Skip to content

deps: bump the all-go-dependencies group across 1 directory with 22 updates - #181

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-8eaafc5b31
Open

deps: bump the all-go-dependencies group across 1 directory with 22 updates#181
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-8eaafc5b31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-go-dependencies group with 22 updates in the / directory:

Package From To
github.com/carapace-sh/carapace 1.16.2 1.16.3
github.com/mark3labs/mcp-go 0.45.0 1.2.0
github.com/mattn/go-runewidth 0.0.30 0.0.31
github.com/projectdiscovery/utils 0.11.6 0.11.9
github.com/uptrace/bun 1.2.18 1.3.0
github.com/uptrace/bun/dialect/sqlitedialect 1.2.18 1.3.0
go.opentelemetry.io/otel 1.44.0 1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 0.20.0 0.23.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 1.44.0 1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.44.0 1.47.0
go.opentelemetry.io/otel/log 0.20.0 1.47.0
go.opentelemetry.io/otel/metric 1.44.0 1.47.0
go.opentelemetry.io/otel/sdk 1.44.0 1.47.0
go.opentelemetry.io/otel/sdk/log 0.20.0 1.47.0
go.opentelemetry.io/otel/sdk/metric 1.44.0 1.47.0
go.opentelemetry.io/otel/trace 1.44.0 1.47.0
golang.org/x/sys 0.48.0 0.49.0
golang.org/x/term 0.45.0 0.46.0
modernc.org/sqlite 1.59.0 1.60.1
github.com/santhosh-tekuri/jsonschema/v6 6.0.2 6.0.3
github.com/yuin/goldmark 1.7.13 1.8.6
golang.org/x/net 0.58.0 0.59.0

Updates github.com/carapace-sh/carapace from 1.16.2 to 1.16.3

Release notes

Sourced from github.com/carapace-sh/carapace's releases.

v1.16.3

Changelog

  • 14e073ea2bfbac5859f07e2512adde9b559a2888 Merge pull request #1299 from carapace-sh/nushell-positional-completer-deprecation
  • 7d4e827068e9728460d7cd5b33db5d89ca318ab0 Fix nushell redirect vhs test and update goldens for nushell 0.116
  • 9bef602f6b21ff61e713c9344b6d17c2fafbc746 Fix nushell positional completer deprecation warning
Commits
  • 14e073e Merge pull request #1299 from carapace-sh/nushell-positional-completer-deprec...
  • 7d4e827 Fix nushell redirect vhs test and update goldens for nushell 0.116
  • 9bef602 Fix nushell positional completer deprecation warning
  • See full diff in compare view

Updates github.com/mark3labs/mcp-go from 0.45.0 to 1.2.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v1.2.0

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v1.1.1...v1.2.0

Release v1.1.1

No release notes provided.

Release v1.1.0

No release notes provided.

... (truncated)

Commits
  • 4cb0d20 fmt
  • 8a1bd51 fix: restore SSE resume and protocol-aware handler errors
  • 1969a6b test(conformance): add official MCP server suite to CI (#1038)
  • 4894e12 fix(client): reject repeated pagination cursors on list APIs (#1033)
  • bca0fe7 fix(mcp): keep structuredContent on tool_result content (#1031)
  • 3934f55 fix(server): reject an unsupported MCP-Protocol-Version header (#1030)
  • 6876685 fix: parse sampling content sent as an array (#1029)
  • 7189928 perf(server): touch a known session without allocating (#1026)
  • 5c3f315 fix(mcp): omit empty completion context arguments (#1024)
  • 114654a fix(client): follow pagination cursors when listing tasks (#1020)
  • Additional commits viewable in compare view

Updates github.com/mattn/go-runewidth from 0.0.30 to 0.0.31

Commits
  • 466251b Merge pull request #118 from mattn/more-format-controls
  • 180bd26 Treat the remaining invisible format controls as zero width
  • cffa69d Merge pull request #117 from abo3losh1/fix/nonprint-format-chars
  • 4b4e798 Treat bidi isolates and other invisible format characters as zero width
  • 8445f99 Merge pull request #116 from mattn/latin-letters-narrow
  • f46a7b3 Update the East Asian width totals in the benchmarks
  • a3ce759 Measure ambiguous Latin letters as one cell in East Asian locales
  • d74f63e Merge pull request #115 from mattn/hegel-fixes
  • ea10d6a Cap only the part of a cluster that is drawn as one glyph
  • 471864b Measure an incomplete UTF-8 sequence at the end of the text
  • Additional commits viewable in compare view

Updates github.com/projectdiscovery/utils from 0.11.6 to 0.11.9

Release notes

Sourced from github.com/projectdiscovery/utils's releases.

v0.11.9

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

Full Changelog: projectdiscovery/utils@v0.11.8...v0.11.9

v0.11.8

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

Full Changelog: projectdiscovery/utils@v0.11.7...v0.11.8

Commits
  • d91f118 chore(deps): bump the modules group across 1 directory with 3 updates (#787)
  • 41a3fd4 Merge pull request #790 from projectdiscovery/dwisiswant0/fix/fileutil/duplic...
  • 3aeb1df fix readers
  • 9082ec4 chore: retract v0.11.7
  • b23db78 fix(fileutil): duplicate line reader option declarations
  • 608d364 Implement configurable line reader options (#756)
  • See full diff in compare view

Updates github.com/uptrace/bun from 1.2.18 to 1.3.0

Release notes

Sourced from github.com/uptrace/bun's releases.

v1.3.0

Please refer to CHANGELOG.md for details

Changelog

Sourced from github.com/uptrace/bun's changelog.

1.3.0 (2026-09-30)

Breaking Changes

Compared with v1.2.18, this release contains four categories of breaking changes. Two are tracked in #1363, and two additional behavioral changes were identified during the release audit.

  • Count, Limit, and Offset use int64 (#1348). DeleteQuery.Limit, SelectQuery.Limit, SelectQuery.Offset, SelectQuery.Count, SelectQuery.ScanAndCount, and UpdateQuery.Limit changed from int parameters or return values to int64. Update affected variables and assignments to int64, or add explicit conversions at call sites.
  • pgdriver verifies TLS certificates (#1398, fixed by #1402). pgdriver.WithInsecure(false) now verifies the server certificate and hostname. Configure valid trust roots and a matching server name. Code that intentionally needs unverified TLS must now opt in explicitly with WithTLSConfig(&tls.Config{InsecureSkipVerify: true}); this is not recommended for production.
  • Duplicate migration IDs are rejected (#1357). Migrations.Discover now returns an error when different migration base filenames share an ID instead of silently overwriting one migration. This also rejects a Go migration registered with MustRegister or Register when Discover encounters a differently named SQL migration with the same ID. Rename conflicting migration files so each ID has a single base filename; a matching .up.sql/.down.sql pair remains valid.
  • NUL-containing strings are rejected (#1406). schema.BaseDialect.AppendString now reports a formatting error instead of silently stripping NUL bytes. Reject or sanitize such input before building queries. This affects the PostgreSQL, SQLite, Oracle, and MSSQL base dialect paths; MySQL's override is unchanged.

Security

  • pgdriver: verify server certificate for WithInsecure(false) (#1402) (023fe24)
  • schema: fail closed when a string contains a NUL byte (#1406) (276ac9f)
  • schema: prevent line-comment SQL injection with negative numbers (CVE-2024-44906 class) (#1396) (13f55cd)

Bug Fixes

  • add LineComment function for handling line comment in formatQuery (49b0464)
  • automigrate: include scanonly fields in the BunModelInspector output (0a83ffc)
  • bunotel: honor WithMeterProvider when reporting DB stats metrics (048005b), closes #1270
  • copy execution state in SelectQuery.Clone (9dad9ac)
  • copy whereHasOr field in SelectQuery.Clone() to preserve soft-delete WhereOr state (e7611b7), closes #1321
  • correct error message prefix and error type (89bf06d)
  • db: propagate transaction context into RunInTx callback (#1381) (640437e)
  • detect duplicate migration IDs during Discover (b8f7b77)
  • detect OR separators case-insensitively for whereHasOr (1110700)
  • improve formatQuery in pgdriver for queries with apostrophes in comments (#1349) (93974c9)
  • migrate: do not append blank lines to SQL query (d32af16)
  • migrate: ignore --bun:skip with a blank query (a34fd3a)
  • migrate: surface lost SQL migration finalizer errors (#1389) (1a289f8)
  • mssql: apply the unicode N prefix to JSON literals (5eb86ee)
  • pgdialect: return an error instead of panicking on empty array input (a3c48dd), closes #1431
  • pgdriver: add slice of byte array support to pgdialect (#1391) (0e5e868)
  • pgdriver: send required params during startup (#1374) (e402298)
  • query: remove debug print and simplify union wrapping (4bdf4d8)
  • query: skip UNION wrapping for SQLite (777c8e2)
  • relation: do not duplicate joined models on a shared base model (856d4d9), closes #1386
  • resolve map column types before scanning rows (af3f6dc), closes #1434
  • resolve nested Relation() with circular struct composition (dd2e4c9), closes #1243
  • return an error instead of panicking when scanning JSON into an unaddressable value (c323fa3), closes #1306
  • schema: do not reject pointers stored in an interface (cc2cd23)
  • schema: escape backslash in AppendJSON without consuming the next byte (#1405) (445907b)
  • schema: resolve m2m BasePKs through the base table's FieldMap (#1375) (9f4d368)
  • schema: return an error when scanning NULL into an unaddressable value (29e4e6e)
  • schema: use dialect-specific AppendBool in QueryGen.Append (#1373) (e91aa81)

... (truncated)

Commits
  • 7d78f9c docs: refine v1.3.0 changelog
  • 8de7fb6 fix(schema): reject NUL before opening string literal
  • ea8b47c docs: document v1.3.0 breaking changes
  • e73781c chore: release v1.3.0 (release.sh)
  • 691d97d Merge pull request #1428 from visheshgubrani/feat/uuid-support
  • 74e036c Merge pull request #1432 from chiliec/fix-array-parser-empty-input
  • 854cf90 Merge pull request #1435 from hsdfat/fix/map-scan-column-types-deadlock
  • aff017d refactor(schema): isolate UUID handlers behind build tags
  • af3f6dc fix: resolve map column types before scanning rows
  • e22ddd3 feat(schema): support Go 1.27 stdlib uuid.UUID (#1427)
  • Additional commits viewable in compare view

Updates github.com/uptrace/bun/dialect/sqlitedialect from 1.2.18 to 1.3.0

Release notes

Sourced from github.com/uptrace/bun/dialect/sqlitedialect's releases.

v1.3.0

Please refer to CHANGELOG.md for details

Changelog

Sourced from github.com/uptrace/bun/dialect/sqlitedialect's changelog.

1.3.0 (2026-09-30)

Breaking Changes

Compared with v1.2.18, this release contains four categories of breaking changes. Two are tracked in #1363, and two additional behavioral changes were identified during the release audit.

  • Count, Limit, and Offset use int64 (#1348). DeleteQuery.Limit, SelectQuery.Limit, SelectQuery.Offset, SelectQuery.Count, SelectQuery.ScanAndCount, and UpdateQuery.Limit changed from int parameters or return values to int64. Update affected variables and assignments to int64, or add explicit conversions at call sites.
  • pgdriver verifies TLS certificates (#1398, fixed by #1402). pgdriver.WithInsecure(false) now verifies the server certificate and hostname. Configure valid trust roots and a matching server name. Code that intentionally needs unverified TLS must now opt in explicitly with WithTLSConfig(&tls.Config{InsecureSkipVerify: true}); this is not recommended for production.
  • Duplicate migration IDs are rejected (#1357). Migrations.Discover now returns an error when different migration base filenames share an ID instead of silently overwriting one migration. This also rejects a Go migration registered with MustRegister or Register when Discover encounters a differently named SQL migration with the same ID. Rename conflicting migration files so each ID has a single base filename; a matching .up.sql/.down.sql pair remains valid.
  • NUL-containing strings are rejected (#1406). schema.BaseDialect.AppendString now reports a formatting error instead of silently stripping NUL bytes. Reject or sanitize such input before building queries. This affects the PostgreSQL, SQLite, Oracle, and MSSQL base dialect paths; MySQL's override is unchanged.

Security

  • pgdriver: verify server certificate for WithInsecure(false) (#1402) (023fe24)
  • schema: fail closed when a string contains a NUL byte (#1406) (276ac9f)
  • schema: prevent line-comment SQL injection with negative numbers (CVE-2024-44906 class) (#1396) (13f55cd)

Bug Fixes

  • add LineComment function for handling line comment in formatQuery (49b0464)
  • automigrate: include scanonly fields in the BunModelInspector output (0a83ffc)
  • bunotel: honor WithMeterProvider when reporting DB stats metrics (048005b), closes #1270
  • copy execution state in SelectQuery.Clone (9dad9ac)
  • copy whereHasOr field in SelectQuery.Clone() to preserve soft-delete WhereOr state (e7611b7), closes #1321
  • correct error message prefix and error type (89bf06d)
  • db: propagate transaction context into RunInTx callback (#1381) (640437e)
  • detect duplicate migration IDs during Discover (b8f7b77)
  • detect OR separators case-insensitively for whereHasOr (1110700)
  • improve formatQuery in pgdriver for queries with apostrophes in comments (#1349) (93974c9)
  • migrate: do not append blank lines to SQL query (d32af16)
  • migrate: ignore --bun:skip with a blank query (a34fd3a)
  • migrate: surface lost SQL migration finalizer errors (#1389) (1a289f8)
  • mssql: apply the unicode N prefix to JSON literals (5eb86ee)
  • pgdialect: return an error instead of panicking on empty array input (a3c48dd), closes #1431
  • pgdriver: add slice of byte array support to pgdialect (#1391) (0e5e868)
  • pgdriver: send required params during startup (#1374) (e402298)
  • query: remove debug print and simplify union wrapping (4bdf4d8)
  • query: skip UNION wrapping for SQLite (777c8e2)
  • relation: do not duplicate joined models on a shared base model (856d4d9), closes #1386
  • resolve map column types before scanning rows (af3f6dc), closes #1434
  • resolve nested Relation() with circular struct composition (dd2e4c9), closes #1243
  • return an error instead of panicking when scanning JSON into an unaddressable value (c323fa3), closes #1306
  • schema: do not reject pointers stored in an interface (cc2cd23)
  • schema: escape backslash in AppendJSON without consuming the next byte (#1405) (445907b)
  • schema: resolve m2m BasePKs through the base table's FieldMap (#1375) (9f4d368)
  • schema: return an error when scanning NULL into an unaddressable value (29e4e6e)
  • schema: use dialect-specific AppendBool in QueryGen.Append (#1373) (e91aa81)

... (truncated)

Commits
  • 7d78f9c docs: refine v1.3.0 changelog
  • 8de7fb6 fix(schema): reject NUL before opening string literal
  • ea8b47c docs: document v1.3.0 breaking changes
  • e73781c chore: release v1.3.0 (release.sh)
  • 691d97d Merge pull request #1428 from visheshgubrani/feat/uuid-support
  • 74e036c Merge pull request #1432 from chiliec/fix-array-parser-empty-input
  • 854cf90 Merge pull request #1435 from hsdfat/fix/map-scan-column-types-deadlock
  • aff017d refactor(schema): isolate UUID handlers behind build tags
  • af3f6dc fix: resolve map column types before scanning rows
  • e22ddd3 feat(schema): support Go 1.27 stdlib uuid.UUID (#1427)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.44.0 to 1.47.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.47.0/v0.69.0/v0.23.0/v0.1.0

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

  • go.opentelemetry.io/otel/log
  • go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

  • Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
  • Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
  • Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
  • Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
  • Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
  • Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
  • Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
  • Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
  • Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

  • Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
  • Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
  • Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
  • Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
  • Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

  • Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
  • Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
  • Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
  • Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
  • Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
  • Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
  • Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
  • Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8801)
  • Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#8849)
  • Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#8873)
  • Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#8864)
  • Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#8815)
  • Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#8844)
  • Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in go.opentelemetry.io/otel/exporters/prometheus. (#8839)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.47.0/0.69.0/0.23.0/0.1.0] - 2026-10-02

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

  • go.opentelemetry.io/otel/log
  • go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

  • Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
  • Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
  • Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
  • Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
  • Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
  • Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
  • Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
  • Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
  • Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

  • Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
  • Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
  • Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
  • Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
  • Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

  • Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
  • Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
  • Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
  • Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
  • Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
  • Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
  • Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
  • Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8801)
  • Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#8849)
  • Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#8873)
  • Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#8864)
  • Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#8815)
  • Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#8844)

... (truncated)

Commits
  • 66cfc95 Release 1.47.0/0.69.0/0...

    Description has been truncated

@dependabot
deps: bump the all-go-dependencies group across 1 directory with 22 u…
e89fcd5 
…pdates

Bumps the all-go-dependencies group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/carapace-sh/carapace](https://github.com/carapace-sh/carapace) | `1.16.2` | `1.16.3` |
| [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `0.45.0` | `1.2.0` |
| [github.com/mattn/go-runewidth](https://github.com/mattn/go-runewidth) | `0.0.30` | `0.0.31` |
| [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) | `0.11.6` | `0.11.9` |
| [github.com/uptrace/bun](https://github.com/uptrace/bun) | `1.2.18` | `1.3.0` |
| [github.com/uptrace/bun/dialect/sqlitedialect](https://github.com/uptrace/bun) | `1.2.18` | `1.3.0` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `0.23.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [go.opentelemetry.io/otel/log](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `1.47.0` |
| [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk/log](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.47.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.45.0` | `0.46.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.59.0` | `1.60.1` |
| [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema) | `6.0.2` | `6.0.3` |
| [github.com/yuin/goldmark](https://github.com/yuin/goldmark) | `1.7.13` | `1.8.6` |
| [golang.org/x/net](https://github.com/golang/net) | `0.58.0` | `0.59.0` |



Updates `github.com/carapace-sh/carapace` from 1.16.2 to 1.16.3
- [Release notes](https://github.com/carapace-sh/carapace/releases)
- [Commits](carapace-sh/carapace@v1.16.2...v1.16.3)

Updates `github.com/mark3labs/mcp-go` from 0.45.0 to 1.2.0
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v0.45.0...v1.2.0)

Updates `github.com/mattn/go-runewidth` from 0.0.30 to 0.0.31
- [Commits](mattn/go-runewidth@v0.0.30...v0.0.31)

Updates `github.com/projectdiscovery/utils` from 0.11.6 to 0.11.9
- [Release notes](https://github.com/projectdiscovery/utils/releases)
- [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md)
- [Commits](projectdiscovery/utils@v0.11.6...v0.11.9)

Updates `github.com/uptrace/bun` from 1.2.18 to 1.3.0
- [Release notes](https://github.com/uptrace/bun/releases)
- [Changelog](https://github.com/uptrace/bun/blob/master/CHANGELOG.md)
- [Commits](uptrace/bun@v1.2.18...v1.3.0)

Updates `github.com/uptrace/bun/dialect/sqlitedialect` from 1.2.18 to 1.3.0
- [Release notes](https://github.com/uptrace/bun/releases)
- [Changelog](https://github.com/uptrace/bun/blob/master/CHANGELOG.md)
- [Commits](uptrace/bun@v1.2.18...v1.3.0)

Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` from 0.20.0 to 0.23.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...metric/v0.23.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `go.opentelemetry.io/otel/log` from 0.20.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...v1.47.0)

Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk/log` from 0.20.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `go.opentelemetry.io/otel/trace` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.47.0)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](golang/term@v0.45.0...v0.46.0)

Updates `modernc.org/sqlite` from 1.59.0 to 1.60.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.59.0...v1.60.1)

Updates `github.com/santhosh-tekuri/jsonschema/v6` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases)
- [Commits](santhosh-tekuri/jsonschema@v6.0.2...v6.0.3)

Updates `github.com/yuin/goldmark` from 1.7.13 to 1.8.6
- [Release notes](https://github.com/yuin/goldmark/releases)
- [Commits](yuin/goldmark@v1.7.13...v1.8.6)

Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](golang/net@v0.58.0...v0.59.0)

---
updated-dependencies:
- dependency-name: github.com/carapace-sh/carapace
  dependency-version: 1.16.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-go-dependencies
- dependency-name: github.com/mattn/go-runewidth
  dependency-version: 0.0.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/projectdiscovery/utils
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/uptrace/bun
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/uptrace/bun/dialect/sqlitedialect
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/log
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk/log
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk/metric
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: modernc.org/sqlite
  dependency-version: 1.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/santhosh-tekuri/jsonschema/v6
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/yuin/goldmark
  dependency-version: 1.8.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants