Watch

fix(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] #52

Open

renovate-forgejo wants to merge 1 commit from renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability into main

renovate-forgejo commented

2026-09-22 08:09:25 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	`v1.44.0` → `v1.45.0`

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

CVE-2026-81870 / GHSA-8wmf-6v46-5gfg / GO-2026-6505

More information

Details

Summary

OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs.

The logged configuration can disclose the address of the trace collector and whether the OTLP/HTTP connection is configured as insecure. The Zipkin exporter logs its complete collector URL, so credentials in URL userinfo or tokens in the query string are also disclosed if an application embeds them there. OTLP authentication headers, TLS key material, and exported span data are not included in this log.

Exporter MarshalLog implementations that caused this configuration to be included in internal logs were introduced by a1fff3c.

Details

When sdk/trace.NewTracerProvider constructs a provider, it records a TracerProvider created internal Info event containing the provider configuration. In affected versions, the configuration's MarshalLog methods recursively include:

the provider's span processors;
each processor's span exporter; and
for the OTLP trace exporter, its client configuration.

This causes the following values to be present in the event:

OTLP trace gRPC: the configured endpoint;
OTLP trace HTTP: the configured endpoint and the Insecure flag; and
Zipkin: the complete collector URL.

OpenTelemetry Go does not emit this event with its default logger, which only emits errors. An application must explicitly configure a sufficiently verbose logger with otel.SetLogger. The required logr verbosity is version-dependent:

versions 1.5.0 through 1.14.x use V(1) for this Info event; and
versions 1.15.0 through 1.44.0 use V(4).

OTLP header configuration is not part of the marshaled object, so credentials supplied with WithHeaders or the corresponding environment variables are not exposed. The documented OTLP WithEndpoint input is a collector address rather than a credential-bearing URL. The higher-risk case is therefore the Zipkin collector URL, which is retained and logged in full, or an application passing sensitive data in an OTLP endpoint outside the documented format.

Proof of concept

The following program demonstrates the behavior with OpenTelemetry Go 1.44.0. It deliberately places credentials and a token in the Zipkin collector URL and enables internal Info logging:

package main

import (
	"bytes"
	"context"
	"fmt"

	"github.com/go-logr/logr/funcr"
	"go.opentelemetry.io/otel"
	"go.opentelemetry.io/otel/exporters/zipkin"
	sdktrace "go.opentelemetry.io/otel/sdk/trace"
)

func main() {
	var logs bytes.Buffer
	otel.SetLogger(funcr.New(func(_, args string) {
		_, _ = logs.WriteString(args)
	}, funcr.Options{Verbosity: 4}))

	exporter, err := zipkin.New(
		"http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret",
	)
	if err != nil {
		panic(err)
	}

	tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter))
	_ = tp.Shutdown(context.Background())

	fmt.Println(logs.String())
}

The TracerProvider created event contains:

http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret

For versions before 1.15.0, set funcr.Options{Verbosity: 1} instead.

Impact

This is a conditional disclosure through application logs. Affected applications must enable verbose OpenTelemetry internal diagnostics and configure a trace exporter containing information they do not intend to expose to readers of those logs. In that configuration, a person or system with log access can learn the trace collector address and internal network topology. If credentials or tokens are embedded directly in a Zipkin collector URL, those values can also be recovered from the logs.

There is no exposure with the default OpenTelemetry logger, and the vulnerable log is generated from local application configuration rather than remotely supplied span data. OTLP authentication headers, certificate or private-key contents, and telemetry payloads are not logged by this path.

Remediation

Upgrade the affected OpenTelemetry Go modules to version 1.45.0 or later. The fix in 3a1412d stops recursively marshaling exporter and client configuration and records their types instead.

If an immediate upgrade is not possible:

keep OpenTelemetry internal logging below the Info verbosity described above;
do not embed credentials or tokens in exporter endpoint URLs; use authentication headers or another supported credential mechanism; and
restrict access to existing logs and rotate any credentials that may already have been recorded.

Severity

CVSS Score: 2.0 / 10 (Low)
Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

CVE-2026-81870 / GHSA-8wmf-6v46-5gfg / GO-2026-6505

More information

Details

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp)

`v1.45.0`: /v0.67.0/v0.21.0/v0.0.18

Compare Source

Overview

Added

Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
Add the go.opentelemetry.io/otel/semconv/v1.42.0 package.
The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.
The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)
Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in go.opentelemetry.io/otel/attribute. (#8402)
Fix histogram data point reuse in go.opentelemetry.io/otel/sdk/metric aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#8403)
Avoid preallocating scope attributes when they are disabled in go.opentelemetry.io/otel/exporters/prometheus. (#8404)
Support HTTP-date values in the HTTP Retry-After header when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8417)
Reduce histogram heap allocations by reusing BucketCounts and Exemplars slices across Collect cycles in the cumulative histogram aggregation in go.opentelemetry.io/otel/sdk/metric. (#8428)
Fix go.opentelemetry.io/otel/exporters/stdout/stdouttrace self-observability to record error.type on the operation-duration histogram when the exportedSpans metric is disabled. (#8432)
Stop including trace exporter endpoint configuration in internal logs from go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. (#8438)
Fix invalid error formatting for out-of-range JSON code values in go.opentelemetry.io/otel/codes. (#8497)
Clarify in go.opentelemetry.io/otel/log that Logger.Enabled should be checked for every log emission because its result may change over time. (#8565)
Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in go.opentelemetry.io/otel/sdk/log. (#8566)
Make WithAttributeCountLimit(0) and OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0 discard all log record attributes in go.opentelemetry.io/otel/sdk/log. (#8570)
Clarify that the Record methods of Float64Histogram and Int64Histogram in go.opentelemetry.io/otel/metric expect non-negative values. (#8574)
Clarify in go.opentelemetry.io/otel/log that LoggerProvider implementations should retain an empty Logger name instead of replacing it with a default. (#8587)
Ensure that the built-in processors in go.opentelemetry.io/otel/sdk/log call exporter ForceFlush during Shutdown. (#8599)
Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem. (GHSA-42cj-99w8-cp2p)
Prevent processor operations in go.opentelemetry.io/otel/sdk/log from overlapping with processor shutdown or running after LoggerProvider shutdown. (#8608)
Prevent BatchProcessor in go.opentelemetry.io/otel/sdk/log from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#8620)
Make BatchProcessor in go.opentelemetry.io/otel/sdk/log return errors encountered while draining records during ForceFlush and Shutdown, while continuing to attempt later batches as long as the request context remains valid. (#8620)
Keep the default BatchProcessor maximum export batch size in go.opentelemetry.io/otel/sdk/log at or below the configured maximum queue size. (#8620)

What's Changed

fix(semconv): share metric option pools by @macayu17 in #8371
chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.1 by @renovate[bot] in #8381
chore(deps): update codspeedhq/action action to v4.17.0 by @renovate[bot] in #8388
chore(deps): update module github.com/rogpeppe/go-internal to v1.15.0 by @renovate[bot] in #8382
chore(deps): update module github.com/jgautheron/goconst to v1.10.2 by @renovate[bot] in #8380
chore(deps): update module github.com/mattn/go-runewidth to v0.0.24 by @renovate[bot] in #8394
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to bc171b2 by @renovate[bot] in #8405
chore(deps): update module github.com/securego/gosec/v2 to v2.27.0 by @renovate[bot] in #8406
fix(deps): update golang.org/x to c761662 by @renovate[bot] in #8384
chore(deps): update module github.com/butuzov/mirror to v1.3.3 by @renovate[bot] in #8390
chore(deps): update module github.com/securego/gosec/v2 to v2.27.1 by @renovate[bot] in #8413
fix(otlphttp): honor retry-after seconds by @AbhiPrasad in #8383
chore(deps): update module github.com/mattn/go-colorable to v0.1.15 by @renovate[bot] in #8391
fix(deps): update module github.com/prometheus/common to v0.68.0 by @renovate[bot] in #8395
chore(deps): update github.com/charmbracelet/ultraviolet digest to 6cf7526 by @renovate[bot] in #8408
docs: update AGENTS.md with CHANGELOG conventions by @dashpole in #8393
chore(deps): update github/codeql-action action to v4.36.1 by @renovate[bot] in #8416
chore(deps): update actions/checkout action to v6.0.3 by @renovate[bot] in #8418
chore(deps): update github.com/golangci/rowserrcheck digest to 0ec5bd2 by @renovate[bot] in #8419
sdk/metric/internal/x: generate x package from x component template by @Mentigen in #8397
chore(deps): update github/codeql-action action to v4.36.2 by @renovate[bot] in #8426
fix(deps): update module github.com/prometheus/common to v0.68.1 by @renovate[bot] in #8420
fix(deps): update golang.org/x by @renovate[bot] in #8421
chore(deps): update module github.com/ldez/gomoddirectives to v0.9.0 by @renovate[bot] in #8422
chore(deps): update module github.com/dlclark/regexp2/v2 to v2.1.2 by @renovate[bot] in #8429
chore(deps): update codecov/codecov-action action to v7 by @renovate[bot] in #8435
fix(deps): update golang.org/x by @renovate[bot] in #8437
chore(deps): update module github.com/dlclark/regexp2/v2 to v2.2.1 by @renovate[bot] in #8434
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.60.0 by @renovate[bot] in #8442
fix(deps): update googleapis to 4308a22 by @renovate[bot] in #8440
chore(deps): update golang.org/x by @renovate[bot] in #8439
chore(deps): update github.com/charmbracelet/ultraviolet digest to 35bcb73 by @renovate[bot] in #8436
fix(stdouttrace/observ): record error.type on opDuration when exportedSpans is disabled by @yumosx in #8432
sdk/trace: avoid logging exporter endpoint configuration by @pellared in #8438
Cleanup limitedSyncMap, and add tests by @dashpole in #8302
fix(otlphttp): support retry-after HTTP-date by @AbhiPrasad in #8417
Fix incorrect formatting verbs in opencensus bridge by @dashpole in #8424
fix: off-by-one bug for FixedSizeReservoir by @dashpole in #8309
sdk/metric: reuse cumulative-histogram Collect buffers to reduce heap usage by @sudowork in #8428
Fix memory leak in exemplar reservoir by storing SpanContext instead of Context by @dashpole in #8389
fix: clear stale histogram fields on datapoint reuse by @dashpole in #8403
prometheus: avoid preallocating scope attributes when disabled by @dashpole in #8404
Document that WithExemplarFilter(nil) is not supported by @dashpole in #8392
fix(deps): update googleapis to 7ab31c2 by @renovate[bot] in #8447
chore(deps): update golang.org/x to fb80ec8 by @renovate[bot] in #8444
chore(deps): update golang.org/x to v0.56.0 by @renovate[bot] in #8448
Add WithUnsafeAttributes to support no-copy dynamic metric API calls by @dashpole in #8251
fix(attribute): prevent zero-hash collapse to empty set by @dashpole in #8402
chore(deps): update codspeedhq/action action to v4.17.5 by @renovate[bot] in #8452
attribute: add MAP type support by @pellared in #8445
fix(deps): update golang.org/x by @renovate[bot] in #8451
chore(deps): update module charm.land/lipgloss/v2 to v2.0.4 by @renovate[bot] in #8455
chore(deps): update github.com/charmbracelet/ultraviolet digest to 2399af7 by @renovate[bot] in #8460
chore(deps): update golang.org/x to 72dfd24 by @renovate[bot] in #8462
fix(deps): update googleapis to 62b3387 by @renovate[bot] in #8463
sdk/trace: apply AttributeValueLengthLimit to attribute.MAP by @pellared in #8454
exporters: support MAP attributes by @pellared in #8453
chore(deps): update module github.com/dlclark/regexp2/v2 to v2.2.2 by @renovate[bot] in #8464
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.0 by @renovate[bot] in #8470
chore(deps): update module github.com/alecthomas/chroma/v2 to v2.27.0 by @renovate[bot] in #8469
fix(deps): update module github.com/prometheus/common to v0.69.0 by @renovate[bot] in #8472
chore(deps): update module github.com/firefart/nonamedreturns to v1.0.7 by @renovate[bot] in #8467
chore(deps): update golang.org/x to 4de325e by @renovate[bot] in #8466
Exporter code cleanup by @ash2k in #8457
[chore] add CNCF Slack join instructions by @cijothomas in #8456
chore(deps): update golang.org/x to 9b6dc03 by @renovate[bot] in #8474
fix(deps): update golang.org/x to v1.4.0 by @renovate[bot] in #8478
sdk: deduplicate MAP attribute keys by @pellared in #8471
attribute: inline hashing for small SLICE and MAP values by @Dipanshusinghh in #8476
attribute: test map equivalence with duplicate keys by @pellared in #8473
fix(deps): update googleapis to 87f3d3e by @renovate[bot] in #8483
chore(deps): update module github.com/cyphar/filepath-securejoin to v0.7.0 by @renovate[bot] in #8486
chore(deps): update golang.org/x to a6991f1 by @renovate[bot] in #8482
chore(deps): update actions/checkout action to v7 by @renovate[bot] in #8487
chore(deps): update codspeedhq/action action to v4.17.6 by @renovate[bot] in #8485
chore(deps): update golang.org/x to e028bae by @renovate[bot] in #8493
Generate and upgrade to semconv/v1.42.0 by @MrAlias in #8484
chore(deps): update otel/weaver docker tag to v0.24.1 by @renovate[bot] in #8494
chore(deps): update github.com/charmbracelet/ultraviolet digest to f39628c by @renovate[bot] in #8498
chore(deps): update module github.com/cloudflare/circl to v1.6.4 by @renovate[bot] in #8500
fix(deps): update googleapis to b703f56 by @renovate[bot] in #8502
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.1 by @renovate[bot] in #8503
log: use attribute values for records by @pellared in #8490
codes: fix invalid code format string by @HNO3Miracle in #8497
chore(deps): update module github.com/rogpeppe/go-internal to v1.15.0 by @renovate[bot] in #8505
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.61.0 by @renovate[bot] in #8506
chore(deps): update actions/cache action to v6 by @renovate[bot] in #8507
chore(deps): update golang.org/x by @renovate[bot] in #8508
chore(deps): update otel/weaver docker tag to v0.24.2 by @renovate[bot] in #8509
Fix/makefile go version by @Vatsal-Chaudhary in #8496
chore(deps): update actions/setup-go action to v6.5.0 by @renovate[bot] in #8516
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.2 by @renovate[bot] in #8513
attribute: improve attribute types GoDoc by @pellared in #8489
otlpmetricgrpc: avoid DNS in self-observability test by @JuvenR in #8514
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to c961bd5 by @renovate[bot] in #8512
chore(deps): update module github.com/go-critic/go-critic to v0.14.4 by @renovate[bot] in #8519
chore(deps): update golang.org/x/telemetry digest to 59b4966 by @renovate[bot] in #8520
fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.4 by @renovate[bot] in #8515
fix(deps): update golang.org/x by @renovate[bot] in #8521
chore(deps): update codspeedhq/action action to v4.18.1 by @renovate[bot] in #8517
chore(deps): update module go.augendre.info/fatcontext to v0.10.0 by @renovate[bot] in #8524
chore(deps): update golang.org/x/telemetry digest to b709645 by @renovate[bot] in #8523
chore(deps): update actions/cache action to v6.1.0 by @renovate[bot] in #8525
gotmpl: update headers to enable golangci-lint on generated files by @Dipanshusinghh in #8481
chore(deps): update module github.com/prometheus/procfs to v0.21.0 by @renovate[bot] in #8526
attribute: skip reflection for short slices in hashValue by @lavish-gambhir in #8511
chore(deps): update module github.com/klauspost/cpuid/v2 to v2.4.0 by @renovate[bot] in #8529
chore(deps): update module github.com/prometheus/procfs to v0.21.1 by @renovate[bot] in #8528
fix(deps): update module google.golang.org/grpc to v1.82.0 by @renovate[bot] in #8530
fix(deps): update googleapis to 925bb5d by @renovate[bot] in #8533
chore: Move inactive members to emeritus by @opentelemetrybot in #8398
chore(deps): update github.com/golangci/rowserrcheck digest to 399602f by @renovate[bot] in #8539
chore(deps): update fossas/fossa-action action to v2 by @renovate[bot] in #8558
chore(deps): update github/codeql-action action to v4.36.3 by @renovate[bot] in #8557
chore(deps): update module github.com/firefart/nonamedreturns to v1.0.8 by @renovate[bot] in #8559
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.3 by @renovate[bot] in #8563
chore(deps): update module charm.land/lipgloss/v2 to v2.0.5 by @renovate[bot] in #8562
chore(deps): update github.com/charmbracelet/ultraviolet digest to f5a850f by @renovate[bot] in #8561
fix(otlptracehttp,otlpmetrichttp): do not append default signal path by @basti1302 in #8538
fix(deps): update googleapis to f0a9213 by @renovate[bot] in #8567
log: clarify Logger.Enabled guidance by @pellared in #8565
chore(deps): update module golang.org/x/text to v0.39.0 by @renovate[bot] in #8568
chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.62.0 by @renovate[bot] in #8569
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.62.0 by @renovate[bot] in #8572
chore(deps): update codspeedhq/action action to v4.18.2 by @renovate[bot] in #8571
sdk/log/logtest: remove attribute limit fields from RecordFactory by @pellared in #8556
sdk/log: honor zero attribute count limit by @pellared in #8570
fix(deps): update golang.org/x by @renovate[bot] in #8577
chore(deps): update github/codeql-action action to v4.37.0 by @renovate[bot] in #8576
Clarify that Histogram's Record method expect non-negative values by @psx95 in #8574
chore(deps): update golang.org/x by @renovate[bot] in #8579
chore(deps): update codspeedhq/action action to v4.18.4 by @renovate[bot] in #8580
sdk/log: derive missing exception attributes by @pellared in #8566
chore(deps): update lycheeverse/lychee-action action to v2.9.0 by @renovate[bot] in #8589
sdk/trace: add WithoutPanicRecording provider option by @pellared in #8532
chore(deps): update codspeedhq/action action to v4.18.5 by @renovate[bot] in #8590
log: clarify EventName uniqueness guidance by @pellared in #8586
sdk/log: document duplicate key receiver behavior by @pellared in #8588
chore(deps): update actions/stale action to v10.4.0 by @renovate[bot] in #8593
fix(deps): update module github.com/prometheus/common to v0.70.0 by @renovate[bot] in #8594
log: clarify empty Logger name handling by @pellared in #8587
chore(deps): update github.com/charmbracelet/ultraviolet digest to 4bee191 by @renovate[bot] in #8597
chore(deps): update module github.com/dlclark/regexp2/v2 to v2.5.0 by @renovate[bot] in #8596
ci: run bare metal benchmarks in a container by @trask in #8575
chore(deps): update ubuntu:24.04 docker digest to 4fbb8e6 by @renovate[bot] in #8600
fix(deps): update googleapis by @renovate[bot] in #8602
chore(deps): update ubuntu docker tag to v26 by @renovate[bot] in #8601
chore(deps): update google.golang.org/genproto/googleapis/api digest to 142c488 by @renovate[bot] in #8603
fix(deps): update googleapis to f5fc221 by @renovate[bot] in #8604
Remove vanity import tooling by @MrAlias in #8609
chore(deps): update module github.com/securego/gosec/v2 to v2.28.0 by @renovate[bot] in #8605
chore(deps): update dependency codespell to v2.4.3 by @renovate[bot] in #8612
chore(deps): update ubuntu:26.04 docker digest to 651ba3f by @renovate[bot] in #8616
fix(deps): update module google.golang.org/grpc to v1.82.1 by @renovate[bot] in #8615
chore(deps): update actions/setup-go action to v7 by @renovate[bot] in #8617
chore(deps): update github/codeql-action action to v4.37.1 by @renovate[bot] in #8621
chore(deps): update golang.org/x/telemetry digest to dad6939 by @renovate[bot] in #8582
chore(deps): update module github.com/dlclark/regexp2/v2 to v2.5.1 by @renovate[bot] in #8625
chore(deps): update module github.com/mattn/go-isatty to v0.0.23 by @renovate[bot] in #8619
fix(deps): update googleapis to e75dac1 by @renovate[bot] in #8614
chore(deps): update golang.org/x/telemetry digest to bdb8988 by @renovate[bot] in #8627
chore(deps): update ubuntu:26.04 docker digest to 3131b4c by @renovate[bot] in #8624
chore(deps): update module github.com/nunnatsa/ginkgolinter to v0.23.1 by @renovate[bot] in #8638
chore(deps): update module github.com/dlclark/regexp2/v2 to v2.5.2 by @renovate[bot] in #8636
chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.63.0 by @renovate[bot] in #8645
Fix benchmark ci after using the container environment by @XSAM in #8635
fix(deps): update module github.com/prometheus/common to v0.70.1 by @renovate[bot] in #8650
chore(deps): update github.com/charmbracelet/ultraviolet digest to 7cc6674 by @renovate[bot] in #8637
fix(deps): update golang.org/x/exp digest to 764159d by @renovate[bot] in #8633
fix(deps): update googleapis to 0afa2a6 by @renovate[bot] in #8639
chore(deps): update actions/checkout action to v7.0.1 by @renovate[bot] in #8640
chore(deps): update github/codeql-action action to v4.37.3 by @renovate[bot] in #8644
fix(deps): update module github.com/prometheus/client_golang to v1.24.0 by @renovate[bot] in #8641
Generate and upgrade to semconv/v1.43.0 by @osullivandonal in #8628
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.63.0 by @renovate[bot] in #8646
chore(deps): update ubuntu docker tag to v26 by @renovate[bot] in #8647
feat: use time-unbiased algorithm for histogram reservoir by @dashpole in #8306
sdk/log: include ForceFlush in built-in processor Shutdown by @pellared in #8599
sdk/log: self observability: batch log processor metrics by @mahendrabishnoi2 in #7124
fix(deps): update module go.opentelemetry.io/proto/otlp to v1.11.0 by @renovate[bot] in #8651
chore(deps): update github.com/timakin/bodyclose digest to 857993a by @renovate[bot] in #8652
fix(deps): update googleapis to 7274b71 by @renovate[bot] in #8655
fix(changelog): update self-observability environment variable to OTEL_GO_X_OBSERVABILITY by @pellared in #8618
sdk: consolidate attribute normalization in attrnorm by @pellared in #8611
chore(deps): update module github.com/mattn/go-isatty to v0.0.24 by @renovate[bot] in #8656
chore(deps): update ossf/scorecard-action action to v2.4.4 by @renovate[bot] in #8658
fix(deps): update module github.com/go-logr/logr to v1.4.4 by @renovate[bot] in #8642
fix(deps): update googleapis to 3fe39f3 by @renovate[bot] in #8659
chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.1 by @renovate[bot] in #8662
fix(deps): update module github.com/prometheus/client_golang to v1.24.1 by @renovate[bot] in #8661
chore(deps): update module github.com/mattn/go-runewidth to v0.0.27 by @renovate[bot] in #8660
sdk/log: prevent BatchProcessor busy-spin by @pellared in #8620
chore(deps): update otel/weaver docker tag to v0.25.0 by @renovate[bot] in #8664
fix(deps): update googleapis to b2f2020 by @renovate[bot] in #8663
chore(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by @renovate[bot] in #8665
chore(deps): update codspeedhq/action action to v4.19.1 by @renovate[bot] in #8666
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 064b4d2 by @renovate[bot] in #8670
fix(deps): update golang.org/x to b88d891 by @renovate[bot] in #8668
fix(deps): update googleapis to 6c54ddd by @renovate[bot] in #8669
chore(deps): update module mvdan.cc/gofumpt to v0.11.0 by @renovate[bot] in #8667
chore(deps): update otel/weaver docker tag to v0.25.1 by @renovate[bot] in #8673
fix(deps): update googleapis to 8efbd57 by @renovate[bot] in #8676
chore(deps): update actions/stale action to v11 by @renovate[bot] in #8671
chore(deps): update module github.com/go-git/go-git/v5 to v5.19.2 by @renovate[bot] in #8674
chore(deps): update codspeedhq/action action to v5 by @renovate[bot] in #8675
chore(deps): update module github.com/jgautheron/goconst to v1.11.0 by @renovate[bot] in #8677
chore(deps): update github/codeql-action action to v4.37.4 by @renovate[bot] in #8680
chore(deps): update github.com/charmbracelet/ultraviolet digest to 19049f2 by @renovate[bot] in #8678
fix(deps): update module google.golang.org/grpc to v1.83.0 by @renovate[bot] in #8679
sdk/log: prevent processor calls after provider shutdown by @pellared in #8608
tests: fix semconvkit temp module setup by @RedZapdos123 in #8682
chore(deps): update github/codeql-action action to v4.37.5 by @renovate[bot] in #8692
chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 by @renovate[bot] in #8687
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 by @renovate[bot] in #8689
chore(deps): update codspeedhq/action action to v5.0.2 by @renovate[bot] in #8690
chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 by @renovate[bot] in #8691
fix(deps): update googleapis to 6ac0973 by @renovate[bot] in #8694
sdk/metric: remove obsolete randomFloat64 TODO by @Mujib-Ahasan in #8685
Release v1.45.0 by @MrAlias in #8693

New Contributors

@macayu17 made their first contribution in #8371
@AbhiPrasad made their first contribution in #8383
@Mentigen made their first contribution in #8397
@sudowork made their first contribution in #8428
@HNO3Miracle made their first contribution in #8497
@Vatsal-Chaudhary made their first contribution in #8496
@JuvenR made their first contribution in #8514
@lavish-gambhir made their first contribution in #8511
@osullivandonal made their first contribution in #8628
@RedZapdos123 made their first contribution in #8682
@Mujib-Ahasan made their first contribution in #8685

Full Changelog: https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `v1.44.0` → `v1.45.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel%2fexporters%2fotlp%2fotlptrace%2fotlptracehttp/v1.45.0?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/go/go.opentelemetry.io%2fotel%2fexporters%2fotlp%2fotlptrace%2fotlptracehttp/v1.45.0?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/go/go.opentelemetry.io%2fotel%2fexporters%2fotlp%2fotlptrace%2fotlptracehttp/v1.44.0/v1.45.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel%2fexporters%2fotlp%2fotlptrace%2fotlptracehttp/v1.44.0/v1.45.0?slim=true) | --- ### OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) / [GHSA-8wmf-6v46-5gfg](https://github.com/advisories/GHSA-8wmf-6v46-5gfg) / [GO-2026-6505](https://pkg.go.dev/vuln/GO-2026-6505) <details> <summary>More information</summary> #### Details ##### Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK `TracerProvider` is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs. The logged configuration can disclose the address of the trace collector and whether the OTLP/HTTP connection is configured as insecure. The Zipkin exporter logs its complete collector URL, so credentials in URL userinfo or tokens in the query string are also disclosed if an application embeds them there. OTLP authentication headers, TLS key material, and exported span data are not included in this log. Exporter `MarshalLog` implementations that caused this configuration to be included in internal logs were introduced by [`a1fff3c`](https://github.com/open-telemetry/opentelemetry-go/commit/a1fff3c2588c783d1f3f6fd2315aa2660fc6d330). ##### Details When `sdk/trace.NewTracerProvider` constructs a provider, it records a `TracerProvider created` internal Info event containing the provider configuration. In affected versions, the configuration's `MarshalLog` methods recursively include: 1. the provider's span processors; 2. each processor's span exporter; and 3. for the OTLP trace exporter, its client configuration. This causes the following values to be present in the event: - OTLP trace gRPC: the configured endpoint; - OTLP trace HTTP: the configured endpoint and the `Insecure` flag; and - Zipkin: the complete collector URL. OpenTelemetry Go does not emit this event with its default logger, which only emits errors. An application must explicitly configure a sufficiently verbose logger with `otel.SetLogger`. The required `logr` verbosity is version-dependent: - versions 1.5.0 through 1.14.x use `V(1)` for this Info event; and - versions 1.15.0 through 1.44.0 use `V(4)`. OTLP header configuration is not part of the marshaled object, so credentials supplied with `WithHeaders` or the corresponding environment variables are not exposed. The documented OTLP `WithEndpoint` input is a collector address rather than a credential-bearing URL. The higher-risk case is therefore the Zipkin collector URL, which is retained and logged in full, or an application passing sensitive data in an OTLP endpoint outside the documented format. ##### Proof of concept The following program demonstrates the behavior with OpenTelemetry Go 1.44.0. It deliberately places credentials and a token in the Zipkin collector URL and enables internal Info logging: ```go package main import ( "bytes" "context" "fmt" "github.com/go-logr/logr/funcr" "go.opentelemetry.io/otel" "go.opentelemetry.io/otel/exporters/zipkin" sdktrace "go.opentelemetry.io/otel/sdk/trace" ) func main() { var logs bytes.Buffer otel.SetLogger(funcr.New(func(_, args string) { _, _ = logs.WriteString(args) }, funcr.Options{Verbosity: 4})) exporter, err := zipkin.New( "http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret", ) if err != nil { panic(err) } tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter)) _ = tp.Shutdown(context.Background()) fmt.Println(logs.String()) } ``` The `TracerProvider created` event contains: ```text http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret ``` For versions before 1.15.0, set `funcr.Options{Verbosity: 1}` instead. ##### Impact This is a conditional disclosure through application logs. Affected applications must enable verbose OpenTelemetry internal diagnostics and configure a trace exporter containing information they do not intend to expose to readers of those logs. In that configuration, a person or system with log access can learn the trace collector address and internal network topology. If credentials or tokens are embedded directly in a Zipkin collector URL, those values can also be recovered from the logs. There is no exposure with the default OpenTelemetry logger, and the vulnerable log is generated from local application configuration rather than remotely supplied span data. OTLP authentication headers, certificate or private-key contents, and telemetry payloads are not logged by this path. ##### Remediation Upgrade the affected OpenTelemetry Go modules to version 1.45.0 or later. The fix in [`3a1412d`](https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38) stops recursively marshaling exporter and client configuration and records their types instead. If an immediate upgrade is not possible: - keep OpenTelemetry internal logging below the Info verbosity described above; - do not embed credentials or tokens in exporter endpoint URLs; use authentication headers or another supported credential mechanism; and - restrict access to existing logs and rotate any credentials that may already have been recorded. #### Severity - CVSS Score: 2.0 / 10 (Low) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [https://github.com/open-telemetry/opentelemetry-go/pull/8438](https://github.com/open-telemetry/opentelemetry-go/pull/8438) - [https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38](https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38) - [https://github.com/open-telemetry/opentelemetry-go](https://github.com/open-telemetry/opentelemetry-go) - [https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0](https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0) - [https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0](https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8wmf-6v46-5gfg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) / [GHSA-8wmf-6v46-5gfg](https://github.com/advisories/GHSA-8wmf-6v46-5gfg) / [GO-2026-6505](https://pkg.go.dev/vuln/GO-2026-6505) <details> <summary>More information</summary> #### Details OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace #### Severity Unknown #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38](https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38) - [https://github.com/open-telemetry/opentelemetry-go/pull/8438](https://github.com/open-telemetry/opentelemetry-go/pull/8438) - [https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0](https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0) - [https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0](https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6505) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp)</summary> ### [`v1.45.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0): /v0.67.0/v0.21.0/v0.0.18 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0) #### Overview ##### Added - Add experimental observability metrics to `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log`. ([#7124](https://github.com/open-telemetry/opentelemetry-go/issues/7124)) - Add the experimental `WithUnsafeAttributes` no-copy attribute option to `go.opentelemetry.io/otel/metric/x` for future performance improvements. This API is a work in progress. ([#8251](https://github.com/open-telemetry/opentelemetry-go/issues/8251)) - Add `Map` and `MapValue` functions for the new `MAP` attribute type in `go.opentelemetry.io/otel/attribute`. ([#8445](https://github.com/open-telemetry/opentelemetry-go/issues/8445)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Apply `AttributeValueLengthLimit` recursively to values contained in `attribute.MAP` attributes in `go.opentelemetry.io/otel/sdk/trace`. ([#8454](https://github.com/open-telemetry/opentelemetry-go/issues/8454)) - Remove duplicate keys from `attribute.MAP` values in `go.opentelemetry.io/otel/sdk/resource` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Remove duplicate keys by default from `attribute.MAP` values in instrumentation scope attributes in `go.opentelemetry.io/otel/sdk/log` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Remove duplicate keys by default from `attribute.MAP` values in span, event, link, and instrumentation scope attributes in `go.opentelemetry.io/otel/sdk/trace` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Remove duplicate keys by default from `attribute.MAP` values in measurement and instrumentation scope attributes in `go.opentelemetry.io/otel/sdk/metric` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Extend `WithAllowKeyDuplication` in `go.opentelemetry.io/otel/sdk/log` to disable duplicate-key removal in `attribute.MAP` values for instrumentation scope attributes. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Add the `go.opentelemetry.io/otel/semconv/v1.42.0` package. The package contains semantic conventions from the `v1.42.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.42.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#8484](https://github.com/open-telemetry/opentelemetry-go/issues/8484)) - Add `WithoutPanicRecording` as a `TracerProviderOption` in `go.opentelemetry.io/otel/sdk/trace` to disable exception event recording for panics. ([#8532](https://github.com/open-telemetry/opentelemetry-go/issues/8532)) - Add the `go.opentelemetry.io/otel/semconv/v1.43.0` package. The package contains semantic conventions from the `v1.43.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.43.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.42.0`. ([#8628](https://github.com/open-telemetry/opentelemetry-go/issues/8628)) ##### Changed - `HistogramReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` now uses a time-unbiased sampling algorithm for exemplars. ([#8306](https://github.com/open-telemetry/opentelemetry-go/issues/8306)) - ⚠️ **Breaking Change:** Use `go.opentelemetry.io/otel/attribute.Value` and `go.opentelemetry.io/otel/attribute.KeyValue` for log bodies and attributes in `go.opentelemetry.io/otel/log`, `go.opentelemetry.io/otel/log/logtest`, `go.opentelemetry.io/otel/sdk/log`, and `go.opentelemetry.io/otel/sdk/log/logtest`. ([#8490](https://github.com/open-telemetry/opentelemetry-go/issues/8490)) - Encode log bodies and attributes as `go.opentelemetry.io/otel/attribute.Value` JSON in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. ([#8490](https://github.com/open-telemetry/opentelemetry-go/issues/8490)) - Improve the performance of hashing `BOOLSLICE`, `INT64SLICE`, `FLOAT64SLICE`, and `STRINGSLICE` attribute values by avoiding reflection for short slices in `go.opentelemetry.io/otel/attribute`. ([#8511](https://github.com/open-telemetry/opentelemetry-go/issues/8511)) - ⚠️ **Breaking Change:** `WithEndpointURL` in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` and with setting the endpoint through `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`. If the URL has no path component, the root path (`/`) is used. Use `WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics"))` to preserve the previous behavior. ([#8538](https://github.com/open-telemetry/opentelemetry-go/issues/8538)) - ⚠️ **Breaking Change:** `WithEndpointURL` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` and with setting the endpoint through `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`. If the URL has no path component, the root path (`/`) is used. Use `WithEndpointURL(url.JoinPath(endpoint, "/v1/traces"))` to preserve the previous behavior. ([#8538](https://github.com/open-telemetry/opentelemetry-go/issues/8538)) ##### Deprecated - Deprecate `WithExportBufferSize` in `go.opentelemetry.io/otel/sdk/log`. The option remains available for source compatibility but no longer affects behavior; `BatchProcessor` no longer maintains a separate export-request buffer. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) ##### Removed - ⚠️ **Breaking Change:** Remove `Kind`, `Value`, `KeyValue`, their constructors, and attribute conversion helpers from `go.opentelemetry.io/otel/log`. ([#8490](https://github.com/open-telemetry/opentelemetry-go/issues/8490)) - ⚠️ **Breaking Change:** Remove the `AttributeValueLengthLimit` and `AttributeCountLimit` fields from `RecordFactory` in `go.opentelemetry.io/otel/sdk/log/logtest`; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. ([#8556](https://github.com/open-telemetry/opentelemetry-go/issues/8556)) ##### Fixed - Apply TLS certificates configured through environment variables to gRPC connections in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. - Prevent panics in `go.opentelemetry.io/otel/bridge/opentracing` when OpenTracing baggage is propagated concurrently with `Span.SetBaggageItem`. - Fix an off-by-one error in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` that prevented the first exemplar from being sampled after the reservoir was filled. ([#8309](https://github.com/open-telemetry/opentelemetry-go/issues/8309)) - Interpret HTTP `Retry-After` header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8383](https://github.com/open-telemetry/opentelemetry-go/issues/8383)) - Fix a memory leak in the `Reservoir` implementation in `go.opentelemetry.io/otel/sdk/metric/exemplar`, where storing the full `context.Context` pinned large objects such as gRPC transport buffers. ([#8389](https://github.com/open-telemetry/opentelemetry-go/issues/8389)) - Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in `go.opentelemetry.io/otel/attribute`. ([#8402](https://github.com/open-telemetry/opentelemetry-go/issues/8402)) - Fix histogram data point reuse in `go.opentelemetry.io/otel/sdk/metric` aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. ([#8403](https://github.com/open-telemetry/opentelemetry-go/issues/8403)) - Avoid preallocating scope attributes when they are disabled in `go.opentelemetry.io/otel/exporters/prometheus`. ([#8404](https://github.com/open-telemetry/opentelemetry-go/issues/8404)) - Support HTTP-date values in the HTTP `Retry-After` header when retrying OTLP HTTP exports in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8417](https://github.com/open-telemetry/opentelemetry-go/issues/8417)) - Reduce histogram heap allocations by reusing `BucketCounts` and `Exemplars` slices across `Collect` cycles in the cumulative histogram aggregation in `go.opentelemetry.io/otel/sdk/metric`. ([#8428](https://github.com/open-telemetry/opentelemetry-go/issues/8428)) - Fix `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` self-observability to record `error.type` on the operation-duration histogram when the `exportedSpans` metric is disabled. ([#8432](https://github.com/open-telemetry/opentelemetry-go/issues/8432)) - Stop including trace exporter endpoint configuration in internal logs from `go.opentelemetry.io/otel/sdk/trace`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, and `go.opentelemetry.io/otel/exporters/zipkin`. ([#8438](https://github.com/open-telemetry/opentelemetry-go/issues/8438)) - Fix invalid error formatting for out-of-range JSON code values in `go.opentelemetry.io/otel/codes`. ([#8497](https://github.com/open-telemetry/opentelemetry-go/issues/8497)) - Clarify in `go.opentelemetry.io/otel/log` that `Logger.Enabled` should be checked for every log emission because its result may change over time. ([#8565](https://github.com/open-telemetry/opentelemetry-go/issues/8565)) - Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in `go.opentelemetry.io/otel/sdk/log`. ([#8566](https://github.com/open-telemetry/opentelemetry-go/issues/8566)) - Make `WithAttributeCountLimit(0)` and `OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0` discard all log record attributes in `go.opentelemetry.io/otel/sdk/log`. ([#8570](https://github.com/open-telemetry/opentelemetry-go/issues/8570)) - Clarify that the `Record` methods of `Float64Histogram` and `Int64Histogram` in `go.opentelemetry.io/otel/metric` expect non-negative values. ([#8574](https://github.com/open-telemetry/opentelemetry-go/issues/8574)) - Clarify in `go.opentelemetry.io/otel/log` that `LoggerProvider` implementations should retain an empty `Logger` name instead of replacing it with a default. ([#8587](https://github.com/open-telemetry/opentelemetry-go/issues/8587)) - Ensure that the built-in processors in `go.opentelemetry.io/otel/sdk/log` call exporter `ForceFlush` during `Shutdown`. ([#8599](https://github.com/open-telemetry/opentelemetry-go/issues/8599)) - Prevent panics in `go.opentelemetry.io/otel/bridge/opentracing` when OpenTracing baggage is propagated concurrently with `Span.SetBaggageItem`. ([GHSA-42cj-99w8-cp2p](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p)) - Prevent processor operations in `go.opentelemetry.io/otel/sdk/log` from overlapping with processor shutdown or running after `LoggerProvider` shutdown. ([#8608](https://github.com/open-telemetry/opentelemetry-go/issues/8608)) - Prevent `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log` from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) - Make `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log` return errors encountered while draining records during `ForceFlush` and `Shutdown`, while continuing to attempt later batches as long as the request context remains valid. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) - Keep the default `BatchProcessor` maximum export batch size in `go.opentelemetry.io/otel/sdk/log` at or below the configured maximum queue size. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) #### What's Changed - fix(semconv): share metric option pools by [@macayu17](https://github.com/macayu17) in [#8371](https://github.com/open-telemetry/opentelemetry-go/pull/8371) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.1 by [@renovate](https://github.com/renovate)\[bot] in [#8381](https://github.com/open-telemetry/opentelemetry-go/pull/8381) - chore(deps): update codspeedhq/action action to v4.17.0 by [@renovate](https://github.com/renovate)\[bot] in [#8388](https://github.com/open-telemetry/opentelemetry-go/pull/8388) - chore(deps): update module github.com/rogpeppe/go-internal to v1.15.0 by [@renovate](https://github.com/renovate)\[bot] in [#8382](https://github.com/open-telemetry/opentelemetry-go/pull/8382) - chore(deps): update module github.com/jgautheron/goconst to v1.10.2 by [@renovate](https://github.com/renovate)\[bot] in [#8380](https://github.com/open-telemetry/opentelemetry-go/pull/8380) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.24 by [@renovate](https://github.com/renovate)\[bot] in [#8394](https://github.com/open-telemetry/opentelemetry-go/pull/8394) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`bc171b2`](https://github.com/open-telemetry/opentelemetry-go/commit/bc171b2) by [@renovate](https://github.com/renovate)\[bot] in [#8405](https://github.com/open-telemetry/opentelemetry-go/pull/8405) - chore(deps): update module github.com/securego/gosec/v2 to v2.27.0 by [@renovate](https://github.com/renovate)\[bot] in [#8406](https://github.com/open-telemetry/opentelemetry-go/pull/8406) - fix(deps): update golang.org/x to [`c761662`](https://github.com/open-telemetry/opentelemetry-go/commit/c761662) by [@renovate](https://github.com/renovate)\[bot] in [#8384](https://github.com/open-telemetry/opentelemetry-go/pull/8384) - chore(deps): update module github.com/butuzov/mirror to v1.3.3 by [@renovate](https://github.com/renovate)\[bot] in [#8390](https://github.com/open-telemetry/opentelemetry-go/pull/8390) - chore(deps): update module github.com/securego/gosec/v2 to v2.27.1 by [@renovate](https://github.com/renovate)\[bot] in [#8413](https://github.com/open-telemetry/opentelemetry-go/pull/8413) - fix(otlphttp): honor retry-after seconds by [@AbhiPrasad](https://github.com/AbhiPrasad) in [#8383](https://github.com/open-telemetry/opentelemetry-go/pull/8383) - chore(deps): update module github.com/mattn/go-colorable to v0.1.15 by [@renovate](https://github.com/renovate)\[bot] in [#8391](https://github.com/open-telemetry/opentelemetry-go/pull/8391) - fix(deps): update module github.com/prometheus/common to v0.68.0 by [@renovate](https://github.com/renovate)\[bot] in [#8395](https://github.com/open-telemetry/opentelemetry-go/pull/8395) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6cf7526`](https://github.com/open-telemetry/opentelemetry-go/commit/6cf7526) by [@renovate](https://github.com/renovate)\[bot] in [#8408](https://github.com/open-telemetry/opentelemetry-go/pull/8408) - docs: update AGENTS.md with CHANGELOG conventions by [@dashpole](https://github.com/dashpole) in [#8393](https://github.com/open-telemetry/opentelemetry-go/pull/8393) - chore(deps): update github/codeql-action action to v4.36.1 by [@renovate](https://github.com/renovate)\[bot] in [#8416](https://github.com/open-telemetry/opentelemetry-go/pull/8416) - chore(deps): update actions/checkout action to v6.0.3 by [@renovate](https://github.com/renovate)\[bot] in [#8418](https://github.com/open-telemetry/opentelemetry-go/pull/8418) - chore(deps): update github.com/golangci/rowserrcheck digest to [`0ec5bd2`](https://github.com/open-telemetry/opentelemetry-go/commit/0ec5bd2) by [@renovate](https://github.com/renovate)\[bot] in [#8419](https://github.com/open-telemetry/opentelemetry-go/pull/8419) - sdk/metric/internal/x: generate x package from x component template by [@Mentigen](https://github.com/Mentigen) in [#8397](https://github.com/open-telemetry/opentelemetry-go/pull/8397) - chore(deps): update github/codeql-action action to v4.36.2 by [@renovate](https://github.com/renovate)\[bot] in [#8426](https://github.com/open-telemetry/opentelemetry-go/pull/8426) - fix(deps): update module github.com/prometheus/common to v0.68.1 by [@renovate](https://github.com/renovate)\[bot] in [#8420](https://github.com/open-telemetry/opentelemetry-go/pull/8420) - fix(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8421](https://github.com/open-telemetry/opentelemetry-go/pull/8421) - chore(deps): update module github.com/ldez/gomoddirectives to v0.9.0 by [@renovate](https://github.com/renovate)\[bot] in [#8422](https://github.com/open-telemetry/opentelemetry-go/pull/8422) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.1.2 by [@renovate](https://github.com/renovate)\[bot] in [#8429](https://github.com/open-telemetry/opentelemetry-go/pull/8429) - chore(deps): update codecov/codecov-action action to v7 by [@renovate](https://github.com/renovate)\[bot] in [#8435](https://github.com/open-telemetry/opentelemetry-go/pull/8435) - fix(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8437](https://github.com/open-telemetry/opentelemetry-go/pull/8437) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.2.1 by [@renovate](https://github.com/renovate)\[bot] in [#8434](https://github.com/open-telemetry/opentelemetry-go/pull/8434) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.60.0 by [@renovate](https://github.com/renovate)\[bot] in [#8442](https://github.com/open-telemetry/opentelemetry-go/pull/8442) - fix(deps): update googleapis to [`4308a22`](https://github.com/open-telemetry/opentelemetry-go/commit/4308a22) by [@renovate](https://github.com/renovate)\[bot] in [#8440](https://github.com/open-telemetry/opentelemetry-go/pull/8440) - chore(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8439](https://github.com/open-telemetry/opentelemetry-go/pull/8439) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`35bcb73`](https://github.com/open-telemetry/opentelemetry-go/commit/35bcb73) by [@renovate](https://github.com/renovate)\[bot] in [#8436](https://github.com/open-telemetry/opentelemetry-go/pull/8436) - fix(stdouttrace/observ): record error.type on opDuration when exportedSpans is disabled by [@yumosx](https://github.com/yumosx) in [#8432](https://github.com/open-telemetry/opentelemetry-go/pull/8432) - sdk/trace: avoid logging exporter endpoint configuration by [@pellared](https://github.com/pellared) in [#8438](https://github.com/open-telemetry/opentelemetry-go/pull/8438) - Cleanup limitedSyncMap, and add tests by [@dashpole](https://github.com/dashpole) in [#8302](https://github.com/open-telemetry/opentelemetry-go/pull/8302) - fix(otlphttp): support retry-after HTTP-date by [@AbhiPrasad](https://github.com/AbhiPrasad) in [#8417](https://github.com/open-telemetry/opentelemetry-go/pull/8417) - Fix incorrect formatting verbs in opencensus bridge by [@dashpole](https://github.com/dashpole) in [#8424](https://github.com/open-telemetry/opentelemetry-go/pull/8424) - fix: off-by-one bug for FixedSizeReservoir by [@dashpole](https://github.com/dashpole) in [#8309](https://github.com/open-telemetry/opentelemetry-go/pull/8309) - sdk/metric: reuse cumulative-histogram Collect buffers to reduce heap usage by [@sudowork](https://github.com/sudowork) in [#8428](https://github.com/open-telemetry/opentelemetry-go/pull/8428) - Fix memory leak in exemplar reservoir by storing SpanContext instead of Context by [@dashpole](https://github.com/dashpole) in [#8389](https://github.com/open-telemetry/opentelemetry-go/pull/8389) - fix: clear stale histogram fields on datapoint reuse by [@dashpole](https://github.com/dashpole) in [#8403](https://github.com/open-telemetry/opentelemetry-go/pull/8403) - prometheus: avoid preallocating scope attributes when disabled by [@dashpole](https://github.com/dashpole) in [#8404](https://github.com/open-telemetry/opentelemetry-go/pull/8404) - Document that WithExemplarFilter(nil) is not supported by [@dashpole](https://github.com/dashpole) in [#8392](https://github.com/open-telemetry/opentelemetry-go/pull/8392) - fix(deps): update googleapis to [`7ab31c2`](https://github.com/open-telemetry/opentelemetry-go/commit/7ab31c2) by [@renovate](https://github.com/renovate)\[bot] in [#8447](https://github.com/open-telemetry/opentelemetry-go/pull/8447) - chore(deps): update golang.org/x to [`fb80ec8`](https://github.com/open-telemetry/opentelemetry-go/commit/fb80ec8) by [@renovate](https://github.com/renovate)\[bot] in [#8444](https://github.com/open-telemetry/opentelemetry-go/pull/8444) - chore(deps): update golang.org/x to v0.56.0 by [@renovate](https://github.com/renovate)\[bot] in [#8448](https://github.com/open-telemetry/opentelemetry-go/pull/8448) - Add WithUnsafeAttributes to support no-copy dynamic metric API calls by [@dashpole](https://github.com/dashpole) in [#8251](https://github.com/open-telemetry/opentelemetry-go/pull/8251) - fix(attribute): prevent zero-hash collapse to empty set by [@dashpole](https://github.com/dashpole) in [#8402](https://github.com/open-telemetry/opentelemetry-go/pull/8402) - chore(deps): update codspeedhq/action action to v4.17.5 by [@renovate](https://github.com/renovate)\[bot] in [#8452](https://github.com/open-telemetry/opentelemetry-go/pull/8452) - attribute: add MAP type support by [@pellared](https://github.com/pellared) in [#8445](https://github.com/open-telemetry/opentelemetry-go/pull/8445) - fix(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8451](https://github.com/open-telemetry/opentelemetry-go/pull/8451) - chore(deps): update module charm.land/lipgloss/v2 to v2.0.4 by [@renovate](https://github.com/renovate)\[bot] in [#8455](https://github.com/open-telemetry/opentelemetry-go/pull/8455) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`2399af7`](https://github.com/open-telemetry/opentelemetry-go/commit/2399af7) by [@renovate](https://github.com/renovate)\[bot] in [#8460](https://github.com/open-telemetry/opentelemetry-go/pull/8460) - chore(deps): update golang.org/x to [`72dfd24`](https://github.com/open-telemetry/opentelemetry-go/commit/72dfd24) by [@renovate](https://github.com/renovate)\[bot] in [#8462](https://github.com/open-telemetry/opentelemetry-go/pull/8462) - fix(deps): update googleapis to [`62b3387`](https://github.com/open-telemetry/opentelemetry-go/commit/62b3387) by [@renovate](https://github.com/renovate)\[bot] in [#8463](https://github.com/open-telemetry/opentelemetry-go/pull/8463) - sdk/trace: apply AttributeValueLengthLimit to attribute.MAP by [@pellared](https://github.com/pellared) in [#8454](https://github.com/open-telemetry/opentelemetry-go/pull/8454) - exporters: support MAP attributes by [@pellared](https://github.com/pellared) in [#8453](https://github.com/open-telemetry/opentelemetry-go/pull/8453) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.2.2 by [@renovate](https://github.com/renovate)\[bot] in [#8464](https://github.com/open-telemetry/opentelemetry-go/pull/8464) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#8470](https://github.com/open-telemetry/opentelemetry-go/pull/8470) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.27.0 by [@renovate](https://github.com/renovate)\[bot] in [#8469](https://github.com/open-telemetry/opentelemetry-go/pull/8469) - fix(deps): update module github.com/prometheus/common to v0.69.0 by [@renovate](https://github.com/renovate)\[bot] in [#8472](https://github.com/open-telemetry/opentelemetry-go/pull/8472) - chore(deps): update module github.com/firefart/nonamedreturns to v1.0.7 by [@renovate](https://github.com/renovate)\[bot] in [#8467](https://github.com/open-telemetry/opentelemetry-go/pull/8467) - chore(deps): update golang.org/x to [`4de325e`](https://github.com/open-telemetry/opentelemetry-go/commit/4de325e) by [@renovate](https://github.com/renovate)\[bot] in [#8466](https://github.com/open-telemetry/opentelemetry-go/pull/8466) - Exporter code cleanup by [@ash2k](https://github.com/ash2k) in [#8457](https://github.com/open-telemetry/opentelemetry-go/pull/8457) - \[chore] add CNCF Slack join instructions by [@cijothomas](https://github.com/cijothomas) in [#8456](https://github.com/open-telemetry/opentelemetry-go/pull/8456) - chore(deps): update golang.org/x to [`9b6dc03`](https://github.com/open-telemetry/opentelemetry-go/commit/9b6dc03) by [@renovate](https://github.com/renovate)\[bot] in [#8474](https://github.com/open-telemetry/opentelemetry-go/pull/8474) - fix(deps): update golang.org/x to v1.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#8478](https://github.com/open-telemetry/opentelemetry-go/pull/8478) - sdk: deduplicate MAP attribute keys by [@pellared](https://github.com/pellared) in [#8471](https://github.com/open-telemetry/opentelemetry-go/pull/8471) - attribute: inline hashing for small SLICE and MAP values by [@Dipanshusinghh](https://github.com/Dipanshusinghh) in [#8476](https://github.com/open-telemetry/opentelemetry-go/pull/8476) - attribute: test map equivalence with duplicate keys by [@pellared](https://github.com/pellared) in [#8473](https://github.com/open-telemetry/opentelemetry-go/pull/8473) - fix(deps): update googleapis to [`87f3d3e`](https://github.com/open-telemetry/opentelemetry-go/commit/87f3d3e) by [@renovate](https://github.com/renovate)\[bot] in [#8483](https://github.com/open-telemetry/opentelemetry-go/pull/8483) - chore(deps): update module github.com/cyphar/filepath-securejoin to v0.7.0 by [@renovate](https://github.com/renovate)\[bot] in [#8486](https://github.com/open-telemetry/opentelemetry-go/pull/8486) - chore(deps): update golang.org/x to [`a6991f1`](https://github.com/open-telemetry/opentelemetry-go/commit/a6991f1) by [@renovate](https://github.com/renovate)\[bot] in [#8482](https://github.com/open-telemetry/opentelemetry-go/pull/8482) - chore(deps): update actions/checkout action to v7 by [@renovate](https://github.com/renovate)\[bot] in [#8487](https://github.com/open-telemetry/opentelemetry-go/pull/8487) - chore(deps): update codspeedhq/action action to v4.17.6 by [@renovate](https://github.com/renovate)\[bot] in [#8485](https://github.com/open-telemetry/opentelemetry-go/pull/8485) - chore(deps): update golang.org/x to [`e028bae`](https://github.com/open-telemetry/opentelemetry-go/commit/e028bae) by [@renovate](https://github.com/renovate)\[bot] in [#8493](https://github.com/open-telemetry/opentelemetry-go/pull/8493) - Generate and upgrade to `semconv/v1.42.0` by [@MrAlias](https://github.com/MrAlias) in [#8484](https://github.com/open-telemetry/opentelemetry-go/pull/8484) - chore(deps): update otel/weaver docker tag to v0.24.1 by [@renovate](https://github.com/renovate)\[bot] in [#8494](https://github.com/open-telemetry/opentelemetry-go/pull/8494) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`f39628c`](https://github.com/open-telemetry/opentelemetry-go/commit/f39628c) by [@renovate](https://github.com/renovate)\[bot] in [#8498](https://github.com/open-telemetry/opentelemetry-go/pull/8498) - chore(deps): update module github.com/cloudflare/circl to v1.6.4 by [@renovate](https://github.com/renovate)\[bot] in [#8500](https://github.com/open-telemetry/opentelemetry-go/pull/8500) - fix(deps): update googleapis to [`b703f56`](https://github.com/open-telemetry/opentelemetry-go/commit/b703f56) by [@renovate](https://github.com/renovate)\[bot] in [#8502](https://github.com/open-telemetry/opentelemetry-go/pull/8502) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.1 by [@renovate](https://github.com/renovate)\[bot] in [#8503](https://github.com/open-telemetry/opentelemetry-go/pull/8503) - log: use attribute values for records by [@pellared](https://github.com/pellared) in [#8490](https://github.com/open-telemetry/opentelemetry-go/pull/8490) - codes: fix invalid code format string by [@HNO3Miracle](https://github.com/HNO3Miracle) in [#8497](https://github.com/open-telemetry/opentelemetry-go/pull/8497) - chore(deps): update module github.com/rogpeppe/go-internal to v1.15.0 by [@renovate](https://github.com/renovate)\[bot] in [#8505](https://github.com/open-telemetry/opentelemetry-go/pull/8505) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.61.0 by [@renovate](https://github.com/renovate)\[bot] in [#8506](https://github.com/open-telemetry/opentelemetry-go/pull/8506) - chore(deps): update actions/cache action to v6 by [@renovate](https://github.com/renovate)\[bot] in [#8507](https://github.com/open-telemetry/opentelemetry-go/pull/8507) - chore(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8508](https://github.com/open-telemetry/opentelemetry-go/pull/8508) - chore(deps): update otel/weaver docker tag to v0.24.2 by [@renovate](https://github.com/renovate)\[bot] in [#8509](https://github.com/open-telemetry/opentelemetry-go/pull/8509) - Fix/makefile go version by [@Vatsal-Chaudhary](https://github.com/Vatsal-Chaudhary) in [#8496](https://github.com/open-telemetry/opentelemetry-go/pull/8496) - chore(deps): update actions/setup-go action to v6.5.0 by [@renovate](https://github.com/renovate)\[bot] in [#8516](https://github.com/open-telemetry/opentelemetry-go/pull/8516) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.2 by [@renovate](https://github.com/renovate)\[bot] in [#8513](https://github.com/open-telemetry/opentelemetry-go/pull/8513) - attribute: improve attribute types GoDoc by [@pellared](https://github.com/pellared) in [#8489](https://github.com/open-telemetry/opentelemetry-go/pull/8489) - otlpmetricgrpc: avoid DNS in self-observability test by [@JuvenR](https://github.com/JuvenR) in [#8514](https://github.com/open-telemetry/opentelemetry-go/pull/8514) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`c961bd5`](https://github.com/open-telemetry/opentelemetry-go/commit/c961bd5) by [@renovate](https://github.com/renovate)\[bot] in [#8512](https://github.com/open-telemetry/opentelemetry-go/pull/8512) - chore(deps): update module github.com/go-critic/go-critic to v0.14.4 by [@renovate](https://github.com/renovate)\[bot] in [#8519](https://github.com/open-telemetry/opentelemetry-go/pull/8519) - chore(deps): update golang.org/x/telemetry digest to [`59b4966`](https://github.com/open-telemetry/opentelemetry-go/commit/59b4966) by [@renovate](https://github.com/renovate)\[bot] in [#8520](https://github.com/open-telemetry/opentelemetry-go/pull/8520) - fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.4 by [@renovate](https://github.com/renovate)\[bot] in [#8515](https://github.com/open-telemetry/opentelemetry-go/pull/8515) - fix(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8521](https://github.com/open-telemetry/opentelemetry-go/pull/8521) - chore(deps): update codspeedhq/action action to v4.18.1 by [@renovate](https://github.com/renovate)\[bot] in [#8517](https://github.com/open-telemetry/opentelemetry-go/pull/8517) - chore(deps): update module go.augendre.info/fatcontext to v0.10.0 by [@renovate](https://github.com/renovate)\[bot] in [#8524](https://github.com/open-telemetry/opentelemetry-go/pull/8524) - chore(deps): update golang.org/x/telemetry digest to [`b709645`](https://github.com/open-telemetry/opentelemetry-go/commit/b709645) by [@renovate](https://github.com/renovate)\[bot] in [#8523](https://github.com/open-telemetry/opentelemetry-go/pull/8523) - chore(deps): update actions/cache action to v6.1.0 by [@renovate](https://github.com/renovate)\[bot] in [#8525](https://github.com/open-telemetry/opentelemetry-go/pull/8525) - gotmpl: update headers to enable golangci-lint on generated files by [@Dipanshusinghh](https://github.com/Dipanshusinghh) in [#8481](https://github.com/open-telemetry/opentelemetry-go/pull/8481) - chore(deps): update module github.com/prometheus/procfs to v0.21.0 by [@renovate](https://github.com/renovate)\[bot] in [#8526](https://github.com/open-telemetry/opentelemetry-go/pull/8526) - attribute: skip reflection for short slices in hashValue by [@lavish-gambhir](https://github.com/lavish-gambhir) in [#8511](https://github.com/open-telemetry/opentelemetry-go/pull/8511) - chore(deps): update module github.com/klauspost/cpuid/v2 to v2.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#8529](https://github.com/open-telemetry/opentelemetry-go/pull/8529) - chore(deps): update module github.com/prometheus/procfs to v0.21.1 by [@renovate](https://github.com/renovate)\[bot] in [#8528](https://github.com/open-telemetry/opentelemetry-go/pull/8528) - fix(deps): update module google.golang.org/grpc to v1.82.0 by [@renovate](https://github.com/renovate)\[bot] in [#8530](https://github.com/open-telemetry/opentelemetry-go/pull/8530) - fix(deps): update googleapis to [`925bb5d`](https://github.com/open-telemetry/opentelemetry-go/commit/925bb5d) by [@renovate](https://github.com/renovate)\[bot] in [#8533](https://github.com/open-telemetry/opentelemetry-go/pull/8533) - chore: Move inactive members to emeritus by [@opentelemetrybot](https://github.com/opentelemetrybot) in [#8398](https://github.com/open-telemetry/opentelemetry-go/pull/8398) - chore(deps): update github.com/golangci/rowserrcheck digest to [`399602f`](https://github.com/open-telemetry/opentelemetry-go/commit/399602f) by [@renovate](https://github.com/renovate)\[bot] in [#8539](https://github.com/open-telemetry/opentelemetry-go/pull/8539) - chore(deps): update fossas/fossa-action action to v2 by [@renovate](https://github.com/renovate)\[bot] in [#8558](https://github.com/open-telemetry/opentelemetry-go/pull/8558) - chore(deps): update github/codeql-action action to v4.36.3 by [@renovate](https://github.com/renovate)\[bot] in [#8557](https://github.com/open-telemetry/opentelemetry-go/pull/8557) - chore(deps): update module github.com/firefart/nonamedreturns to v1.0.8 by [@renovate](https://github.com/renovate)\[bot] in [#8559](https://github.com/open-telemetry/opentelemetry-go/pull/8559) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.4.3 by [@renovate](https://github.com/renovate)\[bot] in [#8563](https://github.com/open-telemetry/opentelemetry-go/pull/8563) - chore(deps): update module charm.land/lipgloss/v2 to v2.0.5 by [@renovate](https://github.com/renovate)\[bot] in [#8562](https://github.com/open-telemetry/opentelemetry-go/pull/8562) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`f5a850f`](https://github.com/open-telemetry/opentelemetry-go/commit/f5a850f) by [@renovate](https://github.com/renovate)\[bot] in [#8561](https://github.com/open-telemetry/opentelemetry-go/pull/8561) - fix(otlptracehttp,otlpmetrichttp): do not append default signal path by [@basti1302](https://github.com/basti1302) in [#8538](https://github.com/open-telemetry/opentelemetry-go/pull/8538) - fix(deps): update googleapis to [`f0a9213`](https://github.com/open-telemetry/opentelemetry-go/commit/f0a9213) by [@renovate](https://github.com/renovate)\[bot] in [#8567](https://github.com/open-telemetry/opentelemetry-go/pull/8567) - log: clarify Logger.Enabled guidance by [@pellared](https://github.com/pellared) in [#8565](https://github.com/open-telemetry/opentelemetry-go/pull/8565) - chore(deps): update module golang.org/x/text to v0.39.0 by [@renovate](https://github.com/renovate)\[bot] in [#8568](https://github.com/open-telemetry/opentelemetry-go/pull/8568) - chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.62.0 by [@renovate](https://github.com/renovate)\[bot] in [#8569](https://github.com/open-telemetry/opentelemetry-go/pull/8569) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.62.0 by [@renovate](https://github.com/renovate)\[bot] in [#8572](https://github.com/open-telemetry/opentelemetry-go/pull/8572) - chore(deps): update codspeedhq/action action to v4.18.2 by [@renovate](https://github.com/renovate)\[bot] in [#8571](https://github.com/open-telemetry/opentelemetry-go/pull/8571) - sdk/log/logtest: remove attribute limit fields from RecordFactory by [@pellared](https://github.com/pellared) in [#8556](https://github.com/open-telemetry/opentelemetry-go/pull/8556) - sdk/log: honor zero attribute count limit by [@pellared](https://github.com/pellared) in [#8570](https://github.com/open-telemetry/opentelemetry-go/pull/8570) - fix(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8577](https://github.com/open-telemetry/opentelemetry-go/pull/8577) - chore(deps): update github/codeql-action action to v4.37.0 by [@renovate](https://github.com/renovate)\[bot] in [#8576](https://github.com/open-telemetry/opentelemetry-go/pull/8576) - Clarify that Histogram's Record method expect non-negative values by [@psx95](https://github.com/psx95) in [#8574](https://github.com/open-telemetry/opentelemetry-go/pull/8574) - chore(deps): update golang.org/x by [@renovate](https://github.com/renovate)\[bot] in [#8579](https://github.com/open-telemetry/opentelemetry-go/pull/8579) - chore(deps): update codspeedhq/action action to v4.18.4 by [@renovate](https://github.com/renovate)\[bot] in [#8580](https://github.com/open-telemetry/opentelemetry-go/pull/8580) - sdk/log: derive missing exception attributes by [@pellared](https://github.com/pellared) in [#8566](https://github.com/open-telemetry/opentelemetry-go/pull/8566) - chore(deps): update lycheeverse/lychee-action action to v2.9.0 by [@renovate](https://github.com/renovate)\[bot] in [#8589](https://github.com/open-telemetry/opentelemetry-go/pull/8589) - sdk/trace: add WithoutPanicRecording provider option by [@pellared](https://github.com/pellared) in [#8532](https://github.com/open-telemetry/opentelemetry-go/pull/8532) - chore(deps): update codspeedhq/action action to v4.18.5 by [@renovate](https://github.com/renovate)\[bot] in [#8590](https://github.com/open-telemetry/opentelemetry-go/pull/8590) - log: clarify EventName uniqueness guidance by [@pellared](https://github.com/pellared) in [#8586](https://github.com/open-telemetry/opentelemetry-go/pull/8586) - sdk/log: document duplicate key receiver behavior by [@pellared](https://github.com/pellared) in [#8588](https://github.com/open-telemetry/opentelemetry-go/pull/8588) - chore(deps): update actions/stale action to v10.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#8593](https://github.com/open-telemetry/opentelemetry-go/pull/8593) - fix(deps): update module github.com/prometheus/common to v0.70.0 by [@renovate](https://github.com/renovate)\[bot] in [#8594](https://github.com/open-telemetry/opentelemetry-go/pull/8594) - log: clarify empty Logger name handling by [@pellared](https://github.com/pellared) in [#8587](https://github.com/open-telemetry/opentelemetry-go/pull/8587) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`4bee191`](https://github.com/open-telemetry/opentelemetry-go/commit/4bee191) by [@renovate](https://github.com/renovate)\[bot] in [#8597](https://github.com/open-telemetry/opentelemetry-go/pull/8597) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.5.0 by [@renovate](https://github.com/renovate)\[bot] in [#8596](https://github.com/open-telemetry/opentelemetry-go/pull/8596) - ci: run bare metal benchmarks in a container by [@trask](https://github.com/trask) in [#8575](https://github.com/open-telemetry/opentelemetry-go/pull/8575) - chore(deps): update ubuntu:24.04 docker digest to [`4fbb8e6`](https://github.com/open-telemetry/opentelemetry-go/commit/4fbb8e6) by [@renovate](https://github.com/renovate)\[bot] in [#8600](https://github.com/open-telemetry/opentelemetry-go/pull/8600) - fix(deps): update googleapis by [@renovate](https://github.com/renovate)\[bot] in [#8602](https://github.com/open-telemetry/opentelemetry-go/pull/8602) - chore(deps): update ubuntu docker tag to v26 by [@renovate](https://github.com/renovate)\[bot] in [#8601](https://github.com/open-telemetry/opentelemetry-go/pull/8601) - chore(deps): update google.golang.org/genproto/googleapis/api digest to [`142c488`](https://github.com/open-telemetry/opentelemetry-go/commit/142c488) by [@renovate](https://github.com/renovate)\[bot] in [#8603](https://github.com/open-telemetry/opentelemetry-go/pull/8603) - fix(deps): update googleapis to [`f5fc221`](https://github.com/open-telemetry/opentelemetry-go/commit/f5fc221) by [@renovate](https://github.com/renovate)\[bot] in [#8604](https://github.com/open-telemetry/opentelemetry-go/pull/8604) - Remove vanity import tooling by [@MrAlias](https://github.com/MrAlias) in [#8609](https://github.com/open-telemetry/opentelemetry-go/pull/8609) - chore(deps): update module github.com/securego/gosec/v2 to v2.28.0 by [@renovate](https://github.com/renovate)\[bot] in [#8605](https://github.com/open-telemetry/opentelemetry-go/pull/8605) - chore(deps): update dependency codespell to v2.4.3 by [@renovate](https://github.com/renovate)\[bot] in [#8612](https://github.com/open-telemetry/opentelemetry-go/pull/8612) - chore(deps): update ubuntu:26.04 docker digest to [`651ba3f`](https://github.com/open-telemetry/opentelemetry-go/commit/651ba3f) by [@renovate](https://github.com/renovate)\[bot] in [#8616](https://github.com/open-telemetry/opentelemetry-go/pull/8616) - fix(deps): update module google.golang.org/grpc to v1.82.1 by [@renovate](https://github.com/renovate)\[bot] in [#8615](https://github.com/open-telemetry/opentelemetry-go/pull/8615) - chore(deps): update actions/setup-go action to v7 by [@renovate](https://github.com/renovate)\[bot] in [#8617](https://github.com/open-telemetry/opentelemetry-go/pull/8617) - chore(deps): update github/codeql-action action to v4.37.1 by [@renovate](https://github.com/renovate)\[bot] in [#8621](https://github.com/open-telemetry/opentelemetry-go/pull/8621) - chore(deps): update golang.org/x/telemetry digest to [`dad6939`](https://github.com/open-telemetry/opentelemetry-go/commit/dad6939) by [@renovate](https://github.com/renovate)\[bot] in [#8582](https://github.com/open-telemetry/opentelemetry-go/pull/8582) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.5.1 by [@renovate](https://github.com/renovate)\[bot] in [#8625](https://github.com/open-telemetry/opentelemetry-go/pull/8625) - chore(deps): update module github.com/mattn/go-isatty to v0.0.23 by [@renovate](https://github.com/renovate)\[bot] in [#8619](https://github.com/open-telemetry/opentelemetry-go/pull/8619) - fix(deps): update googleapis to [`e75dac1`](https://github.com/open-telemetry/opentelemetry-go/commit/e75dac1) by [@renovate](https://github.com/renovate)\[bot] in [#8614](https://github.com/open-telemetry/opentelemetry-go/pull/8614) - chore(deps): update golang.org/x/telemetry digest to [`bdb8988`](https://github.com/open-telemetry/opentelemetry-go/commit/bdb8988) by [@renovate](https://github.com/renovate)\[bot] in [#8627](https://github.com/open-telemetry/opentelemetry-go/pull/8627) - chore(deps): update ubuntu:26.04 docker digest to [`3131b4c`](https://github.com/open-telemetry/opentelemetry-go/commit/3131b4c) by [@renovate](https://github.com/renovate)\[bot] in [#8624](https://github.com/open-telemetry/opentelemetry-go/pull/8624) - chore(deps): update module github.com/nunnatsa/ginkgolinter to v0.23.1 by [@renovate](https://github.com/renovate)\[bot] in [#8638](https://github.com/open-telemetry/opentelemetry-go/pull/8638) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.5.2 by [@renovate](https://github.com/renovate)\[bot] in [#8636](https://github.com/open-telemetry/opentelemetry-go/pull/8636) - chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.63.0 by [@renovate](https://github.com/renovate)\[bot] in [#8645](https://github.com/open-telemetry/opentelemetry-go/pull/8645) - Fix benchmark ci after using the container environment by [@XSAM](https://github.com/XSAM) in [#8635](https://github.com/open-telemetry/opentelemetry-go/pull/8635) - fix(deps): update module github.com/prometheus/common to v0.70.1 by [@renovate](https://github.com/renovate)\[bot] in [#8650](https://github.com/open-telemetry/opentelemetry-go/pull/8650) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`7cc6674`](https://github.com/open-telemetry/opentelemetry-go/commit/7cc6674) by [@renovate](https://github.com/renovate)\[bot] in [#8637](https://github.com/open-telemetry/opentelemetry-go/pull/8637) - fix(deps): update golang.org/x/exp digest to [`764159d`](https://github.com/open-telemetry/opentelemetry-go/commit/764159d) by [@renovate](https://github.com/renovate)\[bot] in [#8633](https://github.com/open-telemetry/opentelemetry-go/pull/8633) - fix(deps): update googleapis to [`0afa2a6`](https://github.com/open-telemetry/opentelemetry-go/commit/0afa2a6) by [@renovate](https://github.com/renovate)\[bot] in [#8639](https://github.com/open-telemetry/opentelemetry-go/pull/8639) - chore(deps): update actions/checkout action to v7.0.1 by [@renovate](https://github.com/renovate)\[bot] in [#8640](https://github.com/open-telemetry/opentelemetry-go/pull/8640) - chore(deps): update github/codeql-action action to v4.37.3 by [@renovate](https://github.com/renovate)\[bot] in [#8644](https://github.com/open-telemetry/opentelemetry-go/pull/8644) - fix(deps): update module github.com/prometheus/client_golang to v1.24.0 by [@renovate](https://github.com/renovate)\[bot] in [#8641](https://github.com/open-telemetry/opentelemetry-go/pull/8641) - Generate and upgrade to semconv/v1.43.0 by [@osullivandonal](https://github.com/osullivandonal) in [#8628](https://github.com/open-telemetry/opentelemetry-go/pull/8628) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.63.0 by [@renovate](https://github.com/renovate)\[bot] in [#8646](https://github.com/open-telemetry/opentelemetry-go/pull/8646) - chore(deps): update ubuntu docker tag to v26 by [@renovate](https://github.com/renovate)\[bot] in [#8647](https://github.com/open-telemetry/opentelemetry-go/pull/8647) - feat: use time-unbiased algorithm for histogram reservoir by [@dashpole](https://github.com/dashpole) in [#8306](https://github.com/open-telemetry/opentelemetry-go/pull/8306) - sdk/log: include ForceFlush in built-in processor Shutdown by [@pellared](https://github.com/pellared) in [#8599](https://github.com/open-telemetry/opentelemetry-go/pull/8599) - sdk/log: self observability: batch log processor metrics by [@mahendrabishnoi2](https://github.com/mahendrabishnoi2) in [#7124](https://github.com/open-telemetry/opentelemetry-go/pull/7124) - fix(deps): update module go.opentelemetry.io/proto/otlp to v1.11.0 by [@renovate](https://github.com/renovate)\[bot] in [#8651](https://github.com/open-telemetry/opentelemetry-go/pull/8651) - chore(deps): update github.com/timakin/bodyclose digest to [`857993a`](https://github.com/open-telemetry/opentelemetry-go/commit/857993a) by [@renovate](https://github.com/renovate)\[bot] in [#8652](https://github.com/open-telemetry/opentelemetry-go/pull/8652) - fix(deps): update googleapis to [`7274b71`](https://github.com/open-telemetry/opentelemetry-go/commit/7274b71) by [@renovate](https://github.com/renovate)\[bot] in [#8655](https://github.com/open-telemetry/opentelemetry-go/pull/8655) - fix(changelog): update self-observability environment variable to OTEL_GO_X_OBSERVABILITY by [@pellared](https://github.com/pellared) in [#8618](https://github.com/open-telemetry/opentelemetry-go/pull/8618) - sdk: consolidate attribute normalization in attrnorm by [@pellared](https://github.com/pellared) in [#8611](https://github.com/open-telemetry/opentelemetry-go/pull/8611) - chore(deps): update module github.com/mattn/go-isatty to v0.0.24 by [@renovate](https://github.com/renovate)\[bot] in [#8656](https://github.com/open-telemetry/opentelemetry-go/pull/8656) - chore(deps): update ossf/scorecard-action action to v2.4.4 by [@renovate](https://github.com/renovate)\[bot] in [#8658](https://github.com/open-telemetry/opentelemetry-go/pull/8658) - fix(deps): update module github.com/go-logr/logr to v1.4.4 by [@renovate](https://github.com/renovate)\[bot] in [#8642](https://github.com/open-telemetry/opentelemetry-go/pull/8642) - fix(deps): update googleapis to [`3fe39f3`](https://github.com/open-telemetry/opentelemetry-go/commit/3fe39f3) by [@renovate](https://github.com/renovate)\[bot] in [#8659](https://github.com/open-telemetry/opentelemetry-go/pull/8659) - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.1 by [@renovate](https://github.com/renovate)\[bot] in [#8662](https://github.com/open-telemetry/opentelemetry-go/pull/8662) - fix(deps): update module github.com/prometheus/client_golang to v1.24.1 by [@renovate](https://github.com/renovate)\[bot] in [#8661](https://github.com/open-telemetry/opentelemetry-go/pull/8661) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.27 by [@renovate](https://github.com/renovate)\[bot] in [#8660](https://github.com/open-telemetry/opentelemetry-go/pull/8660) - sdk/log: prevent BatchProcessor busy-spin by [@pellared](https://github.com/pellared) in [#8620](https://github.com/open-telemetry/opentelemetry-go/pull/8620) - chore(deps): update otel/weaver docker tag to v0.25.0 by [@renovate](https://github.com/renovate)\[bot] in [#8664](https://github.com/open-telemetry/opentelemetry-go/pull/8664) - fix(deps): update googleapis to [`b2f2020`](https://github.com/open-telemetry/opentelemetry-go/commit/b2f2020) by [@renovate](https://github.com/renovate)\[bot] in [#8663](https://github.com/open-telemetry/opentelemetry-go/pull/8663) - chore(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by [@renovate](https://github.com/renovate)\[bot] in [#8665](https://github.com/open-telemetry/opentelemetry-go/pull/8665) - chore(deps): update codspeedhq/action action to v4.19.1 by [@renovate](https://github.com/renovate)\[bot] in [#8666](https://github.com/open-telemetry/opentelemetry-go/pull/8666) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`064b4d2`](https://github.com/open-telemetry/opentelemetry-go/commit/064b4d2) by [@renovate](https://github.com/renovate)\[bot] in [#8670](https://github.com/open-telemetry/opentelemetry-go/pull/8670) - fix(deps): update golang.org/x to [`b88d891`](https://github.com/open-telemetry/opentelemetry-go/commit/b88d891) by [@renovate](https://github.com/renovate)\[bot] in [#8668](https://github.com/open-telemetry/opentelemetry-go/pull/8668) - fix(deps): update googleapis to [`6c54ddd`](https://github.com/open-telemetry/opentelemetry-go/commit/6c54ddd) by [@renovate](https://github.com/renovate)\[bot] in [#8669](https://github.com/open-telemetry/opentelemetry-go/pull/8669) - chore(deps): update module mvdan.cc/gofumpt to v0.11.0 by [@renovate](https://github.com/renovate)\[bot] in [#8667](https://github.com/open-telemetry/opentelemetry-go/pull/8667) - chore(deps): update otel/weaver docker tag to v0.25.1 by [@renovate](https://github.com/renovate)\[bot] in [#8673](https://github.com/open-telemetry/opentelemetry-go/pull/8673) - fix(deps): update googleapis to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-go/commit/8efbd57) by [@renovate](https://github.com/renovate)\[bot] in [#8676](https://github.com/open-telemetry/opentelemetry-go/pull/8676) - chore(deps): update actions/stale action to v11 by [@renovate](https://github.com/renovate)\[bot] in [#8671](https://github.com/open-telemetry/opentelemetry-go/pull/8671) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.2 by [@renovate](https://github.com/renovate)\[bot] in [#8674](https://github.com/open-telemetry/opentelemetry-go/pull/8674) - chore(deps): update codspeedhq/action action to v5 by [@renovate](https://github.com/renovate)\[bot] in [#8675](https://github.com/open-telemetry/opentelemetry-go/pull/8675) - chore(deps): update module github.com/jgautheron/goconst to v1.11.0 by [@renovate](https://github.com/renovate)\[bot] in [#8677](https://github.com/open-telemetry/opentelemetry-go/pull/8677) - chore(deps): update github/codeql-action action to v4.37.4 by [@renovate](https://github.com/renovate)\[bot] in [#8680](https://github.com/open-telemetry/opentelemetry-go/pull/8680) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`19049f2`](https://github.com/open-telemetry/opentelemetry-go/commit/19049f2) by [@renovate](https://github.com/renovate)\[bot] in [#8678](https://github.com/open-telemetry/opentelemetry-go/pull/8678) - fix(deps): update module google.golang.org/grpc to v1.83.0 by [@renovate](https://github.com/renovate)\[bot] in [#8679](https://github.com/open-telemetry/opentelemetry-go/pull/8679) - sdk/log: prevent processor calls after provider shutdown by [@pellared](https://github.com/pellared) in [#8608](https://github.com/open-telemetry/opentelemetry-go/pull/8608) - tests: fix semconvkit temp module setup by [@RedZapdos123](https://github.com/RedZapdos123) in [#8682](https://github.com/open-telemetry/opentelemetry-go/pull/8682) - chore(deps): update github/codeql-action action to v4.37.5 by [@renovate](https://github.com/renovate)\[bot] in [#8692](https://github.com/open-telemetry/opentelemetry-go/pull/8692) - chore(deps): update github.com/golangci/rowserrcheck digest to [`d2031e3`](https://github.com/open-telemetry/opentelemetry-go/commit/d2031e3) by [@renovate](https://github.com/renovate)\[bot] in [#8687](https://github.com/open-telemetry/opentelemetry-go/pull/8687) - chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 by [@renovate](https://github.com/renovate)\[bot] in [#8689](https://github.com/open-telemetry/opentelemetry-go/pull/8689) - chore(deps): update codspeedhq/action action to v5.0.2 by [@renovate](https://github.com/renovate)\[bot] in [#8690](https://github.com/open-telemetry/opentelemetry-go/pull/8690) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`8b69304`](https://github.com/open-telemetry/opentelemetry-go/commit/8b69304) by [@renovate](https://github.com/renovate)\[bot] in [#8691](https://github.com/open-telemetry/opentelemetry-go/pull/8691) - fix(deps): update googleapis to [`6ac0973`](https://github.com/open-telemetry/opentelemetry-go/commit/6ac0973) by [@renovate](https://github.com/renovate)\[bot] in [#8694](https://github.com/open-telemetry/opentelemetry-go/pull/8694) - sdk/metric: remove obsolete randomFloat64 TODO by [@Mujib-Ahasan](https://github.com/Mujib-Ahasan) in [#8685](https://github.com/open-telemetry/opentelemetry-go/pull/8685) - Release v1.45.0 by [@MrAlias](https://github.com/MrAlias) in [#8693](https://github.com/open-telemetry/opentelemetry-go/pull/8693) #### New Contributors - [@macayu17](https://github.com/macayu17) made their first contribution in [#8371](https://github.com/open-telemetry/opentelemetry-go/pull/8371) - [@AbhiPrasad](https://github.com/AbhiPrasad) made their first contribution in [#8383](https://github.com/open-telemetry/opentelemetry-go/pull/8383) - [@Mentigen](https://github.com/Mentigen) made their first contribution in [#8397](https://github.com/open-telemetry/opentelemetry-go/pull/8397) - [@sudowork](https://github.com/sudowork) made their first contribution in [#8428](https://github.com/open-telemetry/opentelemetry-go/pull/8428) - [@HNO3Miracle](https://github.com/HNO3Miracle) made their first contribution in [#8497](https://github.com/open-telemetry/opentelemetry-go/pull/8497) - [@Vatsal-Chaudhary](https://github.com/Vatsal-Chaudhary) made their first contribution in [#8496](https://github.com/open-telemetry/opentelemetry-go/pull/8496) - [@JuvenR](https://github.com/JuvenR) made their first contribution in [#8514](https://github.com/open-telemetry/opentelemetry-go/pull/8514) - [@lavish-gambhir](https://github.com/lavish-gambhir) made their first contribution in [#8511](https://github.com/open-telemetry/opentelemetry-go/pull/8511) - [@osullivandonal](https://github.com/osullivandonal) made their first contribution in [#8628](https://github.com/open-telemetry/opentelemetry-go/pull/8628) - [@RedZapdos123](https://github.com/RedZapdos123) made their first contribution in [#8682](https://github.com/open-telemetry/opentelemetry-go/pull/8682) - [@Mujib-Ahasan](https://github.com/Mujib-Ahasan) made their first contribution in [#8685](https://github.com/open-telemetry/opentelemetry-go/pull/8685) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-forgejo added 1 commit

2026-09-22 08:09:25 +00:00

fix(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security]

Conventional Commits / Validate commit messages (pull_request) Successful in 3s

Details

release / release-changelog (pull_request) Failing after 25s

Details

GO lint & test / check (pull_request) Failing after 2m0s

Details

Build PR Image / Build & push container image (pull_request) Successful in 2m15s

Details

Build PR Image / build-container (pull_request) Successful in 0s

Details

Build PR Image / Comment image tag on PR (pull_request) Failing after 1s

Details

f4b021092d

Signed-off-by: Renovate Bot <ol+renovateforgejo@oluflorenzen.de>

renovate-forgejo commented

2026-09-22 08:09:26 +00:00

Author

Collaborator

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`github.com/go-logr/logr`	`v1.4.3` -> `v1.4.4`
`go.opentelemetry.io/otel`	`v1.44.0` -> `v1.45.0`
`go.opentelemetry.io/otel/metric`	`v1.44.0` -> `v1.45.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 3 additional dependencies were updated Details: | **Package** | **Change** | | :-------------------------------- | :--------------------- | | `github.com/go-logr/logr` | `v1.4.3` -> `v1.4.4` | | `go.opentelemetry.io/otel` | `v1.44.0` -> `v1.45.0` | | `go.opentelemetry.io/otel/metric` | `v1.44.0` -> `v1.45.0` |

Conventional Commits / Validate commit messages (pull_request) Successful in 3s

Details

release / release-changelog (pull_request) Failing after 25s

Details

GO lint & test / check (pull_request) Failing after 2m0s

Details

Build PR Image / Build & push container image (pull_request) Successful in 2m15s

Details

Build PR Image / build-container (pull_request) Successful in 0s

Details

Build PR Image / Comment image tag on PR (pull_request) Failing after 1s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability:renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git switch renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git switch renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git rebase main

git switch main

git merge --ff-only renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git switch renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git rebase main

git switch main

git merge --no-ff renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git switch main

git merge --squash renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git switch main

git merge --ff-only renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git switch main

git merge renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

finkregh/renovate-docker-operator!52

No description provided.

Rows
Columns

fix(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] #52

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Details

Summary

Details

Proof of concept

Impact

Remediation

Severity

References

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

Details

Severity

References

Release Notes

v1.45.0: /v0.67.0/v0.21.0/v0.0.18

Overview

Added

Changed

Deprecated

Removed

Fixed

What's Changed

New Contributors

Configuration

ℹ️ Artifact update notice

File name: go.mod

Checkout

Merge

`v1.45.0`: /v0.67.0/v0.21.0/v0.0.18