Skip to content

Update go module minor/patch updates - #331

Merged
openshift-merge-bot[bot] merged 1 commit into
mainfrom
konflux/mintmaker/main/go-module-minorpatch-updates
Aug 10, 2026
Merged

Update go module minor/patch updates#331
openshift-merge-bot[bot] merged 1 commit into
mainfrom
konflux/mintmaker/main/go-module-minorpatch-updates

Conversation

@red-hat-konflux-kflux-prd-rh02

@red-hat-konflux-kflux-prd-rh02 red-hat-konflux-kflux-prd-rh02 Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/MicahParks/jwkset v0.11.2v0.11.3 age confidence
github.com/getkin/kin-openapi v0.145.0v0.146.0 age confidence
github.com/testcontainers/testcontainers-go v0.43.0v0.44.0 age confidence
github.com/testcontainers/testcontainers-go/modules/postgres v0.43.0v0.44.0 age confidence
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0v0.70.0 age confidence
go.opentelemetry.io/contrib/propagators/autoprop v0.69.0v0.70.0 age confidence
go.opentelemetry.io/otel v1.44.0v1.45.0 age confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0v1.45.0 age confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0v1.45.0 age confidence
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0v1.45.0 age confidence
go.opentelemetry.io/otel/sdk v1.44.0v1.45.0 age confidence
go.opentelemetry.io/otel/trace v1.44.0v1.45.0 age confidence

Release Notes

MicahParks/jwkset (github.com/MicahParks/jwkset)

v0.11.3

Compare Source

The purpose of this release is to programmatically identify IANA prohibited algorithms.

Thank you @​saluc28 for the contribution.

Relevant pull requests:

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.146.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.145.0...v0.146.0

testcontainers/testcontainers-go (github.com/testcontainers/testcontainers-go)

v0.44.0

Compare Source

What's Changed
🔒 Security
🚀 Features
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates
open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.45.0: /v0.67.0/v0.21.0/v0.0.18

Compare Source

Overview
Added
  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#​7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#​8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#​8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#​8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#​8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#​8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#​8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package.
    The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#​8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#​8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.
    The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#​8628)
Changed
  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#​8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#​8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#​8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#​8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#​8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#​8538)
Deprecated
  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#​8620)
Removed
  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#​8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#​8556)
Fixed
  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#​8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#​8389)
  • Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in go.opentelemetry.io/otel/attribute. (#​8402)
  • Fix histogram data point reuse in go.opentelemetry.io/otel/sdk/metric aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#​8403)
  • Avoid preallocating scope attributes when they are disabled in go.opentelemetry.io/otel/exporters/prometheus. (#​8404)
  • Support HTTP-date values in the HTTP Retry-After header when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8417)
  • Reduce histogram heap allocations by reusing BucketCounts and Exemplars slices across Collect cycles in the cumulative histogram aggregation in go.opentelemetry.io/otel/sdk/metric. (#​8428)
  • Fix go.opentelemetry.io/otel/exporters/stdout/stdouttrace self-observability to record error.type on the operation-duration histogram when the exportedSpans metric is disabled. (#​8432)
  • Stop including trace exporter endpoint configuration in internal logs from go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. (#​8438)
  • Fix invalid error formatting for out-of-range JSON code values in go.opentelemetry.io/otel/codes. (#​8497)
  • Clarify in go.opentelemetry.io/otel/log that Logger.Enabled should be checked for every log emission because its result may change over time. (#​8565)
  • Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in go.opentelemetry.io/otel/sdk/log. (#​8566)
  • Make WithAttributeCountLimit(0) and OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0 discard all log record attributes in go.opentelemetry.io/otel/sdk/log. (#​8570)
  • Clarify that the Record methods of Float64Histogram and Int64Histogram in go.opentelemetry.io/otel/metric expect non-negative values. (#​8574)
  • Clarify in go.opentelemetry.io/otel/log that LoggerProvider implementations should retain an empty Logger name instead of replacing it with a default. (#​8587)
  • Ensure that the built-in processors in go.opentelemetry.io/otel/sdk/log call exporter ForceFlush during Shutdown. (#​8599)
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem. (GHSA-42cj-99w8-cp2p)
  • Prevent processor operations in go.opentelemetry.io/otel/sdk/log from overlapping with processor shutdown or running after LoggerProvider shutdown. (#​8608)
  • Prevent BatchProcessor in go.opentelemetry.io/otel/sdk/log from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#​8620)
  • Make BatchProcessor in go.opentelemetry.io/otel/sdk/log return errors encountered while draining records during ForceFlush and Shutdown, while continuing to attempt later batches as long as the request context remains valid. (#​8620)
  • Keep the default BatchProcessor maximum export batch size in go.opentelemetry.io/otel/sdk/log at or below the configured maximum queue size. (#​8620)
What's Changed

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux-kflux-prd-rh02

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 11 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/contrib/propagators/aws v1.44.0 -> v1.45.0
go.opentelemetry.io/contrib/propagators/b3 v1.44.0 -> v1.45.0
go.opentelemetry.io/contrib/propagators/jaeger v1.44.0 -> v1.45.0
go.opentelemetry.io/contrib/propagators/ot v1.44.0 -> v1.45.0
github.com/go-logr/logr v1.4.3 -> v1.4.4
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/metric v1.44.0 -> v1.45.0
go.opentelemetry.io/proto/otlp v1.10.0 -> v1.11.0
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/grpc v1.82.0 -> v1.83.0

@openshift-ci
openshift-ci Bot requested review from Ruclo and ma-hill August 10, 2026 00:04
@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Updated underlying libraries and observability components to newer versions.
    • Improved compatibility with current gRPC, OpenTelemetry, logging, and API tooling ecosystems.
    • Included routine maintenance updates to support continued reliability, interoperability, and smoother integration with modern infrastructure and service environments.

Walkthrough

Updated go.mod dependency versions for JWK, OpenAPI, Testcontainers, OpenTelemetry, logging, Genproto, protobuf, and gRPC modules. OpenTelemetry modules moved from the 1.44/0.69 series to 1.45/0.70. gRPC-related modules moved from v1.82.0 to v1.83.0. No exported or public entities changed.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ruclo, ma-hill


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Sec-02: Secrets In Log Output ❌ Error CWE-532: request logging emits slog.Any("headers", maskedHeaders); masking returns raw headers when disabled, so Authorization tokens can reach logs. Never log raw headers. Always redact Authorization, API-key, cookie, and token headers, including when masking is disabled or the masker is nil.
✅ Passed checks (10 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No Hardcoded Secrets ✅ Passed Only go.mod and go.sum changed; 48 encoded additions are valid Go h1 checksums, with no secret assignments, private-key markers, or credentialed URLs (CWE-798).
No Weak Cryptography ✅ Passed Patch changes only go.mod/go.sum; no weak-crypto references were added. jwkset's unchanged SHA-1 use computes X5T certificate thumbprints, not HMACs, signatures, or password hashes.
No Injection Vectors ✅ Passed HEAD^..HEAD changes only go.mod/go.sum; additions are dependency versions/checksums, with no SQL formatting, exec.Command, template.HTML, or yaml.Unmarshal sinks (CWE-89/-78/-79/-502).
No Privileged Containers ✅ Passed The PR changes only go.mod and go.sum. Production Helm defaults run non-root with privilege escalation disabled; Dockerfile USER root has an install-time justification and switches to non-root. No...
No Pii Or Sensitive Data In Logs ✅ Passed HEAD changes only dependency versions and checksums in go.mod/go.sum; no logging statements, request bodies, PII, session IDs, or host credentials were added.
Title check ✅ Passed The title clearly identifies the Go module minor and patch dependency updates in the changeset.
Description check ✅ Passed The description directly documents the dependency updates and their version changes.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch konflux/mintmaker/main/go-module-minorpatch-updates
✨ Simplify code
  • Create PR with simplified code
  • Commit simplified code in branch konflux/mintmaker/main/go-module-minorpatch-updates

Comment @coderabbitai help to get the list of available commands.

@hyperfleet-ci-bot

hyperfleet-ci-bot Bot commented Aug 10, 2026

Copy link
Copy Markdown

Risk Score: 0 — risk/low

Signal Detail Points
PR size 142 lines +0
Sensitive paths none +0

Computed by hyperfleet-risk-scorer

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
go.mod (1)

30-36: 🎯 Functional Correctness | 🔵 Trivial

Run the standard dependency validation.

createExporter does not call WithEndpointURL; otlptracehttp.New(ctx) uses OTEL_EXPORTER_OTLP_ENDPOINT as a base and appends /v1/traces. This repository has no OpenTelemetry Logs API imports. Run make generate-all, go mod download, and make verify-all in trusted CI.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 30 - 36, Run the standard dependency validation in
trusted CI by executing make generate-all, go mod download, and make verify-all;
do not modify createExporter or add OpenTelemetry Logs API dependencies, since
the existing otlptracehttp.New behavior and imports are valid.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Around line 30-36: Run the standard dependency validation in trusted CI by
executing make generate-all, go mod download, and make verify-all; do not modify
createExporter or add OpenTelemetry Logs API dependencies, since the existing
otlptracehttp.New behavior and imports are valid.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1301464e-ab6a-4825-9abe-59e00e2eb736

📥 Commits

Reviewing files that changed from the base of the PR and between cf39733 and 45f080b.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum, !**/go.sum
📒 Files selected for processing (1)
  • go.mod
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
@red-hat-konflux-kflux-prd-rh02
red-hat-konflux-kflux-prd-rh02 Bot force-pushed the konflux/mintmaker/main/go-module-minorpatch-updates branch from 45f080b to ec89c2d Compare August 10, 2026 12:03
@rafabene

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rafabene

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit 1c3ba97 into main Aug 10, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant