cb93aef09https://redirect.github.com/google/go-containerregistry/issues/2241 ">#2241</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 05:33:17 -04:00
dependabot[bot]
2a6b00dde7
build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 ( #1092 )
...
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx ) from 5.8.0
to 5.9.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md ">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.9.1 (March 22, 2026)</h1>
<ul>
<li>Fix: batch result format corruption when using cached prepared
statements (reported by Dirkjan Bussink)</li>
</ul>
<h1>5.9.0 (March 21, 2026)</h1>
<p>This release includes a number of new features such as
SCRAM-SHA-256-PLUS support, OAuth authentication support, and
PostgreSQL protocol 3.2 support.</p>
<p>It significantly reduces the amount of network traffic when using
prepared statements (which are used automatically by
default) by avoiding unnecessary Describe Portal messages. This also
reduces local memory usage.</p>
<p>It also includes multiple fixes for potential DoS due to panic or OOM
if connected to a malicious server that sends
deliberately malformed messages.</p>
<ul>
<li>Require Go 1.25+</li>
<li>Add SCRAM-SHA-256-PLUS support (Adam Brightwell)</li>
<li>Add OAuth authentication support for PostgreSQL 18 (David
Schneider)</li>
<li>Add PostgreSQL protocol 3.2 support (Dirkjan Bussink)</li>
<li>Add tsvector type support (Adam Brightwell)</li>
<li>Skip Describe Portal for cached prepared statements reducing network
round trips</li>
<li>Make LoadTypes query easier to support on "postgres-like"
servers (Jelte Fennema-Nio)</li>
<li>Default empty user to current OS user matching libpq behavior
(ShivangSrivastava)</li>
<li>Optimize LRU statement cache with custom linked list and node
pooling (Mathias Bogaert)</li>
<li>Optimize date scanning by replacing regex with manual parsing
(Mathias Bogaert)</li>
<li>Optimize pgio append/set functions with direct byte shifts (Mathias
Bogaert)</li>
<li>Make RowsAffected faster (Abhishek Chanda)</li>
<li>Fix: Pipeline.Close panic when server sends multiple FATAL errors
(Varun Chawla)</li>
<li>Fix: ContextWatcher goroutine leak (Hank Donnay)</li>
<li>Fix: stdlib discard connections with open transactions in
ResetSession (Jeremy Schneider)</li>
<li>Fix: pipelineBatchResults.Exec silently swallowing lastRows
error</li>
<li>Fix: ColumnTypeLength using BPCharArrayOID instead of BPCharOID</li>
<li>Fix: TSVector text encoding returning nil for valid empty
tsvector</li>
<li>Fix: wrong error messages for Int2 and Int4 underflow</li>
<li>Fix: Numeric nil Int pointer dereference with Valid: true</li>
<li>Fix: reversed strings.ContainsAny arguments in
Numeric.ScanScientific</li>
<li>Fix: message length parsing on 32-bit platforms</li>
<li>Fix: FunctionCallResponse.Decode mishandling of signed result
size</li>
<li>Fix: returning wrong error in configTLS when DecryptPEMBlock fails
(Maxim Motyshen)</li>
<li>Fix: misleading ParseConfig error when default_query_exec_mode is
invalid (Skarm)</li>
<li>Fix: missed Unwatch in Pipeline error paths</li>
<li>Clarify too many failed acquire attempts error message</li>
<li>Better error wrapping with context and SQL statement (Aneesh
Makala)</li>
<li>Enable govet and ineffassign linters (Federico Guerinoni)</li>
<li>Guard against various malformed binary messages (arrays, hstore,
multirange, protocol messages)</li>
<li>Fix various godoc comments (ferhat elmas)</li>
<li>Fix typos in comments (Oleksandr Redko)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e4eaedb476273188265f7b90c2f1ahttps://redirect.github.com/jackc/pgx/issues/2524 ">#2524</a> from
dbussink/pipeline-result-format-reuse</li>
<li><a
href="3ce6d75be4b4d8e62b66c227cd4f76f492c14836ad8fb08d3f303377376d83ffb3c222https://github.com/jackc/pgx/compare/v5.8.0...v5.9.1 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 00:10:21 -04:00
dependabot[bot]
bc8ff18495
build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.37.3 ( #1098 )
...
Bumps
[github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma )
from 2.37.2 to 2.37.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/danielgtaylor/huma/releases ">github.com/danielgtaylor/huma/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.37.3</h2>
<h2>Overview</h2>
<p>This bugfix release fixes a few minor bugs and typos from previous
releases.</p>
<p>This also adjusts the HTTP status code returned by Huma if marshaling
a response fails, from 200 to 500.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix: add allow-popups to CSP sandbox for OAuth popups by <a
href="https://github.com/Micaso "><code>@Micaso</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/987 ">danielgtaylor/huma#987</a></li>
<li>Fix: use epsilon tolerance in multipleOf float validation by <a
href="https://github.com/smazurov "><code>@smazurov</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/989 ">danielgtaylor/huma#989</a></li>
<li>Fix typo in groups.md documentation by <a
href="https://github.com/Its-Haze "><code>@Its-Haze</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/995 ">danielgtaylor/huma#995</a></li>
<li>Fix relative schema urls by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/990 ">danielgtaylor/huma#990</a></li>
<li>Return HTTP 500 if marshaling fails by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/997 ">danielgtaylor/huma#997</a></li>
<li>Handle contentEncoding and contentMediaType keys by <a
href="https://github.com/NPellet "><code>@NPellet</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/919 ">danielgtaylor/huma#919</a></li>
<li>Chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.11 to
2.52.12 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/984 ">danielgtaylor/huma#984</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Micaso "><code>@Micaso</code></a> made
their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/987 ">danielgtaylor/huma#987</a></li>
<li><a href="https://github.com/smazurov "><code>@smazurov</code></a>
made their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/989 ">danielgtaylor/huma#989</a></li>
<li><a href="https://github.com/Its-Haze "><code>@Its-Haze</code></a>
made their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/995 ">danielgtaylor/huma#995</a></li>
<li><a href="https://github.com/NPellet "><code>@NPellet</code></a> made
their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/919 ">danielgtaylor/huma#919</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3 ">https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a38b53666dhttps://redirect.github.com/danielgtaylor/huma/issues/984 ">#984</a>)</li>
<li><a
href="f4c53634a2https://redirect.github.com/danielgtaylor/huma/issues/919 ">#919</a>)</li>
<li><a
href="1678a04e88https://redirect.github.com/danielgtaylor/huma/issues/997 ">#997</a>)</li>
<li><a
href="1d5dddfc50https://redirect.github.com/danielgtaylor/huma/issues/990 ">#990</a>)</li>
<li><a
href="1b8766d7c3https://redirect.github.com/danielgtaylor/huma/issues/995 ">#995</a>)</li>
<li><a
href="99e60fdd0bhttps://redirect.github.com/danielgtaylor/huma/issues/989 ">#989</a>)</li>
<li><a
href="c6694fa179https://redirect.github.com/danielgtaylor/huma/issues/987 ">#987</a>)</li>
<li>See full diff in <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 00:03:28 -04:00
dependabot[bot]
9c180f4d33
build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 ( #1076 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from
1.78.0 to 1.79.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases ">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.79.3</h2>
<h1>Security</h1>
<ul>
<li>server: fix an authorization bypass where malformed :path headers
(missing the leading slash) could bypass path-based restricted
"deny" rules in interceptors like <code>grpc/authz</code>. Any
request with a non-canonical path is now immediately rejected with an
<code>Unimplemented</code> error. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981 ">#8981</a>)</li>
</ul>
<h2>Release 1.79.2</h2>
<h1>Bug Fixes</h1>
<ul>
<li>stats: Prevent redundant error logging in health/ORCA producers by
skipping stats/tracing processing when no stats handler is configured.
(<a
href="https://redirect.github.com/grpc/grpc-go/pull/8874 ">grpc/grpc-go#8874</a>)</li>
</ul>
<h2>Release 1.79.1</h2>
<h1>Bug Fixes</h1>
<ul>
<li>grpc: Remove the <code>-dev</code> suffix from the User-Agent
header. (<a
href="https://redirect.github.com/grpc/grpc-go/pull/8902 ">grpc/grpc-go#8902</a>)</li>
</ul>
<h2>Release 1.79.0</h2>
<h1>API Changes</h1>
<ul>
<li>mem: Add experimental API <code>SetDefaultBufferPool</code> to
change the default buffer pool. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8806 ">#8806</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/vanja-p "><code>@vanja-p</code></a></li>
</ul>
</li>
<li>experimental/stats: Update <code>MetricsRecorder</code> to require
embedding the new <code>UnimplementedMetricsRecorder</code> (a no-op
struct) in all implementations for forward compatibility. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8780 ">#8780</a>)</li>
</ul>
<h1>Behavior Changes</h1>
<ul>
<li>balancer/weightedtarget: Remove handling of <code>Addresses</code>
and only handle <code>Endpoints</code> in resolver updates. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8841 ">#8841</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Add support for asynchronous gauge metrics
through the new <code>AsyncMetricReporter</code> and
<code>RegisterAsyncReporter</code> APIs. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8780 ">#8780</a>)</li>
<li>pickfirst: Add support for weighted random shuffling of endpoints,
as described in <a
href="https://redirect.github.com/grpc/proposal/pull/535 ">gRFC A113</a>.
<ul>
<li>This is enabled by default, and can be turned off using the
environment variable
<code>GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8864 ">#8864</a>)</li>
</ul>
</li>
<li>xds: Implement <code>:authority</code> rewriting, as specified in <a
href="https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md ">gRFC
A81</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8779 ">#8779</a>)</li>
<li>balancer/randomsubsetting: Implement the
<code>random_subsetting</code> LB policy, as specified in <a
href="https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md ">gRFC
A68</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8650 ">#8650</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/marek-szews "><code>@marek-szews</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>credentials/tls: Fix a bug where the port was not stripped from the
authority override before validation. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8726 ">#8726</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/Atul1710 "><code>@Atul1710</code></a></li>
</ul>
</li>
<li>xds/priority: Fix a bug causing delayed failover to lower-priority
clusters when a higher-priority cluster is stuck in
<code>CONNECTING</code> state. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8813 ">#8813</a>)</li>
<li>health: Fix a bug where health checks failed for clients using
legacy compression options (<code>WithDecompressor</code> or
<code>RPCDecompressor</code>). (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8765 ">#8765</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/sanki92 "><code>@sanki92</code></a></li>
</ul>
</li>
<li>transport: Fix an issue where the HTTP/2 server could skip header
size checks when terminating a stream early. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8769 ">#8769</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/joybestourous "><code>@joybestourous</code></a></li>
</ul>
</li>
<li>server: Propagate status detail headers, if available, when
terminating a stream during request header processing. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8754 ">#8754</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/joybestourous "><code>@joybestourous</code></a></li>
</ul>
</li>
</ul>
<h1>Performance Improvements</h1>
<ul>
<li>credentials/alts: Optimize read buffer alignment to reduce copies.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8791 ">#8791</a>)</li>
<li>mem: Optimize pooling and creation of <code>buffer</code> objects.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8784 ">#8784</a>)</li>
<li>transport: Reduce slice re-allocations by reserving slice capacity.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8797 ">#8797</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dda86dbd9chttps://redirect.github.com/grpc/grpc-go/issues/8983 ">#8983</a>)</li>
<li><a
href="72186f163ehttps://redirect.github.com/grpc/grpc-go/issues/8981 ">#8981</a>)</li>
<li><a
href="97ca3522b2https://redirect.github.com/grpc/grpc-go/issues/8954 ">#8954</a>)</li>
<li><a
href="8902ab6efehttps://redirect.github.com/grpc/grpc-go/issues/8947 ">#8947</a>)</li>
<li><a
href="a9286705aahttps://redirect.github.com/grpc/grpc-go/issues/8874 ">#8874</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8904 ">#8904</a>)</li>
<li><a
href="06df3638c0https://redirect.github.com/grpc/grpc-go/issues/8903 ">#8903</a>)</li>
<li><a
href="782f2de44fhttps://redirect.github.com/grpc/grpc-go/issues/8902 ">#8902</a>)</li>
<li><a
href="850eccbb22https://redirect.github.com/grpc/grpc-go/issues/8851 ">#8851</a>)</li>
<li><a
href="765ff056b6https://redirect.github.com/grpc/grpc-go/issues/8850 ">#8850</a>)</li>
<li><a
href="68804be0e7https://redirect.github.com/grpc/grpc-go/issues/8864 ">#8864</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8896 ">#8896</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 23:56:53 +02:00
dependabot[bot]
9c7c8805cc
build(deps): bump github.com/google/go-containerregistry from 0.21.2 to 0.21.3 ( #1073 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.21.2 to 0.21.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Adds local file support to the <code>crane index</code> subcommand
by <a
href="https://github.com/edwardthiele "><code>@edwardthiele</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2223 ">google/go-containerregistry#2223</a></li>
<li>migrate to github.com/moby/moby modules by <a
href="https://github.com/thaJeztah "><code>@thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2228 ">google/go-containerregistry#2228</a></li>
<li>Bump the go-deps group across 4 directories with 7 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2233 ">google/go-containerregistry#2233</a></li>
<li>Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions
group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2220 ">google/go-containerregistry#2220</a></li>
<li>mutate: reject path traversal and symlink escape in Extract by <a
href="https://github.com/KevinZhao "><code>@KevinZhao</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2227 ">google/go-containerregistry#2227</a></li>
<li>tarball: detect symlink cycles in extractFileFromTar by <a
href="https://github.com/vnykmshr "><code>@vnykmshr</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2232 ">google/go-containerregistry#2232</a></li>
<li>bump golang to 1.25.7 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2236 ">google/go-containerregistry#2236</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edwardthiele "><code>@edwardthiele</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2223 ">google/go-containerregistry#2223</a></li>
<li><a href="https://github.com/thaJeztah "><code>@thaJeztah</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2228 ">google/go-containerregistry#2228</a></li>
<li><a href="https://github.com/KevinZhao "><code>@KevinZhao</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2227 ">google/go-containerregistry#2227</a></li>
<li><a href="https://github.com/vnykmshr "><code>@vnykmshr</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2232 ">google/go-containerregistry#2232</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3 ">https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3888fb8f87https://redirect.github.com/google/go-containerregistry/issues/2236 ">#2236</a>)</li>
<li><a
href="f4396242bdhttps://redirect.github.com/google/go-containerregistry/issues/2232 ">#2232</a>)</li>
<li><a
href="400c263d8ehttps://redirect.github.com/google/go-containerregistry/issues/2227 ">#2227</a>)</li>
<li><a
href="47eedc9de4https://redirect.github.com/google/go-containerregistry/issues/2220 ">#2220</a>)</li>
<li><a
href="be0a845999https://redirect.github.com/google/go-containerregistry/issues/2233 ">#2233</a>)</li>
<li><a
href="e916301498https://redirect.github.com/google/go-containerregistry/issues/2228 ">#2228</a>)</li>
<li><a
href="8b2478e69fhttps://redirect.github.com/google/go-containerregistry/issues/2223 ">#2223</a>)</li>
<li>See full diff in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 23:51:32 +02:00
dependabot[bot]
52178183f3
build(deps): bump github.com/danielgtaylor/huma/v2 from 2.35.0 to 2.37.2 ( #989 )
...
Bumps
[github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma )
from 2.35.0 to 2.37.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/danielgtaylor/huma/releases ">github.com/danielgtaylor/huma/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.37.2</h2>
<h2>Overview</h2>
<p>This bugfix release fixes an issue with how form data was being
documented in OpenAPI.</p>
<p>This also fixes embedded objects with valid JSON tags being
incorrectly embedded in the OpenAPI docs.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't embed embedded objects with valid JSON tags by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/978 ">danielgtaylor/huma#978</a></li>
<li>Fix OpenAPI path prefix regression from $schema fix PR by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/979 ">danielgtaylor/huma#979</a></li>
<li>Fix form param doc regression by <a
href="https://github.com/wolveix "><code>@wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/981 ">danielgtaylor/huma#981</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.1...v2.37.2 ">https://github.com/danielgtaylor/huma/compare/v2.37.1...v2.37.2 </a></p>
<h2>v2.37.1</h2>
<h2>Overview</h2>
<p>This bugfix release fixes an issue regarding the Swagger UI docs
renderer, as well as fixes an issue preventing Groups from using the
configurable options released in v2.37.1.</p>
<p>This also brings interface constructors to <code>humamux</code>.</p>
<h2>What's Changed</h2>
<ul>
<li>Export Gorilla Mux interface constructors by <a
href="https://github.com/RangelReale "><code>@RangelReale</code></a> in
<a
href="https://redirect.github.com/danielgtaylor/huma/pull/965 ">danielgtaylor/huma#965</a></li>
<li>fix(api): use proper CSP hash for inline script in Swagger doc
renderer by <a
href="https://github.com/leonklingele "><code>@leonklingele</code></a>
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/977 ">danielgtaylor/huma#977</a></li>
<li>fix(group): ensure "Group" satisfies the configProvider
interface by <a
href="https://github.com/leonklingele "><code>@leonklingele</code></a>
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/976 ">danielgtaylor/huma#976</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.0...v2.37.1 ">https://github.com/danielgtaylor/huma/compare/v2.37.0...v2.37.1 </a></p>
<h2>v2.37.0</h2>
<h2>Overview</h2>
<h3>Dropped Explicit IDN-Hostname Validation</h3>
<p>This validation unintentionally imported an external library to the
base Huma library. Since this was not a requested feature, it has been
removed for now. The <code>idn-hostname</code> format value has become
an alias for <code>hostname</code> in the meantime.</p>
<h3>Operation ID Normalization</h3>
<p>Spaces in operation IDs get automatically converted to hyphens
now.</p>
<h3>Optimizations & Fixed Memory Leak</h3>
<p>Various internal operations have been optimized (~7% overall
improvement): <a
href="https://redirect.github.com/danielgtaylor/huma/pull/973#issue-3960297052 ">danielgtaylor/huma#973</a></p>
<p>A memory leak when using <code>MultipartFormFiles</code> has been
resolved.</p>
<h3>New Configurable Options</h3>
<h4>Allow Additional Properties By Default</h4>
<p>A new config option has been added to allow additional properties by
default. This can be set in the API config.</p>
<pre lang="go"><code>config.AllowAdditionalPropertiesByDefault = true
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="887f7d4322https://redirect.github.com/danielgtaylor/huma/issues/981 ">#981</a>)</li>
<li><a
href="f02efeb11dhttps://redirect.github.com/danielgtaylor/huma/issues/979 ">#979</a>)</li>
<li><a
href="cbf60b60afhttps://redirect.github.com/danielgtaylor/huma/issues/978 ">#978</a>)</li>
<li><a
href="6d0295c4e1https://redirect.github.com/danielgtaylor/huma/issues/976 ">#976</a>)</li>
<li><a
href="07ca6c5d17https://redirect.github.com/danielgtaylor/huma/issues/977 ">#977</a>)</li>
<li><a
href="58edcf2bf5https://redirect.github.com/danielgtaylor/huma/issues/965 ">#965</a>)</li>
<li><a
href="6c29f67c9dhttps://redirect.github.com/danielgtaylor/huma/issues/916 ">#916</a>)</li>
<li><a
href="3aee9bd172https://redirect.github.com/danielgtaylor/huma/issues/974 ">#974</a>)</li>
<li><a
href="e31a8198adhttps://redirect.github.com/danielgtaylor/huma/issues/973 ">#973</a>)</li>
<li><a
href="ddbb810fd5https://redirect.github.com/danielgtaylor/huma/issues/925 ">#925</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/danielgtaylor/huma/compare/v2.35.0...v2.37.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-03-16 17:06:31 +02:00
dependabot[bot]
00de8fac8b
build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0 ( #1054 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.33.0 to
0.34.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1ac721dff8fb1fac8b36https://github.com/golang/mod/compare/v0.33.0...v0.34.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-12 11:46:51 +01:00
dependabot[bot]
c0ecfd5a65
build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.2 ( #1026 )
...
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry )
from 0.20.7 to 0.21.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases ">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Better handle redirects to https in ping by <a
href="https://github.com/jonjohnsonjr "><code>@jonjohnsonjr</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2225 ">google/go-containerregistry#2225</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.1...v0.21.2 ">https://github.com/google/go-containerregistry/compare/v0.21.1...v0.21.2 </a></p>
<h2>v0.21.1</h2>
<p>This release fixes a regression in <code>crane</code> introduced in
the previous release.</p>
<h2>What's Changed</h2>
<ul>
<li>Add WithFileBufferedOpener for file-backed daemon image buffering by
<a href="https://github.com/twdamhore "><code>@twdamhore</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2214 ">google/go-containerregistry#2214</a></li>
<li>crane: fix case in auth response json by <a
href="https://github.com/aelindeman "><code>@aelindeman</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2218 ">google/go-containerregistry#2218</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/twdamhore "><code>@twdamhore</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2214 ">google/go-containerregistry#2214</a></li>
<li><a
href="https://github.com/aelindeman "><code>@aelindeman</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2218 ">google/go-containerregistry#2218</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.0...v0.21.1 ">https://github.com/google/go-containerregistry/compare/v0.21.0...v0.21.1 </a></p>
<h2>v0.21.0</h2>
<p>This release updates the minimum Go version to
<code>1.25.6</code>.</p>
<h2>What's Changed</h2>
<ul>
<li>fix(mutate): don't skip dir replacements via whiteout in export by
<a href="https://github.com/r4f4 "><code>@r4f4</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2191 ">google/go-containerregistry#2191</a></li>
<li>Improve performance of v1.NewHash by <a
href="https://github.com/bmoylan "><code>@bmoylan</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2194 ">google/go-containerregistry#2194</a></li>
<li>Bump the actions group across 1 directory with 4 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2207 ">google/go-containerregistry#2207</a></li>
<li>Bump the root-deps group across 1 directory with 7 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2195 ">google/go-containerregistry#2195</a></li>
<li>Fix error messages in crane_test.go by <a
href="https://github.com/jammie-jelly "><code>@jammie-jelly</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2189 ">google/go-containerregistry#2189</a></li>
<li>Bump go version across packages to 1.25.6 by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2211 ">google/go-containerregistry#2211</a></li>
<li>Join go.mod dependency updates by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2212 ">google/go-containerregistry#2212</a></li>
<li>Bump the go-deps group across 3 directories with 3 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2213 ">google/go-containerregistry#2213</a></li>
<li>Disable taint gosec lints by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2215 ">google/go-containerregistry#2215</a></li>
<li>Update go version used in goreleaser by <a
href="https://github.com/Subserial "><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2216 ">google/go-containerregistry#2216</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/r4f4 "><code>@r4f4</code></a> made their
first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2191 ">google/go-containerregistry#2191</a></li>
<li><a
href="https://github.com/jammie-jelly "><code>@jammie-jelly</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2189 ">google/go-containerregistry#2189</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.0 ">https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9e0ccb0a72https://redirect.github.com/google/go-containerregistry/issues/2225 ">#2225</a>)</li>
<li><a
href="85f2bf5f73https://redirect.github.com/google/go-containerregistry/issues/2218 ">#2218</a>)</li>
<li><a
href="e971d630dchttps://redirect.github.com/google/go-containerregistry/issues/2214 ">#2214</a>)</li>
<li><a
href="8e2d6a6817https://redirect.github.com/google/go-containerregistry/issues/2216 ">#2216</a>)</li>
<li><a
href="b58334f761https://redirect.github.com/google/go-containerregistry/issues/2215 ">#2215</a>)</li>
<li><a
href="88b39ed906https://redirect.github.com/google/go-containerregistry/issues/2213 ">#2213</a>)</li>
<li><a
href="102ac75ddehttps://redirect.github.com/google/go-containerregistry/issues/2212 ">#2212</a>)</li>
<li><a
href="d5817d559ehttps://redirect.github.com/google/go-containerregistry/issues/2211 ">#2211</a>)</li>
<li><a
href="23f0632fa3https://redirect.github.com/google/go-containerregistry/issues/2189 ">#2189</a>)</li>
<li><a
href="438abde5e7https://redirect.github.com/google/go-containerregistry/issues/2195 ">#2195</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-03-07 15:31:08 +02:00
dependabot[bot]
03d551dbab
build(deps): bump the opentelemetry group with 6 updates ( #1044 )
...
Bumps the opentelemetry group with 6 updates:
| Package | From | To |
| --- | --- | --- |
|
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib )
| `0.66.0` | `0.67.0` |
|
[go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go )
| `1.41.0` | `1.42.0` |
|
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go )
| `0.63.0` | `0.64.0` |
|
[go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go )
| `1.41.0` | `1.42.0` |
|
[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go )
| `1.41.0` | `1.42.0` |
|
[go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go )
| `1.41.0` | `1.42.0` |
Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.66.0 to 0.67.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases ">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>v1.42.0/v2.4.0/v0.67.0/v0.36.0/v0.22.0/v0.17.0/v0.15.0/v0.14.0</h2>
<h3>Added</h3>
<ul>
<li>Add environment variables propagation carrier in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8442 ">#8442</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.40.0</code>, including updates across instrumentation and
detector modules. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8631 ">#8631</a>)</p>
<ul>
<li>The semantic conventions v1.40.0 release introduces RPC breaking
changes applied in this repository:
<ul>
<li>RPC spans and metrics no longer include
<code>network.protocol.name</code>,
<code>network.protocol.version</code>, or <code>network.transport</code>
attributes.</li>
<li><code>rpc.client.request.size</code>,
<code>rpc.client.response.size</code>,
<code>rpc.server.request.size</code>, and
<code>rpc.server.response.size</code> are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.</li>
<li><code>rpc.message</code> span events and their message attributes
are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
(including when <code>WithMessageEvents</code> is configured).</li>
</ul>
</li>
</ul>
<p>See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.40.0 ">semantic-conventions
v1.40.0 release</a> for complete details.</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Ignore informational response status codes (<code>100-199</code>)
except <code>101 Switching Protocols</code> when storing the HTTP status
code in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6913 ">#6913</a>)</li>
<li>Make <code>Body</code> handling in <code>Transport</code> consistent
with stdlib in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8618 ">#8618</a>)</li>
<li>Fix bucket boundaries for <code>rpc.server.call.duration</code> and
<code>rpc.client.call.duration</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8642 ">#8642</a>)</li>
<li>Host resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code> now includes
<code>os.</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8578 ">#8578</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for <a href="https://go.dev/doc/go1.24 ">Go 1.24</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8628 ">#8628</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update github artifact actions to v7 (major) by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8605 ">open-telemetry/opentelemetry-go-contrib#8605</a></li>
<li>chore(deps): update module github.com/sonatard/noctx to v0.5.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8610 ">open-telemetry/opentelemetry-go-contrib#8610</a></li>
<li>chore(deps): update github/codeql-action action to v4.32.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8620 ">open-telemetry/opentelemetry-go-contrib#8620</a></li>
<li>fix(deps): update module github.com/aws/smithy-go to v1.24.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8614 ">open-telemetry/opentelemetry-go-contrib#8614</a></li>
<li>chore(deps): update go-openapi packages by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8621 ">open-telemetry/opentelemetry-go-contrib#8621</a></li>
<li>fix(deps): update module github.com/shirou/gopsutil/v4 to v4.26.2 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8622 ">open-telemetry/opentelemetry-go-contrib#8622</a></li>
<li>chore(deps): update module github.com/kisielk/errcheck to v1.10.0 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8608 ">open-telemetry/opentelemetry-go-contrib#8608</a></li>
<li>chore(deps): update module github.com/protonmail/go-crypto to v1.4.0
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8609 ">open-telemetry/opentelemetry-go-contrib#8609</a></li>
<li>chore(deps): update otel/opentelemetry-collector-contrib docker tag
to v0.147.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8625 ">open-telemetry/opentelemetry-go-contrib#8625</a></li>
<li>chore(deps): update module github.com/daixiang0/gci to v0.14.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8623 ">open-telemetry/opentelemetry-go-contrib#8623</a></li>
<li>Drop support for 1.24 by <a
href="https://github.com/dmathieu "><code>@dmathieu</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8628 ">open-telemetry/opentelemetry-go-contrib#8628</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8554 ">open-telemetry/opentelemetry-go-contrib#8554</a></li>
<li>fix(deps): update kubernetes packages to v0.35.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8626 ">open-telemetry/opentelemetry-go-contrib#8626</a></li>
<li>fix(deps): update aws-sdk-go-v2 monorepo by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8598 ">open-telemetry/opentelemetry-go-contrib#8598</a></li>
<li>fix(deps): update module github.com/aws/aws-lambda-go to v1.53.0 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8630 ">open-telemetry/opentelemetry-go-contrib#8630</a></li>
<li>otelgrpc: modernize the example project by <a
href="https://github.com/ash2k "><code>@ash2k</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8619 ">open-telemetry/opentelemetry-go-contrib#8619</a></li>
<li>chore(deps): update googleapis to a57be14 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8606 ">open-telemetry/opentelemetry-go-contrib#8606</a></li>
<li>fix(deps): update module github.com/gin-gonic/gin to v1.12.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8627 ">open-telemetry/opentelemetry-go-contrib#8627</a></li>
<li>chore(deps): update module github.com/prometheus/procfs to v0.20.1
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8624 ">open-telemetry/opentelemetry-go-contrib#8624</a></li>
<li>fix(otelhttp): make Body handling in Transport consistent with
stdlib by <a href="https://github.com/ash2k "><code>@ash2k</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8618 ">open-telemetry/opentelemetry-go-contrib#8618</a></li>
<li>otelhttp: Ignore informational response status codes when persisting
status by <a
href="https://github.com/VirrageS "><code>@VirrageS</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/6913 ">open-telemetry/opentelemetry-go-contrib#6913</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md ">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/2.4.0/0.67.0/0.36.0/0.22.0/0.17.0/0.15.0/0.14.0] -
2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add environment variables propagation carrier in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8442 ">#8442</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.40.0</code>, including updates across instrumentation and
detector modules. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8631 ">#8631</a>)</p>
<ul>
<li>The semantic conventions v1.40.0 release introduces RPC breaking
changes applied in this repository:
<ul>
<li>RPC spans and metrics no longer include
<code>network.protocol.name</code>,
<code>network.protocol.version</code>, or <code>network.transport</code>
attributes.</li>
<li><code>rpc.client.request.size</code>,
<code>rpc.client.response.size</code>,
<code>rpc.server.request.size</code>, and
<code>rpc.server.response.size</code> are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.</li>
<li><code>rpc.message</code> span events and their message attributes
are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
(including when <code>WithMessageEvents</code> is configured).</li>
</ul>
</li>
</ul>
<p>See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.40.0 ">semantic-conventions
v1.40.0 release</a> for complete details.</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Ignore informational response status codes (<code>100-199</code>)
except <code>101 Switching Protocols</code> when storing the HTTP status
code in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6913 ">#6913</a>)</li>
<li>Make <code>Body</code> handling in <code>Transport</code> consistent
with stdlib in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8618 ">#8618</a>)</li>
<li>Fix bucket boundaries for <code>rpc.server.call.duration</code> and
<code>rpc.client.call.duration</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8642 ">#8642</a>)</li>
<li>Host resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code> now includes
<code>os.</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8578 ">#8578</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8628 ">#8628</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d8dabf6736https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8649 ">#8649</a>)</li>
<li><a
href="b1de2c71d9https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8578 ">#8578</a>)</li>
<li><a
href="b228c0f2f2https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8644 ">#8644</a>)</li>
<li><a
href="e70fd977a6https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8642 ">#8642</a>)</li>
<li><a
href="b018d98a0ehttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8643 ">#8643</a>)</li>
<li><a
href="fb6a3518d8https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8641 ">#8641</a>)</li>
<li><a
href="2c9c10ec4ahttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8640 ">#8640</a>)</li>
<li><a
href="22248d4c31https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8583 ">#8583</a>)</li>
<li><a
href="324662a14bhttps://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8442 ">#8442</a>)</li>
<li><a
href="69addb4996https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8636 ">#8636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.66.0...zpages/v0.67.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985 ">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931 ">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964 ">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834 ">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984 ">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006 ">#8006</a>)</li>
<li><a
href="6059c47bc6https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010 ">#8010</a>)</li>
<li><a
href="44c7edf896https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009 ">#8009</a>)</li>
<li><a
href="de5fb3ad10https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007 ">#8007</a>)</li>
<li><a
href="0b82ded815https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001 ">#8001</a>)</li>
<li><a
href="aa3660f77ehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004 ">#8004</a>)</li>
<li><a
href="9be8c92a13https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003 ">#8003</a>)</li>
<li><a
href="c9d20155fchttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
<li><a
href="fdd1320c39https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
<li><a
href="78f99042e2https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000 ">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.63.0 to
0.64.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases ">go.opentelemetry.io/otel/exporters/prometheus's
releases</a>.</em></p>
<blockquote>
<h2>v1.42.0/v0.64.0/v0.18.0/v0.0.16</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.40.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985 ">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931 ">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964 ">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834 ">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984 ">#7984</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>fix changelog protection marker by <a
href="https://github.com/pellared "><code>@pellared</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7986 ">open-telemetry/opentelemetry-go#7986</a></li>
<li>Drop support for Go 1.24 by <a
href="https://github.com/MrAlias "><code>@MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7984 ">open-telemetry/opentelemetry-go#7984</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7907 ">open-telemetry/opentelemetry-go#7907</a></li>
<li>chore(deps): update module go.opentelemetry.io/collector/featuregate
to v1.53.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7981 ">open-telemetry/opentelemetry-go#7981</a></li>
<li>chore(deps): update benchmark-action/github-action-benchmark action
to v1.21.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7989 ">open-telemetry/opentelemetry-go#7989</a></li>
<li>fix(deps): update module go.opentelemetry.io/collector/pdata to
v1.53.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7982 ">open-telemetry/opentelemetry-go#7982</a></li>
<li>Revert "Revert "Generate semconv/v1.40.0"" by <a
href="https://github.com/MrAlias "><code>@MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7985 ">open-telemetry/opentelemetry-go#7985</a></li>
<li>support stdlib request.GetBody on metrics by <a
href="https://github.com/marifari-hue "><code>@marifari-hue</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7931 ">open-telemetry/opentelemetry-go#7931</a></li>
<li>attribute: add TestNotEquivalence and equality operator tests by <a
href="https://github.com/pellared "><code>@pellared</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7979 ">open-telemetry/opentelemetry-go#7979</a></li>
<li>Refactor benchmark CI by <a
href="https://github.com/XSAM "><code>@XSAM</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7873 ">open-telemetry/opentelemetry-go#7873</a></li>
<li>chore(deps): update module github.com/securego/gosec/v2 to v2.24.7
by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7988 ">open-telemetry/opentelemetry-go#7988</a></li>
<li>chore(deps): pin codspeedhq/action action to df47568 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7996 ">open-telemetry/opentelemetry-go#7996</a></li>
<li>chore(deps): update actions/checkout action to v6.0.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7997 ">open-telemetry/opentelemetry-go#7997</a></li>
<li>chore(deps): update codspeedhq/action action to v4.11.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7999 ">open-telemetry/opentelemetry-go#7999</a></li>
<li>Upgrade to semconv/v1.40.0 by <a
href="https://github.com/MrAlias "><code>@MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7991 ">open-telemetry/opentelemetry-go#7991</a></li>
<li>Regenerate semconv/v1.40.0/MIGRATION.md by <a
href="https://github.com/MrAlias "><code>@MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7992 ">open-telemetry/opentelemetry-go#7992</a></li>
<li>fix: generated semconv helpers skipping attributes by <a
href="https://github.com/victoraugustolls "><code>@victoraugustolls</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7964 ">open-telemetry/opentelemetry-go#7964</a></li>
<li>Feat: Have SpanContext support the new W3C random flag. by <a
href="https://github.com/nikhilmantri0902 "><code>@nikhilmantri0902</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7834 ">open-telemetry/opentelemetry-go#7834</a></li>
<li>Semconv metric helper caller-slice mutation fix by <a
href="https://github.com/MrAlias "><code>@MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7993 ">open-telemetry/opentelemetry-go#7993</a></li>
<li>Fix semconv generated error type to check error chain for custom
type declaration by <a
href="https://github.com/MrAlias "><code>@MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7994 ">open-telemetry/opentelemetry-go#7994</a></li>
<li>refactor: replace uint64 and int32 with atomic types in tests by <a
href="https://github.com/alexandear "><code>@alexandear</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7941 ">open-telemetry/opentelemetry-go#7941</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to 18da590 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8000 ">open-telemetry/opentelemetry-go#8000</a></li>
<li>TracerProvider ForceFlush() Error Fix by <a
href="https://github.com/sawamurataxman "><code>@sawamurataxman</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7856 ">open-telemetry/opentelemetry-go#7856</a></li>
<li>log: add error field to Record and make SDK to emit exception
attributes by <a
href="https://github.com/iblancasa "><code>@iblancasa</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7924 ">open-telemetry/opentelemetry-go#7924</a></li>
<li>chore(deps): update dependency codespell to v2.4.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8003 ">open-telemetry/opentelemetry-go#8003</a></li>
<li>chore(deps): update github/codeql-action action to v4.32.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8004 ">open-telemetry/opentelemetry-go#8004</a></li>
<li>chore(deps): update codspeedhq/action action to v4.11.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8001 ">open-telemetry/opentelemetry-go#8001</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985 ">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931 ">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964 ">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834 ">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984 ">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006 ">#8006</a>)</li>
<li><a
href="6059c47bc6https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010 ">#8010</a>)</li>
<li><a
href="44c7edf896https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009 ">#8009</a>)</li>
<li><a
href="de5fb3ad10https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007 ">#8007</a>)</li>
<li><a
href="0b82ded815https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001 ">#8001</a>)</li>
<li><a
href="aa3660f77ehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004 ">#8004</a>)</li>
<li><a
href="9be8c92a13https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003 ">#8003</a>)</li>
<li><a
href="c9d20155fchttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
<li><a
href="fdd1320c39https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
<li><a
href="78f99042e2https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000 ">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/exporters/prometheus/v0.63.0...exporters/prometheus/v0.64.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/metric` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985 ">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931 ">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964 ">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834 ">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984 ">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006 ">#8006</a>)</li>
<li><a
href="6059c47bc6https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010 ">#8010</a>)</li>
<li><a
href="44c7edf896https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009 ">#8009</a>)</li>
<li><a
href="de5fb3ad10https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007 ">#8007</a>)</li>
<li><a
href="0b82ded815https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001 ">#8001</a>)</li>
<li><a
href="aa3660f77ehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004 ">#8004</a>)</li>
<li><a
href="9be8c92a13https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003 ">#8003</a>)</li>
<li><a
href="c9d20155fchttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
<li><a
href="fdd1320c39https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
<li><a
href="78f99042e2https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000 ">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/sdk` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985 ">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931 ">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964 ">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834 ">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984 ">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006 ">#8006</a>)</li>
<li><a
href="6059c47bc6https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010 ">#8010</a>)</li>
<li><a
href="44c7edf896https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009 ">#8009</a>)</li>
<li><a
href="de5fb3ad10https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007 ">#8007</a>)</li>
<li><a
href="0b82ded815https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001 ">#8001</a>)</li>
<li><a
href="aa3660f77ehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004 ">#8004</a>)</li>
<li><a
href="9be8c92a13https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003 ">#8003</a>)</li>
<li><a
href="c9d20155fchttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
<li><a
href="fdd1320c39https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
<li><a
href="78f99042e2https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000 ">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/sdk/metric` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md ">go.opentelemetry.io/otel/sdk/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md ">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985 ">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931 ">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964 ">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834 ">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984 ">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006 ">#8006</a>)</li>
<li><a
href="6059c47bc6https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010 ">#8010</a>)</li>
<li><a
href="44c7edf896https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009 ">#8009</a>)</li>
<li><a
href="de5fb3ad10https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007 ">#8007</a>)</li>
<li><a
href="0b82ded815https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001 ">#8001</a>)</li>
<li><a
href="aa3660f77ehttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004 ">#8004</a>)</li>
<li><a
href="9be8c92a13https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003 ">#8003</a>)</li>
<li><a
href="c9d20155fchttps://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924 ">#7924</a>)</li>
<li><a
href="fdd1320c39https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856 ">#7856</a>)</li>
<li><a
href="78f99042e2https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000 ">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-07 15:22:17 +02:00
dependabot[bot]
Radoslav Dimitrov