modelcontextprotocol/registry
Watch
1
0
Fork
You've already forked registry
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
573 commits 1 branch 36 tags 50 MiB
Commit graph

573 commits

This branch
This branch
All branches
Author SHA1 Message Date
Radoslav Dimitrov
0cb1f6bf52
 		fix: recalculate isLatest after status changes (#1081) (#1201) v1.7.0 
## Summary

Fixes #1081. When the version flagged `is_latest` was soft-deleted, no
other version was promoted, and because `GetCurrentLatestVersion` didn't
filter deleted rows, subsequent publishes with a lower semver never
became latest — leaving `/v0/servers/{name}/versions/latest` permanently
404.

This PR has two parts:

### 1. Code fix — recalculate `is_latest` on every status change

- Recalculate `is_latest` after every status mutation
(`UpdateServerStatus`, `UpdateAllVersionsStatus`, and the inline status
change in `UpdateServer`), in the same transaction that already holds
the per-server advisory lock.
- Winner selection reuses the existing `CompareVersions` logic: highest
non-deleted version gets the flag; if every version is deleted, the
highest deleted version keeps it so admin lookups via
`includeDeleted=true` still resolve the server (important for restore
flows).
- New `SetLatestVersion` DB primitive issues two statements (clear old,
set new) — `idx_unique_latest_per_server` is a non-deferrable unique
partial index, so a single `UPDATE` that flips two rows trips the
constraint.

### 2. One-shot migration — heal servers already affected (no manual SQL
needed)

`014_heal_is_latest.sql` promotes the highest non-deleted version on
every server whose `is_latest` flag is on a deleted row (or absent
entirely). Picker parses `major.minor.patch` numerically and falls back
to `published_at` for non-semver or as a tiebreaker. Heals
`io.github.containers/kubernetes-mcp-server` to `0.0.61` automatically
and catches any other servers silently affected by the original bug,
without hardcoded version numbers.

Picker behavior vs. `CompareVersions`:
- Standard `M.m.p` semver: matches exactly, including the
backport-after-delete case (e.g. published 1.0.1 then 1.0.0 hotfix after
deleting 2.0.0 → picks 1.0.1, not 1.0.0).
- Non-semver: falls through to `published_at DESC`. Reasonable.
- Prereleases (`1.0.0-alpha` vs `1.0.0`): both parse to `(1,0,0)`,
tiebreak by `published_at`. Diverges from `CompareVersions` (which
always says `1.0.0 > 1.0.0-alpha`). Edge case requires (a) server hit by
this bug AND (b) prereleases at the top of the version list. Acceptable;
the publisher can flip it with one `mcp-publisher status` call (which
now triggers proper recalc thanks to part 1).

## Verification

End-to-end curl repro of the exact scenario from the issue, run against
both `main` and this branch:

**Before (main):**
```
publish 1.0.0 → 200
publish 0.0.59 → 200
PATCH .../1.0.0/status {deleted} → 200
GET /versions/latest → 404            ← bug
publish 0.0.60 → 200
GET /versions/latest → 404            ← bug persists, 0.0.60 has isLatest=False
```

**After (this branch):**
```
publish 1.0.0 → 200
publish 0.0.59 → 200
PATCH .../1.0.0/status {deleted} → 200
GET /versions/latest → 200 (0.0.59, isLatest=true)
publish 0.0.60 → 200
GET /versions/latest → 200 (0.0.60, isLatest=true)
```

## Test plan

- [x] Service tests covering: soft-delete latest → next highest active
promoted; the exact #1081 repro end-to-end through the service;
all-versions-deleted still keeps highest addressable for admin;
restore-to-higher-version reclaims latest.
- [x] Migration tests covering: kubernetes-mcp-server scenario (heals to
highest semver); backport scenario (semver beats most-recent-published);
no-is_latest-row defensive case; all-deleted server left untouched;
healthy server left untouched; non-semver versions fall back to
`published_at`.
- [x] Full unit test suite (`./internal/... ./cmd/...`) passes against a
real Postgres.
- [x] `make lint` (0 issues) and `make validate` pass.
- [x] Manual curl repro against a running registry confirms the fix
resolves the failure mode and `main` still reproduces it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-25 11:59:28 -04:00
Radoslav Dimitrov
c5f50e817b
 		fix(auth): better DNS verification errors and wrong-selector hint (#1202) 
## Summary

DNS auth users have repeatedly hit two failure modes that both produce
the same opaque "Ed25519 signature verification failed" error, making
them indistinguishable to debug. This PR makes both diagnosable
end-to-end without changing the auth protocol or any successful path.

The two recurring failure modes:

1. **Wrong placement** — TXT record put under a selector
(`_mcp-auth.<domain>` or `_mcp-registry.<domain>`) instead of the apex.
DKIM-style intuition, but MCP DNS auth uses SPF-style apex placement.
See #385 (PR #388 fixed the docs but the failure recurred), #1103,
#1126.
2. **Stale apex record** — old TXT record left behind after a key
rotation, silently tried first and rejected.

## Changes

**`internal/api/handlers/v0/auth/dns.go`** — when the apex has no
`v=MCPv1` record, probe `_mcp-auth.<domain>` and
`_mcp-registry.<domain>` in parallel (2s individual timeout). If a
record is found there, return a targeted error pointing the user at the
apex. Costs zero extra DNS work in the success path.

**`internal/api/handlers/v0/auth/common.go`** — when verification fails
against records that *are* present, include short fingerprints of every
key the registry tried (`ed25519:YJLsHFhu`-style 8-char prefix). A new
`ErrSignatureMismatch` sentinel keeps structural errors (wrong signature
size, unsupported algorithm) passing through unchanged via `errors.Is`,
so existing assertions on those messages still hold.

**`docs/modelcontextprotocol-io/authentication.mdx`** — anti-pattern
`<Warning>` callout in the DNS section explicitly warning against
selector placement and stale records.

**Tests** — two new tests:
- `TestDNSAuthHandler_WrongSelectorProbe` — verifies the probe surfaces
records found at `_mcp-auth.` / `_mcp-registry.` and falls through to
the standard error when nothing is found anywhere
- `TestDNSAuthHandler_StaleKeyFingerprintInError` — verifies the
fingerprint hint appears in the failure message for #1126's exact
scenario

One existing test assertion was updated from a generic `"signature
verification failed"` substring to the more specific `"invalid signature
size for ECDSA P-384"` it should always have been asserting; the new
sentinel-based logic surfaces structural errors verbatim.

## Test plan

- [x] `make lint` — clean
- [x] `make test-unit` — all auth tests pass (existing + 2 new)
- [x] Verified existing single-key and multi-key paths preserve their
original (more specific) error messages where they were already specific
- [ ] Reviewer to sanity-check the docs callout renders well in the
Mintlify theme

## Out of scope

The publisher-side preflight DNS check (cross-link in #845) is
intentionally **not** in this PR — that belongs in the broader CLI UX
work tracked by #845.

Refs #845, #385, #1103
Fixes #1126

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-25 11:22:06 -04:00
Radoslav Dimitrov
8b893ae1f1
 		docs: recommend namespaced subkeys inside publisher-provided (#1197) 
## Summary
- Adds a short "Recommended: Namespaced Subkeys" subsection to
`official-registry-requirements.md`, documenting the reverse-DNS subkey
convention for `publisher-provided` metadata with one worked example
- Explicitly notes this is not enforced, to avoid churning the ~15
existing flat-key examples elsewhere in the docs

Closes #477

## Test plan
- [ ] Render the file on GitHub and verify the new subsection appears
right after the `Publisher-Provided Metadata` size-limit note

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-25 07:15:32 -07:00
Radoslav Dimitrov
ccb7057c33
 		docs: note PostgreSQL requirement for prebuilt Docker image (#1196) 
## Summary
- Clarifies in the README that the prebuilt Docker image does not bundle
PostgreSQL and needs an external instance reachable via
\`MCP_REGISTRY_DATABASE_URL\`
- Points readers to \`docker-compose.yml\` as a working multi-container
example

Closes #723

## Test plan
- [ ] Render the README on GitHub and verify the note appears in the
"Alternative: Running a pre-built Docker image" section

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-25 07:15:00 -07:00
Radoslav Dimitrov
aaa634ebb6
 		fix(publisher): honor mcpName as the authoritative server name in init (#1195) 
## Summary

Follow-up to #1145. When `mcpName` is set in `package.json`, it should
be the server name used by `mcp-publisher init`. Two issues addressed:

### 1. `getNameFromPackageJSON` mangled `mcpName` through npm-name
transformation

`mcpName` values are already in MCP server name format (e.g.
`io.github.foo/bar`). The existing code ran them through the
`@scope/name → io.github.scope/name` transform and its
`io.github.<your-username>/*` fallback, producing a broken double-prefix
result.

Example with `"mcpName": "io.github.acme/weather"`:
- Before: `io.github.<your-username>/io.github.acme/weather` ❌
- After: `io.github.acme/weather` ✅

### 2. `detectServerName` consulted git before `mcpName`

Even with `mcpName` set in `package.json`, a github.com git remote (or a
`repository` field) silently won — the function returned
`io.github.<owner>/<repo>` and never looked at `mcpName`. Per the
[quickstart
docs](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx),
*"The value of `mcpName` will be your server's name in the MCP
Registry"*, so `mcpName` should take precedence.

## Changes

- `cmd/publisher/commands/init.go`:
- New `getMcpNameFromPackageJSON()` helper that returns `mcpName` or
`""`.
- `detectServerName` checks `mcpName` first, before git remote and the
`name`-based fallback.
- `getNameFromPackageJSON` simplified — the now-redundant `mcpName`
branch was removed; it only handles the npm `name` transformation.
- `cmd/publisher/commands/init_test.go` (new): 5 cases through the
public `InitCommand` API covering `mcpName` as-is, fallback to scoped
`name`, fallback to placeholder, version fallback, and `mcpName` winning
over a GitHub `repository` URL.

This completes the fix for #737.

## Test plan

- [x] `go test ./cmd/publisher/commands/` passes (5 new subtests)
- [x] `golangci-lint run ./cmd/publisher/commands/` clean
- [ ] Manual: `mcp-publisher init` in a git-tracked directory with
`package.json` containing `mcpName` produces a `server.json` whose
`name` matches `mcpName`, not the repo slug

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-25 07:14:11 -07:00
Mikel Olasagasti Uranga
7c446e75ad
 		feat(oci): add support for Quay.io registry (#1150) 
Adds support for the Quay.io container registry to the OCI validator.
This allows MCP servers hosted on Quay.io to be registered and validated
by the official registry.

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->

Quay.io is a major, trusted public OCI registry widely used by the
cloud-native and open-source communities. Currently, attempting to
publish a server using a Quay image results in an unsupported OCI
registry error. This change enables developers to use Quay.io as a
first-class hosting option for their MCP server images.

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **Unit Tests:** Updated `internal/validators/registries/oci_test.go`
to transition Quay.io from a rejected test case to an allowed one.
- **Pattern Matching:** Verified that the allowlist correctly handles
both specific image identifiers and general pattern matching for the
`quay.io` host.
- **Local Validation:** Ran `make check` to ensure no regressions in the
existing OCI validation logic.

## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No. This is an additive change that expands the allowlist of supported
registries. Existing configurations are unaffected.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
The implementation follows the existing pattern for OCI registries:
1. Added a `RegistryURLQuay` constant to `pkg/model` for consistency.
2. Hardcoded `quay.io` into the `allowedOCIRegistries` map in the
validator to minimize architectural complexity.
3. Updated all relevant documentation files (`package-types.mdx`,
`generic-server-json.md`, and `official-registry-requirements.md`) to
ensure the source of truth is updated across the project.
4. Validation remains scoped to public images; no private registry
authentication was added for this host.

Signed-off-by: Mikel Olasagasti Uranga <mikel@olasagasti.info>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-24 06:11:46 -04:00
Yusufhan Saçak
a1a3303af9
 		feat(publisher): copy version from package.json and prefer mcpName in init (#1145) 
## Summary

Addresses two related enhancements to `mcp-publisher init`:

- **Copy `version` from `package.json`** (#736): When `package.json` is
present and contains a `version` field, it is now used for both the
top-level `version` and `packages[].version` in the generated
`server.json`. Falls back to `"1.0.0"` when unavailable. This aligns
with the recommended best practice of keeping server version in sync
with package version.

- **Prefer `mcpName` over `name`** (#737): The init command now checks
for `mcpName` in `package.json` first, falling back to `name` if
`mcpName` is not defined. This ensures the generated server name matches
the required `mcpName` property.

Closes #736
Closes #737

## Changes

- `cmd/publisher/commands/init.go`:
- Added `getVersionFromPackageJSON()` helper to read version from
`package.json`
- Modified `InitCommand()` to use detected version with `"1.0.0"`
fallback
  - Modified `getNameFromPackageJSON()` to prefer `mcpName` over `name`

## Test plan

- [x] `go build ./cmd/publisher/...` compiles without errors
- [x] `go test ./cmd/publisher/commands/...` passes all existing tests
- [ ] Manual: run `mcp-publisher init` in a directory with
`package.json` containing `version` and `mcpName` — verify both are
copied to `server.json`
- [ ] Manual: run `mcp-publisher init` in a directory with
`package.json` without `mcpName` — verify `name` is used as fallback
- [ ] Manual: run `mcp-publisher init` in a directory without
`package.json` — verify defaults (`"1.0.0"`, directory name) are used

## AI Disclosure

AI assistance (Claude) was used for initial code exploration and issue
research. The implementation was written and reviewed by the author.

Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-24 05:47:24 -04:00
dependabot[bot]
35b124379b
 		build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.231.0 to 3.232.0 in /deploy (#1194) 
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.231.0 to 3.232.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.232.0</h2>
<h2>3.232.0 (2026-04-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add an experimental <code>pulumi neo</code> command that
creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
prints. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22473">#22473</a></p>
</li>
<li>
<p>[cli] Add support for handling user approval requests in the
<code>pulumi neo</code> terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22589">#22589</a></p>
</li>
<li>
<p>[cli] Add an interactive terminal UI for <code>pulumi neo</code>
built with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22570">#22570</a></p>
</li>
<li>
<p>[cli] Switch logging library from glog to slog.</p>
</li>
</ul>
<p>BREAKING: any <code>if logging.V(x) {</code> need to be changed to
<code>if logging.V(x).Enabled()</code></p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22548">#22548</a></p>
<ul>
<li>
<p>[cli] Add a plan-mode toggle to the <code>pulumi neo</code> TUI,
bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running <code>pulumi up</code>, or opening PRs, and surfaces an approved
plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22634">#22634</a></p>
</li>
<li>
<p>[cli] The <code>pulumi neo</code> TUI now drives its
&quot;thinking&quot; spinner off a single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press <code>Esc</code> during a turn to ask the agent to
cancel; the label
switches to &quot;Cancelling...&quot; until the backend
acknowledges.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22637">#22637</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.232.0 (2026-04-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add an experimental <code>pulumi neo</code> command that
creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
prints. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22473">#22473</a></p>
</li>
<li>
<p>[cli] Add support for handling user approval requests in the
<code>pulumi neo</code> terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22589">#22589</a></p>
</li>
<li>
<p>[cli] Add an interactive terminal UI for <code>pulumi neo</code>
built with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22570">#22570</a></p>
</li>
<li>
<p>[cli] Switch logging library from glog to slog.</p>
</li>
</ul>
<p>BREAKING: any <code>if logging.V(x) {</code> need to be changed to
<code>if logging.V(x).Enabled()</code></p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22548">#22548</a></p>
<ul>
<li>
<p>[cli] Add a plan-mode toggle to the <code>pulumi neo</code> TUI,
bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running <code>pulumi up</code>, or opening PRs, and surfaces an approved
plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22634">#22634</a></p>
</li>
<li>
<p>[cli] The <code>pulumi neo</code> TUI now drives its
&quot;thinking&quot; spinner off a single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press <code>Esc</code> during a turn to ask the agent to
cancel; the label
switches to &quot;Cancelling...&quot; until the backend
acknowledges.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22637">#22637</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="59d156aaea"><code>59d156a</code></a>
Add <code>l2-plain-component</code> &amp; remove test dependencies on
AWS (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22470">#22470</a>)</li>
<li><a
href="3efae3eafd"><code>3efae3e</code></a>
Cancel providers before closing them (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22692">#22692</a>)</li>
<li><a
href="448770ec12"><code>448770e</code></a>
Add l2-id-type test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22681">#22681</a>)</li>
<li><a
href="cc8a16f376"><code>cc8a16f</code></a>
go/auto: use random stack names in TestNestedConfig (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22689">#22689</a>)</li>
<li><a
href="6b5ce009ee"><code>6b5ce00</code></a>
skip signal cancellation tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22684">#22684</a>)</li>
<li><a
href="923073c621"><code>923073c</code></a>
fix[codegen/go]: Use Context.GetOrRegisterPackageRef in generated code
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22170">#22170</a>)</li>
<li><a
href="2608e2c071"><code>2608e2c</code></a>
Gitignore <code>.claude/scheduled_tasks.lock</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22686">#22686</a>)</li>
<li><a
href="3e387c7355"><code>3e387c7</code></a>
chore: typo <code>succesful</code> -&gt; <code>successful</code> in
nodejs run/index.ts (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22685">#22685</a>)</li>
<li><a
href="a850bcbfef"><code>a850bcb</code></a>
Update dependency pulumi/pulumi-java to v1.25.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22673">#22673</a>)</li>
<li><a
href="416fd51b5f"><code>416fd51</code></a>
replace underlying logging library with slog (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22548">#22548</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.231.0...v3.232.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.231.0&new-version=3.232.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-24 04:54:09 -04:00
Ashwanthram K L
dac0982f6d
 		docs: signpost non-npm publishers to package-types from quickstart (#1192) 
## What

Two targeted additions to `docs/modelcontextprotocol-io/quickstart.mdx`:

1. A `<Note>` immediately after the tutorial's intro, telling PyPI /
NuGet / OCI / MCPB publishers that the Step 1 ownership-verification
mechanism differs for their package type and pointing them to [Package
Types](./package-types) before continuing.
2. The troubleshooting row for **"Registry validation failed for
package"** previously named only npm's `mcpName` property in
`package.json`. It now names all three current mechanisms (npm →
`mcpName` in `package.json`; PyPI / NuGet → `mcp-name: <server-name>`
line in the package README; other types → link to Package Types).

+5 / -1 lines.

## Why

The quickstart is the landing page for new publishers, but it's entirely
TypeScript / npm-flavored — the Step 1 example shows npm's `mcpName`
property and nothing else. The cross-reference to `./package-types` only
appears in the "Next Steps" footer, by which point a PyPI publisher has
already gone through every step and hit a `400 Bad Request` at
`mcp-publisher publish`:

> `registry validation failed for package 0 (<pkg>): PyPI package
'<pkg>' ownership validation failed. The server name
'io.github.<user>/<server>' must appear as 'mcp-name:
io.github.<user>/<server>' in the package README`

That specific error has tripped at least one other publisher (#531) and
was what motivated this change. The ownership mechanism is correctly
documented at `./package-types` — the fix is purely to route people
there before they publish, not to duplicate the content.

## What this change is **not**

- It does not propose changing the validation logic.
- It does not duplicate content from `package-types.mdx` into the
quickstart.
- It does not add a separate PyPI-specific tutorial. The existing
npm-flavored tutorial remains the canonical one; the note just tells
non-npm readers which step is different.

## Verification

- Change is docs-only; no build or test impact.
- Link target `./package-types` is the same shape as the one already
used in "Next Steps" of the same file.
- Anchor `#step-1-add-verification-information-to-the-package` matches
the existing heading's slug.

## Related

- #531 — same validation error hit by another PyPI publisher; closed
with a workaround but the quickstart wasn't updated.
 2026-04-23 18:21:21 -04:00
Jeff MAURY
d8a1ea4e58
 		fix: update openapi.yml to include statusChangedAt (#1187) 
Fixes #1169

Update the openapi.yml to add a missing field

## Motivation and Context

openapi.yml was not in sync with live data

## How Has This Been Tested?

Validated the openapi.yml file

## Breaking Changes

No

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Signed-off-by: Jeff MAURY <jmaury@redhat.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-23 18:15:43 -04:00
dependabot[bot]
fa450110e4
 		build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.230.0 to 3.231.0 in /deploy (#1176) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.230.0 to 3.231.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.231.0</h2>
<h2>3.231.0 (2026-04-16)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Auto-detect Mercurial repository metadata for <code>pulumi
up</code> / <code>pulumi preview</code> updates, mirroring existing Git
support
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22618">#22618</a></p>
</li>
<li>
<p>[engine] Send Cancel RPC to plugins on host close for graceful
shutdown
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22569">#22569</a></p>
</li>
<li>
<p>[engine] Pass resource options to hooks through the engine
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22582">#22582</a></p>
</li>
<li>
<p>[engine] Add GetDeploymentInfo to the resource monitor service</p>
</li>
<li>
<p>[auto/go] Add <code>New</code> command to Automation API
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22439">#22439</a></p>
</li>
<li>
<p>[auto/{go,nodejs,python}] Add --diff to automation api for destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22563">#22563</a></p>
</li>
<li>
<p>[auto/python] Add <code>new</code> command to Automation API
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22439">#22439</a></p>
</li>
<li>
<p>[pcl] Support for resource hooks in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22365">#22365</a></p>
</li>
<li>
<p>[sdk-nodejs] Warn when a non-ComponentResource class is passed in the
explicit <code>components</code> list to
<code>componentProviderHost</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22619">#22619</a></p>
</li>
<li>
<p>[sdk-python] Warn when a non-ComponentResource class is passed in the
explicit <code>components</code> list to
<code>component_provider_host</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22619">#22619</a></p>
</li>
<li>
<p>[cli/import] Add support for providers to be defined in the same
import file as their users
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21671">#21671</a></p>
</li>
<li>
<p>[cli/policy] ESC environment support for local policy packs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22495">#22495</a></p>
</li>
<li>
<p>[sdk/nodejs] Support package.yaml when using pnpm
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22491">#22491</a></p>
</li>
<li>
<p>[sdk/python] Add function decorator variants for resource and error
hooks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22519">#22519</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.231.0 (2026-04-16)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Auto-detect Mercurial repository metadata for <code>pulumi
up</code> / <code>pulumi preview</code> updates, mirroring existing Git
support
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22618">#22618</a></p>
</li>
<li>
<p>[engine] Send Cancel RPC to plugins on host close for graceful
shutdown
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22569">#22569</a></p>
</li>
<li>
<p>[engine] Pass resource options to hooks through the engine
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22582">#22582</a></p>
</li>
<li>
<p>[engine] Add GetDeploymentInfo to the resource monitor service</p>
</li>
<li>
<p>[auto/go] Add <code>New</code> command to Automation API
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22439">#22439</a></p>
</li>
<li>
<p>[auto/{go,nodejs,python}] Add --diff to automation api for destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22563">#22563</a></p>
</li>
<li>
<p>[auto/python] Add <code>new</code> command to Automation API
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22439">#22439</a></p>
</li>
<li>
<p>[pcl] Support for resource hooks in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22365">#22365</a></p>
</li>
<li>
<p>[sdk-nodejs] Warn when a non-ComponentResource class is passed in the
explicit <code>components</code> list to
<code>componentProviderHost</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22619">#22619</a></p>
</li>
<li>
<p>[sdk-python] Warn when a non-ComponentResource class is passed in the
explicit <code>components</code> list to
<code>component_provider_host</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22619">#22619</a></p>
</li>
<li>
<p>[cli/import] Add support for providers to be defined in the same
import file as their users
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21671">#21671</a></p>
</li>
<li>
<p>[cli/policy] ESC environment support for local policy packs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22495">#22495</a></p>
</li>
<li>
<p>[sdk/nodejs] Support package.yaml when using pnpm
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22491">#22491</a></p>
</li>
<li>
<p>[sdk/python] Add function decorator variants for resource and error
hooks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22519">#22519</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[auto/{nodejs,python}] Support --run-program for inline programs
with preview_refresh/destroy</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5aaa649fbb"><code>5aaa649</code></a>
Add GetDeploymentInfo to resource monitor (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22595">#22595</a>)</li>
<li><a
href="e39b399bdd"><code>e39b399</code></a>
Support --run-program with inline programs for preview_refresh/destroy
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22590">#22590</a>)</li>
<li><a
href="bd4b5db940"><code>bd4b5db</code></a>
Go Automation API Codegen #1B: Generating helpers (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22061">#22061</a>)</li>
<li><a
href="b5bb135a2a"><code>b5bb135</code></a>
Python Automation API Codegen: use TypedDict for option types (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22602">#22602</a>)</li>
<li><a
href="5cb5c1dea3"><code>5cb5c1d</code></a>
sdk/python: fix 'occured' -&gt; 'occurred' in rpc.py doc comment (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22620">#22620</a>)</li>
<li><a
href="b7c9d87db9"><code>b7c9d87</code></a>
try to stop pkg 7/7 from flaking (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22611">#22611</a>)</li>
<li><a
href="00f5eb95f6"><code>00f5eb9</code></a>
Auto-detect Mercurial VCS metadata for updates (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22618">#22618</a>)</li>
<li><a
href="eff41c5258"><code>eff41c5</code></a>
Warn when non-ComponentResource passed to component provider host (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22619">#22619</a>)</li>
<li><a
href="fdbd324199"><code>fdbd324</code></a>
Update dependency pulumi/pulumi-java to v1.24.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22615">#22615</a>)</li>
<li><a
href="12c06b9e59"><code>12c06b9</code></a>
Update dependency pulumi/pulumi-yaml to v1.31.1 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22610">#22610</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.230.0...v3.231.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-21 09:06:55 +00:00
dependabot[bot]
4be2234d3f
 		build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.28.0 to 4.29.0 in /deploy (#1177) 
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.28.0 to 4.29.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.29.0</h2>
<p>No release notes provided.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<h2>4.29.0 (April 15, 2026)</h2>
<h3>Fixed</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/2926">#2926</a>
Use client-side create for new resources instead of server-side
apply.</p>
<p><strong>Users may observe stricter errors on some Create operations.
Please read carefully.</strong></p>
<p>When a resource already exists in the cluster, the API server now
returns an AlreadyExists error instead of silently updating the existing
object.
This prevents data loss from create-then-delete scenarios (e.g. renaming
a Pulumi resource or replacing an explicitly-named resource).
A new provider config option <code>upsertExistingObjects</code> (default
<code>false</code>) restores the previous upsert behavior for users who
intentionally adopt existing cluster resources.
To manage fields on existing objects without owning their lifecycle, use
Patch resources (e.g. <code>NamespacePatch</code>).</p>
</li>
</ul>
<h3>Added</h3>
<ul>
<li><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/2280">#2280</a>
Add <code>enablePatchForce</code> provider config option to force SSA
patch conflicts on a per-stack basis.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Upgrade Kubernetes schema and libraries to v1.35.3.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6a98f51194"><code>6a98f51</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4283">#4283</a>)</li>
<li><a
href="677360aeb6"><code>677360a</code></a>
Fix race condition in istio test (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4282">#4282</a>)</li>
<li><a
href="f3ebf584d3"><code>f3ebf58</code></a>
Prepare for v4.29.0 release (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4280">#4280</a>)</li>
<li><a
href="0d18fe4f02"><code>0d18fe4</code></a>
Use client-side create to prevent silent upsert of existing objects (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4278">#4278</a>)</li>
<li><a
href="829694245f"><code>8296942</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4279">#4279</a>)</li>
<li><a
href="9d2f6f8eb2"><code>9d2f6f8</code></a>
Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4277">#4277</a>)</li>
<li><a
href="7d8fe4d157"><code>7d8fe4d</code></a>
Migrate Windows code signing to Azure Trusted Signing (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4274">#4274</a>)</li>
<li><a
href="374a2b26fe"><code>374a2b2</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4275">#4275</a>)</li>
<li><a
href="065ada9c66"><code>065ada9</code></a>
Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4271">#4271</a>)</li>
<li><a
href="c2f6707259"><code>c2f6707</code></a>
Update module github.com/go-jose/go-jose/v3 to v3.0.5 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4268">#4268</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.28.0...v4.29.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.28.0&new-version=4.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-21 05:03:22 -04:00
dependabot[bot]
85c95569a7
 		build(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 in /deploy (#1180) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.17.2 to 5.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>plumbing: transport/http, Add support for followRedirects policy by
<a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2004">go-git/go-git#2004</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0">https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ea3e7ec9df"><code>ea3e7ec</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2004">#2004</a>
from go-git/v5-http-hardening</li>
<li><a
href="bcd20a9c52"><code>bcd20a9</code></a>
plumbing: transport/http, Add support for followRedirects policy</li>
<li>See full diff in <a
href="https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.2&new-version=5.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-21 05:03:01 -04:00
dependabot[bot]
cc48844ebc
 		build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#1188) 
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.1
to 5.9.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.9.2 (April 18, 2026)</h1>
<p>Fix SQL Injection via placeholder confusion with dollar quoted string
literals (GHSA-j88v-2chj-qfwx)</p>
<p>SQL injection can occur when:</p>
<ol>
<li>The non-default simple protocol is used.</li>
<li>A dollar quoted string literal is used in the SQL query.</li>
<li>That query contains text that would be would be interpreted outside
as a placeholder outside of a string literal.</li>
<li>The value of that placeholder is controllable by the attacker.</li>
</ol>
<p>e.g.</p>
<pre lang="go"><code>attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`,
pgx.QueryExecModeSimpleProtocol, attackValue)
</code></pre>
<p>This is unlikely to occur outside of a contrived scenario.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0aeabbcf11"><code>0aeabbc</code></a>
Release v5.9.2</li>
<li><a
href="60644f8491"><code>60644f8</code></a>
Fix SQL sanitizer bugs with dollar-quoted strings and placeholder
overflow</li>
<li><a
href="a5680bc945"><code>a5680bc</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2531">#2531</a> from
dolmen-go/godoc-add-links</li>
<li><a
href="e34e452400"><code>e34e452</code></a>
doc: Add godoc links</li>
<li><a
href="08c9bb1f0d"><code>08c9bb1</code></a>
Fix Stringer types encoded as text instead of numeric value in composite
fields</li>
<li><a
href="96b4dbdfd0"><code>96b4dbd</code></a>
Remove unstable test</li>
<li><a
href="acf88e0065"><code>acf88e0</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2526">#2526</a> from
abrightwell/abrightwell-min-proto</li>
<li><a
href="2f81f1fc03"><code>2f81f1f</code></a>
Update <code>max_protocol_version</code> and
<code>min_protocol_version</code> defaults</li>
<li>See full diff in <a
href="https://github.com/jackc/pgx/compare/v5.9.1...v5.9.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jackc/pgx/v5&package-manager=go_modules&previous-version=5.9.1&new-version=5.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-21 05:02:43 -04:00
dependabot[bot]
b6ab23cdea
 		build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 in the actions group (#1189) 
Bumps the actions group with 1 update:
[goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/goreleaser/goreleaser-action/releases">goreleaser/goreleaser-action's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: verify release checksum and cosign signature by <a
href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/550">goreleaser/goreleaser-action#550</a></li>
<li>docs: document cosign verification in README by <a
href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/553">goreleaser/goreleaser-action#553</a></li>
<li>docs: Upgrade import GPG action version by <a
href="https://github.com/flecno"><code>@​flecno</code></a> in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/547">goreleaser/goreleaser-action#547</a></li>
<li>ci: drop docker-bake in favor of plain npm by <a
href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/551">goreleaser/goreleaser-action#551</a></li>
<li>ci: add release-major-tag workflow by <a
href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/552">goreleaser/goreleaser-action#552</a></li>
<li>ci: drop pre-cosign-v3 goreleaser versions from tests by <a
href="https://github.com/caarlos0"><code>@​caarlos0</code></a> in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/554">goreleaser/goreleaser-action#554</a></li>
<li>ci(deps): bump the actions group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/543">goreleaser/goreleaser-action#543</a></li>
<li>ci(deps): bump the actions group with 5 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/546">goreleaser/goreleaser-action#546</a></li>
<li>chore(deps): bump undici from 6.23.0 to 6.24.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/545">goreleaser/goreleaser-action#545</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/flecno"><code>@​flecno</code></a> made
their first contribution in <a
href="https://redirect.github.com/goreleaser/goreleaser-action/pull/547">goreleaser/goreleaser-action#547</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/goreleaser/goreleaser-action/compare/v7...v7.1.0">https://github.com/goreleaser/goreleaser-action/compare/v7...v7.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e24998b8b6"><code>e24998b</code></a>
ci: drop pre-cosign-v3 goreleaser versions from tests (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/554">#554</a>)</li>
<li><a
href="be2e8a39ba"><code>be2e8a3</code></a>
docs: document cosign verification in README (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/553">#553</a>)</li>
<li><a
href="5e53f8eea2"><code>5e53f8e</code></a>
ci: add release-major-tag workflow (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/552">#552</a>)</li>
<li><a
href="4068afa2f0"><code>4068afa</code></a>
build: drop docker-bake in favor of plain npm (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/551">#551</a>)</li>
<li><a
href="213ec80f56"><code>213ec80</code></a>
docs: add CONTRIBUTING with pre-commit workflow</li>
<li><a
href="4b462d3d1d"><code>4b462d3</code></a>
feat: verify release checksum and cosign signature (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/550">#550</a>)</li>
<li><a
href="01cbe076be"><code>01cbe07</code></a>
docs: Upgrade import GPG action version (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/547">#547</a>)</li>
<li><a
href="2a473d70e3"><code>2a473d7</code></a>
ci(deps): bump the actions group with 5 updates (<a
href="https://redirect.github.com/goreleaser/goreleaser-action/issues/546">#546</a>)</li>
<li><a
href="fdcf0b9df9"><code>fdcf0b9</code></a>
clean: leftover files from node 22(?)</li>
<li><a
href="9881cc5376"><code>9881cc5</code></a>
fix: use new static URL</li>
<li>Additional commits viewable in <a
href="ec59f474b9...e24998b8b6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=goreleaser/goreleaser-action&package-manager=github_actions&previous-version=7.0.0&new-version=7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-21 05:02:23 -04:00
Radoslav Dimitrov
70b5f457c8
 		deploy: update prod to v1.6.0 (#1172) 
## Summary
- Bumps production image tag from `1.5.0` to `1.6.0` in
`deploy/Pulumi.gcpProd.yaml`
- Corresponds to the [v1.6.0
release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.6.0)

## Test plan
- [ ] Verify Pulumi preview shows only the image tag change
- [ ] Deploy and confirm the service is healthy

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-15 10:28:33 -04:00
Yusufhan Saçak
8df5a7711d
 		fix(publisher): omit repository when URL cannot be detected (#1149) v1.6.0 
## Summary

When `detectRepoURL()` cannot determine the repository (no git remote,
no package.json repository field), return an empty string instead of a
placeholder URL (`https://github.com/YOUR_USERNAME/YOUR_REPO`). This
causes `createServerJSON()` to omit the `repository` field entirely,
preventing schema validation failures on publish.

Fixes #613

## Problem

`mcp-publisher init` generated a `repository` object with a placeholder
URL that fails the `uri` format validation on publish. 88 published
servers in the official registry had this issue.

## Change

- `cmd/publisher/commands/init.go`: `detectRepoURL()` returns `""`
instead of placeholder when no repo is found
- The existing guard in `createServerJSON()` (`if repoURL != "" &&
repoSource != ""`) already handles this correctly — it omits the
repository when URL is empty

## Test plan

- [x] `go build ./cmd/publisher/...` compiles
- [x] `go test ./cmd/publisher/commands/...` passes
- [ ] Manual: `mcp-publisher init` in a directory without git remote or
package.json repo — verify no `repository` field in generated
server.json
- [ ] Manual: `mcp-publisher init` in a git repo — verify `repository`
is populated correctly

## AI Disclosure

AI assistance (Claude) was used for issue research. The implementation
was written and reviewed by the author.
 2026-04-15 07:16:23 -04:00
Radoslav Dimitrov
90baa0528f
 		fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166) 
## Summary

Fixes #663

- **Security fix**: `mcp-publisher login` no longer writes
`.mcpregistry_github_token` and `.mcpregistry_registry_token` to the
current working directory. GitHub tokens are kept in memory during the
login→exchange flow and cleared immediately after.
- **Token location**: Unified token moved from `~/.mcp_publisher_token`
to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following
the convention used by `gh`, `docker`, and `kubectl`.
- **Dead code removed**: `NeedsLogin()` was on the `Provider` interface
but never called — removed from interface and all 4 implementations.
`forceLogin` field also removed.
- **Auth tests added**: 11 new tests for `GitHubATProvider` (package
previously had 0 tests).
- **Test isolation**: `SetupTestToken` now uses `t.TempDir()` +
`t.Setenv("HOME", ...)` instead of writing to real `$HOME`.

### Breaking change

Users must re-login after upgrading (`mcp-publisher login <method>`).
Existing tokens at `~/.mcp_publisher_token` are not auto-migrated.
`logout` cleans up both old and new locations.

## Test plan

- [x] `make check` passes (lint, unit tests, integration tests)
- [x] `mcp-publisher login none` stores token at
`~/.config/mcp-publisher/token.json`
- [x] No `.mcpregistry_*` files created in cwd after login (with
`--token`, `MCP_GITHUB_TOKEN`, or device flow)
- [x] `mcp-publisher publish` reads token from new location
- [x] `mcp-publisher validate` reads registry URL from new location
- [x] `mcp-publisher logout` cleans up new location, legacy
`~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files
- [x] `mcp-publisher logout` when not logged in shows "Not logged in"
- [x] File permissions: dir 0700, file 0600

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-15 03:23:07 -04:00
dependabot[bot]
77bbd41fd3
 		build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 in the actions group (#1154) 2026-04-14 05:20:05 -04:00
dependabot[bot]
0c5dde243b
 		build(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 (#1162) 2026-04-14 05:19:36 -04:00
dependabot[bot]
1e83267610
 		build(deps): bump cloud.google.com/go/kms from 1.27.0 to 1.29.0 (#1163) 2026-04-14 05:19:09 -04:00
dependabot[bot]
07fa85f68b
 		build(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 (#1140) 
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.17.0 to 3.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>.github: configure dependabot by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/477">coreos/go-oidc#477</a></li>
<li>.github: update go versions in CI by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/480">coreos/go-oidc#480</a></li>
<li>build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/coreos/go-oidc/pull/478">coreos/go-oidc#478</a></li>
<li>build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/coreos/go-oidc/pull/479">coreos/go-oidc#479</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0">https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da6b3bfca8"><code>da6b3bf</code></a>
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4</li>
<li><a
href="7f80694215"><code>7f80694</code></a>
build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0</li>
<li><a
href="7271de5758"><code>7271de5</code></a>
.github: update go versions in CI</li>
<li><a
href="3ccf20fdc4"><code>3ccf20f</code></a>
.github: configure dependabot</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.17.0&new-version=3.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-09 18:16:23 -04:00
dependabot[bot]
fbea08a348
 		build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.229.0 to 3.230.0 in /deploy (#1141) 
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.229.0 to 3.230.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.230.0</h2>
<h2>3.230.0 (2026-04-08)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Detect AI agents and send in update metadata
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22497">#22497</a></p>
</li>
<li>
<p>[auto/nodejs] Add &quot;org&quot; commands (get-default, set-default,
search, search ai) to the auto-generated interface
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22395">#22395</a></p>
</li>
<li>
<p>[auto/nodejs] Add &quot;new&quot; command to the auto-generated
interface
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22421">#22421</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Add Cancel handler to Python &amp; Node.js
providers
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22516">#22516</a></p>
</li>
<li>
<p>[cli/policy] Add ESC environment resolution for policy packs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22425">#22425</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[auto/go] Insert --non-interactive flag before &quot;--&quot;
positional separator to avoid misinterpretation as a positional argument
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22462">#22462</a></p>
</li>
<li>
<p>[ci] Add code coverage collection for Node.js automation tools tests
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22412">#22412</a></p>
</li>
<li>
<p>[pcl] Allow key indexing into a map of resources created by range
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22498">#22498</a></p>
</li>
<li>
<p>[programgen/go] Fix an issue with formatted index modules not
importing correctly</p>
</li>
<li>
<p>[cli/state] Check for Pulumi.yaml projects and <code>backend</code>
option in <code>state upgrade</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22483">#22483</a></p>
</li>
<li>
<p>[sdk/go] Fix Go program generation for ternary expressions inside
apply callbacks, add Go predeclared identifiers to reserved words,
handle optional list types in union type codegen, and fix
unmarshalOutput for known outputs with null elements.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22460">#22460</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix inherited input properties missing from component
schema when args interface extends another interface
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22446">#22446</a></p>
</li>
<li>
<p>[sdk/python] Fix inherited input properties missing from component
schema when args class inherits from a base class
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22484">#22484</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ae2e269861"><code>ae2e269</code></a>
Update dependency pulumi/pulumi-java to v1.23.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22526">#22526</a>)</li>
<li><a
href="28d3f9c3b8"><code>28d3f9c</code></a>
Extend module-format test to check index modules (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22505">#22505</a>)</li>
<li><a
href="dc6881aa75"><code>dc6881a</code></a>
Mark generated CLI docs files as auto-generated (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22528">#22528</a>)</li>
<li><a
href="cb231c1819"><code>cb231c1</code></a>
Update dependency pulumi/pulumi-dotnet to v3.102.1 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22525">#22525</a>)</li>
<li><a
href="3809a4c60c"><code>3809a4c</code></a>
Add Cancel handler to Python &amp; Node.js providers (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22516">#22516</a>)</li>
<li><a
href="b4e628b543"><code>b4e628b</code></a>
Fix typos, grammar, and broken references in developer docs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22493">#22493</a>)</li>
<li><a
href="f6ae330abb"><code>f6ae330</code></a>
Add ESC environment resolution for policy packs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22425">#22425</a>)</li>
<li><a
href="14b0963afe"><code>14b0963</code></a>
Use renovate to update the language runtimes (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22517">#22517</a>)</li>
<li><a
href="2e60a39033"><code>2e60a39</code></a>
Fix flaky TestFuzz (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22514">#22514</a>)</li>
<li><a
href="5da6fcb0d3"><code>5da6fcb</code></a>
[Go] Fix l2-resource-optional (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22460">#22460</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.229.0...v3.230.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.229.0&new-version=3.230.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-09 14:20:55 -04:00
dependabot[bot]
83f8ea7cff
 		build(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0 in /deploy (#1139) 
Bumps
[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go)
from 1.41.0 to 1.43.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64"><code>9276201</code></a>
Release v1.43.0 / v0.65.0 / v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li>
<li><a
href="61b8c9466c"><code>61b8c94</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li>
<li><a
href="97a086e82f"><code>97a086e</code></a>
chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li>
<li><a
href="5e363de517"><code>5e363de</code></a>
limit response body size for OTLP HTTP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><a
href="35214b6013"><code>35214b6</code></a>
Use an absolute path when calling bsd kenv (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li><a
href="290024ceaf"><code>290024c</code></a>
fix(deps): update module google.golang.org/grpc to v1.80.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li>
<li><a
href="e70658e098"><code>e70658e</code></a>
fix: support getBody in otelploghttp (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
<li><a
href="4afe468e3b"><code>4afe468</code></a>
fix(deps): update googleapis to 9d38bb4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li>
<li><a
href="b9ca729776"><code>b9ca729</code></a>
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li>
<li><a
href="69472ec56c"><code>69472ec</code></a>
chore(deps): update fossas/fossa-action action to v1.9.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.43.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.41.0&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-09 14:20:33 -04:00
dependabot[bot]
607d52ff20
 		build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#1114) 
Bumps
[github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from
4.1.3 to 4.1.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.4</h2>
<h2>What's Changed</h2>
<p>Fixes Panic in JWE decryption. See <a
href="https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8">https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4">https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0e59876635"><code>0e59876</code></a>
Merge commit from fork</li>
<li><a
href="ddffdbcec8"><code>ddffdbc</code></a>
Bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/go-jose/go-jose/issues/213">#213</a>)</li>
<li>See full diff in <a
href="https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-09 14:20:12 -04:00
dependabot[bot]
5f81cf3336
 		build(deps): bump cloud.google.com/go/kms from 1.26.0 to 1.27.0 (#1111) 
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go)
from 1.26.0 to 1.27.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>kms: v1.27.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.26.0...kms/v1.27.0">v1.27.0</a>
(2026-04-02)</h2>
<h2>retail: v1.27.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/retail/v1.26.0...retail/v1.27.0">v1.27.0</a>
(2026-04-02)</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.26.1...documentai/v1.27.0">1.27.0</a>
(2024-04-15)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Support a new Layout Processor in
Document AI (<a
href="2cdc40a0b4">2cdc40a</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.26.0...documentai/v1.26.1">1.26.1</a>
(2024-03-14)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Update protobuf dep to v1.33.0 (<a
href="30b038d8ca">30b038d</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>documentai:</strong> A comment for field
<code>processor_version_source</code> in message
<code>.google.cloud.documentai.v1beta3.ImportProcessorVersionRequest</code>
is changed (<a
href="25c3f2dfcf">25c3f2d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b64e8dcf0a"><code>b64e8dc</code></a>
chore: librarian release pull request: 20251013T184035Z (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13116">#13116</a>)</li>
<li><a
href="ddc086c9e3"><code>ddc086c</code></a>
feat(aiplatform): Add JAILBREAK category to SafetySettings for
prediction ser...</li>
<li><a
href="c79db96ce2"><code>c79db96</code></a>
chore: librarian generate pull request: 20251013T073656Z (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13101">#13101</a>)</li>
<li><a
href="b041315902"><code>b041315</code></a>
chore: migrate 18 modules to Librarian (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13112">#13112</a>)</li>
<li><a
href="a75de408e8"><code>a75de40</code></a>
chore: migrate advisorynotifications to Librarian (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13110">#13110</a>)</li>
<li><a
href="3cf5269fac"><code>3cf5269</code></a>
chore: undo IAM semi-migration (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13109">#13109</a>)</li>
<li><a
href="7663fdce36"><code>7663fdc</code></a>
fix(internal/stategen): be more conservative about removing OwlBot lines
(<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13">#13</a>...</li>
<li><a
href="8ebb89625c"><code>8ebb896</code></a>
chore: librarian release pull request: 20251010T200657Z (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13107">#13107</a>)</li>
<li><a
href="befb302203"><code>befb302</code></a>
test(internal/postprocessor): skip test that expects certain live config
(<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13">#13</a>...</li>
<li><a
href="1930511848"><code>1930511</code></a>
testing(internal/godocfx): convert equality check to a diff check (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/13089">#13089</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.26.0...dlp/v1.27.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-09 14:19:50 -04:00
Radoslav Dimitrov
0fc4606be2
 		Stop pinning Go to patch versions, use stable in CI (#1137) 
<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
  bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-04-09 11:57:21 -04:00
dependabot[bot]
9b32a5c187
 		build(deps): bump docker/login-action from 4.0.0 to 4.1.0 in the actions group (#1113) 
Bumps the actions group with 1 update:
[docker/login-action](https://github.com/docker/login-action).

Updates `docker/login-action` from 4.0.0 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<ul>
<li>Fix scoped Docker Hub cleanup path when registry is omitted by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1020.0 in <a
href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a>
<a
href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li>
<li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li>
<li>Bump minimatch from 3.1.2 to 3.1.5 in <a
href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4907a6ddec"><code>4907a6d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/930">#930</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="1e233e691a"><code>1e233e6</code></a>
chore: update generated content</li>
<li><a
href="6c24ead680"><code>6c24ead</code></a>
build(deps): bump the aws-sdk-dependencies group with 2 updates</li>
<li><a
href="ee034d7094"><code>ee034d7</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/958">#958</a>
from docker/dependabot/npm_and_yarn/lodash-4.18.1</li>
<li><a
href="1527209db9"><code>1527209</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/937">#937</a>
from docker/dependabot/npm_and_yarn/proxy-agent-depen...</li>
<li><a
href="d39362aba4"><code>d39362a</code></a>
build(deps): bump lodash from 4.17.23 to 4.18.1</li>
<li><a
href="a6f092b568"><code>a6f092b</code></a>
chore: update generated content</li>
<li><a
href="60953f0bed"><code>60953f0</code></a>
build(deps): bump the proxy-agent-dependencies group with 2 updates</li>
<li><a
href="62c688590f"><code>62c6885</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/936">#936</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="102c0e6729"><code>102c0e6</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="b45d80f862...4907a6ddec">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.0.0&new-version=4.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 05:39:37 -04:00
dependabot[bot]
5d0edc97bf
 		build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.228.0 to 3.229.0 in /deploy (#1112) 
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.228.0 to 3.229.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.229.0</h2>
<h2>3.229.0 (2026-04-02)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[auto/python] Add org get-default and set-default commands to
Automation API</p>
</li>
<li>
<p>[backend/diy] Avoid unnecessary S3 bucket HEAD calls to improve
performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22373">#22373</a></p>
</li>
<li>
<p>[cli] Allow TRACEPARENT to be set for CLI invocations, parenting the
pulumi spans under an existing parent span
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22369">#22369</a></p>
</li>
<li>
<p>[cli/display] Add <code>--urns</code> flag to display full resource
URNs instead of short names in preview, up, destroy, refresh, import,
and watch commands
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22007">#22007</a></p>
</li>
<li>
<p>[pcl] Type integer literals as integers rather than numbers in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22268">#22268</a></p>
</li>
<li>
<p>[pcl] Support parameterized providers in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22251">#22251</a></p>
</li>
<li>
<p>[protobuf] Add RunPlugin2 bidirectional streaming RPC to
LanguageRuntime proto
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22389">#22389</a></p>
</li>
<li>
<p>[yaml] Update YAML runtime to 1.30.2
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22426">#22426</a></p>
</li>
<li>
<p>[sdk/go] Add org get-default and set-default commands to Automation
API</p>
</li>
<li>
<p>[sdk/nodejs] Modernize generated tsconfig.json to align with
TypeScript defaults
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22370">#22370</a></p>
</li>
<li>
<p>[cli/policy] Add a new <code>policy analyze</code> command to run a
policy pack against existing state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22250">#22250</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[backend/diy] Remove state lock for refresh --preview-only for diy
backend
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22385">#22385</a></p>
</li>
<li>
<p>[cli] Fix OTEL flushing on provider shutdown
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22358">#22358</a></p>
</li>
<li>
<p>[cli/display] Fix deadlock in message renderer when cancelling an
operation
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22433">#22433</a></p>
</li>
<li>
<p>[engine] Fix <code>--include</code> and <code>--exclude</code> not
working for program-based refresh (RefreshV2)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.229.0 (2026-04-02)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[auto/python] Add org get-default and set-default commands to
Automation API</p>
</li>
<li>
<p>[backend/diy] Avoid unnecessary S3 bucket HEAD calls to improve
performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22373">#22373</a></p>
</li>
<li>
<p>[cli] Allow TRACEPARENT to be set for CLI invocations, parenting the
pulumi spans under an existing parent span
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22369">#22369</a></p>
</li>
<li>
<p>[cli/display] Add <code>--urns</code> flag to display full resource
URNs instead of short names in preview, up, destroy, refresh, import,
and watch commands
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22007">#22007</a></p>
</li>
<li>
<p>[pcl] Type integer literals as integers rather than numbers in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22268">#22268</a></p>
</li>
<li>
<p>[pcl] Support parameterized providers in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22251">#22251</a></p>
</li>
<li>
<p>[protobuf] Add RunPlugin2 bidirectional streaming RPC to
LanguageRuntime proto
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22389">#22389</a></p>
</li>
<li>
<p>[yaml] Update YAML runtime to 1.30.2
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22426">#22426</a></p>
</li>
<li>
<p>[sdk/go] Add org get-default and set-default commands to Automation
API</p>
</li>
<li>
<p>[sdk/nodejs] Modernize generated tsconfig.json to align with
TypeScript defaults
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22370">#22370</a></p>
</li>
<li>
<p>[cli/policy] Add a new <code>policy analyze</code> command to run a
policy pack against existing state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22250">#22250</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[backend/diy] Remove state lock for refresh --preview-only for diy
backend
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22385">#22385</a></p>
</li>
<li>
<p>[cli] Fix OTEL flushing on provider shutdown
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22358">#22358</a></p>
</li>
<li>
<p>[cli/display] Fix deadlock in message renderer when cancelling an
operation
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22433">#22433</a></p>
</li>
<li>
<p>[engine] Fix <code>--include</code> and <code>--exclude</code> not
working for program-based refresh (RefreshV2)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22404">#22404</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4a1e067a15"><code>4a1e067</code></a>
Add <code>org</code> commands to Python and Go Automation APIs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22436">#22436</a>)</li>
<li><a
href="40fd96368b"><code>40fd963</code></a>
Fix var naming for hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22445">#22445</a>)</li>
<li><a
href="5a26c3e545"><code>5a26c3e</code></a>
Fix flaky TestLanguageRuntimeCancellation (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22376">#22376</a>)</li>
<li><a
href="24ff624010"><code>24ff624</code></a>
Cleanup some dotnet codegen from build scripts (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22444">#22444</a>)</li>
<li><a
href="1bf3962a77"><code>1bf3962</code></a>
Add <code>l1-builtin-sha1</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22443">#22443</a>)</li>
<li><a
href="dea48c63e9"><code>dea48c6</code></a>
Fix deadlock in message renderer when cancelling an operation (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22433">#22433</a>)</li>
<li><a
href="0a0aff442a"><code>0a0aff4</code></a>
Delete dead dotnet codegen code (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22435">#22435</a>)</li>
<li><a
href="f80af9ea14"><code>f80af9e</code></a>
Fix config tests to use int type (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22429">#22429</a>)</li>
<li><a
href="f94eb08eba"><code>f94eb08</code></a>
Update java version (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22437">#22437</a>)</li>
<li><a
href="11ebea5709"><code>11ebea5</code></a>
Add <code>property.Glob</code> &amp; implement
<code>encoding.(Unm|M)arshalText</code> for `property.Pa...</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.228.0...v3.229.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.228.0&new-version=3.229.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 05:38:52 -04:00
dependabot[bot]
53af38ee38
 		build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1134) 
Bumps the opentelemetry group with 2 updates in the / directory:
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
and
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go).

Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.67.0 to 0.68.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>v1.43.0 / v2.5.0 / v0.68.0 / v0.37.0 / v0.23.0 / v0.18.0 / v0.16.0 /
v0.15.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8660">#8660</a>)</li>
<li>Add support to set the configuration file via
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li>
<li>Add support for <code>service</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8674">#8674</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in tracer provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8687">#8687</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in logger provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8686">#8686</a>)</li>
<li>Add support for <code>server.address</code> and
<code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li>
<li>Add support for <code>OTEL_SEMCONV_STABILITY_OPT_IN</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
Supported values are <code>rpc</code> (default), <code>rpc/dup</code>
and <code>rpc/old</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8726">#8726</a>)</li>
<li>Add the <code>http.route</code> metric attribute to
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8632">#8632</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Prepend <code>_</code> to the normalized environment variable name
when the key starts with a digit in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, ensuring
POSIX compliance. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8678">#8678</a>)</li>
<li>Move experimental types from
<code>go.opentelemetry.io/contrib/otelconf</code> to
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529">#8529</a>)</li>
<li>Normalize cached environment variable names in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, aligning
<code>Carrier.Keys</code> output with the carrier's normalized key
format. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761">#8761</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Fix <code>go.opentelemetry.io/contrib/otelconf</code> Prometheus
reader converting OTel dot-style label names (e.g.
<code>service.name</code>) to underscore-style
(<code>service_name</code>) in <code>target_info</code> when both
<code>without_type_suffix</code> and <code>without_units</code> are set.
Use <code>NoTranslation</code> instead of
<code>UnderscoreEscapingWithoutSuffixes</code> to preserve dot-style
label names while still suppressing metric name suffixes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763">#8763</a>)</li>
<li>Limit the request body size at 1MB in
<code>go.opentelemetry.io/contrib/zpages</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8656">#8656</a>)</li>
<li>Fix server spans using the client's address and port for
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li>
</ul>
<h2>Removed</h2>
<ul>
<li>Host ID resource detector has been removed when configuring the
<code>host</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8581">#8581</a>)</li>
</ul>
<h2>Deprecated</h2>
<ul>
<li>Deprecate <code>OTEL_EXPERIMENTAL_CONFIG_FILE</code> in favour of
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update module github.com/jgautheron/goconst to v1.9.0
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8651">open-telemetry/opentelemetry-go-contrib#8651</a></li>
<li>chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8652">open-telemetry/opentelemetry-go-contrib#8652</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to e526e8a by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8647">open-telemetry/opentelemetry-go-contrib#8647</a></li>
<li>chore(deps): update module k8s.io/klog/v2 to v2.140.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8650">open-telemetry/opentelemetry-go-contrib#8650</a></li>
<li>chore(deps): update module github.com/mgechev/revive to v1.14.0 by
<a href="https://github.com/mmorel-35"><code>@​mmorel-35</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8646">open-telemetry/opentelemetry-go-contrib#8646</a></li>
<li>chore(deps): update module github.com/mgechev/revive to v1.15.0 by
<a href="https://github.com/renovate"><code>@​renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8539">open-telemetry/opentelemetry-go-contrib#8539</a></li>
<li>chore: fix noctx issues by <a
href="https://github.com/mmorel-35"><code>@​mmorel-35</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8645">open-telemetry/opentelemetry-go-contrib#8645</a></li>
<li>chore(deps): update golang.org/x by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8655">open-telemetry/opentelemetry-go-contrib#8655</a></li>
<li>chore(deps): update module codeberg.org/chavacava/garif to v0.2.1 by
<a href="https://github.com/renovate"><code>@​renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8654">open-telemetry/opentelemetry-go-contrib#8654</a></li>
<li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.21
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8653">open-telemetry/opentelemetry-go-contrib#8653</a></li>
<li>fix(deps): update module go.opentelemetry.io/proto/otlp to v1.10.0
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8657">open-telemetry/opentelemetry-go-contrib#8657</a></li>
<li>Limit the number of bytes read from the zpages body by <a
href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8656">open-telemetry/opentelemetry-go-contrib#8656</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8648">open-telemetry/opentelemetry-go-contrib#8648</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.3 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8661">open-telemetry/opentelemetry-go-contrib#8661</a></li>
<li>chore(deps): update github.com/securego/gosec/v2 digest to 8895462
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8663">open-telemetry/opentelemetry-go-contrib#8663</a></li>
<li>otelconf: support OTEL_CONFIG_FILE as it is no longer experimental
by <a href="https://github.com/codeboten"><code>@​codeboten</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8639">open-telemetry/opentelemetry-go-contrib#8639</a></li>
<li>chore(deps): update module github.com/sonatard/noctx to v0.5.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8664">open-telemetry/opentelemetry-go-contrib#8664</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/2.5.0/0.68.0/0.37.0/0.23.0/0.18.0/0.16.0/0.15.0] -
2026-04-03</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8660">#8660</a>)</li>
<li>Add support to set the configuration file via
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li>
<li>Add support for <code>service</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8674">#8674</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in tracer provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8687">#8687</a>)</li>
<li>Add support for <code>attribute_count_limit</code> and
<code>attribute_value_length_limit</code> in logger provider
configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8686">#8686</a>)</li>
<li>Add support for <code>server.address</code> and
<code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li>
<li>Add support for <code>OTEL_SEMCONV_STABILITY_OPT_IN</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
Supported values are <code>rpc</code> (default), <code>rpc/dup</code>
and <code>rpc/old</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8726">#8726</a>)</li>
<li>Add the <code>http.route</code> metric attribute to
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8632">#8632</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Prepend <code>_</code> to the normalized environment variable name
when the key starts with a digit in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, ensuring
POSIX compliance. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8678">#8678</a>)</li>
<li>Move experimental types from
<code>go.opentelemetry.io/contrib/otelconf</code> to
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529">#8529</a>)</li>
<li>Normalize cached environment variable names in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>, aligning
<code>Carrier.Keys</code> output with the carrier's normalized key
format. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761">#8761</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix <code>go.opentelemetry.io/contrib/otelconf</code> Prometheus
reader converting OTel dot-style label names (e.g.
<code>service.name</code>) to underscore-style
(<code>service_name</code>) in <code>target_info</code> when both
<code>without_type_suffix</code> and <code>without_units</code> are set.
Use <code>NoTranslation</code> instead of
<code>UnderscoreEscapingWithoutSuffixes</code> to preserve dot-style
label names while still suppressing metric name suffixes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763">#8763</a>)</li>
<li>Limit the request body size at 1MB in
<code>go.opentelemetry.io/contrib/zpages</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8656">#8656</a>)</li>
<li>Fix server spans using the client's address and port for
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Host ID resource detector has been removed when configuring the
<code>host</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8581">#8581</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>OTEL_EXPERIMENTAL_CONFIG_FILE</code> in favour of
<code>OTEL_CONFIG_FILE</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="45977a4b9c"><code>45977a4</code></a>
Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8769">#8769</a>)</li>
<li><a
href="0fcc1524d1"><code>0fcc152</code></a>
fix(deps): update module
github.com/googlecloudplatform/opentelemetry-operati...</li>
<li><a
href="eaba3cdaa1"><code>eaba3cd</code></a>
chore(deps): update googleapis to 6f92a3b (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li>
<li><a
href="6df430c480"><code>6df430c</code></a>
chore(deps): update module github.com/jgautheron/goconst to v1.10.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8771">#8771</a>)</li>
<li><a
href="ae90e3237e"><code>ae90e32</code></a>
Fix otelconf prometheus label escaping (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763">#8763</a>)</li>
<li><a
href="f202c3f800"><code>f202c3f</code></a>
otelconf: move experimental types to otelconf/x (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529">#8529</a>)</li>
<li><a
href="8ddaecee1c"><code>8ddaece</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8764">#8764</a>)</li>
<li><a
href="c7c03a47d4"><code>c7c03a4</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8766">#8766</a>)</li>
<li><a
href="717a85a203"><code>717a85a</code></a>
envcar: normalize cached environment variable names (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761">#8761</a>)</li>
<li><a
href="ad990b6d55"><code>ad990b6</code></a>
fix(deps): update module github.com/aws/smithy-go to v1.24.3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8765">#8765</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.67.0...zpages/v0.68.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel` from 1.42.0 to 1.43.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64"><code>9276201</code></a>
Release v1.43.0 / v0.65.0 / v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li>
<li><a
href="61b8c9466c"><code>61b8c94</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li>
<li><a
href="97a086e82f"><code>97a086e</code></a>
chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li>
<li><a
href="5e363de517"><code>5e363de</code></a>
limit response body size for OTLP HTTP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><a
href="35214b6013"><code>35214b6</code></a>
Use an absolute path when calling bsd kenv (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li><a
href="290024ceaf"><code>290024c</code></a>
fix(deps): update module google.golang.org/grpc to v1.80.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li>
<li><a
href="e70658e098"><code>e70658e</code></a>
fix: support getBody in otelploghttp (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
<li><a
href="4afe468e3b"><code>4afe468</code></a>
fix(deps): update googleapis to 9d38bb4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li>
<li><a
href="b9ca729776"><code>b9ca729</code></a>
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li>
<li><a
href="69472ec56c"><code>69472ec</code></a>
chore(deps): update fossas/fossa-action action to v1.9.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.42.0...v1.43.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.64.0 to
0.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel/exporters/prometheus's
releases</a>.</em></p>
<blockquote>
<h2>v1.43.0/v0.65.0/v0.19.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Refactor slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h2>Deprecated</h2>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update module github.com/jgautheron/goconst to v1.9.0
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8014">open-telemetry/opentelemetry-go#8014</a></li>
<li>fix(deps): update github.com/opentracing-contrib/go-grpc/test digest
to 190d7d4 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8013">open-telemetry/opentelemetry-go#8013</a></li>
<li>chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8016">open-telemetry/opentelemetry-go#8016</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8011">open-telemetry/opentelemetry-go#8011</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8023">open-telemetry/opentelemetry-go#8023</a></li>
<li>fix(deps): update module github.com/golangci/golangci-lint/v2 to
v2.11.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8020">open-telemetry/opentelemetry-go#8020</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64"><code>9276201</code></a>
Release v1.43.0 / v0.65.0 / v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li>
<li><a
href="61b8c9466c"><code>61b8c94</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li>
<li><a
href="97a086e82f"><code>97a086e</code></a>
chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li>
<li><a
href="5e363de517"><code>5e363de</code></a>
limit response body size for OTLP HTTP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><a
href="35214b6013"><code>35214b6</code></a>
Use an absolute path when calling bsd kenv (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li><a
href="290024ceaf"><code>290024c</code></a>
fix(deps): update module google.golang.org/grpc to v1.80.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li>
<li><a
href="e70658e098"><code>e70658e</code></a>
fix: support getBody in otelploghttp (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
<li><a
href="4afe468e3b"><code>4afe468</code></a>
fix(deps): update googleapis to 9d38bb4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li>
<li><a
href="b9ca729776"><code>b9ca729</code></a>
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li>
<li><a
href="69472ec56c"><code>69472ec</code></a>
chore(deps): update fossas/fossa-action action to v1.9.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/exporters/prometheus/v0.64.0...exporters/prometheus/v0.65.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/metric` from 1.42.0 to 1.43.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9276201a64"><code>9276201</code></a>
Release v1.43.0 / v0.65.0 / v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li>
<li><a
href="61b8c9466c"><code>61b8c94</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li>
<li><a
href="97a086e82f"><code>97a086e</code></a>
chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li>
<li><a
href="5e363de517"><code>5e363de</code></a>
limit response body size for OTLP HTTP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><a
href="35214b6013"><code>35214b6</code></a>
Use an absolute path when calling bsd kenv (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li><a
href="290024ceaf"><code>290024c</code></a>
fix(deps): update module google.golang.org/grpc to v1.80.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li>
<li><a
href="e70658e098"><code>e70658e</code></a>
fix: support getBody in otelploghttp (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
<li><a
href="4afe468e3b"><code>4afe468</code></a>
fix(deps): update googleapis to 9d38bb4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li>
<li><a
href="b9ca729776"><code>b9ca729</code></a>
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li>
<li><a
href="69472ec56c"><code>69472ec</code></a>
chore(deps): update fossas/fossa-action action to v1.9.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.42.0...v1.43.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opent...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 05:33:36 -04:00
dependabot[bot]
81bc5ff653
 		build(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 (#1131) 
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
from 0.21.3 to 0.21.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.4</h2>
<h2>What's Changed</h2>
<ul>
<li>go.mod: do not make a viral minimum go version by <a
href="https://github.com/howardjohn"><code>@​howardjohn</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2237">google/go-containerregistry#2237</a></li>
<li>Avoid pruning absolute links from extracted and flattened images by
<a href="https://github.com/Subserial"><code>@​Subserial</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2241">google/go-containerregistry#2241</a></li>
<li>Bump the go-deps group across 3 directories with 5 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2245">google/go-containerregistry#2245</a></li>
<li>fix: update to go1.25.8, and use separate .go-version file by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2246">google/go-containerregistry#2246</a></li>
<li>Bump CI go version to 1.26.1 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2242">google/go-containerregistry#2242</a></li>
<li>Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2240">google/go-containerregistry#2240</a></li>
<li>fork distribution client v3 auth-challenge as an internal package
(squashed) by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2248">google/go-containerregistry#2248</a></li>
<li>transport: validate Bearer realm URL to prevent SSRF by <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2243">google/go-containerregistry#2243</a></li>
<li>revert path traversal and symlink escape from <a
href="https://redirect.github.com/google/go-containerregistry/issues/2227">#2227</a>
by <a href="https://github.com/Subserial"><code>@​Subserial</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2250">google/go-containerregistry#2250</a></li>
<li>Fix pkg/v1/google/auth tests for arm64 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2085">google/go-containerregistry#2085</a></li>
<li>goreleaser: Update goreleaser config and GH action by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2253">google/go-containerregistry#2253</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2243">google/go-containerregistry#2243</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4">https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e8813dd0a0"><code>e8813dd</code></a>
goreleaser: Update goreleaser config and GH action for releases (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2253">#2253</a>)</li>
<li><a
href="e90447d319"><code>e90447d</code></a>
replace gcloud in binary calls in pkg/v1/google tests (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2085">#2085</a>)</li>
<li><a
href="0d0368c2a5"><code>0d0368c</code></a>
revert path traversal and symlink escape changes (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2250">#2250</a>)</li>
<li><a
href="a2f47d4202"><code>a2f47d4</code></a>
transport: validate Bearer realm URL to prevent SSRF (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2243">#2243</a>)</li>
<li><a
href="19a36cd8c4"><code>19a36cd</code></a>
fork distribution client v3 auth-challenge as an internal package
(squashed) ...</li>
<li><a
href="c612a9b20a"><code>c612a9b</code></a>
Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2240">#2240</a>)</li>
<li><a
href="8f92f59fd6"><code>8f92f59</code></a>
Bump CI go version to 1.26.1 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2242">#2242</a>)</li>
<li><a
href="c99e7cf68b"><code>c99e7cf</code></a>
fix: update to go1.25.8, and use separate .go-version file (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2246">#2246</a>)</li>
<li><a
href="0794660d72"><code>0794660</code></a>
Bump the go-deps group across 3 directories with 5 updates (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2245">#2245</a>)</li>
<li><a
href="4cb93aef09"><code>4cb93ae</code></a>
Undo pruning absolute links from extracted and flattened images (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2241">#2241</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.3&new-version=0.21.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 05:33:17 -04:00
dependabot[bot]
2a6b00dde7
 		build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (#1092) 
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.8.0
to 5.9.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.9.1 (March 22, 2026)</h1>
<ul>
<li>Fix: batch result format corruption when using cached prepared
statements (reported by Dirkjan Bussink)</li>
</ul>
<h1>5.9.0 (March 21, 2026)</h1>
<p>This release includes a number of new features such as
SCRAM-SHA-256-PLUS support, OAuth authentication support, and
PostgreSQL protocol 3.2 support.</p>
<p>It significantly reduces the amount of network traffic when using
prepared statements (which are used automatically by
default) by avoiding unnecessary Describe Portal messages. This also
reduces local memory usage.</p>
<p>It also includes multiple fixes for potential DoS due to panic or OOM
if connected to a malicious server that sends
deliberately malformed messages.</p>
<ul>
<li>Require Go 1.25+</li>
<li>Add SCRAM-SHA-256-PLUS support (Adam Brightwell)</li>
<li>Add OAuth authentication support for PostgreSQL 18 (David
Schneider)</li>
<li>Add PostgreSQL protocol 3.2 support (Dirkjan Bussink)</li>
<li>Add tsvector type support (Adam Brightwell)</li>
<li>Skip Describe Portal for cached prepared statements reducing network
round trips</li>
<li>Make LoadTypes query easier to support on &quot;postgres-like&quot;
servers (Jelte Fennema-Nio)</li>
<li>Default empty user to current OS user matching libpq behavior
(ShivangSrivastava)</li>
<li>Optimize LRU statement cache with custom linked list and node
pooling (Mathias Bogaert)</li>
<li>Optimize date scanning by replacing regex with manual parsing
(Mathias Bogaert)</li>
<li>Optimize pgio append/set functions with direct byte shifts (Mathias
Bogaert)</li>
<li>Make RowsAffected faster (Abhishek Chanda)</li>
<li>Fix: Pipeline.Close panic when server sends multiple FATAL errors
(Varun Chawla)</li>
<li>Fix: ContextWatcher goroutine leak (Hank Donnay)</li>
<li>Fix: stdlib discard connections with open transactions in
ResetSession (Jeremy Schneider)</li>
<li>Fix: pipelineBatchResults.Exec silently swallowing lastRows
error</li>
<li>Fix: ColumnTypeLength using BPCharArrayOID instead of BPCharOID</li>
<li>Fix: TSVector text encoding returning nil for valid empty
tsvector</li>
<li>Fix: wrong error messages for Int2 and Int4 underflow</li>
<li>Fix: Numeric nil Int pointer dereference with Valid: true</li>
<li>Fix: reversed strings.ContainsAny arguments in
Numeric.ScanScientific</li>
<li>Fix: message length parsing on 32-bit platforms</li>
<li>Fix: FunctionCallResponse.Decode mishandling of signed result
size</li>
<li>Fix: returning wrong error in configTLS when DecryptPEMBlock fails
(Maxim Motyshen)</li>
<li>Fix: misleading ParseConfig error when default_query_exec_mode is
invalid (Skarm)</li>
<li>Fix: missed Unwatch in Pipeline error paths</li>
<li>Clarify too many failed acquire attempts error message</li>
<li>Better error wrapping with context and SQL statement (Aneesh
Makala)</li>
<li>Enable govet and ineffassign linters (Federico Guerinoni)</li>
<li>Guard against various malformed binary messages (arrays, hstore,
multirange, protocol messages)</li>
<li>Fix various godoc comments (ferhat elmas)</li>
<li>Fix typos in comments (Oleksandr Redko)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e4eaedb47"><code>4e4eaed</code></a>
Release v5.9.1</li>
<li><a
href="6273188265"><code>6273188</code></a>
Fix batch result format corruption when using cached prepared
statements</li>
<li><a
href="f7b90c2f1a"><code>f7b90c2</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2524">#2524</a> from
dbussink/pipeline-result-format-reuse</li>
<li><a
href="3ce6d75be4"><code>3ce6d75</code></a>
Add failing test: batch scan corrupted in cache_statement mode</li>
<li><a
href="b4d8e62b66"><code>b4d8e62</code></a>
Release v5.9.0</li>
<li><a
href="c227cd4f76"><code>c227cd4</code></a>
Bump minimum Go version from 1.24 to 1.25</li>
<li><a
href="f492c14836"><code>f492c14</code></a>
Use reflect.TypeFor instead of reflect.TypeOf for static types</li>
<li><a
href="ad8fb08d3f"><code>ad8fb08</code></a>
Use sync.WaitGroup.Go to simplify goroutine spawning</li>
<li><a
href="303377376d"><code>3033773</code></a>
Remove go1.26 build tag from synctest test</li>
<li><a
href="83ffb3c222"><code>83ffb3c</code></a>
Validate multirange element count against source length before
allocating</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.8.0...v5.9.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-02 00:10:21 -04:00
dependabot[bot]
fff1664e3d
 		build(deps): bump the actions group across 1 directory with 2 updates (#1105) 
Bumps the actions group with 2 updates in the / directory:
[actions/setup-go](https://github.com/actions/setup-go) and
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).

Updates `actions/setup-go` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-go/releases">actions/setup-go's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add go-download-base-url input for custom Go distributions by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li>
</ul>
<h3>Documentation update</h3>
<ul>
<li>Rearrange README.md, add advanced-usage.md by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li>
<li>Fix Microsoft build of Go link by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gdams"><code>@​gdams</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4a3601121d"><code>4a36011</code></a>
docs: fix Microsoft build of Go link (<a
href="https://redirect.github.com/actions/setup-go/issues/734">#734</a>)</li>
<li><a
href="8f19afcc70"><code>8f19afc</code></a>
feat: add go-download-base-url input for custom Go distributions (<a
href="https://redirect.github.com/actions/setup-go/issues/721">#721</a>)</li>
<li><a
href="27fdb267c1"><code>27fdb26</code></a>
Bump minimatch from 3.1.2 to 3.1.5 (<a
href="https://redirect.github.com/actions/setup-go/issues/727">#727</a>)</li>
<li><a
href="def8c394e3"><code>def8c39</code></a>
Rearrange README.md, add advanced-usage.md (<a
href="https://redirect.github.com/actions/setup-go/issues/724">#724</a>)</li>
<li>See full diff in <a
href="4b73464bb3...4a3601121d">compare
view</a></li>
</ul>
</details>
<br />

Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update default cosign-release to v3.0.5 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/223">sigstore/cosign-installer#223</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1">https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cad07c2e89"><code>cad07c2</code></a>
chore: update default cosign-release to v3.0.5 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/223">#223</a>)</li>
<li>See full diff in <a
href="ba7bc0a3fe...cad07c2e89">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-02 00:04:08 -04:00
dependabot[bot]
7be5dd23c0
 		build(deps): bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 in /deploy (#1104) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.16.5 to 5.17.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/cloudflare/circl to v1.6.3
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1930">go-git/go-git#1930</a></li>
<li>[v5] plumbing: format/index, Improve v4 entry name validation by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1935">go-git/go-git#1935</a></li>
<li>[v5] plumbing: format/idxfile, Fix version and fanout checks by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1937">go-git/go-git#1937</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1">https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1</a></p>
<h2>v5.17.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.16.5
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1839">go-git/go-git#1839</a></li>
<li>git: worktree, optimize infiles function for very large repos by <a
href="https://github.com/k-anshul"><code>@​k-anshul</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1853">go-git/go-git#1853</a></li>
<li>git: Add strict checks for supported extensions by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1861">go-git/go-git#1861</a></li>
<li>backport, git: Improve Status() speed with new index.ModTime check
by <a
href="https://github.com/cedric-appdirect"><code>@​cedric-appdirect</code></a>
in <a
href="https://redirect.github.com/go-git/go-git/pull/1862">go-git/go-git#1862</a></li>
<li>storage: filesystem, Avoid overwriting loose obj files by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1864">go-git/go-git#1864</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0">https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5e23dfd02d"><code>5e23dfd</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1937">#1937</a>
from pjbgf/idx-v5</li>
<li><a
href="6b38a32681"><code>6b38a32</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1935">#1935</a>
from pjbgf/index-v5</li>
<li><a
href="cd757fcb85"><code>cd757fc</code></a>
plumbing: format/idxfile, Fix version and fanout checks</li>
<li><a
href="3ec0d70cb6"><code>3ec0d70</code></a>
plumbing: format/index, Fix tree extension invalidated entry
parsing</li>
<li><a
href="dbe10b6b42"><code>dbe10b6</code></a>
plumbing: format/index, Align V2/V3 long name and V4 prefix encoding
with Git</li>
<li><a
href="e9b65df44c"><code>e9b65df</code></a>
plumbing: format/index, Improve v4 entry name validation</li>
<li><a
href="adad18daab"><code>adad18d</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1930">#1930</a>
from go-git/renovate/releases/v5.x-go-github.com-clo...</li>
<li><a
href="29470bd1d8"><code>29470bd</code></a>
build: Update module github.com/cloudflare/circl to v1.6.3
[SECURITY]</li>
<li><a
href="bdf06885bd"><code>bdf0688</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1864">#1864</a>
from pjbgf/v5-issue-55</li>
<li><a
href="5290e521c8"><code>5290e52</code></a>
storage: filesystem, Avoid overwriting loose obj files. Fixes <a
href="https://redirect.github.com/go-git/go-git/issues/55">#55</a></li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.16.5&new-version=5.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-02 00:03:51 -04:00
dependabot[bot]
bc8ff18495
 		build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.37.3 (#1098) 
Bumps
[github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma)
from 2.37.2 to 2.37.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/danielgtaylor/huma/releases">github.com/danielgtaylor/huma/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.37.3</h2>
<h2>Overview</h2>
<p>This bugfix release fixes a few minor bugs and typos from previous
releases.</p>
<p>This also adjusts the HTTP status code returned by Huma if marshaling
a response fails, from 200 to 500.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix: add allow-popups to CSP sandbox for OAuth popups by <a
href="https://github.com/Micaso"><code>@​Micaso</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/987">danielgtaylor/huma#987</a></li>
<li>Fix: use epsilon tolerance in multipleOf float validation by <a
href="https://github.com/smazurov"><code>@​smazurov</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/989">danielgtaylor/huma#989</a></li>
<li>Fix typo in groups.md documentation by <a
href="https://github.com/Its-Haze"><code>@​Its-Haze</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/995">danielgtaylor/huma#995</a></li>
<li>Fix relative schema urls by <a
href="https://github.com/wolveix"><code>@​wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/990">danielgtaylor/huma#990</a></li>
<li>Return HTTP 500 if marshaling fails by <a
href="https://github.com/wolveix"><code>@​wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/997">danielgtaylor/huma#997</a></li>
<li>Handle contentEncoding and contentMediaType keys by <a
href="https://github.com/NPellet"><code>@​NPellet</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/919">danielgtaylor/huma#919</a></li>
<li>Chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.11 to
2.52.12 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/984">danielgtaylor/huma#984</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Micaso"><code>@​Micaso</code></a> made
their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/987">danielgtaylor/huma#987</a></li>
<li><a href="https://github.com/smazurov"><code>@​smazurov</code></a>
made their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/989">danielgtaylor/huma#989</a></li>
<li><a href="https://github.com/Its-Haze"><code>@​Its-Haze</code></a>
made their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/995">danielgtaylor/huma#995</a></li>
<li><a href="https://github.com/NPellet"><code>@​NPellet</code></a> made
their first contribution in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/919">danielgtaylor/huma#919</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3">https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a38b53666d"><code>a38b536</code></a>
chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.11 to 2.52.12
(<a
href="https://redirect.github.com/danielgtaylor/huma/issues/984">#984</a>)</li>
<li><a
href="f4c53634a2"><code>f4c5363</code></a>
Handle contentEncoding and contentMediaType keys (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/919">#919</a>)</li>
<li><a
href="1678a04e88"><code>1678a04</code></a>
Return HTTP 500 if marshaling fails (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/997">#997</a>)</li>
<li><a
href="1d5dddfc50"><code>1d5dddf</code></a>
Fix relative schema urls (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/990">#990</a>)</li>
<li><a
href="1b8766d7c3"><code>1b8766d</code></a>
fix typo in groups.md documentation (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/995">#995</a>)</li>
<li><a
href="99e60fdd0b"><code>99e60fd</code></a>
fix: use epsilon tolerance in multipleOf float validation (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/989">#989</a>)</li>
<li><a
href="c6694fa179"><code>c6694fa</code></a>
fix: add allow-popups to CSP sandbox for OAuth popups (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/987">#987</a>)</li>
<li>See full diff in <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.37.2&new-version=2.37.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-02 00:03:28 -04:00
dependabot[bot]
f30e540117
 		build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.226.0 to 3.228.0 in /deploy (#1094) 
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.226.0 to 3.228.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.228.0</h2>
<h2>3.228.0 (2026-03-25)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Don't apply the secrets filter to <code>true</code> and
<code>false</code> (case-insensitive)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22269">#22269</a></p>
</li>
<li>
<p>[cli] Add grpcs:// support and header authentication to OTLP exporter
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22320">#22320</a></p>
</li>
<li>
<p>[cli] Read OTEL_RESOURCE_ATTRIBUTES
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22329">#22329</a></p>
</li>
<li>
<p>[auto/nodejs] Add low-level &quot;cancel&quot; command to the
auto-generated interface
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22156">#22156</a></p>
</li>
<li>
<p>[cli/state] Allow <code>pulumi state delete</code> to accept multiple
resource URNs and delete them in a dependency-safe order</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Allow relative file paths for --otel-traces
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22300">#22300</a></p>
</li>
<li>
<p>[cli] Bridge opentracing spans from providers into OTel
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22313">#22313</a></p>
</li>
<li>
<p>[cli] Correctly end spans for GRPC streams
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22304">#22304</a></p>
</li>
<li>
<p>[cli/about] Do not include the access token in plain text
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22347">#22347</a></p>
</li>
<li>
<p>[display] Fix detailed diff indentation so changed resources are not
visually nested under unrelated visible resources when unchanged parents
are hidden.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22317">#22317</a></p>
</li>
<li>
<p>[cli/import] Fix import codegen when generating references to
non-standard names
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22319">#22319</a></p>
</li>
<li>
<p>[engine] Update golang version
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22277">#22277</a></p>
</li>
<li>
<p>[pcl] Typecheck component inputs in PCL programs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22292">#22292</a></p>
</li>
<li>
<p>[programgen/{nodejs,python}] Fix literal conversion when calling into
local components
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22306">#22306</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.228.0 (2026-03-25)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Don't apply the secrets filter to <code>true</code> and
<code>false</code> (case-insensitive)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22269">#22269</a></p>
</li>
<li>
<p>[cli] Add grpcs:// support and header authentication to OTLP exporter
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22320">#22320</a></p>
</li>
<li>
<p>[cli] Read OTEL_RESOURCE_ATTRIBUTES
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22329">#22329</a></p>
</li>
<li>
<p>[auto/nodejs] Add low-level &quot;cancel&quot; command to the
auto-generated interface
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22156">#22156</a></p>
</li>
<li>
<p>[cli/state] Allow <code>pulumi state delete</code> to accept multiple
resource URNs and delete them in a dependency-safe order</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Allow relative file paths for --otel-traces
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22300">#22300</a></p>
</li>
<li>
<p>[cli] Bridge opentracing spans from providers into OTel
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22313">#22313</a></p>
</li>
<li>
<p>[cli] Correctly end spans for GRPC streams
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22304">#22304</a></p>
</li>
<li>
<p>[cli/about] Do not include the access token in plain text
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22347">#22347</a></p>
</li>
<li>
<p>[display] Fix detailed diff indentation so changed resources are not
visually nested under unrelated visible resources when unchanged parents
are hidden.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22317">#22317</a></p>
</li>
<li>
<p>[cli/import] Fix import codegen when generating references to
non-standard names
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22319">#22319</a></p>
</li>
<li>
<p>[engine] Update golang version
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22277">#22277</a></p>
</li>
<li>
<p>[pcl] Typecheck component inputs in PCL programs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22292">#22292</a></p>
</li>
<li>
<p>[programgen/{nodejs,python}] Fix literal conversion when calling into
local components
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22306">#22306</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7551b7f72e"><code>7551b7f</code></a>
feat(cli/state): multiple URNs and substring match for <code>pulumi
state delete</code> ...</li>
<li><a
href="6a1c2d2d64"><code>6a1c2d2</code></a>
env: mark AccessToken as Secret (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22347">#22347</a>)</li>
<li><a
href="9630cec028"><code>9630cec</code></a>
Deprecate legacy mode (<a
href="https://redirect.github.com/pulumi/pulumi/issues/19625">#19625</a>)</li>
<li><a
href="3171ca6903"><code>3171ca6</code></a>
Fix l2-component-call-simple (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22339">#22339</a>)</li>
<li><a
href="d5bf67ee45"><code>d5bf67e</code></a>
Fix use of sanitised names in import codegen (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22319">#22319</a>)</li>
<li><a
href="6589fd4215"><code>6589fd4</code></a>
Allow setting a GRPC endpoint for performance tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22330">#22330</a>)</li>
<li><a
href="fba98e9c64"><code>fba98e9</code></a>
Unskip l2-snake-names (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22337">#22337</a>)</li>
<li><a
href="469eb8384d"><code>469eb83</code></a>
[display] Fix detailed diff indentation when hidden parents are
unchanged (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="fe4a6355b1"><code>fe4a635</code></a>
Update golang version to fix CVEs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22277">#22277</a>)</li>
<li><a
href="cfb587b741"><code>cfb587b</code></a>
fix(sdk/go/pulumi-language-go/goversion): handle non-standard toolchains
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22">#22</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.226.0...v3.228.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.226.0&new-version=3.228.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-02 00:03:02 -04:00
dependabot[bot]
c5c4b9e889
 		build(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 in the actions group (#1085) 2026-03-22 18:53:07 +02:00
Radoslav Dimitrov
ddb93bd3a8
 		Add contributing guidelines to prevent seed.json PRs (#1079) 
<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We've been receiving numerous PRs from authors attempting to publish
their MCP server by adding entries to `data/seed.json`. This is not the
correct approach as servers should be published using the
`mcp-publisher` CLI tool.

Many of these PRs appear to be AI-generated so the existing docs aren't
being surfaced effectively. This PR adds explicit guidance in the files
that AI coding assistants actually read:
- `CONTRIBUTING.md` - shown by GitHub when opening new PRs; widely
ingested by AI tools
- `.github/copilot-instructions.md` - read by GitHub Copilot
- `CLAUDE.md` - read by Claude Code and Claude on github.com

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-03-22 07:42:18 -07:00
dependabot[bot]
9c180f4d33
 		build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#1076) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.78.0 to 1.79.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.79.3</h2>
<h1>Security</h1>
<ul>
<li>server: fix an authorization bypass where malformed :path headers
(missing the leading slash) could bypass path-based restricted
&quot;deny&quot; rules in interceptors like <code>grpc/authz</code>. Any
request with a non-canonical path is now immediately rejected with an
<code>Unimplemented</code> error. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li>
</ul>
<h2>Release 1.79.2</h2>
<h1>Bug Fixes</h1>
<ul>
<li>stats: Prevent redundant error logging in health/ORCA producers by
skipping stats/tracing processing when no stats handler is configured.
(<a
href="https://redirect.github.com/grpc/grpc-go/pull/8874">grpc/grpc-go#8874</a>)</li>
</ul>
<h2>Release 1.79.1</h2>
<h1>Bug Fixes</h1>
<ul>
<li>grpc: Remove the <code>-dev</code> suffix from the User-Agent
header. (<a
href="https://redirect.github.com/grpc/grpc-go/pull/8902">grpc/grpc-go#8902</a>)</li>
</ul>
<h2>Release 1.79.0</h2>
<h1>API Changes</h1>
<ul>
<li>mem: Add experimental API <code>SetDefaultBufferPool</code> to
change the default buffer pool. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8806">#8806</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/vanja-p"><code>@​vanja-p</code></a></li>
</ul>
</li>
<li>experimental/stats: Update <code>MetricsRecorder</code> to require
embedding the new <code>UnimplementedMetricsRecorder</code> (a no-op
struct) in all implementations for forward compatibility. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li>
</ul>
<h1>Behavior Changes</h1>
<ul>
<li>balancer/weightedtarget: Remove handling of <code>Addresses</code>
and only handle <code>Endpoints</code> in resolver updates. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8841">#8841</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Add support for asynchronous gauge metrics
through the new <code>AsyncMetricReporter</code> and
<code>RegisterAsyncReporter</code> APIs. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li>
<li>pickfirst: Add support for weighted random shuffling of endpoints,
as described in <a
href="https://redirect.github.com/grpc/proposal/pull/535">gRFC A113</a>.
<ul>
<li>This is enabled by default, and can be turned off using the
environment variable
<code>GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a>)</li>
</ul>
</li>
<li>xds: Implement <code>:authority</code> rewriting, as specified in <a
href="https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md">gRFC
A81</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8779">#8779</a>)</li>
<li>balancer/randomsubsetting: Implement the
<code>random_subsetting</code> LB policy, as specified in <a
href="https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md">gRFC
A68</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8650">#8650</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/marek-szews"><code>@​marek-szews</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>credentials/tls: Fix a bug where the port was not stripped from the
authority override before validation. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8726">#8726</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/Atul1710"><code>@​Atul1710</code></a></li>
</ul>
</li>
<li>xds/priority: Fix a bug causing delayed failover to lower-priority
clusters when a higher-priority cluster is stuck in
<code>CONNECTING</code> state. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8813">#8813</a>)</li>
<li>health: Fix a bug where health checks failed for clients using
legacy compression options (<code>WithDecompressor</code> or
<code>RPCDecompressor</code>). (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8765">#8765</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/sanki92"><code>@​sanki92</code></a></li>
</ul>
</li>
<li>transport: Fix an issue where the HTTP/2 server could skip header
size checks when terminating a stream early. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8769">#8769</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/joybestourous"><code>@​joybestourous</code></a></li>
</ul>
</li>
<li>server: Propagate status detail headers, if available, when
terminating a stream during request header processing. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8754">#8754</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/joybestourous"><code>@​joybestourous</code></a></li>
</ul>
</li>
</ul>
<h1>Performance Improvements</h1>
<ul>
<li>credentials/alts: Optimize read buffer alignment to reduce copies.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8791">#8791</a>)</li>
<li>mem: Optimize pooling and creation of <code>buffer</code> objects.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8784">#8784</a>)</li>
<li>transport: Reduce slice re-allocations by reserving slice capacity.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8797">#8797</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dda86dbd9c"><code>dda86db</code></a>
Change version to 1.79.3 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8983">#8983</a>)</li>
<li><a
href="72186f163e"><code>72186f1</code></a>
grpc: enforce strict path checking for incoming requests on the server
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li>
<li><a
href="97ca3522b2"><code>97ca352</code></a>
Changing version to 1.79.3-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8954">#8954</a>)</li>
<li><a
href="8902ab6efe"><code>8902ab6</code></a>
Change the version to release 1.79.2 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8947">#8947</a>)</li>
<li><a
href="a9286705aa"><code>a928670</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/8874">#8874</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8904">#8904</a>)</li>
<li><a
href="06df3638c0"><code>06df363</code></a>
Change version to 1.79.2-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8903">#8903</a>)</li>
<li><a
href="782f2de44f"><code>782f2de</code></a>
Change version to 1.79.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8902">#8902</a>)</li>
<li><a
href="850eccbb22"><code>850eccb</code></a>
Change version to 1.79.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8851">#8851</a>)</li>
<li><a
href="765ff056b6"><code>765ff05</code></a>
Change version to 1.79.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8850">#8850</a>)</li>
<li><a
href="68804be0e7"><code>68804be</code></a>
Cherry pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8896">#8896</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.78.0&new-version=1.79.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 23:56:53 +02:00
dependabot[bot]
29ed71a8b8
 		build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /deploy (#1077) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.79.1 to 1.79.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.79.3</h2>
<h1>Security</h1>
<ul>
<li>server: fix an authorization bypass where malformed :path headers
(missing the leading slash) could bypass path-based restricted
&quot;deny&quot; rules in interceptors like <code>grpc/authz</code>. Any
request with a non-canonical path is now immediately rejected with an
<code>Unimplemented</code> error. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li>
</ul>
<h2>Release 1.79.2</h2>
<h1>Bug Fixes</h1>
<ul>
<li>stats: Prevent redundant error logging in health/ORCA producers by
skipping stats/tracing processing when no stats handler is configured.
(<a
href="https://redirect.github.com/grpc/grpc-go/pull/8874">grpc/grpc-go#8874</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dda86dbd9c"><code>dda86db</code></a>
Change version to 1.79.3 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8983">#8983</a>)</li>
<li><a
href="72186f163e"><code>72186f1</code></a>
grpc: enforce strict path checking for incoming requests on the server
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li>
<li><a
href="97ca3522b2"><code>97ca352</code></a>
Changing version to 1.79.3-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8954">#8954</a>)</li>
<li><a
href="8902ab6efe"><code>8902ab6</code></a>
Change the version to release 1.79.2 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8947">#8947</a>)</li>
<li><a
href="a9286705aa"><code>a928670</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/8874">#8874</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8904">#8904</a>)</li>
<li><a
href="06df3638c0"><code>06df363</code></a>
Change version to 1.79.2-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8903">#8903</a>)</li>
<li>See full diff in <a
href="https://github.com/grpc/grpc-go/compare/v1.79.1...v1.79.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.79.1&new-version=1.79.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 23:52:06 +02:00
dependabot[bot]
9c7c8805cc
 		build(deps): bump github.com/google/go-containerregistry from 0.21.2 to 0.21.3 (#1073) 
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
from 0.21.2 to 0.21.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Adds local file support to the <code>crane index</code> subcommand
by <a
href="https://github.com/edwardthiele"><code>@​edwardthiele</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2223">google/go-containerregistry#2223</a></li>
<li>migrate to github.com/moby/moby modules by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2228">google/go-containerregistry#2228</a></li>
<li>Bump the go-deps group across 4 directories with 7 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2233">google/go-containerregistry#2233</a></li>
<li>Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2220">google/go-containerregistry#2220</a></li>
<li>mutate: reject path traversal and symlink escape in Extract by <a
href="https://github.com/KevinZhao"><code>@​KevinZhao</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2227">google/go-containerregistry#2227</a></li>
<li>tarball: detect symlink cycles in extractFileFromTar by <a
href="https://github.com/vnykmshr"><code>@​vnykmshr</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2232">google/go-containerregistry#2232</a></li>
<li>bump golang to 1.25.7 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2236">google/go-containerregistry#2236</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edwardthiele"><code>@​edwardthiele</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2223">google/go-containerregistry#2223</a></li>
<li><a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2228">google/go-containerregistry#2228</a></li>
<li><a href="https://github.com/KevinZhao"><code>@​KevinZhao</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2227">google/go-containerregistry#2227</a></li>
<li><a href="https://github.com/vnykmshr"><code>@​vnykmshr</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2232">google/go-containerregistry#2232</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3">https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3888fb8f87"><code>3888fb8</code></a>
bump golang to 1.25.7 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2236">#2236</a>)</li>
<li><a
href="f4396242bd"><code>f439624</code></a>
tarball: detect symlink cycles in extractFileFromTar (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2232">#2232</a>)</li>
<li><a
href="400c263d8e"><code>400c263</code></a>
mutate: reject path traversal and symlink escape in Extract (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2227">#2227</a>)</li>
<li><a
href="47eedc9de4"><code>47eedc9</code></a>
Bump goreleaser/goreleaser-action in the actions group (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2220">#2220</a>)</li>
<li><a
href="be0a845999"><code>be0a845</code></a>
Bump the go-deps group across 4 directories with 7 updates (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2233">#2233</a>)</li>
<li><a
href="e916301498"><code>e916301</code></a>
migrate to github.com/moby/moby modules (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2228">#2228</a>)</li>
<li><a
href="8b2478e69f"><code>8b2478e</code></a>
Adds local file support to the <code>crane index</code> subcommand (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2223">#2223</a>)</li>
<li>See full diff in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.2&new-version=0.21.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 23:51:32 +02:00
dependabot[bot]
52178183f3
 		build(deps): bump github.com/danielgtaylor/huma/v2 from 2.35.0 to 2.37.2 (#989) 
Bumps
[github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma)
from 2.35.0 to 2.37.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/danielgtaylor/huma/releases">github.com/danielgtaylor/huma/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.37.2</h2>
<h2>Overview</h2>
<p>This bugfix release fixes an issue with how form data was being
documented in OpenAPI.</p>
<p>This also fixes embedded objects with valid JSON tags being
incorrectly embedded in the OpenAPI docs.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't embed embedded objects with valid JSON tags by <a
href="https://github.com/wolveix"><code>@​wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/978">danielgtaylor/huma#978</a></li>
<li>Fix OpenAPI path prefix regression from $schema fix PR by <a
href="https://github.com/wolveix"><code>@​wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/979">danielgtaylor/huma#979</a></li>
<li>Fix form param doc regression by <a
href="https://github.com/wolveix"><code>@​wolveix</code></a> in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/981">danielgtaylor/huma#981</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.1...v2.37.2">https://github.com/danielgtaylor/huma/compare/v2.37.1...v2.37.2</a></p>
<h2>v2.37.1</h2>
<h2>Overview</h2>
<p>This bugfix release fixes an issue regarding the Swagger UI docs
renderer, as well as fixes an issue preventing Groups from using the
configurable options released in v2.37.1.</p>
<p>This also brings interface constructors to <code>humamux</code>.</p>
<h2>What's Changed</h2>
<ul>
<li>Export Gorilla Mux interface constructors by <a
href="https://github.com/RangelReale"><code>@​RangelReale</code></a> in
<a
href="https://redirect.github.com/danielgtaylor/huma/pull/965">danielgtaylor/huma#965</a></li>
<li>fix(api): use proper CSP hash for inline script in Swagger doc
renderer by <a
href="https://github.com/leonklingele"><code>@​leonklingele</code></a>
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/977">danielgtaylor/huma#977</a></li>
<li>fix(group): ensure &quot;Group&quot; satisfies the configProvider
interface by <a
href="https://github.com/leonklingele"><code>@​leonklingele</code></a>
in <a
href="https://redirect.github.com/danielgtaylor/huma/pull/976">danielgtaylor/huma#976</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/danielgtaylor/huma/compare/v2.37.0...v2.37.1">https://github.com/danielgtaylor/huma/compare/v2.37.0...v2.37.1</a></p>
<h2>v2.37.0</h2>
<h2>Overview</h2>
<h3>Dropped Explicit IDN-Hostname Validation</h3>
<p>This validation unintentionally imported an external library to the
base Huma library. Since this was not a requested feature, it has been
removed for now. The <code>idn-hostname</code> format value has become
an alias for <code>hostname</code> in the meantime.</p>
<h3>Operation ID Normalization</h3>
<p>Spaces in operation IDs get automatically converted to hyphens
now.</p>
<h3>Optimizations &amp; Fixed Memory Leak</h3>
<p>Various internal operations have been optimized (~7% overall
improvement): <a
href="https://redirect.github.com/danielgtaylor/huma/pull/973#issue-3960297052">danielgtaylor/huma#973</a></p>
<p>A memory leak when using <code>MultipartFormFiles</code> has been
resolved.</p>
<h3>New Configurable Options</h3>
<h4>Allow Additional Properties By Default</h4>
<p>A new config option has been added to allow additional properties by
default. This can be set in the API config.</p>
<pre lang="go"><code>config.AllowAdditionalPropertiesByDefault = true
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="887f7d4322"><code>887f7d4</code></a>
Fix form param doc regression (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/981">#981</a>)</li>
<li><a
href="f02efeb11d"><code>f02efeb</code></a>
Fix OpenAPI path prefix regression from $schema fix PR (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/979">#979</a>)</li>
<li><a
href="cbf60b60af"><code>cbf60b6</code></a>
Don't embed embedded objects with valid JSON tags (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/978">#978</a>)</li>
<li><a
href="6d0295c4e1"><code>6d0295c</code></a>
fix(group): ensure &quot;Group&quot; satisfies the configProvider
interface (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/976">#976</a>)</li>
<li><a
href="07ca6c5d17"><code>07ca6c5</code></a>
fix(api): use proper CSP hash for inline script in Swagger doc renderer
(<a
href="https://redirect.github.com/danielgtaylor/huma/issues/977">#977</a>)</li>
<li><a
href="58edcf2bf5"><code>58edcf2</code></a>
Export humamux constructors (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/965">#965</a>)</li>
<li><a
href="6c29f67c9d"><code>6c29f67</code></a>
chore(api,docs): update unpkg libraries, specify SRI hash, add strict
CSP (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/916">#916</a>)</li>
<li><a
href="3aee9bd172"><code>3aee9bd</code></a>
Additional docs + normalize operation IDs (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/974">#974</a>)</li>
<li><a
href="e31a8198ad"><code>e31a819</code></a>
Resource optimizations, Go 1.25, remove IDNA library, add benchmark CI
(<a
href="https://redirect.github.com/danielgtaylor/huma/issues/973">#973</a>)</li>
<li><a
href="ddbb810fd5"><code>ddbb810</code></a>
Implement Registry and Query Validation Options (<a
href="https://redirect.github.com/danielgtaylor/huma/issues/925">#925</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/danielgtaylor/huma/compare/v2.35.0...v2.37.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.35.0&new-version=2.37.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-03-16 17:06:31 +02:00
dependabot[bot]
a94c56a78f
 		build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.27.0 to 4.28.0 in /deploy (#1056) 
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.27.0 to 4.28.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.28.0</h2>
<p>No release notes provided.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<h2>4.28.0 (March 12, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Upgrade Kubernetes schema and libraries to v1.35.2.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1655f4c793"><code>1655f4c</code></a>
Prepare for v4.28.0 release (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4230">#4230</a>)</li>
<li><a
href="dbeeb56978"><code>dbeeb56</code></a>
Update module github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3
to v3...</li>
<li><a
href="c6b1c916a3"><code>c6b1c91</code></a>
Automated upgrade: bump Kubernetes to v1.35.2 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4223">#4223</a>)</li>
<li><a
href="fedb665c4f"><code>fedb665</code></a>
Run build on patch upgrade PRs (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4221">#4221</a>)</li>
<li><a
href="4b3e1f493c"><code>4b3e1f4</code></a>
Fix misplaced closing paren in kubernetes-update-check workflow (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4218">#4218</a>)</li>
<li><a
href="1737d00694"><code>1737d00</code></a>
Combined dependencies PR (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4209">#4209</a>)</li>
<li><a
href="be0dfed214"><code>be0dfed</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4217">#4217</a>)</li>
<li><a
href="4ecded1435"><code>4ecded1</code></a>
Fix make lint to run to completion (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4213">#4213</a>)</li>
<li><a
href="af862bb849"><code>af862bb</code></a>
Move cloud-ready-checks back to pulumi-kubernetes (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4196">#4196</a>)</li>
<li><a
href="ecf6701c9e"><code>ecf6701</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4208">#4208</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.27.0...v4.28.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.27.0&new-version=4.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-13 11:53:31 +01:00
dependabot[bot]
01b1ae2555
 		build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.225.1 to 3.226.0 in /deploy (#1057) 
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.225.1 to 3.226.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.226.0</h2>
<h2>3.226.0 (2026-03-11)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[backend/service] Automatically repair snapshot integrity issues,
while sending an error event to the backend for further diagnosis
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22179">#22179</a></p>
</li>
<li>
<p>[cli] Add a --otel-traces flag, that allows writing otel traces to a
file, or directly to a grpc interface
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22129">#22129</a></p>
</li>
<li>
<p>[engine] Engine will use provider references from
<code>__self__</code> arguments to calls
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22114">#22114</a></p>
</li>
<li>
<p>[sdk/bun] Support bun as a runtime
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22177">#22177</a>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22049">#22049</a></p>
</li>
<li>
<p>[sdk/bun] Add debugger support for the bun runtime
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22177">#22177</a></p>
</li>
<li>
<p>[sdk/bun] Add support for Bun as a plugin runtime
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22189">#22189</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix ReplacementTrigger firing due to dependency changes
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22119">#22119</a></p>
</li>
<li>
<p>[engine] Correctly serialize output values to the snapshot rather
than always recording them as computed even when known
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22120">#22120</a></p>
</li>
<li>
<p>[pcl] Support resource ranges in PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22144">#22144</a></p>
</li>
<li>
<p>[cli/config] Include environments used when refreshing a stack's
config
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22103">#22103</a></p>
</li>
<li>
<p>[cli/display] Fix <code>pulumi destroy</code> not showing parent
resource hierarchy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22148">#22148</a></p>
</li>
<li>
<p>[cli/package] Correctly parse package URLs with .git in them
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22174">#22174</a></p>
</li>
<li>
<p>[cli/plugin] Fix package get-schema for binary providers at relative
paths
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22107">#22107</a></p>
</li>
<li>
<p>[sdk/python] Handle null detailedDiff in automation StepEventMetadata
JSON parsing</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="94ee966f0f"><code>94ee966</code></a>
Bump the SDKs for 3.226.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22195">#22195</a>)</li>
<li><a
href="4f16f96499"><code>4f16f96</code></a>
Fix Mise deprecation warnings (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22186">#22186</a>)</li>
<li><a
href="b0a5846488"><code>b0a5846</code></a>
Tighten CLI error typing for exit code mapping (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22176">#22176</a>)</li>
<li><a
href="6ebc01e665"><code>6ebc01e</code></a>
Add support for Bun as a plugin runtime (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22189">#22189</a>)</li>
<li><a
href="a42977b776"><code>a42977b</code></a>
Revert &quot;Pin Node.js to 25.6&quot; (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22188">#22188</a>)</li>
<li><a
href="c1dabceab2"><code>c1dabce</code></a>
rename env variable used for otel internal endpoint (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22187">#22187</a>)</li>
<li><a
href="646a020a63"><code>646a020</code></a>
Read Poetry and uv lockfiles to determine program dependencies (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22072">#22072</a>)</li>
<li><a
href="32871e07a4"><code>32871e0</code></a>
Add <code>l3-for</code> &amp; <code>l3-for-resource</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22180">#22180</a>)</li>
<li><a
href="b190b8b18e"><code>b190b8b</code></a>
Include <code>environment</code> when re-loading config from cloud state
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22103">#22103</a>)</li>
<li><a
href="e5e3a1d68f"><code>e5e3a1d</code></a>
auto repair snapshot integrity errors and send error event (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22179">#22179</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.225.1...v3.226.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.225.1&new-version=3.226.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-13 01:30:03 +01:00
dependabot[bot]
00de8fac8b
 		build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0 (#1054) 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.33.0 to
0.34.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1ac721dff8"><code>1ac721d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="fb1fac8b36"><code>fb1fac8</code></a>
all: upgrade go directive to at least 1.25.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.33.0...v0.34.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.33.0&new-version=0.34.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 11:46:51 +01:00
Jonathan Hefner
b941ee3674
 		Remove .mdx suffixes from internal doc links for Mintlify (#1052) 
These docs are synced to modelcontextprotocol.io which uses Mintlify for
rendering. Mintlify routes are extension-less, so links like
`./package-types.mdx` produce 404s on the live site. Dropping the `.mdx`
suffix fixes those broken links. The trade-off is that the links no
longer resolve when browsing the raw files on GitHub.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-12 11:46:30 +01:00
dependabot[bot]
b112ac3335
 		build(deps): bump the actions group with 2 updates (#1049) 
Bumps the actions group with 2 updates:
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer)
and [anchore/sbom-action](https://github.com/anchore/sbom-action).

Updates `sigstore/cosign-installer` from 4.0.0 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<h2>What's Changed</h2>
<p>We recommend updating as soon as possible as this includes bug fixes
for Cosign. We also recommend removing <code>with: cosign-release</code>
and strongly discourage using <code>cosign-release</code> unless you
have a specific reason to use an older version of Cosign.</p>
<ul>
<li>Bump cosign to 3.0.5 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/220">sigstore/cosign-installer#220</a></li>
<li>fix: add retry to curl downloads for transient network failures in
<a
href="https://redirect.github.com/sigstore/cosign-installer/pull/210">sigstore/cosign-installer#210</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0">https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ba7bc0a3fe"><code>ba7bc0a</code></a>
fix: add retry to curl downloads for transient network failures (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/210">#210</a>)</li>
<li><a
href="5a292e1504"><code>5a292e1</code></a>
Bump cosign to 3.0.5 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/220">#220</a>)</li>
<li><a
href="351ea76151"><code>351ea76</code></a>
Bump actions/checkout from 6.0.1 to 6.0.2 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/217">#217</a>)</li>
<li><a
href="c17565ff32"><code>c17565f</code></a>
test with go 1.26 too (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/221">#221</a>)</li>
<li><a
href="a6fdd19182"><code>a6fdd19</code></a>
Bump actions/setup-go from 6.1.0 to 6.3.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/218">#218</a>)</li>
<li><a
href="430b6a704f"><code>430b6a7</code></a>
docs: fix registry from gcr.io to ghcr.io (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/213">#213</a>)</li>
<li><a
href="4d14d7f17e"><code>4d14d7f</code></a>
feat: update to v3.0.3 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/212">#212</a>)</li>
<li><a
href="f14800521e"><code>f148005</code></a>
fix: use env vars for template expansions; show curl errors (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/207">#207</a>)</li>
<li><a
href="c3f2d79008"><code>c3f2d79</code></a>
Bump actions/checkout from 6.0.0 to 6.0.1 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/208">#208</a>)</li>
<li><a
href="b9a9af4616"><code>b9a9af4</code></a>
drop tests with go1.24 as it cant build (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/211">#211</a>)</li>
<li>Additional commits viewable in <a
href="faadad0cce...ba7bc0a3fe">compare
view</a></li>
</ul>
</details>
<br />

Updates `anchore/sbom-action` from 0.23.0 to 0.23.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anchore/sbom-action/releases">anchore/sbom-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.23.1</h2>
<h2>⬆️ Dependencies</h2>
<ul>
<li>chore(deps): update Syft to v1.42.2 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/607">#607</a>)
[@<a
href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>]</li>
<li>chore(deps): bump fast-xml-parser and all other deps (<a
href="https://redirect.github.com/anchore/sbom-action/issues/604">#604</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="57aae52805"><code>57aae52</code></a>
chore(deps): update Syft to v1.42.2 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/607">#607</a>)</li>
<li><a
href="c29e913258"><code>c29e913</code></a>
chore(deps): bump fast-xml-parser and other deps (<a
href="https://redirect.github.com/anchore/sbom-action/issues/604">#604</a>)</li>
<li>See full diff in <a
href="https://github.com/anchore/sbom-action/compare/v0.23.0...v0.23.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-11 10:44:47 +01:00
Tadas Antanavicius
2575290393
 		chore(deploy): bump production image tag to 1.5.0 (#1043) 
## Summary
- Updates the production image tag in `deploy/Pulumi.gcpProd.yaml` from
`1.4.1` to `1.5.0`

## Test plan
- [ ] Verify the Pulumi deployment picks up the new image tag
- [ ] Confirm the v1.5.0 container image exists in the registry

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 06:53:30 -08:00
dependabot[bot]
c0ecfd5a65
 		build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.2 (#1026) 
Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
from 0.20.7 to 0.21.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Better handle redirects to https in ping by <a
href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2225">google/go-containerregistry#2225</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.1...v0.21.2">https://github.com/google/go-containerregistry/compare/v0.21.1...v0.21.2</a></p>
<h2>v0.21.1</h2>
<p>This release fixes a regression in <code>crane</code> introduced in
the previous release.</p>
<h2>What's Changed</h2>
<ul>
<li>Add WithFileBufferedOpener for file-backed daemon image buffering by
<a href="https://github.com/twdamhore"><code>@​twdamhore</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2214">google/go-containerregistry#2214</a></li>
<li>crane: fix case in auth response json by <a
href="https://github.com/aelindeman"><code>@​aelindeman</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2218">google/go-containerregistry#2218</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/twdamhore"><code>@​twdamhore</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2214">google/go-containerregistry#2214</a></li>
<li><a
href="https://github.com/aelindeman"><code>@​aelindeman</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2218">google/go-containerregistry#2218</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.0...v0.21.1">https://github.com/google/go-containerregistry/compare/v0.21.0...v0.21.1</a></p>
<h2>v0.21.0</h2>
<p>This release updates the minimum Go version to
<code>1.25.6</code>.</p>
<h2>What's Changed</h2>
<ul>
<li>fix(mutate): don't skip dir replacements via whiteout in export by
<a href="https://github.com/r4f4"><code>@​r4f4</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2191">google/go-containerregistry#2191</a></li>
<li>Improve performance of v1.NewHash by <a
href="https://github.com/bmoylan"><code>@​bmoylan</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2194">google/go-containerregistry#2194</a></li>
<li>Bump the actions group across 1 directory with 4 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2207">google/go-containerregistry#2207</a></li>
<li>Bump the root-deps group across 1 directory with 7 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2195">google/go-containerregistry#2195</a></li>
<li>Fix error messages in crane_test.go by <a
href="https://github.com/jammie-jelly"><code>@​jammie-jelly</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2189">google/go-containerregistry#2189</a></li>
<li>Bump go version across packages to 1.25.6 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2211">google/go-containerregistry#2211</a></li>
<li>Join go.mod dependency updates by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2212">google/go-containerregistry#2212</a></li>
<li>Bump the go-deps group across 3 directories with 3 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2213">google/go-containerregistry#2213</a></li>
<li>Disable taint gosec lints by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2215">google/go-containerregistry#2215</a></li>
<li>Update go version used in goreleaser by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2216">google/go-containerregistry#2216</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/r4f4"><code>@​r4f4</code></a> made their
first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2191">google/go-containerregistry#2191</a></li>
<li><a
href="https://github.com/jammie-jelly"><code>@​jammie-jelly</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2189">google/go-containerregistry#2189</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.0">https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9e0ccb0a72"><code>9e0ccb0</code></a>
Better handle redirects to https in ping (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2225">#2225</a>)</li>
<li><a
href="85f2bf5f73"><code>85f2bf5</code></a>
crane: fix case in auth response json (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2218">#2218</a>)</li>
<li><a
href="e971d630dc"><code>e971d63</code></a>
Add WithFileBufferedOpener for file-backed daemon image buffering (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2214">#2214</a>)</li>
<li><a
href="8e2d6a6817"><code>8e2d6a6</code></a>
Update go version used in goreleaser (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2216">#2216</a>)</li>
<li><a
href="b58334f761"><code>b58334f</code></a>
Disable taint gosec lints (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2215">#2215</a>)</li>
<li><a
href="88b39ed906"><code>88b39ed</code></a>
Bump the go-deps group across 3 directories with 3 updates (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2213">#2213</a>)</li>
<li><a
href="102ac75dde"><code>102ac75</code></a>
join go.mod dependency updates (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2212">#2212</a>)</li>
<li><a
href="d5817d559e"><code>d5817d5</code></a>
Bump go version across packages to 1.25.6 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2211">#2211</a>)</li>
<li><a
href="23f0632fa3"><code>23f0632</code></a>
Fix error messages in crane_test.go (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2189">#2189</a>)</li>
<li><a
href="438abde5e7"><code>438abde</code></a>
Bump the root-deps group across 1 directory with 7 updates (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2195">#2195</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.20.7&new-version=0.21.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
 2026-03-07 15:31:08 +02:00
dependabot[bot]
03d551dbab
 		build(deps): bump the opentelemetry group with 6 updates (#1044) 
Bumps the opentelemetry group with 6 updates:

| Package | From | To |
| --- | --- | --- |
|
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
| `0.66.0` | `0.67.0` |
|
[go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go)
| `1.41.0` | `1.42.0` |
|
[go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go)
| `0.63.0` | `0.64.0` |
|
[go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go)
| `1.41.0` | `1.42.0` |
|
[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go)
| `1.41.0` | `1.42.0` |
|
[go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go)
| `1.41.0` | `1.42.0` |

Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from
0.66.0 to 0.67.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>v1.42.0/v2.4.0/v0.67.0/v0.36.0/v0.22.0/v0.17.0/v0.15.0/v0.14.0</h2>
<h3>Added</h3>
<ul>
<li>Add environment variables propagation carrier in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8442">#8442</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.40.0</code>, including updates across instrumentation and
detector modules. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8631">#8631</a>)</p>
<ul>
<li>The semantic conventions v1.40.0 release introduces RPC breaking
changes applied in this repository:
<ul>
<li>RPC spans and metrics no longer include
<code>network.protocol.name</code>,
<code>network.protocol.version</code>, or <code>network.transport</code>
attributes.</li>
<li><code>rpc.client.request.size</code>,
<code>rpc.client.response.size</code>,
<code>rpc.server.request.size</code>, and
<code>rpc.server.response.size</code> are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.</li>
<li><code>rpc.message</code> span events and their message attributes
are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
(including when <code>WithMessageEvents</code> is configured).</li>
</ul>
</li>
</ul>
<p>See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.40.0">semantic-conventions
v1.40.0 release</a> for complete details.</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Ignore informational response status codes (<code>100-199</code>)
except <code>101 Switching Protocols</code> when storing the HTTP status
code in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6913">#6913</a>)</li>
<li>Make <code>Body</code> handling in <code>Transport</code> consistent
with stdlib in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8618">#8618</a>)</li>
<li>Fix bucket boundaries for <code>rpc.server.call.duration</code> and
<code>rpc.client.call.duration</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8642">#8642</a>)</li>
<li>Host resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code> now includes
<code>os.</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8578">#8578</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for <a href="https://go.dev/doc/go1.24">Go 1.24</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8628">#8628</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update github artifact actions to v7 (major) by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8605">open-telemetry/opentelemetry-go-contrib#8605</a></li>
<li>chore(deps): update module github.com/sonatard/noctx to v0.5.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8610">open-telemetry/opentelemetry-go-contrib#8610</a></li>
<li>chore(deps): update github/codeql-action action to v4.32.5 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8620">open-telemetry/opentelemetry-go-contrib#8620</a></li>
<li>fix(deps): update module github.com/aws/smithy-go to v1.24.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8614">open-telemetry/opentelemetry-go-contrib#8614</a></li>
<li>chore(deps): update go-openapi packages by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8621">open-telemetry/opentelemetry-go-contrib#8621</a></li>
<li>fix(deps): update module github.com/shirou/gopsutil/v4 to v4.26.2 by
<a href="https://github.com/renovate"><code>@​renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8622">open-telemetry/opentelemetry-go-contrib#8622</a></li>
<li>chore(deps): update module github.com/kisielk/errcheck to v1.10.0 by
<a href="https://github.com/renovate"><code>@​renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8608">open-telemetry/opentelemetry-go-contrib#8608</a></li>
<li>chore(deps): update module github.com/protonmail/go-crypto to v1.4.0
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8609">open-telemetry/opentelemetry-go-contrib#8609</a></li>
<li>chore(deps): update otel/opentelemetry-collector-contrib docker tag
to v0.147.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8625">open-telemetry/opentelemetry-go-contrib#8625</a></li>
<li>chore(deps): update module github.com/daixiang0/gci to v0.14.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8623">open-telemetry/opentelemetry-go-contrib#8623</a></li>
<li>Drop support for 1.24 by <a
href="https://github.com/dmathieu"><code>@​dmathieu</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8628">open-telemetry/opentelemetry-go-contrib#8628</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8554">open-telemetry/opentelemetry-go-contrib#8554</a></li>
<li>fix(deps): update kubernetes packages to v0.35.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8626">open-telemetry/opentelemetry-go-contrib#8626</a></li>
<li>fix(deps): update aws-sdk-go-v2 monorepo by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8598">open-telemetry/opentelemetry-go-contrib#8598</a></li>
<li>fix(deps): update module github.com/aws/aws-lambda-go to v1.53.0 by
<a href="https://github.com/renovate"><code>@​renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8630">open-telemetry/opentelemetry-go-contrib#8630</a></li>
<li>otelgrpc: modernize the example project by <a
href="https://github.com/ash2k"><code>@​ash2k</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8619">open-telemetry/opentelemetry-go-contrib#8619</a></li>
<li>chore(deps): update googleapis to a57be14 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8606">open-telemetry/opentelemetry-go-contrib#8606</a></li>
<li>fix(deps): update module github.com/gin-gonic/gin to v1.12.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8627">open-telemetry/opentelemetry-go-contrib#8627</a></li>
<li>chore(deps): update module github.com/prometheus/procfs to v0.20.1
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8624">open-telemetry/opentelemetry-go-contrib#8624</a></li>
<li>fix(otelhttp): make Body handling in Transport consistent with
stdlib by <a href="https://github.com/ash2k"><code>@​ash2k</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8618">open-telemetry/opentelemetry-go-contrib#8618</a></li>
<li>otelhttp: Ignore informational response status codes when persisting
status by <a
href="https://github.com/VirrageS"><code>@​VirrageS</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/6913">open-telemetry/opentelemetry-go-contrib#6913</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/2.4.0/0.67.0/0.36.0/0.22.0/0.17.0/0.15.0/0.14.0] -
2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add environment variables propagation carrier in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8442">#8442</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.40.0</code>, including updates across instrumentation and
detector modules. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8631">#8631</a>)</p>
<ul>
<li>The semantic conventions v1.40.0 release introduces RPC breaking
changes applied in this repository:
<ul>
<li>RPC spans and metrics no longer include
<code>network.protocol.name</code>,
<code>network.protocol.version</code>, or <code>network.transport</code>
attributes.</li>
<li><code>rpc.client.request.size</code>,
<code>rpc.client.response.size</code>,
<code>rpc.server.request.size</code>, and
<code>rpc.server.response.size</code> are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.</li>
<li><code>rpc.message</code> span events and their message attributes
are no longer emitted in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
(including when <code>WithMessageEvents</code> is configured).</li>
</ul>
</li>
</ul>
<p>See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.40.0">semantic-conventions
v1.40.0 release</a> for complete details.</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Ignore informational response status codes (<code>100-199</code>)
except <code>101 Switching Protocols</code> when storing the HTTP status
code in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6913">#6913</a>)</li>
<li>Make <code>Body</code> handling in <code>Transport</code> consistent
with stdlib in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8618">#8618</a>)</li>
<li>Fix bucket boundaries for <code>rpc.server.call.duration</code> and
<code>rpc.client.call.duration</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8642">#8642</a>)</li>
<li>Host resource detector in
<code>go.opentelemetry.io/contrib/otelconf</code> now includes
<code>os.</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8578">#8578</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8628">#8628</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d8dabf6736"><code>d8dabf6</code></a>
Release v1.42.0/v2.4.0/v0.67.0/v0.36.0/v0.22.0/v0.17.0/v0.15.0/v0.14.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8649">#8649</a>)</li>
<li><a
href="b1de2c71d9"><code>b1de2c7</code></a>
otelconf: host detector should include os as well (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8578">#8578</a>)</li>
<li><a
href="b228c0f2f2"><code>b228c0f</code></a>
fix(deps): update module google.golang.org/grpc to v1.79.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8644">#8644</a>)</li>
<li><a
href="e70fd977a6"><code>e70fd97</code></a>
Use correct bucket boundaries for otelgrpc client and server histograms
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8642">#8642</a>)</li>
<li><a
href="b018d98a0e"><code>b018d98</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8643">#8643</a>)</li>
<li><a
href="fb6a3518d8"><code>fb6a351</code></a>
chore(deps): update github/codeql-action action to v4.32.6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8641">#8641</a>)</li>
<li><a
href="2c9c10ec4a"><code>2c9c10e</code></a>
chore(deps): update dependency codespell to v2.4.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8640">#8640</a>)</li>
<li><a
href="22248d4c31"><code>22248d4</code></a>
chore: enable modernize linter (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8583">#8583</a>)</li>
<li><a
href="324662a14b"><code>324662a</code></a>
envcar: add environment carrier (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8442">#8442</a>)</li>
<li><a
href="69addb4996"><code>69addb4</code></a>
chore(deps): update k8s.io/kube-openapi digest to 5b3e3fd (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8636">#8636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.66.0...zpages/v0.67.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595"><code>a3941ff</code></a>
Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006">#8006</a>)</li>
<li><a
href="6059c47bc6"><code>6059c47</code></a>
chore(deps): update golang.org/x/telemetry digest to e526e8a (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010">#8010</a>)</li>
<li><a
href="44c7edf896"><code>44c7edf</code></a>
chore(deps): update module github.com/mgechev/revive to v1.15.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009">#8009</a>)</li>
<li><a
href="de5fb3ad10"><code>de5fb3a</code></a>
fix(deps): update module google.golang.org/grpc to v1.79.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007">#8007</a>)</li>
<li><a
href="0b82ded815"><code>0b82ded</code></a>
chore(deps): update codspeedhq/action action to v4.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001">#8001</a>)</li>
<li><a
href="aa3660f77e"><code>aa3660f</code></a>
chore(deps): update github/codeql-action action to v4.32.6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004">#8004</a>)</li>
<li><a
href="9be8c92a13"><code>9be8c92</code></a>
chore(deps): update dependency codespell to v2.4.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003">#8003</a>)</li>
<li><a
href="c9d20155fc"><code>c9d2015</code></a>
log: add error field to Record and make SDK to emit exception attributes
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
<li><a
href="fdd1320c39"><code>fdd1320</code></a>
TracerProvider ForceFlush() Error Fix (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
<li><a
href="78f99042e2"><code>78f9904</code></a>
chore(deps): update golang.org/x/telemetry digest to 18da590 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.63.0 to
0.64.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel/exporters/prometheus's
releases</a>.</em></p>
<blockquote>
<h2>v1.42.0/v0.64.0/v0.18.0/v0.0.16</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>fix changelog protection marker by <a
href="https://github.com/pellared"><code>@​pellared</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7986">open-telemetry/opentelemetry-go#7986</a></li>
<li>Drop support for Go 1.24 by <a
href="https://github.com/MrAlias"><code>@​MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7984">open-telemetry/opentelemetry-go#7984</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7907">open-telemetry/opentelemetry-go#7907</a></li>
<li>chore(deps): update module go.opentelemetry.io/collector/featuregate
to v1.53.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7981">open-telemetry/opentelemetry-go#7981</a></li>
<li>chore(deps): update benchmark-action/github-action-benchmark action
to v1.21.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7989">open-telemetry/opentelemetry-go#7989</a></li>
<li>fix(deps): update module go.opentelemetry.io/collector/pdata to
v1.53.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7982">open-telemetry/opentelemetry-go#7982</a></li>
<li>Revert &quot;Revert &quot;Generate semconv/v1.40.0&quot;&quot; by <a
href="https://github.com/MrAlias"><code>@​MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7985">open-telemetry/opentelemetry-go#7985</a></li>
<li>support stdlib request.GetBody on metrics by <a
href="https://github.com/marifari-hue"><code>@​marifari-hue</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7931">open-telemetry/opentelemetry-go#7931</a></li>
<li>attribute: add TestNotEquivalence and equality operator tests by <a
href="https://github.com/pellared"><code>@​pellared</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7979">open-telemetry/opentelemetry-go#7979</a></li>
<li>Refactor benchmark CI by <a
href="https://github.com/XSAM"><code>@​XSAM</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7873">open-telemetry/opentelemetry-go#7873</a></li>
<li>chore(deps): update module github.com/securego/gosec/v2 to v2.24.7
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7988">open-telemetry/opentelemetry-go#7988</a></li>
<li>chore(deps): pin codspeedhq/action action to df47568 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7996">open-telemetry/opentelemetry-go#7996</a></li>
<li>chore(deps): update actions/checkout action to v6.0.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7997">open-telemetry/opentelemetry-go#7997</a></li>
<li>chore(deps): update codspeedhq/action action to v4.11.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7999">open-telemetry/opentelemetry-go#7999</a></li>
<li>Upgrade to semconv/v1.40.0 by <a
href="https://github.com/MrAlias"><code>@​MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7991">open-telemetry/opentelemetry-go#7991</a></li>
<li>Regenerate semconv/v1.40.0/MIGRATION.md by <a
href="https://github.com/MrAlias"><code>@​MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7992">open-telemetry/opentelemetry-go#7992</a></li>
<li>fix: generated semconv helpers skipping attributes by <a
href="https://github.com/victoraugustolls"><code>@​victoraugustolls</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7964">open-telemetry/opentelemetry-go#7964</a></li>
<li>Feat: Have SpanContext support the new W3C random flag. by <a
href="https://github.com/nikhilmantri0902"><code>@​nikhilmantri0902</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7834">open-telemetry/opentelemetry-go#7834</a></li>
<li>Semconv metric helper caller-slice mutation fix by <a
href="https://github.com/MrAlias"><code>@​MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7993">open-telemetry/opentelemetry-go#7993</a></li>
<li>Fix semconv generated error type to check error chain for custom
type declaration by <a
href="https://github.com/MrAlias"><code>@​MrAlias</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7994">open-telemetry/opentelemetry-go#7994</a></li>
<li>refactor: replace uint64 and int32 with atomic types in tests by <a
href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7941">open-telemetry/opentelemetry-go#7941</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to 18da590 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8000">open-telemetry/opentelemetry-go#8000</a></li>
<li>TracerProvider ForceFlush() Error Fix by <a
href="https://github.com/sawamurataxman"><code>@​sawamurataxman</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7856">open-telemetry/opentelemetry-go#7856</a></li>
<li>log: add error field to Record and make SDK to emit exception
attributes by <a
href="https://github.com/iblancasa"><code>@​iblancasa</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7924">open-telemetry/opentelemetry-go#7924</a></li>
<li>chore(deps): update dependency codespell to v2.4.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8003">open-telemetry/opentelemetry-go#8003</a></li>
<li>chore(deps): update github/codeql-action action to v4.32.6 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8004">open-telemetry/opentelemetry-go#8004</a></li>
<li>chore(deps): update codspeedhq/action action to v4.11.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8001">open-telemetry/opentelemetry-go#8001</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/prometheus's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595"><code>a3941ff</code></a>
Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006">#8006</a>)</li>
<li><a
href="6059c47bc6"><code>6059c47</code></a>
chore(deps): update golang.org/x/telemetry digest to e526e8a (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010">#8010</a>)</li>
<li><a
href="44c7edf896"><code>44c7edf</code></a>
chore(deps): update module github.com/mgechev/revive to v1.15.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009">#8009</a>)</li>
<li><a
href="de5fb3ad10"><code>de5fb3a</code></a>
fix(deps): update module google.golang.org/grpc to v1.79.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007">#8007</a>)</li>
<li><a
href="0b82ded815"><code>0b82ded</code></a>
chore(deps): update codspeedhq/action action to v4.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001">#8001</a>)</li>
<li><a
href="aa3660f77e"><code>aa3660f</code></a>
chore(deps): update github/codeql-action action to v4.32.6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004">#8004</a>)</li>
<li><a
href="9be8c92a13"><code>9be8c92</code></a>
chore(deps): update dependency codespell to v2.4.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003">#8003</a>)</li>
<li><a
href="c9d20155fc"><code>c9d2015</code></a>
log: add error field to Record and make SDK to emit exception attributes
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
<li><a
href="fdd1320c39"><code>fdd1320</code></a>
TracerProvider ForceFlush() Error Fix (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
<li><a
href="78f99042e2"><code>78f9904</code></a>
chore(deps): update golang.org/x/telemetry digest to 18da590 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/exporters/prometheus/v0.63.0...exporters/prometheus/v0.64.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/metric` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595"><code>a3941ff</code></a>
Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006">#8006</a>)</li>
<li><a
href="6059c47bc6"><code>6059c47</code></a>
chore(deps): update golang.org/x/telemetry digest to e526e8a (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010">#8010</a>)</li>
<li><a
href="44c7edf896"><code>44c7edf</code></a>
chore(deps): update module github.com/mgechev/revive to v1.15.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009">#8009</a>)</li>
<li><a
href="de5fb3ad10"><code>de5fb3a</code></a>
fix(deps): update module google.golang.org/grpc to v1.79.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007">#8007</a>)</li>
<li><a
href="0b82ded815"><code>0b82ded</code></a>
chore(deps): update codspeedhq/action action to v4.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001">#8001</a>)</li>
<li><a
href="aa3660f77e"><code>aa3660f</code></a>
chore(deps): update github/codeql-action action to v4.32.6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004">#8004</a>)</li>
<li><a
href="9be8c92a13"><code>9be8c92</code></a>
chore(deps): update dependency codespell to v2.4.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003">#8003</a>)</li>
<li><a
href="c9d20155fc"><code>c9d2015</code></a>
log: add error field to Record and make SDK to emit exception attributes
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
<li><a
href="fdd1320c39"><code>fdd1320</code></a>
TracerProvider ForceFlush() Error Fix (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
<li><a
href="78f99042e2"><code>78f9904</code></a>
chore(deps): update golang.org/x/telemetry digest to 18da590 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/sdk` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595"><code>a3941ff</code></a>
Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006">#8006</a>)</li>
<li><a
href="6059c47bc6"><code>6059c47</code></a>
chore(deps): update golang.org/x/telemetry digest to e526e8a (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010">#8010</a>)</li>
<li><a
href="44c7edf896"><code>44c7edf</code></a>
chore(deps): update module github.com/mgechev/revive to v1.15.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009">#8009</a>)</li>
<li><a
href="de5fb3ad10"><code>de5fb3a</code></a>
fix(deps): update module google.golang.org/grpc to v1.79.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007">#8007</a>)</li>
<li><a
href="0b82ded815"><code>0b82ded</code></a>
chore(deps): update codspeedhq/action action to v4.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001">#8001</a>)</li>
<li><a
href="aa3660f77e"><code>aa3660f</code></a>
chore(deps): update github/codeql-action action to v4.32.6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004">#8004</a>)</li>
<li><a
href="9be8c92a13"><code>9be8c92</code></a>
chore(deps): update dependency codespell to v2.4.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003">#8003</a>)</li>
<li><a
href="c9d20155fc"><code>c9d2015</code></a>
log: add error field to Record and make SDK to emit exception attributes
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
<li><a
href="fdd1320c39"><code>fdd1320</code></a>
TracerProvider ForceFlush() Error Fix (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
<li><a
href="78f99042e2"><code>78f9904</code></a>
chore(deps): update golang.org/x/telemetry digest to 18da590 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.41.0 to 1.42.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk/metric's
changelog</a>.</em></p>
<blockquote>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
<li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code>
in <code>go.opentelemetry.io/otel/log</code> to attach an error and set
record exception attributes in
<code>go.opentelemetry.io/otel/log/sdk</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>TracerProvider.ForceFlush</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together
and continues iteration through SpanProcessors as opposed to returning
the first encountered error without attempting exports on subsequent
SpanProcessors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li>
<li>Fix semconv v1.39.0 generated metric helpers skipping required
attributes when extra attributes were empty. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li>
<li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag)
during trace context extraction and injection in
<code>go.opentelemetry.io/otel/propagation</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Drop support for [Go 1.24]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3941ff595"><code>a3941ff</code></a>
Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006">#8006</a>)</li>
<li><a
href="6059c47bc6"><code>6059c47</code></a>
chore(deps): update golang.org/x/telemetry digest to e526e8a (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010">#8010</a>)</li>
<li><a
href="44c7edf896"><code>44c7edf</code></a>
chore(deps): update module github.com/mgechev/revive to v1.15.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009">#8009</a>)</li>
<li><a
href="de5fb3ad10"><code>de5fb3a</code></a>
fix(deps): update module google.golang.org/grpc to v1.79.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007">#8007</a>)</li>
<li><a
href="0b82ded815"><code>0b82ded</code></a>
chore(deps): update codspeedhq/action action to v4.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001">#8001</a>)</li>
<li><a
href="aa3660f77e"><code>aa3660f</code></a>
chore(deps): update github/codeql-action action to v4.32.6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004">#8004</a>)</li>
<li><a
href="9be8c92a13"><code>9be8c92</code></a>
chore(deps): update dependency codespell to v2.4.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003">#8003</a>)</li>
<li><a
href="c9d20155fc"><code>c9d2015</code></a>
log: add error field to Record and make SDK to emit exception attributes
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li>
<li><a
href="fdd1320c39"><code>fdd1320</code></a>
TracerProvider ForceFlush() Error Fix (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li>
<li><a
href="78f99042e2"><code>78f9904</code></a>
chore(deps): update golang.org/x/telemetry digest to 18da590 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000">#8000</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.42.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-07 15:22:17 +02:00