Skip to content

deps: bump the go-dependencies group across 1 directory with 23 updates - #21

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-ba6df7974d
Closed

deps: bump the go-dependencies group across 1 directory with 23 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-ba6df7974d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 14 updates in the / directory:

Package From To
go.opentelemetry.io/contrib/bridges/otelslog 0.19.0 0.20.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.69.0 0.70.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc 0.20.0 0.21.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 0.20.0 0.21.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/stdout/stdoutlog 0.20.0 0.21.0
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace 1.44.0 1.45.0
google.golang.org/protobuf 1.36.11 1.36.12
modernc.org/sqlite 1.54.0 1.56.0

Updates go.opentelemetry.io/contrib/bridges/otelslog from 0.19.0 to 0.20.0

Release notes

Sourced from go.opentelemetry.io/contrib/bridges/otelslog's releases.

Release v0.20.0

Changed

  • The go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo instrumentation now accepts a WithCommandAttributeDisabled, so the caller can specify whether to opt-out of tracing the mongo command. (#712)
  • Upgrade to v0.20.0 of go.opentelemetry.io/otel. (#758)
  • The B3 and Jaeger propagators now store their debug or deferred state in the context.Context instead of the SpanContext. (#758)

Raw changes made between v0.19.0 and v0.20.0

0e5bef9af1c708e28aabcadd3fd8b35c36526e44 (HEAD -> main, tag: v0.20.0, tag: propagators/v0.20.0, tag: propagators/opencensus/v0.20.0, tag: propagators/opencensus/examples/v0.20.0, tag: propagators/aws/v0.20.0, tag: instrumentation/runtime/v0.20.0, tag: instrumentation/runtime/example/v0.20.0, tag: instrumentation/net/http/otelhttp/v0.20.0, tag: instrumentation/net/http/otelhttp/example/v0.20.0, tag: instrumentation/net/http/httptrace/otelhttptrace/v0.20.0, tag: instrumentation/net/http/httptrace/otelhttptrace/example/v0.20.0, tag: instrumentation/host/v0.20.0, tag: instrumentation/host/example/v0.20.0, tag: instrumentation/gopkg.in/macaron.v1/otelmacaron/v0.20.0, tag: instrumentation/gopkg.in/macaron.v1/otelmacaron/example/v0.20.0, tag: instrumentation/google.golang.org/grpc/otelgrpc/v0.20.0, tag: instrumentation/google.golang.org/grpc/otelgrpc/example/v0.20.0, tag: instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo/v0.20.0, tag: instrumentation/github.com/labstack/echo/otelecho/v0.20.0, tag: instrumentation/github.com/labstack/echo/otelecho/example/v0.20.0, tag: instrumentation/github.com/gorilla/mux/otelmux/v0.20.0, tag: instrumentation/github.com/gorilla/mux/otelmux/example/v0.20.0, tag: instrumentation/github.com/gocql/gocql/otelgocql/v0.20.0, tag: instrumentation/github.com/gocql/gocql/otelgocql/example/v0.20.0, tag: instrumentation/github.com/go-kit/kit/otelkit/v0.20.0, tag: instrumentation/github.com/go-kit/kit/otelkit/example/v0.20.0, tag: instrumentation/github.com/gin-gonic/gin/otelgin/v0.20.0, tag: instrumentation/github.com/gin-gonic/gin/otelgin/example/v0.20.0, tag: instrumentation/github.com/emicklei/go-restful/otelrestful/v0.20.0, tag: instrumentation/github.com/emicklei/go-restful/otelrestful/example/v0.20.0, tag: instrumentation/github.com/bradfitz/gomemcache/memcache/otelmemcache/v0.20.0, tag: instrumentation/github.com/bradfitz/gomemcache/memcache/otelmemcache/example/v0.20.0, tag: instrumentation/github.com/aws/aws-sdk-go-v2/otelaws/v0.20.0, tag: instrumentation/github.com/aws/aws-sdk-go-v2/otelaws/example/v0.20.0, tag: instrumentation/github.com/astaxie/beego/otelbeego/v0.20.0, tag: instrumentation/github.com/astaxie/beego/otelbeego/example/v0.20.0, tag: instrumentation/github.com/Shopify/sarama/otelsarama/v0.20.0, tag: instrumentation/github.com/Shopify/sarama/otelsarama/example/v0.20.0, tag: exporters/metric/dogstatsd/v0.20.0, tag: exporters/metric/datadog/v0.20.0, tag: exporters/metric/cortex/v0.20.0, tag: exporters/metric/cortex/utils/v0.20.0, tag: exporters/metric/cortex/example/v0.20.0, tag: detectors/gcp/v0.20.0, tag: detectors/aws/v0.20.0, tag: detectors/aws/eks/v0.20.0, tag: detectors/aws/ecs/v0.20.0, upstream/main, origin/main) Release v0.20.0 (#758) 4d6b37ee50101d33b128be80da797df689dcac73 update grpc example commands (#756) 7b51f7af720d404b75942132988548814759b4b1 Bump github.com/emicklei/go-restful/v3 from 3.5.0 to 3.5.1 in /instrumentation/github.com/emicklei/go-restful/otelrestful (#753) 8db2eaeb371da4b5c046edb63f5ac4aad4f4c329 Bump actions/cache from v2.1.4 to v2.1.5 (#752) 57cfdfcf8c81451509ac1ec66c42e1027113c261 Bump github.com/aws/aws-sdk-go from 1.38.17 to 1.38.21 in /detectors/aws (#751) e1a7c4781baf5716364bc5661052c5746e87e344 Bump github.com/emicklei/go-restful/v3 (#745) b82a9a1da1cc60ddd3f26d216d1fac3f509aef46 Bump github.com/labstack/echo/v4 from 4.2.1 to 4.2.2 in /instrumentation/github.com/labstack/echo/otelecho (#737) 960b296a0c84987f185bc91d6a78088161d184eb Bump github.com/gin-gonic/gin from 1.6.3 to 1.7.1 in /instrumentation/github.com/gin-gonic/gin/otelgin (#736) ac1585995f673176d64f580c316ff046e377cf41 Bump google.golang.org/grpc from 1.36.1 to 1.37.0 in /instrumentation/google.golang.org/grpc/otelgrpc (#740) 988a57d5c3e0c8c497d9b189d549a3d867ac1861 Bump github.com/emicklei/go-restful/v3 from 3.4.0 to 3.5.0 in /instrumentation/github.com/emicklei/go-restful/otelrestful (#735) 892d7f9682fdc37e89dfc54cfc93224277544f62 Bump github.com/aws/aws-sdk-go from 1.38.12 to 1.38.17 in /detectors/aws (#734) 5b82c086071c7d152c3ea72fe1f3a455254acfc5 Add WithCommandLoggingDisabled to otelmongo tracer (#723) ae2c628729ec7c3ac90abe11b5ed04843fae752d otelhttp: handle nil base http transport (#713) e8c2192dd636d4a53625406e6dda5e3e54f4caeb Bump github.com/golang/protobuf from 1.5.1 to 1.5.2 in /instrumentation/google.golang.org/grpc/otelgrpc (#730) e416457164be70ea39a6655742bf5715b218d4d7 Bump go.mongodb.org/mongo-driver (#731) 3e90802df3d48d001bdbd20c7e9f0d018be4ddc9 Bump cloud.google.com/go from 0.80.0 to 0.81.0 in /detectors/gcp (#729) 13ba41fbf7bb8b9ba3f6fb83adc0936cfba1452b Bump github.com/golang/protobuf (#728) 4c3fcb8b89786b0f3afe7e933871314dad7f408d Bump github.com/aws/aws-sdk-go from 1.38.7 to 1.38.12 in /detectors/aws (#727) 2760096474280b3634e92431a7ed6da0744ef144 fix import link (#724) 0b89c82a57465cb877c553c38fa46bae28acdb89 Bump github.com/golangci/golangci-lint from 1.38.0 to 1.39.0 in /tools (#717) ec6d93d81c246a912e60020a34f1b13991d70e08 Bump cloud.google.com/go from 0.79.0 to 0.80.0 in /detectors/gcp (#716) 8d7211f260c9a1dba665bc40815b5ed424019d2c Bump github.com/aws/aws-sdk-go from 1.38.1 to 1.38.7 in /detectors/aws (#715) 0cca425e8c0f4ad49e7d71cffd641139cc2e2778 Bump google.golang.org/grpc from 1.36.0 to 1.36.1 in /instrumentation/google.golang.org/grpc/otelgrpc (#718) 5ec7f3c9b1d9e02998391a9020c8fd9e7775b6a1 fix cortex example code (#722) a51c8df3ff19784513809e8a3d3dafa99f7a3fa6 Update project approvers (#721) 9d0d9d99f94204dd2037e106a26633cfa37bc98f support aws sdk go for v2 instrumentation (#621) c33229996f97bd62fef40fa46911104dae9954ef Update InjectEncoding doc for B3 (#710) 09e3a120e157bb55b9595118a90767014cd3897b Bump github.com/golang/protobuf from 1.4.3 to 1.5.1 in /instrumentation/google.golang.org/grpc/otelgrpc (#681) 454823f7cb255304f9f371eecf7ba4209798ce73 Bump github.com/aws/aws-sdk-go from 1.37.30 to 1.38.1 in /detectors/aws (#708)

Changelog

Sourced from go.opentelemetry.io/contrib/bridges/otelslog's changelog.

[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03

Added

  • Add go.opentelemetry.io/contrib/detectors/ibmcloud/vpc, a new resource detector for IBM Cloud VPC virtual server instances, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, cloud.account.id, cloud.resource_id, host.id, host.image.id, host.image.name, host.name, and host.type. (#9011)
  • Add go.opentelemetry.io/contrib/detectors/k8sapi, a new resource detector that queries the Kubernetes API. Detects k8s.node.name and k8s.node.uid when K8S_NODE_NAME is set via the downward API, and k8s.cluster.uid derived from the kube-system namespace UID (works on any Kubernetes distribution). (#9108)
  • Add new elasticbeanstalk resource detector for AWS Elastic Beanstalk, ported from processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk in opentelemetry-collector-contrib. (#8993)
  • The resource created by go.opentelemetry.io/contrib/otelconf now includes default SDK attributes. (#8990)
  • Add support for the aws.ecs resource detector in go.opentelemetry.io/contrib/otelconf/x. (#8915)
  • Add support for the aws.eks resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9138)
  • Add support for the azure.vm resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9074)
  • Add support for the gcp resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9137)
  • Add go.opentelemetry.io/contrib/detectors/azure/azureappservice, a new resource detector for Azure App Service. Detects cloud.*, service.name, azure.resource_group.name, azure.app_service.instance.id, and deployment.environment.name from the WEBSITE_* and REGION_NAME environment variables. (#9289)
  • Add azurecontainerapps resource detector for Azure Container Apps. (#8939)
  • Add go.opentelemetry.io/contrib/detectors/azure/azurefunctions, a new resource detector for Azure Functions. Detects cloud.*, service.name, azure.resource_group.name, faas.instance, and deployment.environment.name from the FUNCTIONS_*, WEBSITE_*, CONTAINER_NAME, and REGION_NAME environment variables. (#9290)
  • Add NewResourceDetector along with the WithAttributeFilter and WithTagKeyFilter options in go.opentelemetry.io/contrib/detectors/azure/azurevm. WithAttributeFilter restricts the returned resource to the attributes the filter accepts. WithTagKeyFilter opts in to azure.tag.<name> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (#9162)
  • Add go.opentelemetry.io/contrib/detectors/vultr — a new resource detector for Vultr Cloud Compute instances, ported from processor/resourcedetectionprocessor/internal/vultr in opentelemetry-collector-contrib. Detects cloud.provider, cloud.platform, cloud.region, host.id, and host.name. (#8995)

Changed

  • Upgrade go.opentelemetry.io/otel/semconv to v1.43.0, including updates across instrumentation and detector modules. See semantic-conventions v1.43.0 release for complete details. (#9337)
  • Upgrade go.opentelemetry.io/otel/semconv to v1.42.0, including updates across instrumentation and detector modules. See semantic-conventions v1.42.0 release for complete details. (#9196)
  • Use direct normalized-key lookups in Carrier.Get and Carrier.Keys in go.opentelemetry.io/contrib/propagators/envcar. (#9112)
  • Update log bridge conversions to use attribute key-values instead of the removed log key-values in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. (#9180)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux has been replaced by const Version. (#9076)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin. (#8977)
  • Prefer the gRPC dial target over the resolved peer IP for the server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8904)
  • The detector in go.opentelemetry.io/contrib/detectors/azure/azurevm now also detects cloud.account.id, cloud.availability_zone, azure.vm.name, azure.vm.size, azure.vm.scaleset.name, and azure.resource_group.name, and prefers osProfile.computerName for host.name (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (#9162)

Fixed

  • Fix Prometheus reader resource label filter configuration in go.opentelemetry.io/contrib/otelconf/v0.2.0. (#9062)
  • Apply resource.detection/development.attributes.included and excluded filtering to resource detector attributes in go.opentelemetry.io/contrib/otelconf/x. (#9131)
  • Honor the context configured with WithContext when constructing resources in go.opentelemetry.io/contrib/otelconf and go.opentelemetry.io/contrib/otelconf/x. (#9160)
  • Handle nil response bodies from custom RoundTripper implementations in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp without panicking. (#9184)
  • Fix incorrect (overestimated) sum calculation for runtime histograms in go.opentelemetry.io/contrib/instrumentation/runtime. (#9063)
  • Fix Severity.UnmarshalText round trip for positive FATAL offsets above the named range in go.opentelemetry.io/contrib/processors/minsev. (#9197)
  • Reduce binary size by fetching ConfigMaps via rest.HTTPClientFor instead of the Kubernetes clientset in go.opentelemetry.io/contrib/detectors/aws/eks. (#9284)
  • TextMapPropagator in go.opentelemetry.io/contrib/propagators/autoprop returns the no-op propagator for empty input, matching the behavior of none. An unknown OTEL_PROPAGATORS value still returns an error with a nil propagator so NewTextMapPropagator falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (#9163)
  • Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in go.opentelemetry.io/contrib/bridges/otelslog. (#9238)
  • Fix a data race in go.opentelemetry.io/contrib/bridges/otelslog where concurrent Handle calls could corrupt each other's log attributes because kvBuffer.KeyValues returned a slice aliasing a shared buffer. (#9229)
  • Avoid a panic in go.opentelemetry.io/contrib/bridges/otelzap when a malformed error field contains a nil or non-error value. (#9068)
  • Use azure.container_app.instance.id instead of service.instance.id for the replica name detected by go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps. (#9208)
  • Preserve the underlying metadata errors returned with partial resources from go.opentelemetry.io/contrib/detectors/gcp. (#9069)
  • Copy MultipartForm back to the request otelmux.Middleware was given after the wrapped handler returns, so net/http can find and remove the temp files ParseMultipartForm created on the context-derived request copy, when otelmux.Middleware wraps a handler directly, in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. This does not cover a handler panic, nor the common router.Use(...) integration, where gorilla/mux's own routing step makes an additional request copy the middleware cannot write back through; see gorilla/mux#777. (#9361)
  • Report the b3 header from Fields() for the default B3Unspecified single-header injection encoding, matching what Inject writes, in go.opentelemetry.io/contrib/propagators/b3. (#9273)
  • Fix go.opentelemetry.io/contrib/propagators/aws/xray producing deterministic trace and span IDs when the seed read from crypto/rand silently failed, by switching to math/rand/v2's concurrency-safe top-level generator. (#9359)
  • Strip connection number suffix from connection ID in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo to prevent unbounded metric cardinality. (#9352)

... (truncated)

Commits
  • 0e5bef9 Release v0.20.0 (#758)
  • 4d6b37e update grpc example commands (#756)
  • 7b51f7a Bump github.com/emicklei/go-restful/v3 from 3.5.0 to 3.5.1 in /instrumentatio...
  • 8db2eae Bump actions/cache from v2.1.4 to v2.1.5 (#752)
  • 57cfdfc Bump github.com/aws/aws-sdk-go from 1.38.17 to 1.38.21 in /detectors/aws (#751)
  • e1a7c47 Bump github.com/emicklei/go-restful/v3 (#745)
  • b82a9a1 Bump github.com/labstack/echo/v4 from 4.2.1 to 4.2.2 in /instrumentation/gith...
  • 960b296 Bump github.com/gin-gonic/gin from 1.6.3 to 1.7.1 in /instrumentation/github....
  • ac15859 Bump google.golang.org/grpc from 1.36.1 to 1.37.0 in /instrumentation/google....
  • 988a57d Bump github.com/emicklei/go-restful/v3 from 3.4.0 to 3.5.0 in /instrumentatio...
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.69.0 to 0.70.0

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc's changelog.

[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03

Added

  • Add go.opentelemetry.io/contrib/detectors/ibmcloud/vpc, a new resource detector for IBM Cloud VPC virtual server instances, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, cloud.account.id, cloud.resource_id, host.id, host.image.id, host.image.name, host.name, and host.type. (#9011)
  • Add go.opentelemetry.io/contrib/detectors/k8sapi, a new resource detector that queries the Kubernetes API. Detects k8s.node.name and k8s.node.uid when K8S_NODE_NAME is set via the downward API, and k8s.cluster.uid derived from the kube-system namespace UID (works on any Kubernetes distribution). (#9108)
  • Add new elasticbeanstalk resource detector for AWS Elastic Beanstalk, ported from processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk in opentelemetry-collector-contrib. (#8993)
  • The resource created by go.opentelemetry.io/contrib/otelconf now includes default SDK attributes. (#8990)
  • Add support for the aws.ecs resource detector in go.opentelemetry.io/contrib/otelconf/x. (#8915)
  • Add support for the aws.eks resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9138)
  • Add support for the azure.vm resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9074)
  • Add support for the gcp resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9137)
  • Add go.opentelemetry.io/contrib/detectors/azure/azureappservice, a new resource detector for Azure App Service. Detects cloud.*, service.name, azure.resource_group.name, azure.app_service.instance.id, and deployment.environment.name from the WEBSITE_* and REGION_NAME environment variables. (#9289)
  • Add azurecontainerapps resource detector for Azure Container Apps. (#8939)
  • Add go.opentelemetry.io/contrib/detectors/azure/azurefunctions, a new resource detector for Azure Functions. Detects cloud.*, service.name, azure.resource_group.name, faas.instance, and deployment.environment.name from the FUNCTIONS_*, WEBSITE_*, CONTAINER_NAME, and REGION_NAME environment variables. (#9290)
  • Add NewResourceDetector along with the WithAttributeFilter and WithTagKeyFilter options in go.opentelemetry.io/contrib/detectors/azure/azurevm. WithAttributeFilter restricts the returned resource to the attributes the filter accepts. WithTagKeyFilter opts in to azure.tag.<name> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (#9162)
  • Add go.opentelemetry.io/contrib/detectors/vultr — a new resource detector for Vultr Cloud Compute instances, ported from processor/resourcedetectionprocessor/internal/vultr in opentelemetry-collector-contrib. Detects cloud.provider, cloud.platform, cloud.region, host.id, and host.name. (#8995)

Changed

  • Upgrade go.opentelemetry.io/otel/semconv to v1.43.0, including updates across instrumentation and detector modules. See semantic-conventions v1.43.0 release for complete details. (#9337)
  • Upgrade go.opentelemetry.io/otel/semconv to v1.42.0, including updates across instrumentation and detector modules. See semantic-conventions v1.42.0 release for complete details. (#9196)
  • Use direct normalized-key lookups in Carrier.Get and Carrier.Keys in go.opentelemetry.io/contrib/propagators/envcar. (#9112)
  • Update log bridge conversions to use attribute key-values instead of the removed log key-values in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. (#9180)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux has been replaced by const Version. (#9076)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin. (#8977)
  • Prefer the gRPC dial target over the resolved peer IP for the server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8904)
  • The detector in go.opentelemetry.io/contrib/detectors/azure/azurevm now also detects cloud.account.id, cloud.availability_zone, azure.vm.name, azure.vm.size, azure.vm.scaleset.name, and azure.resource_group.name, and prefers osProfile.computerName for host.name (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (#9162)

Fixed

  • Fix Prometheus reader resource label filter configuration in go.opentelemetry.io/contrib/otelconf/v0.2.0. (#9062)
  • Apply resource.detection/development.attributes.included and excluded filtering to resource detector attributes in go.opentelemetry.io/contrib/otelconf/x. (#9131)
  • Honor the context configured with WithContext when constructing resources in go.opentelemetry.io/contrib/otelconf and go.opentelemetry.io/contrib/otelconf/x. (#9160)
  • Handle nil response bodies from custom RoundTripper implementations in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp without panicking. (#9184)
  • Fix incorrect (overestimated) sum calculation for runtime histograms in go.opentelemetry.io/contrib/instrumentation/runtime. (#9063)
  • Fix Severity.UnmarshalText round trip for positive FATAL offsets above the named range in go.opentelemetry.io/contrib/processors/minsev. (#9197)
  • Reduce binary size by fetching ConfigMaps via rest.HTTPClientFor instead of the Kubernetes clientset in go.opentelemetry.io/contrib/detectors/aws/eks. (#9284)
  • TextMapPropagator in go.opentelemetry.io/contrib/propagators/autoprop returns the no-op propagator for empty input, matching the behavior of none. An unknown OTEL_PROPAGATORS value still returns an error with a nil propagator so NewTextMapPropagator falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (#9163)
  • Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in go.opentelemetry.io/contrib/bridges/otelslog. (#9238)
  • Fix a data race in go.opentelemetry.io/contrib/bridges/otelslog where concurrent Handle calls could corrupt each other's log attributes because kvBuffer.KeyValues returned a slice aliasing a shared buffer. (#9229)
  • Avoid a panic in go.opentelemetry.io/contrib/bridges/otelzap when a malformed error field contains a nil or non-error value. (#9068)
  • Use azure.container_app.instance.id instead of service.instance.id for the replica name detected by go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps. (#9208)
  • Preserve the underlying metadata errors returned with partial resources from go.opentelemetry.io/contrib/detectors/gcp. (#9069)
  • Copy MultipartForm back to the request otelmux.Middleware was given after the wrapped handler returns, so net/http can find and remove the temp files ParseMultipartForm created on the context-derived request copy, when otelmux.Middleware wraps a handler directly, in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. This does not cover a handler panic, nor the common router.Use(...) integration, where gorilla/mux's own routing step makes an additional request copy the middleware cannot write back through; see gorilla/mux#777. (#9361)
  • Report the b3 header from Fields() for the default B3Unspecified single-header injection encoding, matching what Inject writes, in go.opentelemetry.io/contrib/propagators/b3. (#9273)
  • Fix go.opentelemetry.io/contrib/propagators/aws/xray producing deterministic trace and span IDs when the seed read from crypto/rand silently failed, by switching to math/rand/v2's concurrency-safe top-level generator. (#9359)
  • Strip connection number suffix from connection ID in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo to prevent unbounded metric cardinality. (#9352)

... (truncated)

Commits
  • c8a87a6 Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0 (#9413)
  • cde125c fix(deps): update aws-sdk-go-v2 monorepo (#9384)
  • 88572a7 chore(deps): update googleapis to 6ac0973 (#9409)
  • e4f511a chore(deps): update github/codeql-action action to v4.37.5 (#9410)
  • 265eb0b fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (#9317)
  • 941ba46 chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
  • ededd3b chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#9406)
  • 7c6e819 fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1 (#9405)
  • ec1e544 chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (#9403)
  • 5d7e16a chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#9402)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.44.0 to 1.45.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

Overview

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove th...

    Description has been truncated

@dependabot
deps: bump the go-dependencies group across 1 directory with 23 updates
afbd7ab 
Bumps the go-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/contrib/bridges/otelslog](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.19.0` | `0.20.0` |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.69.0` | `0.70.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `0.21.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `0.21.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdoutlog](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `0.21.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdoutmetric](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| google.golang.org/protobuf | `1.36.11` | `1.36.12` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.54.0` | `1.56.0` |



Updates `go.opentelemetry.io/contrib/bridges/otelslog` from 0.19.0 to 0.20.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@v0.19.0...v0.20.0)

Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.69.0 to 0.70.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.69.0...zpages/v0.70.0)

Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdoutlog` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/log` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/sdk/log` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/trace` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260720211330-0afa2a65878a to 0.0.0-20260803160001-6ac0973c030d
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/grpc` from 1.82.1 to 1.83.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.82.1...v1.83.0)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

Updates `modernc.org/sqlite` from 1.54.0 to 1.56.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.56.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/bridges/otelslog
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-version: 0.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdoutlog
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdoutmetric
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/log
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk/log
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk/metric
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20260803160001-6ac0973c030d
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: modernc.org/sqlite
  dependency-version: 1.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 13, 2026
@dependabot
dependabot Bot requested review from a team as code owners August 13, 2026 19:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 13, 2026
@github-actions

github-actions Bot commented Aug 13, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 4 package(s) with unknown licenses.
See the Details below.

License Issues

go.mod

PackageVersionLicenseIssue Type
github.com/go-logr/logr1.4.4NullUnknown License
github.com/mattn/go-isatty0.0.24NullUnknown License
modernc.org/libc1.74.4NullUnknown License
modernc.org/sqlite1.56.0NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
gomod/github.com/go-logr/logr 1.4.4 UnknownUnknown
gomod/github.com/mattn/go-isatty 0.0.24 UnknownUnknown
gomod/go.opentelemetry.io/contrib/bridges/otelslog 0.20.0 🟢 9
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Signed-Releases🟢 84 out of the last 4 releases have a total of 4 signed artifacts.
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 45 contributing companies or organizations
gomod/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.70.0 🟢 9
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Signed-Releases🟢 84 out of the last 4 releases have a total of 4 signed artifacts.
License🟢 10license file detected
Vulnerabilities🟢 91 existing vulnerabilities detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 45 contributing companies or organizations
gomod/go.opentelemetry.io/otel 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc 0.21.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 0.21.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlptrace 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/stdout/stdoutlog 0.21.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/stdout/stdoutmetric 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/exporters/stdout/stdouttrace 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/log 0.21.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/metric 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/sdk 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/sdk/log 0.21.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/sdk/metric 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/go.opentelemetry.io/otel/trace 1.45.0 🟢 9.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 91 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 43 contributing companies or organizations
gomod/google.golang.org/genproto/googleapis/api 0.0.0-20260803160001-6ac0973c030d 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3
gomod/google.golang.org/genproto/googleapis/rpc 0.0.0-20260803160001-6ac0973c030d 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3
gomod/google.golang.org/grpc 1.83.0 🟢 7.7
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 7SAST tool detected but not run on all commits
gomod/google.golang.org/protobuf 1.36.12 UnknownUnknown
gomod/modernc.org/libc 1.74.4 UnknownUnknown
gomod/modernc.org/sqlite 1.56.0 UnknownUnknown

Scanned Files

  • go.mod

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 10, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-dependencies-ba6df7974d branch September 10, 2026 19:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants