Bump the go_modules group across 4 directories with 7 updates by dependabot[bot] · Pull Request #9 · zendesk/opencost-upstream

dependabot · 2026-07-03T09:20:01Z

Bumps the go_modules group with 5 updates in the / directory:

Package	From	To
go.opentelemetry.io/otel	`1.36.0`	`1.41.0`
github.com/go-jose/go-jose/v4	`4.0.5`	`4.1.4`
go.opentelemetry.io/otel/sdk	`1.36.0`	`1.43.0`
golang.org/x/crypto	`0.40.0`	`0.45.0`
google.golang.org/grpc	`1.74.2`	`1.79.3`

Bumps the go_modules group with 5 updates in the /core directory:

Package	From	To
go.opentelemetry.io/otel	`1.36.0`	`1.41.0`
github.com/go-jose/go-jose/v4	`4.0.5`	`4.1.4`
go.opentelemetry.io/otel/sdk	`1.36.0`	`1.43.0`
golang.org/x/crypto	`0.40.0`	`0.45.0`
google.golang.org/grpc	`1.74.2`	`1.79.3`

Bumps the go_modules group with 5 updates in the /modules/collector-source directory:

Package	From	To
go.opentelemetry.io/otel	`1.36.0`	`1.41.0`
github.com/go-jose/go-jose/v4	`4.0.5`	`4.1.4`
go.opentelemetry.io/otel/sdk	`1.36.0`	`1.43.0`
golang.org/x/crypto	`0.40.0`	`0.45.0`
google.golang.org/grpc	`1.74.2`	`1.79.3`

Bumps the go_modules group with 1 update in the /modules/prometheus-source directory: golang.org/x/net.

Updates go.opentelemetry.io/otel from 1.36.0 to 1.41.0

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

Support testing of [Go 1.26]. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)

Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)

Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)

Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)

Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)

Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)

Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)

Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)

The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)

Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)

Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

... (truncated)

Commits

4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
c38a4a5 Generate semconv/v1.40.0 (#7929)
0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.4

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Remove Go 1.23 support by @mcpherrinm in go-jose/go-jose#205

Reject JWS with an unprotected critical b64 header by @mcpherrinm in go-jose/go-jose#210

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

Update go-jose documentation by @mcpherrinm in go-jose/go-jose#198

Remove dependency on testify by @wardviaene in go-jose/go-jose#197

Improve error message for invalid private keys by @ProjectMutilation in go-jose/go-jose#195

JWK unsupported error when unmarshalling by @fprojetto in go-jose/go-jose#191

Add JSONWebKey type to makeJWERecipient by @alvarolivie in go-jose/go-jose#200

testutils/assert: remove True, Nil, NotNil by @jsha in go-jose/go-jose#202

New Contributors

@wardviaene made their first contribution in go-jose/go-jose#197

@fprojetto made their first contribution in go-jose/go-jose#191

@alvarolivie made their first contribution in go-jose/go-jose#200

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

What's Changed

Drop go-cmp dependency by @mcpherrinm in go-jose/go-jose#186

jws: improve performance and allocations for ParseSignedCompact by @drakkan in go-jose/go-jose#188

Add missing quote to unknown curve message #170 by @sudhanvaghebbale in go-jose/go-jose#189

Fix incorrect validation by @ProjectMutilation in go-jose/go-jose#192

Restore Go 1.23 compatibility by @anuraaga in go-jose/go-jose#193

New Contributors

@drakkan made their first contribution in go-jose/go-jose#188

@sudhanvaghebbale made their first contribution in go-jose/go-jose#189

@ProjectMutilation made their first contribution in go-jose/go-jose#192

@anuraaga made their first contribution in go-jose/go-jose#193

... (truncated)

Commits

0e59876 Merge commit from fork
ddffdbc Bump actions/checkout from 5 to 6 (#213)
5348b9a Reject JWS with an unprotected critical b64 header (#210)
9153a5e Bump actions/setup-python from 5 to 6 (#208)
2126e17 Bump actions/setup-go from 5 to 6 (#209)
9860c65 Bump actions/checkout from 4 to 5 (#206)
14239fd Remove Go 1.23 support (#205)
a16e158 Update CI to run on Go 1.24 and 1.25 (#204)
a1565a4 testutils/assert: remove True, Nil, NotNil (#202)
3a80e13 jwe: accept non-pointer JSONWebKey in Recipient (#200)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.36.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)

Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)

Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)

Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)

Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)

Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)

Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)

Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)

Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits

9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
5e363de limit response body size for OTLP HTTP exporters (#8108)
35214b6 Use an absolute path when calling bsd kenv (#8113)
290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
e70658e fix: support getBody in otelploghttp (#8096)
4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.6.1 to 1.7.14

Commits

676a8b1 Release 2025-01-24
1737386 Regenerated Clients
3bc09da Update API model
cb98dee Fix flex checksum validation cfg (#2981)
9c76401 fix bad changelog type
ed8a3ca Reduce fmt.Sprintf allocations in query encoding (#2919)
d5773a9 Add FixUnmarshalIndividualSetValues option to DecoderOptions of dynamodb (#2896)
58e23dc fix codegen test failing in main
640d919 fix broken jmespath waiters in cloudwatch and autoscaling (#2984)
613a6cf Optimize/directory traversal (#2970)
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.40.0 to 0.45.0

Commits

4e0068c go.mod: update golang.org/x dependencies
e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
f91f7a7 ssh/agent: prevent panic on malformed constraint
2df4153 acme/autocert: let automatic renewal work with short lifetime certs
bcf6a84 acme: pass context to request
b4f2b62 ssh: fix error message on unsupported cipher
79ec3a5 ssh: allow to bind to a hostname in remote forwarding
122a78f go.mod: update golang.org/x dependencies
c0531f9 all: eliminate vet diagnostics
0997000 all: fix some comments
Additional commits viewable in compare view

Updates golang.org/x/net from 0.42.0 to 0.47.0

Commits

7770ec4 go.mod: update golang.org/x dependencies
4ece7b6 html: escape greater-than symbol in doctype identifiers
08be507 html: improve Noah's Ark clause performance
a8fb2fe html: properly render fostered elements in foreign content
0dc5b7a html: properly check namespace in "in body" any other end tag
a452f3c html: ignore duplicate attributes during tokenization
f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
210ed3c quic: establish a "happened-before" relationship between stream write and read
ad8140e quic: fix buffer slicing when handling overlapping stream data
23ee2ef http2: avoid API changes when built with go1.27
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.74.2 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

grpc: Remove the -dev suffix from the User-Agent header. (grpc/grpc-go#8902)

Release 1.79.0

API Changes

mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)

Special Thanks: @vanja-p

experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)

pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.

This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)

xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)

balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Special Thanks: @marek-szews

Bug Fixes

credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)

Special Thanks: @Atul1710

xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)

health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)

Special Thanks: @sanki92

transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)

Special Thanks: @joybestourous

server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Special Thanks: @joybestourous

Performance Improvements

credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)

mem: Optimize pooling and creation of buffer objects. (#8784)

transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

dda86db Change version to 1.79.3 (#8983)
72186f1 grpc: enforce strict path checking for incoming requests on the server (#8981)
97ca352 Changing version to 1.79.3-dev (#8954)
8902ab6 Change the version to release 1.79.2 (#8947)
a928670 Cherry-pick #8874 to v1.79.x (#8904)
06df363 Change version to 1.79.2-dev (#8903)
782f2de Change version to 1.79.1 (#8902)
850eccb Change version to 1.79.1-dev (#8851)
765ff05 Change version to 1.79.0 (#8850)
68804be Cherry pick #8864 to v1.79.x (#8896)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.36.0 to 1.41.0

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

Support testing of [Go 1.26]. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)

Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)

Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)

Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)

Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)

Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)

Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)

Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)

The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)

Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)

Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

... (truncated)

Commits

4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
c38a4a5 Generate semconv/v1.40.0 (#7929)
0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.4

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Remove Go 1.23 support by @mcpherrinm in go-jose/go-jose#205

Reject JWS with an unprotected critical b64 header by @mcpherrinm in go-jose/go-jose#210

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

Update go-jose documentation by @mcpherrinm in go-jose/go-jose#198

Remove dependency on testify by @wardviaene in go-jose/go-jose#197

Improve error message for invalid private keys by @ProjectMutilation in go-jose/go-jose#195

JWK unsupported error when unmarshalling by @fprojetto in go-jose/go-jose#191

Add JSONWebKey type to makeJWERecipient by @alvarolivie in go-jose/go-jose#200

testutils/assert: remove True, Nil, NotNil by @jsha in go-jose/go-jose#202

New Contributors

@wardviaene made their first contribution in go-jose/go-jose#197

@fprojetto made their first contribution in go-jose/go-jose#191

@alvarolivie made their first contribution in go-jose/go-jose#200

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

What's Changed

Drop go-cmp dependency by @mcpherrinm in go-jose/go-jose#186

jws: improve performance and allocations for ParseSignedCompact by @drakkan in go-jose/go-jose#188

Add missing quote to unknown curve message #170 by @sudhanvaghebbale in go-jose/go-jose#189

Fix incorrect validation by @ProjectMutilation in go-jose/go-jose#192

Restore Go 1.23 compatibility by @anuraaga in go-jose/go-jose#193

New Contributors

@drakkan made their first contribution in go-jose/go-jose#188

@sudhanvaghebbale made their first contribution in go-jose/go-jose#189

@ProjectMutilation made their first contribution in go-jose/go-jose#192

@anuraaga made their first contribution in go-jose/go-jose#193

... (truncated)

Commits

0e59876 Merge commit from fork
ddffdbc Bump actions/checkout from 5 to 6 (#213)
5348b9a Reject JWS with an unprotected critical b64 header (#210)
9153a5e Bump actions/setup-python from 5 to 6 (#208)
2126e17 Bump actions/setup-go from 5 to 6 (#209)
9860c65 Bump actions/checkout from 4 to 5 (#206)
14239fd Remove Go 1.23 support (#205)
a16e158 Update CI to run on Go 1.24 and 1.25 (#204)
a1565a4 testutils/assert: remove True, Nil, NotNil (#202)
3a80e13 jwe: accept non-pointer JSONWebKey in Recipient (#200)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.36.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and Description has been truncated

Bumps the go_modules group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.41.0` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.5` | `4.1.4` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.43.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.40.0` | `0.45.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.74.2` | `1.79.3` | Bumps the go_modules group with 5 updates in the /core directory: | Package | From | To | | --- | --- | --- | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.41.0` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.5` | `4.1.4` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.43.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.40.0` | `0.45.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.74.2` | `1.79.3` | Bumps the go_modules group with 5 updates in the /modules/collector-source directory: | Package | From | To | | --- | --- | --- | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.41.0` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.5` | `4.1.4` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.43.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.40.0` | `0.45.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.74.2` | `1.79.3` | Bumps the go_modules group with 1 update in the /modules/prometheus-source directory: [golang.org/x/net](https://github.com/golang/net). Updates `go.opentelemetry.io/otel` from 1.36.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.41.0) Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.0.5...v4.1.4) Updates `go.opentelemetry.io/otel/sdk` from 1.36.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) Updates `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream` from 1.6.1 to 1.7.14 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.6.1...service/eksauth/v1.7.14) Updates `golang.org/x/crypto` from 0.40.0 to 0.45.0 - [Commits](golang/crypto@v0.40.0...v0.45.0) Updates `golang.org/x/net` from 0.42.0 to 0.47.0 - [Commits](golang/net@v0.42.0...v0.55.0) Updates `google.golang.org/grpc` from 1.74.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.74.2...v1.79.3) Updates `go.opentelemetry.io/otel` from 1.36.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.41.0) Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.0.5...v4.1.4) Updates `go.opentelemetry.io/otel/sdk` from 1.36.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) Updates `golang.org/x/crypto` from 0.40.0 to 0.45.0 - [Commits](golang/crypto@v0.40.0...v0.45.0) Updates `golang.org/x/net` from 0.42.0 to 0.47.0 - [Commits](golang/net@v0.42.0...v0.55.0) Updates `google.golang.org/grpc` from 1.74.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.74.2...v1.79.3) Updates `go.opentelemetry.io/otel` from 1.36.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.41.0) Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.0.5...v4.1.4) Updates `go.opentelemetry.io/otel/sdk` from 1.36.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) Updates `golang.org/x/crypto` from 0.40.0 to 0.45.0 - [Commits](golang/crypto@v0.40.0...v0.45.0) Updates `golang.org/x/net` from 0.42.0 to 0.47.0 - [Commits](golang/net@v0.42.0...v0.55.0) Updates `google.golang.org/grpc` from 1.74.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.74.2...v1.79.3) Updates `golang.org/x/net` from 0.42.0 to 0.55.0 - [Commits](golang/net@v0.42.0...v0.55.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream dependency-version: 1.7.14 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.47.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.47.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.47.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 3, 2026

This was referenced Jul 3, 2026

Bump golang.org/x/net from 0.23.0 to 0.33.0 in /core in the go_modules group across 1 directory #6

Closed

Bump the go_modules group across 3 directories with 6 updates #8

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the go_modules group across 4 directories with 7 updates#9

Bump the go_modules group across 4 directories with 7 updates#9
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/go_modules/go_modules-d0bc904b7b

dependabot Bot commented on behalf of github Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 3, 2026

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

Added

Fixed

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

Changed

Fixed

v4.1.4

What's Changed

v4.1.3

What's Changed

v4.1.2

What's Changed

New Contributors

v4.1.1

What's Changed

New Contributors

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Changed

Deprecated

Fixed

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Release 1.79.3

Security

Release 1.79.2

Bug Fixes

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

Behavior Changes

New Features

Bug Fixes

Performance Improvements

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

Added

Fixed

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

Changed

Fixed

v4.1.4

What's Changed

v4.1.3

What's Changed

v4.1.2

What's Changed

New Contributors

v4.1.1

What's Changed

New Contributors

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants