[dependabot]

Bumps the golang group with 8 updates in the / directory:

Package	From	To
github.com/gin-contrib/sessions	1.1.1	1.1.2
github.com/go-ldap/ldap/v3	3.4.14	3.4.15
go.mongodb.org/mongo-driver/v2	2.9.1	2.9.2
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin	0.71.0	0.72.0
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk	1.46.0	1.47.0

Updates github.com/gin-contrib/sessions from 1.1.1 to 1.1.2

Release notes

Sourced from github.com/gin-contrib/sessions's releases.

v1.1.2

Changelog

Others

• 30faf8469f7727b2b78dd4409745bb62991753da: chore(deps)!: fix Trivy security findings (#313) (@​appleboy)

Commits

• 30faf84 chore(deps)!: fix Trivy security findings (#313)
• See full diff in compare view

Updates github.com/go-ldap/ldap/v3 from 3.4.14 to 3.4.15

Release notes

Sourced from github.com/go-ldap/ldap/v3's releases.

v3.4.15

What's Changed

• guard malformed attribute in unpackAttributes by @​netliomax25-code in go-ldap/ldap#612
• bump Go to 1.26/1.27 in CI and update GitHub Actions to latest major versions by @​t2y in go-ldap/ldap#624
• fix: identify RFC 4533 sync control members by tag, not by count by @​youdie006 in go-ldap/ldap#625
• chore: resolve staticcheck findings and repair the make targets by @​t2y in go-ldap/ldap#631
• extended: wrap requestValue as RFC 4511 [1] OCTET STRING by @​team-humaki in go-ldap/ldap#628
• fix: validate closing parenthesis in compound and grouped filters (#633) by @​littfed in go-ldap/ldap#635
• fix: reject malformed packets via shared child-count and bounds checks by @​cpuschma in go-ldap/ldap#632
• Expose ResultCode and DiagnosticMessage on SearchResult by @​Pujathacker2210 in go-ldap/ldap#626
• fix: navigate LDAPMessage envelope in parseLDAPResult by @​cpuschma in go-ldap/ldap#636
• fix: reject out-of-range resultCode in GetLDAPError by @​netliomax25-code in go-ldap/ldap#640
• fix: return error for unexpected response in ModifyWithResult by @​netliomax25-code in go-ldap/ldap#639

New Contributors

• @​youdie006 made their first contribution in go-ldap/ldap#625
• @​team-humaki made their first contribution in go-ldap/ldap#628
• @​littfed made their first contribution in go-ldap/ldap#635
• @​Pujathacker2210 made their first contribution in go-ldap/ldap#626

Full Changelog: go-ldap/ldap@v3.4.14...v3.4.15

Commits

• e614cf9 fix: return error for unexpected response in ModifyWithResult (#639)
• f3f0153 fix: reject out-of-range resultCode before narrowing to uint16 (#640)
• f8db69e Modify README for testing and server commands
• 05f305f fix: navigate LDAPMessage envelope in parseLDAPResult (#636)
• ca8bcfa feat: expose ResultCode and DiagnosticMessage on SearchResult (#626)
• f3d2070 fix: export ErrMalformedPacket sentinel
• 0c9a799 fix: address review feedback on malformed-packet hardening
• b73a2ec fix: reject malformed packets via shared child-count and bounds checks
• e4851f6 fix: validate closing parenthesis in compound and grouped filters (#633) (#635)
• 90c6466 extended: wrap requestValue as RFC 4511 [1] OCTET STRING (#628)
• Additional commits viewable in compare view

Updates go.mongodb.org/mongo-driver/v2 from 2.9.1 to 2.9.2

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.9.2

The MongoDB Go Driver Team is pleased to release version 2.9.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] Go Driver versions v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite. The fix shipped in v2.8.2 but was not included in v2.9.0 or v2.9.1. This release restores the fix for the 2.9 line. Users on v2.9.0 or v2.9.1 are encouraged to upgrade to Go Driver v2.9.2 as soon as possible. Go Driver v1 is not affected.

[!WARNING]
Go Driver versions v1.1.0 and later and v2.0.0 through v2.9.1 are affected by a security issue CVE-2026-107325 in the bson.RawArray.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.2 as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

This release addresses CVE-2026-107325, a security issue in calling bson.RawArray.Validate. Calling bson.RawArray.Validate on an array whose declared length is 0 causes a runtime panic.

It also restores a fix from v2.8.1 that was likewise missing from v2.9.0 and v2.9.1: when a command's first attempt failed with a server error and the retry reported NoWritesPerformed, operations such as Database.RunCommand could return a nil error instead of the server error. They now return the original server error.

Sessions now inherit timeoutMS from the client, so operations run in a session honor the client-level timeout.

What's Changed

🐛 Fixed

• GODRIVER-4142: Inherit timeoutMS at the session level (#2586) by @​prestonvasquez in mongodb/mongo-go-driver#2598
• GODRIVER-4135 Reject negative uncompressed size in DecompressPayload. by @​qingyang-hu in mongodb/mongo-go-driver#2607
• GODRIVER-4083 fix duplicate error logging for network error by @​ayesha-ilm in mongodb/mongo-go-driver#2595
• GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing by @​rajath201 in mongodb/mongo-go-driver#2591
• GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 characters by @​zigzagdev in mongodb/mongo-go-driver#2564
• GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branch by @​rajath201 in mongodb/mongo-go-driver#2638
• GODRIVER-4075 Return an error if there are invalid characters in the … by @​prestonvasquez in mongodb/mongo-go-driver#2665
• GODRIVER-4088 Return the server error when the first attempt fails wi… by @​prestonvasquez in mongodb/mongo-go-driver#2666

Full Changelog: mongodb/mongo-go-driver@v2.9.1...v2.9.2

Commits

• df261dc BUMP v2.9.2
• 16b6195 GODRIVER-4088 Return the server error when the first attempt fails wi… (#2666)
• de647b7 GODRIVER-4075 Return an error if there are invalid characters in the … (#2665)
• 59c2e6b GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branc...
• 15edca6 GODRIVER-4138 Latest server binary downloads require private S3. (#2660)
• 74278b9 GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 ch...
• 13954c2 GODRIVER-4168: Authenticate the Claude review with the drivers PR bot app (#2...
• 8f9da57 GODRIVER-4168: Run Claude review only when the claude-review label is applied...
• 44ee9af GODRIVER-4168: Add Claude GitHub workflow (#2632)
• a097394 GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing (#...
• Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin from 0.71.0 to 0.72.0

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin's changelog.

[1.47.0/2.6.0/0.72.0/0.38.0/0.27.0/0.21.0/0.17.0/0.19.0] - 2026-10-03

Added

• Add NewResourceDetectorWithOptions and the WithAWSLogger option to go.opentelemetry.io/contrib/detectors/aws/ec2/v2, allowing a custom AWS SDK logging.Logger to be supplied to the EC2 resource detector. (#9132)
• Add go.opentelemetry.io/contrib/detectors/openshift, a new resource detector for OpenShift 4 clusters, ported from processor/resourcedetectionprocessor/internal/openshift in opentelemetry-collector-contrib. Detects k8s.cluster.name, and cloud.provider, cloud.platform and cloud.region for clusters running on AWS, Google Cloud and IBM Cloud; Azure clusters report cloud.provider and cloud.platform only. (#9499)
• Add go.opentelemetry.io/contrib/detectors/kubeadm, a new resource detector for kubeadm-provisioned Kubernetes clusters, ported from processor/resourcedetectionprocessor/internal/kubeadm in opentelemetry-collector-contrib. Detects k8s.cluster.name from the ClusterConfiguration document in the kube-system/kubeadm-config ConfigMap and k8s.cluster.uid from the kube-system namespace UID. (#9500)

Changed

• Client metrics in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp no longer include attributes from the server-side Labeler, preventing attributes such as http.route from leaking into outbound requests. This is a breaking change for applications that use ContextWithLabeler to add custom client metric attributes: use ContextWithClientLabeler / ClientLabelerFromContext or the WithMetricAttributesFn option instead. Server-side use of ContextWithLabeler / LabelerFromContext is unchanged. (#8924)
• Stop emitting the legacy http.read_bytes and http.wrote_bytes attributes on the per-operation span events enabled by WithMessageEvents in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. The read and write events remain, while total body sizes continue to be recorded on the server span as http.request.body.size and http.response.body.size according to HTTP semantic conventions. (#9624)

Deprecated

• Deprecate go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws. (#9707)
• Deprecate go.opentelemetry.io/contrib/propagators/aws. (#9706)
• Deprecate go.opentelemetry.io/contrib/samplers/probability/consistent. (#9633)
• Deprecate ReadBytesKey, ReadErrorKey, WroteBytesKey, and WriteErrorKey in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. The identifiers remain available and their values are unchanged, but WithMessageEvents no longer emits http.read_bytes or http.wrote_bytes. There is no semantic-convention replacement for per-read or per-write byte counts or the human-readable error fields. Use HTTPRequestBodySizeKey and HTTPResponseBodySizeKey from go.opentelemetry.io/otel/semconv/v1.43.0 to record total body sizes on the span. If an error causes the HTTP request to fail, set the span status to Error and record ErrorType(err) from go.opentelemetry.io/otel/semconv/v1.43.0 on the span. (#9624)

Fixed

• Treat empty Prometheus exporter environment variable values as unset in go.opentelemetry.io/contrib/exporters/autoexport, restoring the documented defaults. (#9636)
• Bound converter-owned recursive map, slice, array, and pointer traversal in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. A field requiring more than 100 such levels is replaced with <max-depth-exceeded> and the record continues to be emitted. Existing fmt and user-method behavior remains unchanged. (#9691)
• Format span attributes in go.opentelemetry.io/contrib/zpages using attribute.Value.String instead of the deprecated attribute.Value.Emit, following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#9453)
• Set error.type on the span and on the request-duration, request-body-size, and response-body-size metrics when a client disconnects mid-request in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin, using the request context's cancellation error as the classification source when the handler has not already recorded an error via c.Error. Previously a disconnect was recorded with span status Error and no error.type, indistinguishable from a genuine server fault. (#9394)
• Report Prometheus metrics HTTP server errors in go.opentelemetry.io/contrib/otelconf when using the v0.2.0 configuration schema. The error check was inverted, so a clean shutdown (http.ErrServerClosed) was reported as unexpected while real Serve errors were ignored. (#9653)
• Fix temporary file cleanup for multipart requests in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp by copying the parsed multipart form back to the original request during deferred cleanup, preserving net/http cleanup during panic unwinding for HTTP/2 panic handling and outer recovery middleware paths. Unrecovered HTTP/1 handler panics remain uncleaned because net/http skips finishRequest in that path. (#9685)
• Fix http.client.request.body.size recording for streaming request bodies in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8684)
• Bound Kubernetes ConfigMap requests in go.opentelemetry.io/contrib/detectors/aws/eks with a 10-second timeout so Detect cannot hang indefinitely when the caller-provided context has no deadline. (#9419)

Removed

• Drop support for [Go 1.25]. (#9584)
• Remove go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho. Use github.com/labstack/echo-opentelemetry instead. (#9613)

Commits

• 0c76f61 Release v1.47.0/v2.6.0/v0.72.0/v0.38.0/v0.27.0/v0.21.0/v0.17.0/v0.19.0 (#9802)
• 318f5f9 Add timeout on Kubernetes API calls for EKS detector (#9419)
• f848a15 test(detector/ecs): increase unit test coverage (#9774)
• c0d84de Restore gofumpt clothe-returns and balance-calls (#9793)
• 6215054 fix(deps): update aws-sdk-go-v2 monorepo (#9785)
• 9a2e8ea fix(deps): update kubernetes monorepo to v0.37.1
• 3d8e338 chore(deps): update sigs.k8s.io/json digest to 11ed52e
• be5b688 chore(deps): update go-openapi packages
• e382b4d chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.4
• 97f9e88 fix(deps): update module github.com/moby/moby/client to v0.6.1
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.46.0 to 1.47.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.47.0/v0.69.0/v0.23.0/v0.1.0

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
• Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
• Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
• Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
• Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

• Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
• Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
• Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
• Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
• Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
• Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
• Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
• Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8801)
• Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#8849)
• Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#8873)
• Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#8864)
• Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#8815)
• Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#8844)
• Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in go.opentelemetry.io/otel/exporters/prometheus. (#8839)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.47.0/0.69.0/0.23.0/0.1.0] - 2026-10-02

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
• Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
• Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
• Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
• Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

• Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
• Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
• Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
• Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
• Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
• Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
• Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
• Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8801)
• Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#8849)
• Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#8873)
• Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#8864)
• Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#8815)
• Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#8844)

... (truncated)

Commits

• 66cfc95 Release 1.47.0/0.69.0/0.23.0/0.1.0 (#9024)
• f09d1de Merge commit from fork
• 017b08c Merge commit from fork
• d9d3ac2 Update ubuntu:26.04 Docker digest to 88a381d
• b240391 Update module github.com/uudashr/iface to v1.5.3
• 55899e3 Fix zero attribute value length for malformed UTF-8 (#9054)
• 75b1fe3 Update github.com/charmbracelet/ultraviolet digest to 8786532
• cce78ad Update github.com/golangci/rowserrcheck digest to f772fe6 (#9066)
• cdc6ee4 Update module github.com/pjbgf/sha1cd to v0.7.0
• ef11bfc chore: Replace deprecated gofumpt extra-rules with extra options (#9062)
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.46.0 to 1.47.0

Release notes

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp's releases.

v1.47.0/v0.69.0/v0.23.0/v0.1.0

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
• Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
• Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
• Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
• Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

• Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
• Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
• Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
• Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
• Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
• Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
• Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
• Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8801)
• Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#8849)
• Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#8873)
• Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#8864)
• Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#8815)
• Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#8844)
• Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in go.opentelemetry.io/otel/exporters/prometheus. (#8839)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp's changelog.

[1.47.0/0.69.0/0.23.0/0.1.0] - 2026-10-02

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
• Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
• Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
• Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
• Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

• Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
• Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
• Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
• Prevent precision loss for large Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.