v2.9.4

🔒 Security 🔒

• operations: Update Go to 1.26.5 and bump vendored golang.org/x/net and golang.org/x/text to fix CVE-2026-39822, CVE-2026-42504, CVE-2026-27145, CVE-2026-42505, CVE-2026-42507, CVE-2026-46600, and CVE-2026-56852 (#7641) (@mattdurham)
• deps: Update github.com/apache/thrift to v0.23.0 to pick up upstream security fixes. (#7119) (@renovate)
• deps: Update golang.org/x/crypto to v0.52.0 to pick up upstream security fixes. (#7258, #7343) (@renovate)
• deps: Update golang.org/x/net to v0.55.0 to pick up upstream security fixes. (#7128, #7259, #7371) (@renovate)
• deps: Update golang.org/x/sys to v0.44.0 to pick up upstream security fixes. (#7260) (@renovate)

🛑 Breaking changes 🛑

• distributor: Dropped support for the OpenCensus receiver. (#7323) (@zhxiaogg)

🧰 Bug fixes 🧰

• metrics-generator: Fix panic when write_relabel_configs is configured on remote write endpoints. (#7338) (@carles-grafana)