fix(security/unknown/): update module go.opentelemetry.io/otel to v1.44.0 [security] by renovate-sh-app[bot] · Pull Request #658 · grafana/plugin-validator

renovate-sh-app · 2026-07-24T23:01:53Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
go.opentelemetry.io/otel	indirect	minor	`v1.43.0` → `v1.44.0`

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

CVE-2026-41178 / GHSA-5wrp-cwcj-q835 / GO-2026-5158

More information

Details

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

`v1.44.0`: /v0.66.0/v0.20.0/v0.0.17

Compare Source

Added

Add ByteSlice and ByteSliceValue functions for new BYTESLICE attribute type in go.opentelemetry.io/otel/attribute. (#7948)
Apply attribute value limit to the KindBytes attribute type in go.opentelemetry.io/otel/sdk/log. (#7990)
Apply attribute value limit to the BYTESLICE attribute type in go.opentelemetry.io/otel/sdk/trace. (#7990)
Support BYTESLICE attributes in go.opentelemetry.io/otel/trace. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8153)
Add String method for Value type in go.opentelemetry.io/otel/attribute. (#8142)
Add Slice and SliceValue functions for new SLICE attribute type in go.opentelemetry.io/otel/attribute. (#8166)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8216)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8216)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8216)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8216)
Apply AttributeValueLengthLimit to attribute.SLICE type attribute values in go.opentelemetry.io/otel/sdk/trace, recursively truncating contained string values. (#8217)
Add Error field on Record type in go.opentelemetry.io/otel/log/logtest. (#8148)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8157)
Add Settable to go.opentelemetry.io/otel/metric/x to allow reusing attribute options. (#8178)
Add experimental support for splitting metric data across multiple batches in go.opentelemetry.io/otel/sdk/metric.
Set OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size> to enable for all periodic readers.
See go.opentelemetry.io/otel/sdk/metric/internal/x for feature documentation. (#8071)
Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc.
Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable.
See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x for feature documentation. (#8192)
Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp.
Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable.
See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x for feature documentation. (#8194)
Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutlog.
Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable.
See go.opentelemetry.io/otel/stdout/stdoutlog/internal/x for feature documentation. (#8263)
Add WithDefaultAttributes to go.opentelemetry.io/otel/metric/x to support setting default attributes on instruments. (#8135)
Add go.opentelemetry.io/otel/semconv/v1.41.0 package.
The package contains semantic conventions from the v1.41.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.40.0. (#8324)
Add Observable variants of instruments to go.opentelemetry.io/otel/semconv/v1.41.0 package. (#8350)
Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in go.opentelemetry.io/otel/semconv/v1.41.0. (#8002)

Changed

⚠️ Breaking Change: go.opentelemetry.io/otel/sdk/metric now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation.
New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing attribute.Bool("otel.metric.overflow", true).
This can break users who relied on the previous unlimited default.
Set WithCardinalityLimit(0) or the deprecated OTEL_GO_X_CARDINALITY_LIMIT=0 environment variable to preserve unlimited cardinality.
Note that support for OTEL_GO_X_CARDINALITY_LIMIT may be removed in a future release. (#8247)
ErrorType in go.opentelemetry.io/otel/semconv now unwraps errors created with fmt.Errorf when deriving the error.type attribute. (#8133)
go.opentelemetry.io/otel/sdk/log now unwraps error chains created with fmt.Errorf when deriving the error.type attribute from errors on log records. (#8133)
Set.MarshalLog method in go.opentelemetry.io/otel/attribute now uses Value.String formatting following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#8169)
Optimize go.opentelemetry.io/otel/sdk/metric to return a drop reservoir and short-circuit Offer calls to the exemplar reservoir when exemplar.AlwaysOffFilter is configured. (#8211) (#8267)
Optimize go.opentelemetry.io/otel/sdk/metric to return a drop reservoir for asynchronous instruments when exemplar.TraceBasedFilter is configured. (#8286)

Deprecated

Deprecate Value.Emit method in go.opentelemetry.io/otel/attribute.
Use Value.String instead. (#8176)

Fixed

Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Fix gzipped request body replay on redirect in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8135)
Fix gzipped request body replay on redirect in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8152)
go.opentelemetry.io/otel/exporters/prometheus now uses Value.String formatting for label values following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#8170)
Propagate errors from the exporter when calling Shutdown on BatchSpanProcessor in go.opentelemetry.io/otel/sdk/trace. (#8197)
Fix stale status code reporting on self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8226)
Fix a concurrent Collect data race and potential panic in go.opentelemetry.io/otel/exporters/prometheus when WithResourceAsConstantLabels option is used. (#8227)
Fix race condition in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by reverting #7447. (#8249)
Fix FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar to safely handle zero size.
A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in Offer() and Collect() ensure no-op behavior. (#8295)
Fix counting of spans and logs in self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8254)
Drop conflicting scope attributes named name, version, or schema_url from metric labels in go.opentelemetry.io/otel/exporters/prometheus, preserving the dedicated otel_scope_name, otel_scope_version, and otel_scope_schema_url labels. (#8264)
Close schema files opened by ParseFile in go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1. (GHSA-995v-fvrw-c78m)
Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation. (#8222)
Fix go.opentelemetry.io/otel/semconv/v1.41.0 to include Attr* helper methods for required attributes on observable instruments. (#8361)
Limit baggage extraction error reporting in go.opentelemetry.io/otel/propagation to prevent malformed or oversized baggage headers from flooding logs. (GHSA-5wrp-cwcj-q835)

What's Changed

Document how to implement experimental features by @dashpole in #8124
Add support for experimental options in the metrics API by @dashpole in #8111
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to e5db982 by @renovate[bot] in #8136
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 32cd848 by @renovate[bot] in #8141
fix(deps): update googleapis to 6f92a3b by @renovate[bot] in #8140
chore(deps): update module github.com/jgautheron/goconst to v1.10.0 by @renovate[bot] in #8134
attribute: add BYTESLICE type support by @NesterovYehor in #7948
unwrap error chains created with fmt.Errorf by @pellared in #8133
log/logtest: add Error field to Record type by @pellared in #8148
attribute: add String method for Value type by @pellared in #8142
fix(deps): update module golang.org/x/sys to v0.43.0 by @renovate[bot] in #8156
chore(deps): update codspeedhq/action action to v4.13.1 by @renovate[bot] in #8155
fix(otlploghttp): replay gzipped bodies on redirect by @MrAlias in #8152
Improve test coverage for exponential histogram edge cases by @dashpole in #8129
Add example test for the prometheus exporter by @dashpole in #8137
chore(deps): update golang.org/x/telemetry digest to 93c7c8a by @renovate[bot] in #8158
chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by @renovate[bot] in #8161
chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by @renovate[bot] in #8159
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 6b4d2bc by @renovate[bot] in #8160
Add experimental support for batching in periodic reader by @dashpole in #8071
chore(deps): update golang.org/x by @renovate[bot] in #8165
Support BYTESLICE attributes across trace and exporter paths by @MrAlias in #8153
chore(deps): update golang.org/x by @renovate[bot] in #8171
fix(deps): update module golang.org/x/tools to v0.44.0 by @renovate[bot] in #8173
metricdatatest: support BYTESLICE attribute comparisons by @pellared in #8167
test: add test case for ByteSlice in TestValueFromAttribute by @pellared in #8168
attribute: Set.MarshalLog to use Value.String instead of Value.Emit by @pellared in #8169
prometheus: use Value.String instead of Value.Emit by @pellared in #8170
fix(deps): update golang.org/x to 746e56f by @renovate[bot] in #8175
Add support for the development attributes advisory parameter by @dashpole in #8135
chore(deps): update actions/upload-artifact action to v7.0.1 by @renovate[bot] in #8177
attribute: deprecate Value.Emit by @pellared in #8176
chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by @renovate[bot] in #8181
chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by @renovate[bot] in #8180
chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by @renovate[bot] in #8182
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.56.0 by @renovate[bot] in #8184
Update semconv template and 1.40.0 to use Enabled for metrics by @dashpole in #8172
Add x.Settable to allow reusing attribute options by @dashpole in #8178
chore(deps): update actions/cache action to v5.0.5 by @renovate[bot] in #8187
fix(deps): update googleapis to 3e5c5a5 by @renovate[bot] in #8190
fix(otlpmetrichttp): replay gzipped bodies on redirect by @pellared in #8185
fix(deps): update module golang.org/x/vuln to v1.2.0 by @renovate[bot] in #8193
fix(deps): update googleapis to afd174a by @renovate[bot] in #8195
chore(deps): update module github.com/dave/dst to v0.27.4 by @renovate[bot] in #8198
Fix exemplar tests in containerized environments by @dashpole in #8188
Update contributing to recommend using Enabled by @dashpole in #8189
otlptracehttp: reset pooled gzip writer before reuse by @pellared in #8196
chore(deps): update golang.org/x/telemetry digest to fac6e1c by @renovate[bot] in #8202
fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.3 by @renovate[bot] in #8207
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 07c9668 by @renovate[bot] in #8206
attribute: make TestHashKVs linear-time by @pellared in #8204
chore(deps): update github/codeql-action action to v4.35.2 by @renovate[bot] in #8208
sdk/trace: propagate SpanExporter.Shutdown error from BatchSpanProcessor by @alliasgher in #8197
add GitHub Copilot code review instructions by @pellared in #8212
chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.29.0 by @renovate[bot] in #8214
attribute: add SLICE type support by @pellared in #8166
Fix typos found by copilot by @dashpole in #8221
chore(deps): update module github.com/go-git/go-git/v5 to v5.18.0 by @renovate[bot] in #8223
docs: add agent guide for autonomous coding agents by @pellared in #8215
test: truncate attribute string values using Unicode rune count by @pellared in #8219
sdk/trace: apply AttributeValueLengthLimit to attribute.SLICE by @pellared in #8217
chore(deps): update module github.com/dlclark/regexp2 to v1.12.0 by @renovate[bot] in #8229
prometheus: fix Collect data race for constant resource labels by @pellared in #8227
exporters: support SLICE attributes by @pellared in #8216
chore(deps): update codspeedhq/action action to v4.14.0 by @renovate[bot] in #8234
Fix stale status code reporting on self-observability metrics by @dashpole in #8226
fix(deps): update googleapis to e10c466 by @renovate[bot] in #8241
fix(deps): update build-tools to v0.30.0 by @renovate[bot] in #8244
[chore] changelog: re-run workflow on PR title edits by @cijothomas in #8246
stdlog observ: remove partial success handling by @yumosx in #8174
feat: add self-observability metrics to otlpmetrichttp metric exporters by @dashpole in #8194
chore(deps): update golang.org/x/telemetry digest to 392afab by @renovate[bot] in #8248
Use a DropReservoir when an exemplar.AlwaysOffFilter is provided by @dashpole in #8211
metric: clarify sync vs observable Gauge in package godoc by @alliasgher in #8225
sdk/metric: apply default cardinality limit of 2000 by @pellared in #8247
Revert "Optimize fixedsize reservoir (#7447)" by @dashpole in #8249
fix(deps): update module golang.org/x/vuln to v1.3.0 by @renovate[bot] in #8256
chore(deps): update otel/weaver docker tag to v0.23.0 by @renovate[bot] in #8255
Run benchmarks using Settable for more accurate comparrisons by @dashpole in #8252
Add MaxRequestSize option to OTLP exporters by @pellared in #8157
fix counting of spans/logs in self-observability metrics in otlp trace and log exporters by @dashpole in #8254
fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 2f88a58 by @renovate[bot] in #8260
chore(deps): update golang.org/x/telemetry digest to 329d219 by @renovate[bot] in #8259
chore(deps): update module github.com/sourcegraph/go-diff to v0.8.0 by @renovate[bot] in #8262
chore(deps): update module github.com/mattn/go-isatty to v0.0.22 by @renovate[bot] in #8265
chore(deps): update module go.uber.org/zap to v1.28.0 by @renovate[bot] in #8269
fix(deps): update googleapis to 7cedc36 by @renovate[bot] in #8266
chore(deps): update module github.com/securego/gosec/v2 to v2.26.1 by @renovate[bot] in #8270
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.57.0 by @renovate[bot] in #8275
chore(deps): update codspeedhq/action action to v4.15.0 by @renovate[bot] in #8272
chore(deps): update golang.org/x/telemetry digest to 76f71b9 by @renovate[bot] in #8271
Apply attribute value limit for BYTESLICE and KindBytes by @NesterovYehor in #7990
chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.0 by @renovate[bot] in #8277
chore(deps): update module github.com/fsnotify/fsnotify to v1.10.0 by @renovate[bot] in #8280
chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.1 by @renovate[bot] in #8281
Prometheus Exporter: Drop Scope attributes name, version and schema_url by @ArthurSens in #8264
attribute: split HashKVs benchmark by value type by @pellared in #8268
[chore] metric: document Enabled and WithAttributeSet in package docs by @cijothomas in #8245
chore(deps): update module github.com/bombsimon/wsl/v5 to v5.8.0 by @renovate[bot] in #8287
fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0 by @renovate[bot] in #8283
chore(deps): update module github.com/pjbgf/sha1cd to v0.6.0 by @renovate[bot] in #8288
Optimize metrics sdk measurement with AlwaysOff exemplar filter by @dashpole in #8267
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.0 by @renovate[bot] in #8290
chore(deps): update github/codeql-action action to v4.35.3 by @renovate[bot] in #8289
chore(deps): update github.com/charmbracelet/ultraviolet digest to 6603726 by @renovate[bot] in #8291
chore(deps): update github.com/golangci/rowserrcheck digest to 8d53bbc by @renovate[bot] in #8292
chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.1 by @renovate[bot] in #8293
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.1 by @renovate[bot] in #8294
chore(deps): update module github.com/ryancurrah/gomodguard/v2 to v2.1.3 by @renovate[bot] in #8296
fix(deps): update module google.golang.org/grpc to v1.81.0 by @renovate[bot] in #8298
chore(deps): update module github.com/fsnotify/fsnotify to v1.10.1 by @renovate[bot] in #8300
chore(deps): update module github.com/uudashr/iface to v1.4.2 by @renovate[bot] in #8301
fix(deps): update googleapis to 60b97b3 by @renovate[bot] in #8303
chore(deps): update codspeedhq/action action to v4.15.1 by @renovate[bot] in #8307
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.2 by @renovate[bot] in #8308
chore(deps): update golang.org/x/telemetry digest to 5a0966d by @renovate[bot] in #8310
chore(deps): update module github.com/ghostiam/protogetter to v0.3.21 by @renovate[bot] in #8311
chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 by @renovate[bot] in #8312
chore(deps): update module github.com/jgautheron/goconst to v1.10.1 by @renovate[bot] in #8315
chore(deps): update github/codeql-action action to v4.35.4 by @renovate[bot] in #8318
chore(deps): update golang.org/x/telemetry digest to e88f59f by @renovate[bot] in #8317
chore(deps): update module github.com/raeperd/recvcheck to v0.3.0 by @renovate[bot] in #8314
fix(deps): update module golang.org/x/sys to v0.44.0 by @renovate[bot] in #8322
chore(deps): update module github.com/go-git/go-git/v5 to v5.19.0 by @renovate[bot] in #8313
chore(deps): update module github.com/abirdcfly/dupword to v0.1.8 by @renovate[bot] in #8316
chore(deps): update golang.org/x by @renovate[bot] in #8323
docs: Expand SIG meeting welcoming language by @cijothomas in #8319
chore(deps): update module mvdan.cc/gofumpt to v0.10.0 by @renovate[bot] in #8304
chore(deps): update golang.org/x by @renovate[bot] in #8325
chore(deps): update golang.org/x/telemetry digest to 42602be by @renovate[bot] in #8326
Fix benchmark ci by @XSAM in #8282
fix(deps): update golang.org/x by @renovate[bot] in #8327
chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.58.0 by @renovate[bot] in #8328
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.58.0 by @renovate[bot] in #8329
chore(deps): update github.com/charmbracelet/ultraviolet digest to c840852 by @renovate[bot] in #8331
fix(deps): update googleapis to 3700d41 by @renovate[bot] in #8332
fix: clear cached objects to enable GC by @ash2k in #8233
Generate and upgrade to semconv/v1.41.0 by @MrAlias in #8324
chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 by @renovate[bot] in #8345
chore: Skip benchmark workflow when only non-Go files change by @cijothomas in #8346
chore(deps): update github/codeql-action action to v4.35.5 by @renovate[bot] in #8341
Add max baggage length as limitation by @XSAM in #8222
Generating histogram boundaries from weaver.yaml by @itssaharsh in #8015
chore(deps): update codecov/codecov-action action to v6.0.1 by @renovate[bot] in #8342
chore(deps): update module github.com/kisielk/errcheck to v1.20.0 by @renovate[bot] in #8333
Add observable instrument variants to semconv v1.41.0 by @dashpole in #8350
fix(semconv): clear pooled slices to enable GC by @pellared in #8352
chore(deps): update actions/stale action to v10.3.0 by @renovate[bot] in #8355
chore(deps): update module github.com/uudashr/iface to v1.4.4 by @renovate[bot] in #8335
fix(deps): update module google.golang.org/grpc to v1.81.1 by @renovate[bot] in #8340
chore(deps): update module 4d63.com/gocheckcompilerdirectives to v1.4.0 by @renovate[bot] in #8334
chore(deps): update golang.org/x/telemetry digest to eab6ae5 by @renovate[bot] in #8348
fix(deps): update googleapis to aa98bba by @renovate[bot] in #8344
Fix semconv generation to include Attr helpers for required attributes on observable instruments by @dashpole in #8361
fix(deps): update golang.org/x by @renovate[bot] in #8363
chore(deps): update module github.com/antonboom/nilnil to v1.1.2 by @renovate[bot] in #8360
chore(deps): update module github.com/antonboom/errname to v1.1.2 by @renovate[bot] in #8359
chore(deps): update module github.com/uudashr/iface to v1.5.0 by @renovate[bot] in #8362
Fix Extrema failure test by @mujib77 in #8338
Fix receiver-naming issues from revive by @mmorel-35 in #8093
docs: clarify that View attribute filters do not apply to Exemplars by @Dipanshusinghh in #8339
Disable exemplar reservoir for asynchronous instruments by default by @dashpole in #8286
fix: handle FixedSizeReservoir size=0 without panic by @muskiteer in #8295
fix(deps): update module go.opentelemetry.io/collector/pdata to v1.59.0 by @renovate[bot] in #8373
chore(deps): update github/codeql-action action to v4.36.0 by @renovate[bot] in #8367
chore(deps): update module github.com/clickhouse/clickhouse-go-linter to v1.2.1 by @renovate[bot] in #8366
chore(deps): update github.com/charmbracelet/ultraviolet digest to 948f455 by @renovate[bot] in #8374
fix(deps): update googleapis to 0a33c5d by @renovate[bot] in #8369
add self observability for stdout exporter by @yumosx in #8263
sdk/metric: document unit-sensitivity of DefaultAggregationSelector by @alliasgher in #8224
semconvkit: add invariant test for histogram-exclusion rule by @thealpha93 in #8370
exporters/otlp: default max request size to 64 MiB by @pellared in #8365
fix(deps): update googleapis to 3dc84a4 by @renovate[bot] in #8375
fix(deps): update golang.org/x by [@re

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

…44.0 [security]

renovate-sh-app · 2026-07-24T23:01:55Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`go.opentelemetry.io/otel/metric`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/trace`	`v1.43.0` -> `v1.44.0`

fix(security/unknown/): update module go.opentelemetry.io/otel to v1.…

44a0d4c

…44.0 [security]

renovate-sh-app Bot requested a review from a team as a code owner July 24, 2026 23:01

renovate-sh-app Bot added automerge-security-update severity:UNKNOWN labels Jul 24, 2026

renovate-sh-app Bot requested review from Ukochka, academo and wbrowne July 24, 2026 23:01

github-project-automation Bot added this to Grafana Catalog Team Jul 24, 2026

github-project-automation Bot moved this to 📬 Triage in Grafana Catalog Team Jul 24, 2026

grafana-catalog-project-bot Bot moved this from 📬 Triage to 🔬 In review in Grafana Catalog Team Jul 27, 2026

academo approved these changes Jul 27, 2026

View reviewed changes

academo merged commit 52a4a2d into main Jul 27, 2026
14 checks passed

academo deleted the renovate/security-go.opentelemetry.iootel branch July 27, 2026 07:47

github-project-automation Bot moved this from 🔬 In review to 🚀 Shipped in Grafana Catalog Team Jul 27, 2026

grafana-plugins-platform-bot Bot mentioned this pull request Jul 27, 2026

chore(main): release plugin-validator 0.45.3 #654

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security/unknown/): update module go.opentelemetry.io/otel to v1.44.0 [security] - #658

fix(security/unknown/): update module go.opentelemetry.io/otel to v1.44.0 [security]#658
academo merged 1 commit into
mainfrom
renovate/security-go.opentelemetry.iootel

renovate-sh-app Bot commented Jul 24, 2026

Uh oh!

renovate-sh-app Bot commented Jul 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate-sh-app Bot commented Jul 24, 2026

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Details

Severity

References

Release Notes

v1.44.0: /v0.66.0/v0.20.0/v0.0.17

Added

Changed

Deprecated

Fixed

What's Changed

Configuration

Need help?

Uh oh!

renovate-sh-app Bot commented Jul 24, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v1.44.0`: /v0.66.0/v0.20.0/v0.0.17