Skip to content

chore(deps): bump the go_modules group across 1 directory with 6 updates#4849

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go_modules-26912dbd36
Open

chore(deps): bump the go_modules group across 1 directory with 6 updates#4849
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go_modules-26912dbd36

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the go_modules group with 6 updates in the / directory:

Package From To
go.opentelemetry.io/otel/sdk 1.31.0 1.43.0
golang.org/x/crypto 0.44.0 0.45.0
google.golang.org/grpc 1.69.4 1.79.3
github.com/ipld/go-ipld-prime 0.21.0 0.23.0
github.com/quic-go/quic-go 0.57.1 0.59.1
github.com/quic-go/webtransport-go 0.9.0 0.10.0

Updates go.opentelemetry.io/otel/sdk from 1.31.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
  • Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits
  • 9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
  • 61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
  • 97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
  • 5e363de limit response body size for OTLP HTTP exporters (#8108)
  • 35214b6 Use an absolute path when calling bsd kenv (#8113)
  • 290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
  • e70658e fix: support getBody in otelploghttp (#8096)
  • 4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
  • b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
  • 69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.44.0 to 0.45.0

Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • See full diff in compare view

Updates google.golang.org/grpc from 1.69.4 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

Updates github.com/ipld/go-ipld-prime from 0.21.0 to 0.23.0

Release notes

Sourced from github.com/ipld/go-ipld-prime's releases.

v0.23.0

What's Changed

Full Changelog: ipld/go-ipld-prime@v0.22.0...v0.23.0

v0.22.0

What's Changed

... (truncated)

Changelog

Sourced from github.com/ipld/go-ipld-prime's changelog.

CHANGELOG

Here is collected some brief notes on major changes over time, sorted by tag in which they are first available.

Of course for the "detailed changelog", you can always check the commit log! But hopefully this summary helps.

Note about version numbering: All release tags are in the "v0.${x}" range. We do not expect to make a v1 release. Nonetheless, this should not be taken as a statement that the library isn't usable already. Much of this code is used in other libraries and products, and we do take some care about making changes. (If you're ever wondering about stability of a feature, ask -- or contribute more tests ;))

Planned/Upcoming Changes

Here are some outlines of changes we intend to make that affect the public API:

  • IPLD Amend: is likely to land soon; it implements a more efficient underlying architecture to support IPLD Patch and related features. IPLD Amend adds an interface to allow incremental changes to Nodes in an efficient way. Whereas IPLD Patch is a protocol for expressing changes. We're still working on figuring out exactly where it fits in the stack and making sure it won't be disruptive but early benchmarks are very promising for both Patch and traversal-based transforms. See ipld/go-ipld-prime#445 for more.
  • Layered Node implementation optimizations: When layering different implementations of Node builders or consumers, having to defer through basicnode types can lead to large inefficiencies of memory and speed. We are looking at ways to improve this situation, including ways to assemble layered assemblers. See ipld/go-ipld-prime#443 for discussion and some initial plans.
  • Selectors: There have been some recurring wishes to do something about the Selector package layout. There's no intended or prioritized date for this. See ipld/go-ipld-prime#236 for more.
  • Absent / "Not found" values: There may be some upcoming changes to exactly how "not found" values are handled in order to clarify and standardize the subject. There's no finalized date for this. See ipld/go-ipld-prime#360 for more.

Released Changes

Commits
  • bfde418 v0.23.0 bump (#626)
  • d5efcf7 feat(codec): MaxDepth on DecodeOptions & more bounds testing (#625)
  • f0e3f36 build(deps): bump github.com/ipfs/go-cid from 0.6.0 to 0.6.1 (#620)
  • 1424bc4 build(deps): bump github.com/ipfs/boxo in /storage/bsadapter (#622)
  • 5c494ab build(deps): bump github.com/ipfs/go-cid in /storage/bsrvadapter (#621)
  • 1f7ac04 build(deps): bump github.com/ipld/go-ipld-prime in /storage/bsadapter (#618)
  • 7205a44 build(deps): bump github.com/ipfs/go-cid in /storage/bsadapter (#624)
  • c6916a0 build(deps): bump github.com/ipfs/boxo in /storage/bsrvadapter (#623)
  • 5c66635 chore(docs): s/AllowBudget/AllocationBudget (#617)
  • acfa3ce ci: uci/update-go (#616)
  • Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.57.1 to 0.59.1

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.59.1

This patch release backports quic-go/quic-go#5642, which adds validation for HTTP/3 trailers.

v0.59.0

This release adds a couple of new features:

  • Adds an API to peek stream data on ReceiveStream and Stream: #5501
  • Adds an API to peek the next varint on a stream: #5502
  • Reworks the API exposed by the HTTP/3 package for WebTransport: #5509, #5512. Regular HTTP/3 use cases should not be affected by these changes.
  • Adds support for HTTP request trailers (trailers sent by the client): #5507

Breaking Changes

  • Removes the deprecated ClientHelloInfo: #5497
  • Removes the deprecated ConnectionTracingID and ConnectionTracingKey: #5521
  • http3: the qlogger is now closed after all streams have been handled: #5524
  • The ConnectionState now reports both the local and the remote status of the QUIC Datagram and Reliable Stream Reset extensions: #5533

Other Notable Fixes

  • Fixes an infinite loop of PING-only packets caused by a bug in the PTO queueing logic: #5538 and #5539
  • http3: Fixes a race condition between new request streams and GOAWAY: #5522
  • qlog: Fixes a race condition between RecordEvent and Close: #5523

Changelog

Full Changelog: quic-go/quic-go@v0.58.0...v0.59.0

... (truncated)

Commits
  • 438abf0 http3: implement trailer validation logic (#5642)
  • 7659dd8 ackhandler: fix counting of packets queued for PTO probing (#5539)
  • bd4aea9 ackhandler: fix qlogging of outstanding packet count (#5538)
  • 76b3e07 ackhandler: remove unused declaredLost field in the packet (#5537)
  • 2020668 expose local and remote settings in ConnectionState (#5533)
  • d082d9f fix flaky TestHTTP3Qlog (#5532)
  • c5f15f2 http3: close qlogger after all streams have been handled (#5524)
  • f6dbf89 polish the security policy (#5526)
  • 29cb6ff qlogwriter: fix race between RecordEvent and Close (#5523)
  • e8a6e37 http3: fix race between new streams and GOAWAY (#5522)
  • Additional commits viewable in compare view

Updates github.com/quic-go/webtransport-go from 0.9.0 to 0.10.0

Release notes

Sourced from github.com/quic-go/webtransport-go's releases.

v0.10.0

This release updates webtransport-go to use the new API introduced in quic-go v0.59.0 (#221): Instead of "hijacking" streams from the HTTP/3 layer, the underlying QUIC connection is now owned by WebTransport, and webtransport-go dispatches incoming streams to either the HTTP/3 layer or an existing or new WebTransport session.

New Features

Breaking Changes

  • Session.ConnectionState was renamed to SessionState: #189
  • The StreamID method was removed from Stream, SendStream and ReceiveStream: #226
  • The Server now embeds the http3.Server as a pointer (instead of by value): #215

Other Changes

  • The Stream and the SendStream now expose a Context method: #176 (thanks to @​Sicilica)
  • Delayed streams for already closed sessions are immediately reset: #235
  • The Session context now uses the request or dial context, allowing the application to attach values to the context: #199
  • When a WebTransport session is closed, streams are reset using the WT_SESSION_GONE error. Stream Read and Write now wait for the WT_CLOSE_SESSION capsule on the CONNECT stream to return a meaningful error: #213

Notable Fixes

  • Closed sessions are now properly cleaned up: #198 (thanks to @​rolaechea), #230
  • Session errors are now properly propagated to the stream Read and Write calls: #207
  • The length limit for WT_CLOSE_SESSION capsules is now enforced: #202
  • The dial timeout is now respected while waiting for the server's HTTP/3 settings: #216
  • A 10ms deadline is applied before attempting the WT_CLOSE_SESSION capsule, preventing Session.Close from blocking any longer than 10ms: #224
  • errors.Is error comparisons were fixed for StreamError and SessionError: #204, #205
  • The underlying QUIC connection is now closed when establishing a WebTransport session fails: #236

Changelog

... (truncated)

Commits
  • 9d448b1 enable and use the QUIC Stream Resets with Partial Delivery extension (#239)
  • 128538a update quic-go to v0.59.0 (#240)
  • 5d8d3c4 immediately reject streams for closed sessions (#235)
  • af56b7f close client’s QUIC connection on WebTransport session close or failure (#236)
  • 093f58b move connection management to client and server (#231)
  • 9154cfc ci: update golangci-lint to v2.7.2 (#234)
  • acca676 add a security policy (#233)
  • f2622e1 remove stray TODO from Session (#232)
  • 58df38a simplify stream buffering logic in the session manager (#230)
  • 3b5a3df README: add list of notable projects and a release policy (#225)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the go_modules group across 1 directory with 6 updates
8da6d11 
Bumps the go_modules group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.31.0` | `1.43.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.44.0` | `0.45.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.69.4` | `1.79.3` |
| [github.com/ipld/go-ipld-prime](https://github.com/ipld/go-ipld-prime) | `0.21.0` | `0.23.0` |
| [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.57.1` | `0.59.1` |
| [github.com/quic-go/webtransport-go](https://github.com/quic-go/webtransport-go) | `0.9.0` | `0.10.0` |



Updates `go.opentelemetry.io/otel/sdk` from 1.31.0 to 1.43.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.31.0...v1.43.0)

Updates `golang.org/x/crypto` from 0.44.0 to 0.45.0
- [Commits](golang/crypto@v0.44.0...v0.45.0)

Updates `google.golang.org/grpc` from 1.69.4 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.69.4...v1.79.3)

Updates `github.com/ipld/go-ipld-prime` from 0.21.0 to 0.23.0
- [Release notes](https://github.com/ipld/go-ipld-prime/releases)
- [Changelog](https://github.com/ipld/go-ipld-prime/blob/master/CHANGELOG.md)
- [Commits](ipld/go-ipld-prime@v0.21.0...v0.23.0)

Updates `github.com/quic-go/quic-go` from 0.57.1 to 0.59.1
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.57.1...v0.59.1)

Updates `github.com/quic-go/webtransport-go` from 0.9.0 to 0.10.0
- [Release notes](https://github.com/quic-go/webtransport-go/releases)
- [Commits](quic-go/webtransport-go@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.43.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/ipld/go-ipld-prime
  dependency-version: 0.23.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.59.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/quic-go/webtransport-go
  dependency-version: 0.10.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot requested a review from a team as a code owner June 3, 2026 21:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 3, 2026
@CLAassistant

CLAassistant commented Jun 3, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@sonarqubecloud

sonarqubecloud Bot commented Jun 3, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@CLAassistant