[eli-r-ph]

💡 Motivation and Context

main shipped 1.35.0–1.36.0 after #361 synced 1.30–1.34. This brings those releases into v1 so the v2 release does not drop them.
It also brings 1.36.1–1.38.0, except #382.
One of them, #371, makes the otel bridge import the core SDK, so otel now moves with the core major like posthogmcpsdk.

Changes

• Cherry-picks, in main order with -x: fix(flags): load shared definitions without a secret key #366, chore(deps): bump the github-actions group with 2 updates #373, chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /otel #377, chore(deps): bump github.com/klauspost/compress from 1.17.11 to 1.18.7 in /posthogmcpsdk in the go_modules group across 1 directory #379, fix(mcp): set $exception_source and strip reserved exception metadata #357, fix(flags): match explicit null properties with string operators #381, feat(flags): honor experiment holdouts in local flag evaluation #360, chore(deps): bump the github-actions group with 4 updates #385, feat(otel): add per-request context to span processor #371, chore(deps): bump github.com/klauspost/compress from 1.17.11 to 1.18.7 in /otel #380, and the 1.35.0–1.36.0 release commits (changelog and version, as in feat!: sync main 1.30-1.34 into v1, drop Capture.Library #361).
• Cherry-picks, in main order with -x: docs: require signed commits in contributor docs #388, fix(flags): fall back for incompatible local regex evaluation #387, feat(otel): add opt-in exception trace context #374, feat(otel): add request context to application spans #375, and the 1.36.1–1.38.0 release commits.
• Not picked: fix: preserve events with non-finite numeric properties #382, which sends NaN and ±Inf property values as null. v1 already does the same through its own change (fix: send non-finite numbers as null without slowing normal events #394), so the migration guide and the 1.36.1 changelog line point to that instead.
• Breaking: posthogotel.EnqueueWithContext (feat(otel): add opt-in exception trace context #374) adds the derived $trace_id and $span_id only when neither the event nor the request context sets either key. In 1.37 each ID filled on its own, so an event could mix one trace's ID with another trace's span.
• Breaking: the otel bridge is now the github.com/posthog/posthog-go/otel/v2 module and shares the core release version. It imports posthog.RequestContext, so an otel module still on core v1 would read a different context key and silently drop the request context.
• The release workflow tags otel/vX.Y.Z with the core, as main already does. It also brings over ci(release): synchronize nested module core minimums #376: it sets both nested modules' core requirement to the new version and creates the core release before the nested tags.
• otel no longer has its own changesets package, and its pending changeset now targets posthog-go.
• The pinned-core CI check now runs for otel too, through one shared script, bin/build-against-pinned-core.

Adapted picks (every other pick changes exactly the lines upstream changed):

Pick	Adaptation
#371	Keeps v1's "a processor with an unusable API key does nothing" guard, and imports core /v2
#357	Uses upstream's reserved-property helper in place of v1's, which had one caller
#360	Inlines the holdout id conversion, because v1 removed groupKeyToString (#343)
Release commits	Keep v1's nested go.mod core requirements
#374	Imports core /v2; a follow-up commit adds the derived trace IDs only as a pair. A $trace_id or $span_id in DefaultEventProperties does not stop the pair, because the helper cannot see the client's config (accepted, documented)
1.36.1 release	The changelog line for #382 points to v2's own non-finite handling (#394); no changeset to delete
#375	A follow-up commit, placed after the 1.38.0 release commit so CI runs on the head, imports core /v2 and builds the test clients with v1's New, which also returns an error

💚 How did you test it?

• go vet and go test -race pass for the core, otel and posthogmcpsdk modules.
• make api-diff is clean, and go mod tidy leaves otel and posthogmcpsdk unchanged.
• The pinned-core check skips with its warning, because v2.0.0 is not tagged yet.
• Not run locally: pnpm install --frozen-lockfile, because the registry was unreachable from this machine. The only lockfile change removes the otel workspace entry.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Written with Claude Code (Claude Opus 5.5, claude-opus-5-5) under the direction of the assignee.
The assignee chose to move otel to /v2 in lockstep over two alternatives: keep otel at major 1 while it requires core v2 (mixed majors, silent context loss), or leave #371 out of v1.

🤖 Generated with Claude Code

[turnipdabeets]

I checked each pick against its upstream commit. The unadapted ones match line for line, and the adapted ones (#357, #360, #371, #374, and the release commits) do what the table says. Moving otel to /v2 in lockstep makes sense, and the pair rule matches what posthog-node does. Thanks for the careful sync!