Skip to content

chore(deps): Update go minor and patch#2254

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-minor-and-patch
Open

chore(deps): Update go minor and patch#2254
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-minor-and-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 1, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/dgraph-io/ristretto/v2 v2.2.0v2.4.0 age confidence
github.com/google/flatbuffers v25.2.10+incompatiblev25.12.19+incompatible age confidence
github.com/klauspost/compress v1.18.0v1.18.5 age confidence
github.com/spf13/cobra v1.9.1v1.10.2 age confidence
github.com/stretchr/testify v1.10.0v1.11.1 age confidence
go.opentelemetry.io/contrib/zpages v0.62.0v0.68.0 age confidence
go.opentelemetry.io/otel v1.37.0v1.43.0 age confidence
golang.org/x/sys v0.35.0v0.43.0 age confidence
google.golang.org/protobuf v1.36.7v1.36.11 age confidence

Release Notes

dgraph-io/ristretto (github.com/dgraph-io/ristretto/v2)

v2.4.0

Compare Source

Added
  • Implement public Cache.IterValues() method (#​475)
  • Allow custom key types with underlying types in Key constraint (#​478)
Fixed
  • Fix compilation on 32-bit archs (#​465)

Full Changelog: dgraph-io/ristretto@v2.3.0...v2.4.0

v2.3.0: Ristretto v2.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: dgraph-io/ristretto@v2.2.0...v2.3.0

google/flatbuffers (github.com/google/flatbuffers)

v25.12.19+incompatible

Compare Source

v25.9.23+incompatible

Compare Source

klauspost/compress (github.com/klauspost/compress)

v1.18.5

Compare Source

What's Changed

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed
New Contributors

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

spf13/cobra (github.com/spf13/cobra)

v1.10.2

Compare Source

🔧 Dependencies

  • chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in #​2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

🔥✍🏼 Docs

🍂 Refactors

🤗 New Contributors

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

v1.10.1

Compare Source

🐛 Fix

v1.0.9 of pflags brought back ParseErrorsWhitelist and marked it as deprecated

Full Changelog: spf13/cobra@v1.10.0...v1.10.1

v1.10.0

Compare Source

What's Changed

🚨 Attention!

This version of pflag carried a breaking change: it renamed ParseErrorsWhitelist to ParseErrorsAllowlist which can break builds if both pflag and cobra are dependencies in your project.

  • If you use both pflag and cobra, upgrade pflagto 1.0.8 andcobrato1.10.0`
  • or use the newer, fixed version of pflag v1.0.9 which keeps the deprecated ParseErrorsWhitelist

More details can be found here: #​2303 (comment)

✨ Features
🐛 Fix
🪠 Testing
📝 Docs

New Contributors

Full Changelog: spf13/cobra@v1.9.1...v1.9.2

stretchr/testify (github.com/stretchr/testify)

v1.11.1

Compare Source

This release fixes #​1785 introduced in v1.11.0 where expected argument values implementing the stringer interface (String() string) with a method which mutates their value, when passed to mock.Mock.On (m.On("Method", <expected>).Return()) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case.

What's Changed

Full Changelog: stretchr/testify@v1.11.0...v1.11.1

v1.11.0

Compare Source

What's Changed

Functional Changes

v1.11.0 Includes a number of performance improvements.

Fixes
Documentation, Build & CI

New Contributors

Full Changelog: stretchr/testify@v1.10.0...v1.11.0

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.43.0: /v0.65.0/v0.19.0

Compare Source

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
    for W3C Trace Context Level 2 Random Trace ID Flag support. (#​8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#​7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#​8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
    Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#​8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#​7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#​8038)
  • Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#​8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#​8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#​8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
    make the implementation spec-compliant. (#​8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#​8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#​8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#​8096)

What's Changed


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner February 1, 2026 02:30
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Feb 1, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.23.0 -> 1.25.0
github.com/spf13/pflag v1.0.6 -> v1.0.9
go.opentelemetry.io/auto/sdk v1.1.0 -> v1.2.1
go.opentelemetry.io/otel/metric v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/sdk v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.37.0 -> v1.43.0

@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch 4 times, most recently from 6a1608f to b9ce655 Compare February 11, 2026 10:05
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch from b9ce655 to af6dbd5 Compare February 12, 2026 22:02
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch from af6dbd5 to 36c46d1 Compare February 26, 2026 15:17
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch 4 times, most recently from bcf867e to 5f60cc9 Compare March 9, 2026 22:40
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch 3 times, most recently from 09f1fcc to e655702 Compare March 27, 2026 20:50
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch 3 times, most recently from 4ea87b6 to 0328640 Compare April 10, 2026 08:54
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch 6 times, most recently from e42e2ac to 26f05c2 Compare April 19, 2026 20:29
@renovate renovate bot force-pushed the renovate/go-minor-and-patch branch from 26f05c2 to f31a390 Compare April 20, 2026 00:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant