Bumps the go-dependencies group with 1 update:
[github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc).
Updates `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>oidc: ignore JWKs with unsupported key types rather than failing by
<a href="https://github.com/nicoske"><code>@nicoske</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/499">coreos/go-oidc#499</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/nicoske"><code>@nicoske</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/499">coreos/go-oidc#499</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0">https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c914bd3803"><code>c914bd3</code></a>
oidc: ignore JWKs with unsupported key types rather than failing</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go)
from 1.14.0 to 1.14.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases">github.com/Azure/azure-sdk-for-go/sdk/azidentity's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azidentity/v1.14.1</h2>
<h2>1.14.1 (2026-08-27)</h2>
<h3>Other Changes</h3>
<ul>
<li>Upgraded dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="920e79a166"><code>920e79a</code></a>
Prep azidentity for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/27473">#27473</a>)</li>
<li><a
href="d86ae78bd6"><code>d86ae78</code></a>
Prep azcore for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/27471">#27471</a>)</li>
<li><a
href="33dd768d27"><code>33dd768</code></a>
[azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path
(<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/27422">#27422</a>)</li>
<li><a
href="a27ca57b4d"><code>a27ca57</code></a>
Upgrade TypeSpec Go emitter dependencies (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/27466">#27466</a>)</li>
<li><a
href="af75eb0f82"><code>af75eb0</code></a>
[AutoPR
sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...</li>
<li><a
href="8dcff8c382"><code>8dcff8c</code></a>
[AutoPR
sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...</li>
<li><a
href="e4569f1adf"><code>e4569f1</code></a>
[AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK
Generation - G...</li>
<li><a
href="7069bf802d"><code>7069bf8</code></a>
[AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK
Genera...</li>
<li><a
href="5ceffcea63"><code>5ceffce</code></a>
Bump gh-aw to v0.86.2 for mgmt review workflow (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/27460">#27460</a>)</li>
<li><a
href="663b6ce414"><code>663b6ce</code></a>
Enhance azblob perf tests with OAuth, parallel setup, and profiling (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/27324">#27324</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.14.0...sdk/azidentity/v1.14.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.82.1 to 1.83.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.83.1</h2>
<h1>Security</h1>
<ul>
<li>xds/rbac: Fix a bug where nested <code>Principal</code> or
<code>Permission</code> rules with <code>:scheme</code> or
<code>grpc-</code> prefixed header matchers were not rejected, which
could cause DENY rules to fail open. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where the <code>host</code> header matcher was
not being replaced with <code>:authority</code> in nested
<code>Principal</code> or <code>Permission</code> rules. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where a header matcher whose name was not
lowercase, such as <code>X-Role</code>, matched no header, which could
cause DENY rules to fail open. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/alimony"><code>@alimony</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where a <code>:scheme</code> or
<code>grpc-</code> prefixed header matcher was accepted when its name
was not lowercase. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/alimony"><code>@alimony</code></a></li>
</ul>
</li>
<li>xds/rbac: Fix a bug where a <code>Host</code> header matcher was not
replaced with <code>:authority</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/alimony"><code>@alimony</code></a></li>
</ul>
</li>
</ul>
<h1>Performance</h1>
<ul>
<li>transport: Restrict memory overhead of buffering small data frames.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a>)</li>
</ul>
<h2>Release 1.83.0</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from connections when flooded by HTTP/2 frames
to mitigate resource exhaustion. The default value for this limit is 100
frames, excluding DATA and HEADERS, and may be changed by setting
environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
<li>xds: Fix panic when parsing route header matchers configured with
empty <code>exact_match</code>, <code>prefix_match</code>, or
<code>suffix_match</code> strings. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>xds/googlec2p: Enable DirectPath over Interconnect support for
on-premises clients via the <code>force-xds</code> target URI query
parameter. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9133">#9133</a>)</li>
<li>xds: Enable xDS configuration to control which fields get propagated
from ORCA backend metric reports to LRS load reports. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9145">#9145</a>)</li>
<li>authz: Add <code>OnPolicyUpdate</code> callback to
<code>FileWatcherOptions</code> to notify when an authz policy is loaded
or updated. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/hnefatl"><code>@hnefatl</code></a></li>
</ul>
</li>
<li>xds: Add support for the GCP Authentication HTTP Filter, which
automatically fetches and attaches GCP Service Account Identity JWT
tokens to outgoing RPCs.
<ul>
<li>This feature can be enabled by setting environment variable
<code>GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9119">#9119</a>)</li>
</ul>
</li>
<li>xds: Add support for xDS-based HTTP CONNECT proxies.
<ul>
<li>This feature can be enabled by setting environment variable
<code>GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9151">#9151</a>)</li>
</ul>
</li>
<li>xds: Add support for <code>contains_match</code> in route header
matchers. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>credentials/alts: Fix panic when processing malformed frames by
validating that the message frame length exceeds the message type field
size. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9197">#9197</a>)</li>
<li>grpc: Fix compilation on Plan 9 targets (<code>GOOS=plan9</code>),
broken since v1.81.0. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9255">#9255</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/Yusufihsangorgel"><code>@Yusufihsangorgel</code></a></li>
</ul>
</li>
</ul>
<h2>Release 1.82.2</h2>
<h1>Security</h1>
<ul>
<li>server: Reject requests missing both <code>:authority</code> and
<code>Host</code> headers with HTTP 400 and status
<code>Internal</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/pull/9365">grpc/grpc-go#9365</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1550d9e0cd"><code>1550d9e</code></a>
Change version to 1.83.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9336">#9336</a>)</li>
<li><a
href="ebba6f3f1b"><code>ebba6f3</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>
and <a
href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>
into v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9335">#9335</a>)</li>
<li><a
href="8cfeca0e1e"><code>8cfeca0</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a> to
v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9333">#9333</a>)</li>
<li><a
href="dec6951305"><code>dec6951</code></a>
Change version to 1.83.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9229">#9229</a>)</li>
<li><a
href="4c226daff8"><code>4c226da</code></a>
Change version to 1.83.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9228">#9228</a>)</li>
<li><a
href="c198988aa9"><code>c198988</code></a>
Cherrypick 9223 into v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9279">#9279</a>)</li>
<li><a
href="8ce3ebf24a"><code>8ce3ebf</code></a>
Cherrypick PR 9255 into v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9263">#9263</a>)</li>
<li><a
href="e39384978c"><code>e393849</code></a>
Cherry-pick recent changes from master (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9240">#9240</a>)</li>
<li><a
href="2a112a82f5"><code>2a112a8</code></a>
authz: add onPolicyUpdate callback to authz file watcher (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>)</li>
<li><a
href="1a80fca960"><code>1a80fca</code></a>
vet: adds a check to disallow usage of regex.Compile in xDS code (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9216">#9216</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps the opentelemetry group with 2 updates in the / directory:
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
and
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go).
Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.69.0 to 0.70.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] -
2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/contrib/detectors/ibmcloud/vpc</code>,
a new resource detector for IBM Cloud VPC virtual server instances,
ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>cloud.account.id</code>, <code>cloud.resource_id</code>,
<code>host.id</code>, <code>host.image.id</code>,
<code>host.image.name</code>, <code>host.name</code>, and
<code>host.type</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9011">#9011</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/k8sapi</code>, a new
resource detector that queries the Kubernetes API. Detects
<code>k8s.node.name</code> and <code>k8s.node.uid</code> when
<code>K8S_NODE_NAME</code> is set via the downward API, and
<code>k8s.cluster.uid</code> derived from the kube-system namespace UID
(works on any Kubernetes distribution). (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9108">#9108</a>)</li>
<li>Add new <code>elasticbeanstalk</code> resource detector for AWS
Elastic Beanstalk, ported from
<code>processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk</code>
in opentelemetry-collector-contrib. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8993">#8993</a>)</li>
<li>The resource created by
<code>go.opentelemetry.io/contrib/otelconf</code> now includes <a
href="https://pkg.go.dev/go.opentelemetry.io/otel/sdk/resource#Default">default
SDK attributes</a>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8990">#8990</a>)</li>
<li>Add support for the <code>aws.ecs</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8915">#8915</a>)</li>
<li>Add support for the <code>aws.eks</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9138">#9138</a>)</li>
<li>Add support for the <code>azure.vm</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9074">#9074</a>)</li>
<li>Add support for the <code>gcp</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9137">#9137</a>)</li>
<li>Add
<code>go.opentelemetry.io/contrib/detectors/azure/azureappservice</code>,
a new resource detector for Azure App Service. Detects
<code>cloud.*</code>, <code>service.name</code>,
<code>azure.resource_group.name</code>,
<code>azure.app_service.instance.id</code>, and
<code>deployment.environment.name</code> from the <code>WEBSITE_*</code>
and <code>REGION_NAME</code> environment variables. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9289">#9289</a>)</li>
<li>Add <code>azurecontainerapps</code> resource detector for Azure
Container Apps. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8939">#8939</a>)</li>
<li>Add
<code>go.opentelemetry.io/contrib/detectors/azure/azurefunctions</code>,
a new resource detector for Azure Functions. Detects
<code>cloud.*</code>, <code>service.name</code>,
<code>azure.resource_group.name</code>, <code>faas.instance</code>, and
<code>deployment.environment.name</code> from the
<code>FUNCTIONS_*</code>, <code>WEBSITE_*</code>,
<code>CONTAINER_NAME</code>, and <code>REGION_NAME</code> environment
variables. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9290">#9290</a>)</li>
<li>Add <code>NewResourceDetector</code> along with the
<code>WithAttributeFilter</code> and <code>WithTagKeyFilter</code>
options in
<code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code>.
<code>WithAttributeFilter</code> restricts the returned resource to the
attributes the filter accepts. <code>WithTagKeyFilter</code> opts in to
<code>azure.tag.<name></code> attributes for the VM tags whose
keys satisfy the provided predicate; no VM tags are emitted without it.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/vultr</code> — a new
resource detector for Vultr Cloud Compute instances, ported from
<code>processor/resourcedetectionprocessor/internal/vultr</code> in
<code>opentelemetry-collector-contrib</code>. Detects
<code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>host.id</code>, and
<code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8995">#8995</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.43.0</code>, including updates across instrumentation and
detector modules.
See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.43.0">semantic-conventions
v1.43.0 release</a> for complete details. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9337">#9337</a>)</li>
<li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.42.0</code>, including updates across instrumentation and
detector modules.
See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.42.0">semantic-conventions
v1.42.0 release</a> for complete details. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9196">#9196</a>)</li>
<li>Use direct normalized-key lookups in <code>Carrier.Get</code> and
<code>Carrier.Keys</code> in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9112">#9112</a>)</li>
<li>Update log bridge conversions to use attribute key-values instead of
the removed log key-values in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code>,
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>,
<code>go.opentelemetry.io/contrib/bridges/otelslog</code>, and
<code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9180">#9180</a>)</li>
<li>The <code>Version()</code> function in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>
has been replaced by <code>const Version</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9076">#9076</a>)</li>
<li>Set <code>error.type</code> attribute instead of adding
<code>exception</code> span events in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8977">#8977</a>)</li>
<li>Prefer the gRPC dial target over the resolved peer IP for the
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8904">#8904</a>)</li>
<li>The detector in
<code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code> now
also detects <code>cloud.account.id</code>,
<code>cloud.availability_zone</code>, <code>azure.vm.name</code>,
<code>azure.vm.size</code>, <code>azure.vm.scaleset.name</code>, and
<code>azure.resource_group.name</code>, and prefers
<code>osProfile.computerName</code> for <code>host.name</code> (falling
back to the VM name), reconciling it with the collector-contrib Azure
resource detector. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix Prometheus reader resource label filter configuration in
<code>go.opentelemetry.io/contrib/otelconf/v0.2.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9062">#9062</a>)</li>
<li>Apply
<code>resource.detection/development.attributes.included</code> and
<code>excluded</code> filtering to resource detector attributes in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9131">#9131</a>)</li>
<li>Honor the context configured with <code>WithContext</code> when
constructing resources in
<code>go.opentelemetry.io/contrib/otelconf</code> and
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9160">#9160</a>)</li>
<li>Handle nil response bodies from custom <code>RoundTripper</code>
implementations in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
without panicking. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9184">#9184</a>)</li>
<li>Fix incorrect (overestimated) sum calculation for runtime histograms
in <code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9063">#9063</a>)</li>
<li>Fix <code>Severity.UnmarshalText</code> round trip for positive
<code>FATAL</code> offsets above the named range in
<code>go.opentelemetry.io/contrib/processors/minsev</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9197">#9197</a>)</li>
<li>Reduce binary size by fetching ConfigMaps via
<code>rest.HTTPClientFor</code> instead of the Kubernetes clientset in
<code>go.opentelemetry.io/contrib/detectors/aws/eks</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9284">#9284</a>)</li>
<li><code>TextMapPropagator</code> in
<code>go.opentelemetry.io/contrib/propagators/autoprop</code> returns
the no-op propagator for empty input, matching the behavior of
<code>none</code>. An unknown <code>OTEL_PROPAGATORS</code> value still
returns an error with a nil propagator so
<code>NewTextMapPropagator</code> falls back to the default TraceContext
and Baggage propagators instead of disabling propagation. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9163">#9163</a>)</li>
<li>Preserve error-valued attributes nested in a group as grouped
attributes instead of silently dropping them in
<code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9238">#9238</a>)</li>
<li>Fix a data race in
<code>go.opentelemetry.io/contrib/bridges/otelslog</code> where
concurrent <code>Handle</code> calls could corrupt each other's log
attributes because <code>kvBuffer.KeyValues</code> returned a slice
aliasing a shared buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9229">#9229</a>)</li>
<li>Avoid a panic in
<code>go.opentelemetry.io/contrib/bridges/otelzap</code> when a
malformed error field contains a nil or non-error value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9068">#9068</a>)</li>
<li>Use <code>azure.container_app.instance.id</code> instead of
<code>service.instance.id</code> for the replica name detected by
<code>go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9208">#9208</a>)</li>
<li>Preserve the underlying metadata errors returned with partial
resources from <code>go.opentelemetry.io/contrib/detectors/gcp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9069">#9069</a>)</li>
<li>Copy <code>MultipartForm</code> back to the request
<code>otelmux.Middleware</code> was given after the wrapped handler
returns, so <code>net/http</code> can find and remove the temp files
<code>ParseMultipartForm</code> created on the context-derived request
copy, when <code>otelmux.Middleware</code> wraps a handler directly, in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
This does not cover a handler panic, nor the common
<code>router.Use(...)</code> integration, where
<code>gorilla/mux</code>'s own routing step makes an additional request
copy the middleware cannot write back through; see <a
href="https://redirect.github.com/gorilla/mux/pull/777">gorilla/mux#777</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9361">#9361</a>)</li>
<li>Report the <code>b3</code> header from <code>Fields()</code> for the
default <code>B3Unspecified</code> single-header injection encoding,
matching what <code>Inject</code> writes, in
<code>go.opentelemetry.io/contrib/propagators/b3</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9273">#9273</a>)</li>
<li>Fix <code>go.opentelemetry.io/contrib/propagators/aws/xray</code>
producing deterministic trace and span IDs when the seed read from
<code>crypto/rand</code> silently failed, by switching to
<code>math/rand/v2</code>'s concurrency-safe top-level generator. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9359">#9359</a>)</li>
<li>Strip connection number suffix from connection ID in
<code>go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo</code>
to prevent unbounded metric cardinality. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9352">#9352</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c8a87a60ba"><code>c8a87a6</code></a>
Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9413">#9413</a>)</li>
<li><a
href="cde125c563"><code>cde125c</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9384">#9384</a>)</li>
<li><a
href="88572a7662"><code>88572a7</code></a>
chore(deps): update googleapis to 6ac0973 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9409">#9409</a>)</li>
<li><a
href="e4f511a0f3"><code>e4f511a</code></a>
chore(deps): update github/codeql-action action to v4.37.5 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9410">#9410</a>)</li>
<li><a
href="265eb0b5fe"><code>265eb0b</code></a>
fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9317">#9317</a>)</li>
<li><a
href="941ba46979"><code>941ba46</code></a>
chore(deps): update github.com/charmbracelet/ultraviolet digest to
8b69304 (#...</li>
<li><a
href="ededd3b571"><code>ededd3b</code></a>
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9406">#9406</a>)</li>
<li><a
href="7c6e819d4e"><code>7c6e819</code></a>
fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9405">#9405</a>)</li>
<li><a
href="ec1e544a0d"><code>ec1e544</code></a>
chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9403">#9403</a>)</li>
<li><a
href="5d7e16aa11"><code>5d7e16a</code></a>
chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9402">#9402</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.69.0...zpages/v0.70.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.45.0/v0.67.0/v0.21.0/v0.0.18</h2>
<h2>Overview</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.42.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.43.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383">#8383</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.42.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.43.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383">#8383</a>)</li>
<li>Fix a memory leak in the <code>Reservoir</code> implementation in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code>, where storing
the full <code>context.Context</code> pinned large objects such as gRPC
transport buffers. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8389">#8389</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="93a693edee"><code>93a693e</code></a>
Release v1.45.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8693">#8693</a>)</li>
<li><a
href="c65d435b43"><code>c65d435</code></a>
Merge commit from fork</li>
<li><a
href="223f9fdce4"><code>223f9fd</code></a>
sdk/metric: remove obsolete randomFloat64 TODO (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8685">#8685</a>)</li>
<li><a
href="06272bc491"><code>06272bc</code></a>
fix(deps): update googleapis to 6ac0973 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8694">#8694</a>)</li>
<li><a
href="a4f238f576"><code>a4f238f</code></a>
chore(deps): update github.com/charmbracelet/ultraviolet digest to
8b69304 (#...</li>
<li><a
href="37140e7882"><code>37140e7</code></a>
chore(deps): update codspeedhq/action action to v5.0.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8690">#8690</a>)</li>
<li><a
href="cef0855960"><code>cef0855</code></a>
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8689">#8689</a>)</li>
<li><a
href="e814a7281f"><code>e814a72</code></a>
Merge commit from fork</li>
<li><a
href="bfd8eb7f85"><code>bfd8eb7</code></a>
chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8687">#8687</a>)</li>
<li><a
href="48db2c659c"><code>48db2c6</code></a>
chore(deps): update github/codeql-action action to v4.37.5 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8692">#8692</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.66.0 to
0.67.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.42.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.43.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383">#8383</a>)</li>
<li>Fix a memory leak in the <code>Reservoir</code> implementation in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code>, where storing
the full <code>context.Context</code> pinned large objects such as gRPC
transport buffers. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8389">#8389</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="93a693edee"><code>93a693e</code></a>
Release v1.45.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8693">#8693</a>)</li>
<li><a
href="c65d435b43"><code>c65d435</code></a>
Merge commit from fork</li>
<li><a
href="223f9fdce4"><code>223f9fd</code></a>
sdk/metric: remove obsolete randomFloat64 TODO (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8685">#8685</a>)</li>
<li><a
href="06272bc491"><code>06272bc</code></a>
fix(deps): update googleapis to 6ac0973 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8694">#8694</a>)</li>
<li><a
href="a4f238f576"><code>a4f238f</code></a>
chore(deps): update github.com/charmbracelet/ultraviolet digest to
8b69304 (#...</li>
<li><a
href="37140e7882"><code>37140e7</code></a>
chore(deps): update codspeedhq/action action to v5.0.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8690">#8690</a>)</li>
<li><a
href="cef0855960"><code>cef0855</code></a>
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8689">#8689</a>)</li>
<li><a
href="e814a7281f"><code>e814a72</code></a>
Merge commit from fork</li>
<li><a
href="bfd8eb7f85"><code>bfd8eb7</code></a>
chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8687">#8687</a>)</li>
<li><a
href="48db2c659c"><code>48db2c6</code></a>
chore(deps): update github/codeql-action action to v4.37.5 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8692">#8692</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/metric/x/v0.66.0...metric/x/v0.67.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel/metric's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.45.0/v0.67.0/v0.21.0/v0.0.18</h2>
<h2>Overview</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability metrics to
<code>BatchProcessor</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7124">#7124</a>)</li>
<li>Add the experimental <code>WithUnsafeAttributes</code> no-copy
attribute option to <code>go.opentelemetry.io/otel/metric/x</code> for
future performance improvements. This API is a work in progress. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8251">#8251</a>)</li>
<li>Add <code>Map</code> and <code>MapValue</code> functions for the new
<code>MAP</code> attribute type in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8445">#8445</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Support <code>MAP</code> attributes in
<code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8453">#8453</a>)</li>
<li>Apply <code>AttributeValueLengthLimit</code> recursively to values
contained in <code>attribute.MAP</code> attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8454">#8454</a>)</li>
<li>Remove duplicate keys from <code>attribute.MAP</code> values in
<code>go.opentelemetry.io/otel/sdk/resource</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/log</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in span, event, link, and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/trace</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Remove duplicate keys by default from <code>attribute.MAP</code>
values in measurement and instrumentation scope attributes in
<code>go.opentelemetry.io/otel/sdk/metric</code> using last-value-wins
semantics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Extend <code>WithAllowKeyDuplication</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to disable duplicate-key
removal in <code>attribute.MAP</code> values for instrumentation scope
attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8471">#8471</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.42.0</code>
package.
The package contains semantic conventions from the <code>v1.42.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.42.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8484">#8484</a>)</li>
<li>Add <code>WithoutPanicRecording</code> as a
<code>TracerProviderOption</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> to disable exception
event recording for panics. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8532">#8532</a>)</li>
<li>Add the <code>go.opentelemetry.io/otel/semconv/v1.43.0</code>
package.
The package contains semantic conventions from the <code>v1.43.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.43.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.42.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8628">#8628</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> now uses a
time-unbiased sampling algorithm for exemplars. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8306">#8306</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Use
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/attribute.KeyValue</code> for log bodies
and attributes in <code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/log/logtest</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/sdk/log/logtest</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Encode log bodies and attributes as
<code>go.opentelemetry.io/otel/attribute.Value</code> JSON in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>Improve the performance of hashing <code>BOOLSLICE</code>,
<code>INT64SLICE</code>, <code>FLOAT64SLICE</code>, and
<code>STRINGSLICE</code> attribute values by avoiding reflection for
short slices in <code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8511">#8511</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_METRICS_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/metrics"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> <code>WithEndpointURL</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
no longer appends the default signal path when an endpoint URL has no
path, making the behavior consistent with
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
and with setting the endpoint through
<code>OTEL_EXPORTER_OTLP_TRACES_ENDPOINT</code>. If the URL has no path
component, the root path (<code>/</code>) is used. Use
<code>WithEndpointURL(url.JoinPath(endpoint,
"/v1/traces"))</code> to preserve the previous behavior. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8538">#8538</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>WithExportBufferSize</code> in
<code>go.opentelemetry.io/otel/sdk/log</code>. The option remains
available for source compatibility but no longer affects behavior;
<code>BatchProcessor</code> no longer maintains a separate
export-request buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8620">#8620</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>⚠️ <strong>Breaking Change:</strong> Remove <code>Kind</code>,
<code>Value</code>, <code>KeyValue</code>, their constructors, and
attribute conversion helpers from
<code>go.opentelemetry.io/otel/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8490">#8490</a>)</li>
<li>⚠️ <strong>Breaking Change:</strong> Remove the
<code>AttributeValueLengthLimit</code> and
<code>AttributeCountLimit</code> fields from <code>RecordFactory</code>
in <code>go.opentelemetry.io/otel/sdk/log/logtest</code>; records
produced by the factory now keep attribute limits disabled so test code
can append exact attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8556">#8556</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Apply TLS certificates configured through environment variables to
gRPC connections in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.</li>
<li>Prevent panics in
<code>go.opentelemetry.io/otel/bridge/opentracing</code> when
OpenTracing baggage is propagated concurrently with
<code>Span.SetBaggageItem</code>.</li>
<li>Fix an off-by-one error in <code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> that prevented
the first exemplar from being sampled after the reservoir was filled.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8309">#8309</a>)</li>
<li>Interpret HTTP <code>Retry-After</code> header values as seconds
instead of nanoseconds when retrying OTLP HTTP exports in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>,
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>,
and
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8383">#8383</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add experimental observability me...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.38.0 to
0.40.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d3398d06de"><code>d3398d0</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="57549bfb0d"><code>57549bf</code></a>
sumdb: ignore unrelated hashes in Lookup</li>
<li><a
href="96f62ae6e9"><code>96f62ae</code></a>
sumdb/tlog: fix TileHashReader authentication bypass</li>
<li><a
href="13be9020bb"><code>13be902</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.38.0...v0.40.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Consolidates the five open dependabot PRs into a single change so they
can be reviewed and merged together. Each bump was reproduced against
current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA
pins applied for the actions group), rather than merging the individual
branches, to avoid stale `go.sum` conflicts.
## Root module (`go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 |
| `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 |
| `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 |
## Deploy module (`deploy/go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449
|
## GitHub Actions (#1476)
- `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`,
`deploy-production.yml`, `deploy-staging.yml`
- `actions/download-artifact` v4 → v8.0.1 in
`close-invalid-publish-prs.yml`
`go mod tidy` re-resolved transitive dependencies in both modules
accordingly.
## Verification
- `go build ./...` passes (root + deploy)
- `go vet ./...` passes
- `govulncheck ./...` reports no `golang.org/x/text` finding (the
GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0)
## Follow-up
Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449,
#1476) can be closed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Problem
The **Build, Lint, and Validate** CI job is failing on every open PR
(#1480, #1474, #1449) and on `main`. The failing step is `govulncheck`:
```
Vulnerability #1: GO-2026-5970
Infinite loop on invalid input in golang.org/x/text
Found in: golang.org/x/text@v0.38.0
Fixed in: golang.org/x/text@v0.39.0
```
This is **not** caused by any of those PRs' changes —
`govulncheck-action` fetches the live vulnerability database at runtime,
so when GO-2026-5970 was published, every branch based on the current
`main` started failing. The vulnerable symbol is reachable via:
- `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do`
- `database.NewTestDB` → `pgx.Connect`
so the scan exits with code 3.
## Fix
Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the
fixed `v0.39.0` and `go mod tidy`.
## Verification
- `govulncheck ./...` no longer reports GO-2026-5970 (confirmed
locally).
- `go build ./...` passes.
## Note
The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also <
v0.39.0. It is a separate module and is **not** scanned by this CI job
(govulncheck runs `./...` in the root module only), so it does not block
CI. Worth a follow-up bump for hygiene, but out of scope here.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.37.0 to
0.38.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="792ac169a9"><code>792ac16</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="fe2ec04f7c"><code>fe2ec04</code></a>
all: fix some comments to improve readability</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.37.0...v0.38.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.18.0 to 3.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Key refresh should set <code>no-cache</code> to get most up to
date keys by <a
href="https://github.com/Yanni8"><code>@Yanni8</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li>
<li>oidc: add support for validating back-channel logout tokens by <a
href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/486">coreos/go-oidc#486</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Yanni8"><code>@Yanni8</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4204f0b2b0"><code>4204f0b</code></a>
oidc: add support for validating back-channel logout tokens</li>
<li><a
href="f77e01c509"><code>f77e01c</code></a>
fix: Key refresh should set no-cache to get most up to date keys</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.2
to 5.10.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.10.0 (June 3, 2026)</h1>
<p>This release includes a significant amount of hardening against
malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds
binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds
<code>require_auth</code> to restrict which authentication
methods a server may use (mitigating downgrade attacks under
<code>sslmode=prefer</code>), and ensures cancellation requests are
sent over TLS when the original connection used TLS.</p>
<h2>Features</h2>
<ul>
<li>Add <code>require_auth</code> to restrict accepted server
authentication methods (Sean Chittenden at CrowdStrike, Inc.)</li>
<li>Add <code>ParseConfigOptions.ConnStringAllowedKeys</code> to
restrict allowed connection string keys (Sean Chittenden at CrowdStrike,
Inc.)</li>
<li>Add <code>StructArgs</code> and <code>StrictStructArgs</code> for
<code>@</code>-named queries (Tubelight30)</li>
<li>Add <code>ErrConnClosed</code> sentinel error and unwrap it from
<code>connLockError</code> (Charlie Tonneslan)</li>
<li>pgxpool: check if connection is expired before acquire
(arthurdotwork)</li>
</ul>
<h2>Security Hardening</h2>
<ul>
<li>Encrypt <code>CancelRequest</code> connection when the primary
connection used TLS (Sean Chittenden at CrowdStrike, Inc.)</li>
<li>Cap server-supplied SCRAM iteration count (Sean Chittenden at
CrowdStrike, Inc.)</li>
<li>Default Frontend max message body length to ~1 GiB (Sean Chittenden
at CrowdStrike, Inc.)</li>
<li>Bound hstore binary decode against malicious server input (Sean
Chittenden at CrowdStrike, Inc.)</li>
<li>Bound array binary decode element length against remaining message
bytes (Sean Chittenden at CrowdStrike, Inc.)</li>
<li>Bound array element count against remaining message bytes (Sean
Chittenden at CrowdStrike, Inc.)</li>
<li>Bound range, multirange, and tsvector binary decoders (Sean
Chittenden at CrowdStrike, Inc.)</li>
<li>Document secure connection configuration (Sean Chittenden at
CrowdStrike, Inc.)</li>
<li>Fix panic on malformed geometric text; return an error instead
(MaIII)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>Fix scanning <code>"char"</code> (OID 18) into
<code>*string</code> in binary format (luongs3)</li>
<li>Fix handling of typed-nil <code>driver.Valuer</code> in array and
composite codecs (Donncha Fahy)</li>
<li>Fix <code>CopyData.Data</code> hex decoding in
<code>UnmarshalJSON</code> (Charlie Tonneslan)</li>
<li>Fix data race when context is cancelled during connect</li>
<li>Fix <code>parseKeywordValueSettings</code> rejecting trailing
whitespace (alliasgher)</li>
<li>pgconn: preserve full error chain in
<code>normalizeTimeoutError</code> (Charlie Tonneslan)</li>
<li>pgconn: use a fresh context for the fallback connection in
<code>connectPreferred</code> (Charlie Tonneslan)</li>
<li>pgxpool: fix <code>MaxLifetimeDestroyCount</code> and ping order for
acquire-time expiry check</li>
<li>Add missing error check of <code>rows.Err</code> to load types (Jen
Altavilla)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7293fb1112"><code>7293fb1</code></a>
Update changelog for v5.10.0</li>
<li><a
href="1ade285284"><code>1ade285</code></a>
pgconn: document secure connection configuration</li>
<li><a
href="b4d6d4d1be"><code>b4d6d4d</code></a>
pgtype: bound range, multirange, and tsvector binary decoders</li>
<li><a
href="0639b37f8f"><code>0639b37</code></a>
pgconn: add ParseConfigOptions.ConnStringAllowedKeys</li>
<li><a
href="b28e65b0c3"><code>b28e65b</code></a>
pgtype: bound array element count against remaining message bytes</li>
<li><a
href="cd1f389d37"><code>cd1f389</code></a>
pgtype: bound array binary decode element length against remaining
bytes</li>
<li><a
href="ff27b5bbea"><code>ff27b5b</code></a>
pgtype: bound hstore binary decode against malicious server input</li>
<li><a
href="a6002e12a8"><code>a6002e1</code></a>
pgproto3: default Frontend max message body length to ~1 GiB</li>
<li><a
href="44f61732ec"><code>44f6173</code></a>
pgconn: cap server-supplied SCRAM iteration count</li>
<li><a
href="1a976f7bb9"><code>1a976f7</code></a>
pgconn: add require_auth to restrict accepted server auth methods</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.9.2...v5.10.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Bumps `golang.org/x/net` from v0.53.0 to v0.55.0 to fix
[GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) (failure to reject
ASCII-only Punycode-encoded labels in `golang.org/x/net/idna`).
- govulncheck flagged the vuln via `auth.DefaultHTTPKeyFetcher.FetchKey`
→ `http.Client.Do` → `idna.ToASCII` at
`internal/api/handlers/v0/auth/http.go:191`.
- Also brings in associated `x/crypto`, `x/sys`, `x/text` bumps via `go
mod tidy`.
This unblocks open dependabot PRs (e.g. #1298) that are failing CI on
the same govulncheck finding despite not touching the root module.
## Test plan
- [x] `go build ./...`
- [x] `govulncheck` no longer reports GO-2026-5026 locally
- [ ] CI passes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.35.0 to
0.36.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="643da9ba74"><code>643da9b</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="ccc3cdf529"><code>ccc3cdf</code></a>
zip: include 'but content has correct sum' note in TestVCS</li>
<li><a
href="ab30318032"><code>ab30318</code></a>
zip: update zip hashes for new flate compression</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.35.0...v0.36.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
Bumps `golang.org/x/net` from `v0.52.0` to `v0.53.0` to address
`GO-2026-4918` (HTTP/2 transport infinite loop on bad
`SETTINGS_MAX_FRAME_SIZE`). `go mod tidy` also pulls
`golang.org/x/crypto` to v0.50.0 and `golang.org/x/text` to v0.36.0.
## Why now
`govulncheck` is failing on `main` and every open Dependabot PR (#1263,
#1264, #1265) after the 2026-05 Go security release. The findings split
into:
- **One we control** — `golang.org/x/net@v0.52.0` → fixed in `v0.53.0`.
Addressed here.
- **Six stdlib findings** (`GO-2026-4986`, `4982`, `4980`, `4977`,
`4971`, and the stdlib half of `4918`) — all fixed in `go1.26.3`. We
deliberately do **not** pin a Go patch in the workflow: `go-version:
'stable'` will pick up `1.26.3` automatically once the
`actions/go-versions` manifest catches up, with no workflow maintenance.
## Test plan
- [x] `go build ./...`
- [x] `go vet ./...`
- [x] `GOTOOLCHAIN=go1.26.3 govulncheck ./...` → "No vulnerabilities
found."
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps [github.com/caarlos0/env/v11](https://github.com/caarlos0/env)
from 11.4.0 to 11.4.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/caarlos0/env/releases">github.com/caarlos0/env/v11's
releases</a>.</em></p>
<blockquote>
<h2>v11.4.1</h2>
<h2>Changelog</h2>
<h3>Bug fixes</h3>
<ul>
<li>6daeb06ac7e3c9532a7eaa5768d45917393b7480: fix: use Key instead of
OwnKey in rawEnvVars to properly reference existing defaults in complex
structs (<a
href="https://redirect.github.com/caarlos0/env/issues/412">#412</a>) (<a
href="https://github.com/AndrewChubatiuk"><code>@AndrewChubatiuk</code></a>)</li>
</ul>
<h3>Documentation updates</h3>
<ul>
<li>1ff55e6c9733833ce75d62b345916a407dbe4158: docs: adaptive starchart
(<a href="https://redirect.github.com/caarlos0/env/issues/416">#416</a>)
(<a
href="https://github.com/alexandear"><code>@alexandear</code></a>)</li>
</ul>
<h3>Other work</h3>
<ul>
<li>cf4a9682420b025e44b4773fd7ee0be48bb68b2f: ci(deps): bump the actions
group with 3 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/411">#411</a>) (<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot])</li>
<li>33faf6f333c2c3dacef2991825f8e03960a2c0cb: ci(deps): bump the actions
group with 3 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/417">#417</a>) (<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot])</li>
<li>0cb635b62488f4d310809a82a8832cedc9aa94eb: ci(deps): bump the actions
group with 6 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/415">#415</a>) (<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot])</li>
<li>a72d89a8930fc800372a6a338a1acf33e5cc3a56: ci: update release config
(<a href="https://github.com/caarlos0"><code>@caarlos0</code></a>)</li>
</ul>
<hr />
<p><em>Released with <a href="https://goreleaser.com/pro">GoReleaser
Pro</a>!</em></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a72d89a893"><code>a72d89a</code></a>
ci: update release config</li>
<li><a
href="6daeb06ac7"><code>6daeb06</code></a>
fix: use Key instead of OwnKey in rawEnvVars to properly reference
existing d...</li>
<li><a
href="33faf6f333"><code>33faf6f</code></a>
ci(deps): bump the actions group with 3 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/417">#417</a>)</li>
<li><a
href="1ff55e6c97"><code>1ff55e6</code></a>
docs: adaptive starchart (<a
href="https://redirect.github.com/caarlos0/env/issues/416">#416</a>)</li>
<li><a
href="0cb635b624"><code>0cb635b</code></a>
ci(deps): bump the actions group with 6 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/415">#415</a>)</li>
<li><a
href="cf4a968242"><code>cf4a968</code></a>
ci(deps): bump the actions group with 3 updates (<a
href="https://redirect.github.com/caarlos0/env/issues/411">#411</a>)</li>
<li>See full diff in <a
href="https://github.com/caarlos0/env/compare/v11.4.0...v11.4.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.1
to 5.9.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.9.2 (April 18, 2026)</h1>
<p>Fix SQL Injection via placeholder confusion with dollar quoted string
literals (GHSA-j88v-2chj-qfwx)</p>
<p>SQL injection can occur when:</p>
<ol>
<li>The non-default simple protocol is used.</li>
<li>A dollar quoted string literal is used in the SQL query.</li>
<li>That query contains text that would be would be interpreted outside
as a placeholder outside of a string literal.</li>
<li>The value of that placeholder is controllable by the attacker.</li>
</ol>
<p>e.g.</p>
<pre lang="go"><code>attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`,
pgx.QueryExecModeSimpleProtocol, attackValue)
</code></pre>
<p>This is unlikely to occur outside of a contrived scenario.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0aeabbcf11"><code>0aeabbc</code></a>
Release v5.9.2</li>
<li><a
href="60644f8491"><code>60644f8</code></a>
Fix SQL sanitizer bugs with dollar-quoted strings and placeholder
overflow</li>
<li><a
href="a5680bc945"><code>a5680bc</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2531">#2531</a> from
dolmen-go/godoc-add-links</li>
<li><a
href="e34e452400"><code>e34e452</code></a>
doc: Add godoc links</li>
<li><a
href="08c9bb1f0d"><code>08c9bb1</code></a>
Fix Stringer types encoded as text instead of numeric value in composite
fields</li>
<li><a
href="96b4dbdfd0"><code>96b4dbd</code></a>
Remove unstable test</li>
<li><a
href="acf88e0065"><code>acf88e0</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2526">#2526</a> from
abrightwell/abrightwell-min-proto</li>
<li><a
href="2f81f1fc03"><code>2f81f1f</code></a>
Update <code>max_protocol_version</code> and
<code>min_protocol_version</code> defaults</li>
<li>See full diff in <a
href="https://github.com/jackc/pgx/compare/v5.9.1...v5.9.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.17.0 to 3.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>.github: configure dependabot by <a
href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/477">coreos/go-oidc#477</a></li>
<li>.github: update go versions in CI by <a
href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/480">coreos/go-oidc#480</a></li>
<li>build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/coreos/go-oidc/pull/478">coreos/go-oidc#478</a></li>
<li>build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/coreos/go-oidc/pull/479">coreos/go-oidc#479</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0">https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da6b3bfca8"><code>da6b3bf</code></a>
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4</li>
<li><a
href="7f80694215"><code>7f80694</code></a>
build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0</li>
<li><a
href="7271de5758"><code>7271de5</code></a>
.github: update go versions in CI</li>
<li><a
href="3ccf20fdc4"><code>3ccf20f</code></a>
.github: configure dependabot</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.8.0
to 5.9.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.9.1 (March 22, 2026)</h1>
<ul>
<li>Fix: batch result format corruption when using cached prepared
statements (reported by Dirkjan Bussink)</li>
</ul>
<h1>5.9.0 (March 21, 2026)</h1>
<p>This release includes a number of new features such as
SCRAM-SHA-256-PLUS support, OAuth authentication support, and
PostgreSQL protocol 3.2 support.</p>
<p>It significantly reduces the amount of network traffic when using
prepared statements (which are used automatically by
default) by avoiding unnecessary Describe Portal messages. This also
reduces local memory usage.</p>
<p>It also includes multiple fixes for potential DoS due to panic or OOM
if connected to a malicious server that sends
deliberately malformed messages.</p>
<ul>
<li>Require Go 1.25+</li>
<li>Add SCRAM-SHA-256-PLUS support (Adam Brightwell)</li>
<li>Add OAuth authentication support for PostgreSQL 18 (David
Schneider)</li>
<li>Add PostgreSQL protocol 3.2 support (Dirkjan Bussink)</li>
<li>Add tsvector type support (Adam Brightwell)</li>
<li>Skip Describe Portal for cached prepared statements reducing network
round trips</li>
<li>Make LoadTypes query easier to support on "postgres-like"
servers (Jelte Fennema-Nio)</li>
<li>Default empty user to current OS user matching libpq behavior
(ShivangSrivastava)</li>
<li>Optimize LRU statement cache with custom linked list and node
pooling (Mathias Bogaert)</li>
<li>Optimize date scanning by replacing regex with manual parsing
(Mathias Bogaert)</li>
<li>Optimize pgio append/set functions with direct byte shifts (Mathias
Bogaert)</li>
<li>Make RowsAffected faster (Abhishek Chanda)</li>
<li>Fix: Pipeline.Close panic when server sends multiple FATAL errors
(Varun Chawla)</li>
<li>Fix: ContextWatcher goroutine leak (Hank Donnay)</li>
<li>Fix: stdlib discard connections with open transactions in
ResetSession (Jeremy Schneider)</li>
<li>Fix: pipelineBatchResults.Exec silently swallowing lastRows
error</li>
<li>Fix: ColumnTypeLength using BPCharArrayOID instead of BPCharOID</li>
<li>Fix: TSVector text encoding returning nil for valid empty
tsvector</li>
<li>Fix: wrong error messages for Int2 and Int4 underflow</li>
<li>Fix: Numeric nil Int pointer dereference with Valid: true</li>
<li>Fix: reversed strings.ContainsAny arguments in
Numeric.ScanScientific</li>
<li>Fix: message length parsing on 32-bit platforms</li>
<li>Fix: FunctionCallResponse.Decode mishandling of signed result
size</li>
<li>Fix: returning wrong error in configTLS when DecryptPEMBlock fails
(Maxim Motyshen)</li>
<li>Fix: misleading ParseConfig error when default_query_exec_mode is
invalid (Skarm)</li>
<li>Fix: missed Unwatch in Pipeline error paths</li>
<li>Clarify too many failed acquire attempts error message</li>
<li>Better error wrapping with context and SQL statement (Aneesh
Makala)</li>
<li>Enable govet and ineffassign linters (Federico Guerinoni)</li>
<li>Guard against various malformed binary messages (arrays, hstore,
multirange, protocol messages)</li>
<li>Fix various godoc comments (ferhat elmas)</li>
<li>Fix typos in comments (Oleksandr Redko)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e4eaedb47"><code>4e4eaed</code></a>
Release v5.9.1</li>
<li><a
href="6273188265"><code>6273188</code></a>
Fix batch result format corruption when using cached prepared
statements</li>
<li><a
href="f7b90c2f1a"><code>f7b90c2</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2524">#2524</a> from
dbussink/pipeline-result-format-reuse</li>
<li><a
href="3ce6d75be4"><code>3ce6d75</code></a>
Add failing test: batch scan corrupted in cache_statement mode</li>
<li><a
href="b4d8e62b66"><code>b4d8e62</code></a>
Release v5.9.0</li>
<li><a
href="c227cd4f76"><code>c227cd4</code></a>
Bump minimum Go version from 1.24 to 1.25</li>
<li><a
href="f492c14836"><code>f492c14</code></a>
Use reflect.TypeFor instead of reflect.TypeOf for static types</li>
<li><a
href="ad8fb08d3f"><code>ad8fb08</code></a>
Use sync.WaitGroup.Go to simplify goroutine spawning</li>
<li><a
href="303377376d"><code>3033773</code></a>
Remove go1.26 build tag from synctest test</li>
<li><a
href="83ffb3c222"><code>83ffb3c</code></a>
Validate multirange element count against source length before
allocating</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.8.0...v5.9.1">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.33.0 to
0.34.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1ac721dff8"><code>1ac721d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="fb1fac8b36"><code>fb1fac8</code></a>
all: upgrade go directive to at least 1.25.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.33.0...v0.34.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot[bot]
Radoslav Dimitrov