Skip to content

deps(deps): bump the go-dependencies group across 1 directory with 17 updates - #252

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-a81fdd7529
Closed

deps(deps): bump the go-dependencies group across 1 directory with 17 updates#252
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-a81fdd7529

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 13 updates in the / directory:

Package From To
cloud.google.com/go/firestore 1.24.0 1.25.0
github.com/alicebob/miniredis/v2 2.38.0 2.39.0
github.com/aws/aws-sdk-go-v2 1.43.4 1.45.1
github.com/aws/aws-sdk-go-v2/config 1.32.35 1.33.2
github.com/aws/aws-sdk-go-v2/service/bedrock 1.66.4 1.70.0
github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.57.1 1.60.0
github.com/stretchr/testify 1.11.1 1.12.1
go.opentelemetry.io/otel 1.45.0 1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace 1.45.0 1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.45.0 1.46.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace 1.45.0 1.46.0
google.golang.org/api 0.292.0 0.297.0
google.golang.org/genai 1.67.0 1.71.0

Updates cloud.google.com/go/firestore from 1.24.0 to 1.25.0

Release notes

Sourced from cloud.google.com/go/firestore's releases.

redis: v1.25.0

1.25.0 (2026-07-23)

Features

firestore: v1.25.0

1.25.0 (2026-08-07)

Features

Changelog

Sourced from cloud.google.com/go/firestore's changelog.

1.25.0 (2024-02-09)

Features

  • documentai: Expose model_type in v1 processor, so that user can see the model_type after get or list processor version (2fcf55c)
Commits
  • 1b34244 chore: librarian release pull request: 20260122T080909Z (#13657)
  • e31373e chore: tidy snippets (#13655)
  • 2103cc6 chore: librarian release pull request: 20260121T212954Z (#13654)
  • 8ddeca5 chore: librarian generate pull request: 20260121T080645Z (#13650)
  • a80159a chore(all): update deps (major) (#13644)
  • e6111d4 chore: disable major version upgrade of pubsub (#13648)
  • 8e33ea0 chore(all): update opentelemetry-go monorepo to v1.39.0 (#13643)
  • 3876978 fix(auth): add InternalOptions.TelemetryAttributes for internal client use (#...
  • 736b758 chore: update spanner test module (#13639)
  • 4fecc87 chore(all): update module golang.org/x/crypto to v0.45.0 [SECURITY] (#13640)
  • Additional commits viewable in compare view

Updates github.com/alicebob/miniredis/v2 from 2.38.0 to 2.39.0

Release notes

Sourced from github.com/alicebob/miniredis/v2's releases.

GEOSEARCH, HPERSIST, PZPOP*

Changelog

Sourced from github.com/alicebob/miniredis/v2's changelog.

v2.39.0

Commits

Updates github.com/aws/aws-sdk-go-v2 from 1.43.4 to 1.45.1

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.35 to 1.33.2

Commits

Updates github.com/aws/aws-sdk-go-v2/service/bedrock from 1.66.4 to 1.70.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/bedrockruntime from 1.57.1 to 1.60.0

Commits

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (

@dependabot
deps(deps): bump the go-dependencies group across 1 directory with 17…
7b0d961 
… updates

Bumps the go-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/firestore](https://github.com/googleapis/google-cloud-go) | `1.24.0` | `1.25.0` |
| [github.com/alicebob/miniredis/v2](https://github.com/alicebob/miniredis) | `2.38.0` | `2.39.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.43.4` | `1.45.1` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.35` | `1.33.2` |
| [github.com/aws/aws-sdk-go-v2/service/bedrock](https://github.com/aws/aws-sdk-go-v2) | `1.66.4` | `1.70.0` |
| [github.com/aws/aws-sdk-go-v2/service/bedrockruntime](https://github.com/aws/aws-sdk-go-v2) | `1.57.1` | `1.60.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.45.0` | `1.46.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.45.0` | `1.46.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.45.0` | `1.46.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) | `1.45.0` | `1.46.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.292.0` | `0.297.0` |
| [google.golang.org/genai](https://github.com/googleapis/go-genai) | `1.67.0` | `1.71.0` |



Updates `cloud.google.com/go/firestore` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](googleapis/google-cloud-go@kms/v1.24.0...kms/v1.25.0)

Updates `github.com/alicebob/miniredis/v2` from 2.38.0 to 2.39.0
- [Release notes](https://github.com/alicebob/miniredis/releases)
- [Changelog](https://github.com/alicebob/miniredis/blob/master/CHANGELOG.md)
- [Commits](alicebob/miniredis@v2.38.0...v2.39.0)

Updates `github.com/aws/aws-sdk-go-v2` from 1.43.4 to 1.45.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.43.4...v1.45.1)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.35 to 1.33.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.35...config/v1.33.2)

Updates `github.com/aws/aws-sdk-go-v2/service/bedrock` from 1.66.4 to 1.70.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/fsx/v1.66.4...service/s3/v1.70.0)

Updates `github.com/aws/aws-sdk-go-v2/service/bedrockruntime` from 1.57.1 to 1.60.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.57.1...service/s3/v1.60.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/trace` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `google.golang.org/api` from 0.292.0 to 0.297.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.292.0...v0.297.0)

Updates `google.golang.org/genai` from 1.67.0 to 1.71.0
- [Release notes](https://github.com/googleapis/go-genai/releases)
- [Changelog](https://github.com/googleapis/go-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/go-genai@v1.67.0...v1.71.0)

Updates `google.golang.org/grpc` from 1.83.0 to 1.83.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.2)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: cloud.google.com/go/firestore
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/alicebob/miniredis/v2
  dependency-version: 2.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/bedrock
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/bedrockruntime
  dependency-version: 1.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/api
  dependency-version: 0.297.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/genai
  dependency-version: 1.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 7, 2026
@charlesgreen charlesgreen mentioned this pull request Sep 9, 2026
Merged
5 tasks done
charlesgreen added a commit that referenced this pull request Sep 10, 2026
@charlesgreen
chore(deps): bulk dependabot + security updates (#254)
5f374f2 
* chore(deps): bulk dependabot + security updates, close 6 open PRs

Fixes two HIGH-severity grpc-go DoS advisories (missing :authority/Host
header crash, HTTP/2 DATA frame heap exhaustion) that affected the
v1.83.0 pin in the root module and all 5 grpc-dependent examples, by
bumping to v1.83.2 everywhere. Bumps the Go toolchain 1.26.5 -> 1.26.6,
clearing 8 stdlib govulncheck findings. govulncheck reports 0 reachable
vulnerabilities across the root module and every example module.

Applied (closes #253, #252, #251, #249, #244, #243):
- google.golang.org/grpc -> v1.83.2 (root + 5 example modules)
- cloud.google.com/go/firestore -> v1.25.0
- github.com/alicebob/miniredis/v2 -> v2.39.0
- github.com/aws/aws-sdk-go-v2 -> v1.45.1
- github.com/aws/aws-sdk-go-v2/config -> v1.33.2
- github.com/aws/aws-sdk-go-v2/service/bedrock -> v1.70.0
- github.com/aws/aws-sdk-go-v2/service/bedrockruntime -> v1.60.0
- github.com/stretchr/testify -> v1.12.1
- go.opentelemetry.io/otel{,/sdk,/trace,/metric} -> v1.46.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace{,/otlptracehttp} -> v1.46.0
- go.opentelemetry.io/otel/exporters/stdout/stdouttrace -> v1.46.0
- google.golang.org/api -> v0.297.0
- google.golang.org/genai -> v1.71.0
- actions/checkout -> v7.0.1
- actions/setup-go -> v7.0.0
- docker/setup-buildx-action -> v4.3.0
- github/codeql-action/upload-sarif -> v4.37.9
- securego/gosec -> v2.29.0
- anchore/sbom-action/download-syft -> v0.24.2

Not fixable by dependency bump: 6 Trivy code-scanning alerts (rule
GO-2026-5932) flag golang.org/x/crypto/openpgp as unmaintained. It's
an unremovable transitive dep of grpc/otel with no reachable call site
in this repo's source and no patched version exists. Filed dismissal
requests (delegated approval required by org policy) rather than
force through.

~110 remaining open Dependabot alerts (grpc <1.79.3/1.82.1, x/crypto,
x/net, otel) are stale duplicates against versions already satisfied
by this bump; they'll auto-resolve once the dependency graph rescans
this branch.

* fix(lint): resolve staticcheck SA1019 deprecation findings

golangci-lint-action installs 'latest' unpinned, so an upstream release
started flagging two long-standing deprecated-API uses that weren't
caught before (main's last CI run passed Lint cleanly):
- ChatCompletionRequest.MaxTokens -> MaxCompletionTokens (go-openai);
  the replacement is a direct drop-in and also works with o1-series
  models, unlike MaxTokens.
- tls.Config.PreferServerCipherSuites has been a no-op since Go 1.18;
  dropped from the reference "secure config" in the test rather than
  keep asserting on a field that does nothing.

golangci-lint run --timeout=5m: 0 issues (was 2).
@charlesgreen

charlesgreen commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Superseded by #254, which bumped this (and 5 other open Dependabot PRs) to an equal or newer version in one bulk update, merged to main at 5f374f2.

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/go_modules/go-dependencies-a81fdd7529 branch September 10, 2026 01:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@charlesgreen