Skip to content

chore(deps): bump the go_modules group across 1 directory with 12 updates - #326

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-48d79d049c
Open

chore(deps): bump the go_modules group across 1 directory with 12 updates#326
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-48d79d049c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go_modules group with 7 updates in the / directory:

Package From To
github.com/getkin/kin-openapi 0.133.0 0.144.0
github.com/go-chi/chi/v5 5.2.3 5.2.4
github.com/jackc/pgx/v5 5.8.0 5.9.2
github.com/openfga/openfga 1.11.6 1.18.0
github.com/go-jose/go-jose/v3 3.0.4 3.0.5
github.com/moby/go-archive 0.1.0 0.3.0
github.com/oapi-codegen/oapi-codegen/v2 2.5.1 2.7.1

Updates github.com/getkin/kin-openapi from 0.133.0 to 0.144.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.144.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.143.0...v0.144.0

v0.143.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.142.0...v0.143.0

v0.142.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.141.0...v0.142.0

v0.141.0

What's Changed

... (truncated)

Commits
  • f0407d5 Merge commit from fork
  • c947670 some fixes to please my moulinette (#1232)
  • 68ac2af Merge commit from fork
  • 3e5d7f4 openapi3filter: prefer non-empty value for repeated scalar query params (#1231)
  • 30e2923 Merge commit from fork
  • c11a481 openapi3gen: inline embedded struct with options-only JSON tag (#1229)
  • 0fb1f0e openapi3filter: skip schema checks for empty allowEmptyValue strings (#1228)
  • a872c57 openapi3: stable codes for validation errors (#1223)
  • d2f115e openapi3: preserve origin for a $ref to a schema under an arbitrary top-level...
  • 49523e0 openapi3filter: skip Split allocation for single-value array query params (#1...
  • Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.2.4

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.2.3...v5.2.4

Commits

Updates github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

5.9.1 (March 22, 2026)

  • Fix: batch result format corruption when using cached prepared statements (reported by Dirkjan Bussink)

5.9.0 (March 21, 2026)

This release includes a number of new features such as SCRAM-SHA-256-PLUS support, OAuth authentication support, and PostgreSQL protocol 3.2 support.

It significantly reduces the amount of network traffic when using prepared statements (which are used automatically by default) by avoiding unnecessary Describe Portal messages. This also reduces local memory usage.

It also includes multiple fixes for potential DoS due to panic or OOM if connected to a malicious server that sends deliberately malformed messages.

  • Require Go 1.25+
  • Add SCRAM-SHA-256-PLUS support (Adam Brightwell)
  • Add OAuth authentication support for PostgreSQL 18 (David Schneider)
  • Add PostgreSQL protocol 3.2 support (Dirkjan Bussink)
  • Add tsvector type support (Adam Brightwell)
  • Skip Describe Portal for cached prepared statements reducing network round trips
  • Make LoadTypes query easier to support on "postgres-like" servers (Jelte Fennema-Nio)
  • Default empty user to current OS user matching libpq behavior (ShivangSrivastava)
  • Optimize LRU statement cache with custom linked list and node pooling (Mathias Bogaert)
  • Optimize date scanning by replacing regex with manual parsing (Mathias Bogaert)
  • Optimize pgio append/set functions with direct byte shifts (Mathias Bogaert)
  • Make RowsAffected faster (Abhishek Chanda)
  • Fix: Pipeline.Close panic when server sends multiple FATAL errors (Varun Chawla)
  • Fix: ContextWatcher goroutine leak (Hank Donnay)
  • Fix: stdlib discard connections with open transactions in ResetSession (Jeremy Schneider)

... (truncated)

Commits
  • 0aeabbc Release v5.9.2
  • 60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
  • a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
  • e34e452 doc: Add godoc links
  • 08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
  • 96b4dbd Remove unstable test
  • acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
  • 2f81f1f Update max_protocol_version and min_protocol_version defaults
  • 4e4eaed Release v5.9.1
  • 6273188 Fix batch result format corruption when using cached prepared statements
  • Additional commits viewable in compare view

Updates github.com/openfga/openfga from 1.11.6 to 1.18.0

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.18.0

🚨 Operational warning for MySQL users 🚨

This release contains a migration for MySQL which acquires a shared lock on the tuple and changelog tables. This is a potentially-lengthy migration, during which you will not be able to perform Write operations.

What you should do: Do not execute auto-migrations on startup for production instances with large datasets. Please refer to this migration guide before applying this migration.

Fixed

  • Use crypto/subtle.ConstantTimeCompare for preshared key authentication to close a timing side-channel where the prior map lookup could reveal information about valid key bytes. #3168 Thanks to @​geo-chen for reporting this.

Security

  • Fixed identifier comparison on the MySQL backend to be case-sensitive, matching Postgres and SQLite. Ships schema migrations 008, which require a maintenance window — see the operator runbook before upgrading. Resolves CVE-2026-55170. Resolves CVE-2026-55689. Thank you @​sahajamoth for bringing this to our attention.
  • Enforce that authn.oidc.issuer and authn.oidc.audience are both set when authn.method is oidc. Previously, omitting --authn-oidc-audience caused the JWT aud claim to be silently skipped during token validation, allowing any validly-signed token from the trusted issuer to be accepted regardless of its intended audience. OpenFGA will now refuse to start if either value is missing. Thank you @​0xVijay for bringing this to our attention.

Full Changelog: openfga/openfga@v1.17.1...v1.18.0

v1.17.1

Changed

  • Update PR workflow benchmark comparison to be less flakey. #3153

Fixed

  • Fixed experimental weighted_graph_check falling back to the standard algorithm on errors that v1 would reject identically or that should not be retried. ErrTransactionThrottled, check.ErrValidation, check.ErrInvalidUser, and *tuple.InvalidTupleError (from contextual-tuple validation) are now returned directly instead of triggering a v1 retry. #3150
  • Fixed a race where an iterator cache entry flushed concurrently with a write could survive cache controller invalidation checks, causing stale tuples to be returned to subsequent requests. #3155 Thanks to @​0xmrma for reporting this bug.
  • Fixed ReadChanges pagination erroring past the first page when an object type name contains |, and tightened Deserialize to reject tokens with an empty ULID segment rather than silently restarting pagination from the beginning. #3152

Security

  • Update toolchain Go version to 1.26.4 to address the Go standard library vulnerabilities documented in the Go 1.26.4 release notes. #3159
  • Update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so released images no longer ship the Go standard library vulnerabilities fixed in the Go 1.26.4 release notes. #3164 Thanks @​Keralin!

New Contributors

Full Changelog: openfga/openfga@v1.17.0...v1.17.1

v1.17.0

Added

  • Added a configurable trace sampler via trace.sampler (OPENFGA_TRACE_SAMPLER / OTEL_TRACES_SAMPLER), supporting the standard OpenTelemetry strategies always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, and parentbased_traceidratio. This lets OpenFGA honor upstream parent sampling decisions when running as a downstream service. Defaults to traceidratio to preserve existing behavior. #3072 Thanks @​armujahid!

Changed

  • Redesigned cache key generation to use TLV (type-length-value) binary encoding, eliminating collision risk from string concatenation and adding per-process hash seeding to prevent hash-flooding attacks. #3148

New Contributors

Full Changelog: openfga/openfga@v1.16.1...v1.17.0

v1.16.1

Changed

... (truncated)

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.18.0] - 2026-06-16

Fixed

  • Use crypto/subtle.ConstantTimeCompare for preshared key authentication to close a timing side-channel where the prior map lookup could reveal information about valid key bytes. #3168 Thanks to @​geo-chen for reporting this.

Security

  • Fixed identifier comparison on the MySQL backend to be case-sensitive, matching Postgres and SQLite. Ships schema migrations 008, which require a maintenance window — see the operator runbook before upgrading. Resolves CVE-2026-55170. Thank you @​sahajamoth for bringing this to our attention.
  • Enforce that authn.oidc.issuer and authn.oidc.audience are both set when authn.method is oidc. Previously, omitting --authn-oidc-audience caused the JWT aud claim to be silently skipped during token validation, allowing any validly-signed token from the trusted issuer to be accepted regardless of its intended audience. OpenFGA will now refuse to start if either value is missing. Resolves CVE-2026-55689. Thank you @​0xVijay for bringing this to our attention.

[1.17.1] - 2026-06-05

Changed

  • Update PR workflow benchmark comparison to be less flakey. #3153

Fixed

  • Fixed experimental weighted_graph_check falling back to the standard algorithm on errors that v1 would reject identically or that should not be retried. ErrTransactionThrottled, check.ErrValidation, check.ErrInvalidUser, and *tuple.InvalidTupleError (from contextual-tuple validation) are now returned directly instead of triggering a v1 retry. #3150
  • Fixed a race where an iterator cache entry flushed concurrently with a write could survive cache controller invalidation checks, causing stale tuples to be returned to subsequent requests. #3155 Thanks to @​0xmrma for reporting this bug.
  • Fixed ReadChanges pagination erroring past the first page when an object type name contains |, and tightened Deserialize to reject tokens with an empty ULID segment rather than silently restarting pagination from the beginning. #3152

Security

  • Update toolchain Go version to 1.26.4 to address the Go standard library vulnerabilities documented in the Go 1.26.4 release notes. #3159
  • Update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so released images no longer ship the Go standard library vulnerabilities fixed in the Go 1.26.4 release notes. #3164 Thanks @​Keralin!

[1.17.0] - 2026-06-02

Added

  • Added a configurable trace sampler via trace.sampler (OPENFGA_TRACE_SAMPLER / OTEL_TRACES_SAMPLER), supporting the standard OpenTelemetry strategies always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, and parentbased_traceidratio. This lets OpenFGA honor upstream parent sampling decisions when running as a downstream service. Defaults to traceidratio to preserve existing behavior. #3072 Thanks @​armujahid!

Changed

  • Redesigned cache key generation to use TLV (type-length-value) binary encoding, eliminating collision risk from string concatenation and adding per-process hash seeding to prevent hash-flooding attacks. #3148

[1.16.1] - 2026-05-28

Changed

  • Added workflow-level concurrency.group and cancel-in-progress for PR-related workflow runs to reduce wasted effort. #3140

Fixed

  • Fixed experimental weighted_graph_check incorrectly falling back to the standard algorithm on deadline/cancellation/throttle-timeout errors; these are now returned directly. Also fixed weighted_graph_check emitting metrics under the wrong method label when used as the primary algorithm. #3141
  • Fixed a bug in experimental weighted_graph_check where the weight2 strategy could return false denies when contextual tuples were present, because their concatenation with datastore results violated the sort assumption of the pruning optimization. #3145

Security

  • Update grpc-health-probe to v0.4.50 to address multiple CVEs in the go std lib. #3146

[1.16.0] - 2026-05-20

Added

  • Added datastore ping timeout (PingTimeout) and datastore ping retry timeout (PingRetryMaxElapsedTime) configurations. #3113

Changed

  • Report allowed result and tuple_key on Check and experimental weighted_graph_check resolution trace spans. #3116

Fixed

  • Fixed cache key collisions in experimental weighted_graph_check union resolution by moving result caching from the union node level to the individual edge level, preventing collisions across requests that share edges but differ in object or relation. #3117
  • Fixed a bug in experimental weighted_graph_check where in-flight goroutines cancelled by a union short-circuit or recursive resolution could cache a false result, causing subsequent requests to incorrectly return false without querying the datastore. #3125
  • Fixed experimental weighted_graph_check returning an error when v2Check fails; Check now falls back to the standard algorithm instead. #3126

... (truncated)

Commits
  • 81089a3 release: update changelog for release v1.18.0 (#3174)
  • 4459677 Merge commit from fork
  • a2e0dbe Merge commit from fork
  • 0c75947 fix: use constant-time comparison for preshared key authentication (#3168)
  • 7a356c9 chore(deps): bump the dependencies group with 2 updates (#3166)
  • 9ac791f chore(deps): bump the dependencies group with 2 updates (#3167)
  • 393db3f release: update changelog for release v1.17.1 (#3165)
  • ec685d0 chore: bump grpc-health-probe to v0.4.52 (#3164)
  • c452374 docs: update caching docs (#3163)
  • 4f00251 fix: continuation token deserializer - handle | in type names (#3152)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.40.0 to 1.44.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.44.0/v0.66.0/v0.20.0/v0.0.17

Added

  • Add ByteSlice and ByteSliceValue functions for new BYTESLICE attribute type in go.opentelemetry.io/otel/attribute. (#7948)
  • Apply attribute value limit to the KindBytes attribute type in go.opentelemetry.io/otel/sdk/log. (#7990)
  • Apply attribute value limit to the BYTESLICE attribute type in go.opentelemetry.io/otel/sdk/trace. (#7990)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/trace. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8153)
  • Add String method for Value type in go.opentelemetry.io/otel/attribute. (#8142)
  • Add Slice and SliceValue functions for new SLICE attribute type in go.opentelemetry.io/otel/attribute. (#8166)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8216)
  • Apply AttributeValueLengthLimit to attribute.SLICE type attribute values in go.opentelemetry.io/otel/sdk/trace, recursively truncating contained string values. (#8217)
  • Add Error field on Record type in go.opentelemetry.io/otel/log/logtest. (#8148)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8157)
  • Add Settable to go.opentelemetry.io/otel/metric/x to allow reusing attribute options. (#8178)
  • Add experimental support for splitting metric data across multiple batches in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size> to enable for all periodic readers. See go.opentelemetry.io/otel/sdk/metric/internal/x for feature documentation. (#8071)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x for feature documentation. (#8192)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x for feature documentation. (#8194)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/stdout/stdoutlog/internal/x for feature documentation. (#8263)
  • Add WithDefaultAttributes to go.opentelemetry.io/otel/metric/x to support setting default attributes on instruments. (#8135)
  • Add go.opentelemetry.io/otel/semconv/v1.41.0 package. The package contains semantic conventions from the v1.41.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.40.0. (#8324)
  • Add Observable variants of instruments to go.opentelemetry.io/otel/semconv/v1.41.0 package. (#8350)
  • Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in go.opentelemetry.io/otel/semconv/v1.41.0. (#8002)

Changed

  • ⚠️ Breaking Change: go.opentelemetry.io/otel/sdk/metric now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing attribute.Bool("otel.metric.overflow", true). This can break users who relied on the previous unlimited default.

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27

Added

  • Add ByteSlice and ByteSliceValue functions for new BYTESLICE attribute type in go.opentelemetry.io/otel/attribute. (#7948)
  • Apply attribute value limit to the KindBytes attribute type in go.opentelemetry.io/otel/sdk/log. (#7990)
  • Apply attribute value limit to the BYTESLICE attribute type in go.opentelemetry.io/otel/sdk/trace. (#7990)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/trace. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8153)
  • Add String method for Value type in go.opentelemetry.io/otel/attribute. (#8142)
  • Add Slice and SliceValue functions for new SLICE attribute type in go.opentelemetry.io/otel/attribute. (#8166)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8216)
  • Apply AttributeValueLengthLimit to attribute.SLICE type attribute values in go.opentelemetry.io/otel/sdk/trace, recursively truncating contained string values. (#8217)
  • Add Error field on Record type in go.opentelemetry.io/otel/log/logtest. (#8148)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8157)
  • Add Settable to go.opentelemetry.io/otel/metric/x to allow reusing attribute options. (#8178)
  • Add experimental support for splitting metric data across multiple batches in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size> to enable for all periodic readers. See go.opentelemetry.io/otel/sdk/metric/internal/x for feature documentation. (#8071)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. Enable with OTEL_GO_X_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x for feature documentation. (#8192)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. Enable with OTEL_GO_X_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x for feature documentation. (#8194)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. Enable with OTEL_GO_X_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/stdout/stdoutlog/internal/x for feature documentation. (#8263)
  • Add WithDefaultAttributes to go.opentelemetry.io/otel/metric/x to support setting default attributes on instruments. (#8135)
  • Add go.opentelemetry.io/otel/semconv/v1.41.0 package. The package contains semantic conventions from the v1.41.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.40.0. (#8324)
  • Add Observable variants of instruments to go.opentelemetry.io/otel/semconv/v1.41.0 package. (#8350)
  • Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in go.opentelemetry.io/otel/semconv/v1.41.0. (#8002)

Changed

  • ⚠️ Breaking Change: go.opentelemetry.io/otel/sdk/metric now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing attribute.Bool("otel.metric.overflow", true).

... (truncated)

Commits
  • b62d928 Release 1.44.0 (#8376)
  • 94132a0 chore(deps): update golang.org/x/telemetry digest to 5997936 (#8379)
  • 6fdcf82 feat: add self-observability metrics to otlpmetricgrpc metric exporters (#8192)
  • 761bbfc fix(deps): update golang.org/x (#8377)
  • 3a91dc6 fix(deps): update googleapis to 3dc84a4 (#8375)
  • f593185 exporters/otlp: default max request size to 64 MiB (#8365)
  • f02feac Merge commit from fork
  • 36c2f1b semconvkit: add invariant test for histogram-exclusion rule (#8370)
  • d0b6cbd sdk/metric: document unit-sensitivity of DefaultAggregationSelector (#8224)
  • 9a68034 add self observability for stdout exporter (#8263)
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.3 to 1.7.20

Commits

Updates github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5

Release notes

Sourced from github.com/go-jose/go-jose/v3's releases.

v3.0.5

What's Changed

Fixes GHSA-78h2-9frx-2jm8

We recommend migrating from v3 to v4, and we will stop support v3 in the near future.

Full Changelog: go-jose/go-jose@v3.0.4...v3.0.5

Commits

Updates github.com/google/cel-go from 0.27.0 to 0.28.1

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.28.1

What's Changed

New Contributors

Full Changelog: https://github.com/google/cel-go/compare/v0.28.0...v0.28.1

Release v0.28.0

High-Level Changes

  • Enhanced JSON Interoperability: New support for JSON names across the checker, AST, and runtime allows for more seamless data handling when working with JSON-native structures.
  • Improved Developer Tooling: Integration is now smoother thanks to new utilities for converting Go errors into cel.Issues and more descriptive, context-aware error messages.
  • Greater Environment Flexibility: You can now redeclare variables as constants and export parse limit options, providing finer control over how CEL environments are configured and constrained.
  • Native Struct Improvements: Support for mixing CEL and native values within native structs simplifies the handling of complex, hybrid data types.

🚀 Features

@dependabot
chore(deps): bump the go_modules group across 1 directory with 12 upd…
5207782 
…ates

Bumps the go_modules group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) | `0.133.0` | `0.144.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.3` | `5.2.4` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.8.0` | `5.9.2` |
| [github.com/openfga/openfga](https://github.com/openfga/openfga) | `1.11.6` | `1.18.0` |
| [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) | `3.0.4` | `3.0.5` |
| [github.com/moby/go-archive](https://github.com/moby/go-archive) | `0.1.0` | `0.3.0` |
| [github.com/oapi-codegen/oapi-codegen/v2](https://github.com/oapi-codegen/oapi-codegen) | `2.5.1` | `2.7.1` |



Updates `github.com/getkin/kin-openapi` from 0.133.0 to 0.144.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.133.0...v0.144.0)

Updates `github.com/go-chi/chi/v5` from 5.2.3 to 5.2.4
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.2.3...v5.2.4)

Updates `github.com/jackc/pgx/v5` from 5.8.0 to 5.9.2
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.8.0...v5.9.2)

Updates `github.com/openfga/openfga` from 1.11.6 to 1.18.0
- [Release notes](https://github.com/openfga/openfga/releases)
- [Changelog](https://github.com/openfga/openfga/blob/main/CHANGELOG.md)
- [Commits](openfga/openfga@v1.11.6...v1.18.0)

Updates `go.opentelemetry.io/otel` from 1.40.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.44.0)

Updates `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream` from 1.7.3 to 1.7.20
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/m2/v1.7.3...service/notifications/v1.7.20)

Updates `github.com/go-jose/go-jose/v3` from 3.0.4 to 3.0.5
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v3.0.4...v3.0.5)

Updates `github.com/google/cel-go` from 0.27.0 to 0.28.1
- [Release notes](https://github.com/google/cel-go/releases)
- [Commits](https://github.com/google/cel-go/compare/v0.27.0...v0.28.1)

Updates `github.com/moby/go-archive` from 0.1.0 to 0.3.0
- [Release notes](https://github.com/moby/go-archive/releases)
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go)
- [Commits](moby/go-archive@v0.1.0...v0.3.0)

Updates `github.com/oapi-codegen/oapi-codegen/v2` from 2.5.1 to 2.7.1
- [Release notes](https://github.com/oapi-codegen/oapi-codegen/releases)
- [Commits](oapi-codegen/oapi-codegen@v2.5.1...v2.7.1)

Updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.44.0)

Updates `google.golang.org/grpc` from 1.79.1 to 1.81.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.1...v1.81.1)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.144.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.2.4
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.9.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/openfga/openfga
  dependency-version: 1.18.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
  dependency-version: 1.7.20
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-version: 3.0.5
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/google/cel-go
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/moby/go-archive
  dependency-version: 0.3.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/oapi-codegen/oapi-codegen/v2
  dependency-version: 2.7.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.44.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.1
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants