fix(deps): vuln minor upgrades — 10 packages (minor: 8 · patch: 2) [src/accountingservice]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 10 packages upgraded (MINOR changes included)

Manifests changed:

• src/accountingservice (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
google.golang.org/grpc	v1.59.0	v1.80.0	minor	Direct	3 CRITICAL
go.opentelemetry.io/otel/sdk	v1.20.0	v1.43.0	minor	Direct	1 HIGH
google.golang.org/protobuf	v1.31.0	v1.36.11	minor	Direct	2 MODERATE
github.com/IBM/sarama	v1.42.1	v1.47.0	minor	Direct	-
go.opentelemetry.io/otel	v1.20.0	v1.43.0	minor	Direct	-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.20.0	v1.43.0	minor	Direct	-
go.opentelemetry.io/otel/trace	v1.20.0	v1.43.0	minor	Direct	-
google.golang.org/grpc/cmd/protoc-gen-go-grpc	v1.3.0	v1.6.1	minor	Direct	-
github.com/golang/protobuf	v1.5.3	v1.5.4	patch	Direct	-
github.com/sirupsen/logrus	v1.9.3	v1.9.4	patch	Direct	-

Packages marked with "-" are updated due to dependency constraints.

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
google.golang.org/grpc	GO-2026-4762	critical	Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc	v1.59.0	1.79.3
google.golang.org/grpc	GHSA-p77j-4mvh-x3m3	CRITICAL	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.59.0	1.79.3
google.golang.org/grpc	CVE-2026-33186	critical	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.59.0	-
go.opentelemetry.io/otel/sdk	GHSA-hfvc-g4fc-pqhx	HIGH	opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking	v1.20.0	1.43.0

ℹ️ Other Vulnerabilities (2)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
google.golang.org/protobuf	GHSA-8r3f-844c-mc37	MODERATE	Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON	v1.31.0	1.33.0
google.golang.org/protobuf	GO-2024-2611	MODERATE	Infinite loop in JSON unmarshaling in google.golang.org/protobuf	v1.31.0	1.33.0

⚠️ Dependencies that have Reached EOL (2)

Dependency	Unsafe Version	EOL Date	New Version	Path
github.com/golang/protobuf	v1.5.3	Mar 8, 2026	v1.5.4	src/accountingservice/go.mod
google.golang.org/grpc/cmd/protoc-gen-go-grpc	v1.3.0	Mar 1, 2026	v1.6.1	src/accountingservice/go.mod

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: Vulnerability Remediation (Critical/High)

🤖 Generated by DataDog Automated Dependency Management System

[campaigner-prod]

Release Notes

google.golang.org/grpc (v1.59.0 → v1.80.0) — GitHub Release

v1.80.0

Behavior Changes

• balancer: log a warning if a balancer is registered with uppercase letters, as balancer names should be lowercase. In a future release, balancer names will be treated as case-insensitive; see balancer: use case-sensitive balancer registries grpc/grpc-go#5288 for details. (balancer: introduce env flag for case-sensitive registry grpc/grpc-go#8837)
• xds: update resource error handling and re-resolution logic (xds: change cdsbalancer to use update from dependency manager grpc/grpc-go#8907)
  • Re-resolve all LOGICAL_DNS clusters simultaneously when re-resolution is requested.
  • Fail all in-flight RPCs immediately upon receipt of listener or route resource errors, instead of allowing them to complete.

Bug Fixes

• xds: support the LB policy configured in LOGICAL_DNS cluster resources instead of defaulting to pick_first. (xds/clusterresolver: implement gRFC A61 changes for LOGICAL_DNS clusters grpc/grpc-go#8733)
• credentials/tls: perform per-RPC authority validation against the leaf certificate instead of the entire peer certificate chain. (credentials/tls: verify overwritten authority against only leaf certificate grpc/grpc-go#8831)
• xds: enabling A76 ring hash endpoint keys no longer causes EDS resources with invalid proxy metadata to be NACKed when HTTP CONNECT (gRFC A86) is disabled. (xds: decouple A76 and A86 EDS metadata parsing grpc/grpc-go#8875)
• xds: validate that the sum of endpoint weights in a locality does not exceed the maximum uint32 value. (xds/xdsclient: add EDS sum of endpoint weights does not exceed MaxUint32 grpc/grpc-go#8899)
  • Special Thanks: @RAVEYUS
• xds: fix incorrect proto field access in the weighted round robin (WRR) configuration where blackout_period was used instead of weight_expiration_period. (xds: fix copy-paste bug in WeightExpirationPeriod config grpc/grpc-go#8915)
  • Special Thanks: @gregbarasch
• xds/rbac: handle addresses with ports in IP matchers. (xds/rbac: add additional handling for addresses with ports grpc/grpc-go#8990)

New Features

• ringhash: enable gRFC A76 (endpoint hash keys and request hash headers) by default. (ringhash: enable behaviors of A76 by default grpc/grpc-go#8922)

Performance Improvements

• credentials/alts: pool write buffers to reduce memory allocations and usage. (credentials/alts: Pool write buffers grpc/grpc-go#8919)
• grpc: enable the use of pooled write buffers for buffering HTTP/2 frame writes by default. This reduces memory usage when connections are idle. Use the WithSharedWriteBuffer dial option or the SharedWriteBuffer server

(truncated)

v1.79.3

Security

• server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (grpc: enforce strict path checking for incoming requests on the server grpc/grpc-go#8981)

v1.79.2

Bug Fixes

• stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (client: process RPC stats/tracing only when a handler is configured grpc/grpc-go#8874)

v1.79.1

Bug Fixes

• grpc: Remove the -dev suffix from the User-Agent header. (Change version to 1.79.1 grpc/grpc-go#8902)

v1.79.0

API Changes

• mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (mem: Allow overriding the default buffer pool. grpc/grpc-go#8806)
  • Special Thanks: @vanja-p
• experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (stats/otel: a79 scaffolding to register an async gauge metric and api to record it- part 3 grpc/grpc-go#8780)

Behavior Changes

• balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (xds: remove references to ResolverState.Addresses grpc/grpc-go#8841)

New Features

• experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (stats/otel: a79 scaffolding to register an async gauge metric and api to record it- part 3 grpc/grpc-go#8780)
• pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
  • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (*: Implementation of weighted random shuffling (A113) grpc/grpc-go#8864)
• xds: Implement :authority rewriting, as specified in gRFC A81. (xds: implement :authority header rewriting in xds_cluster_impl LB policy (gRFC A81) grpc/grpc-go#8779)
• balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (balancer/randomsubsetting: Implementation of the random_subsetting LB policy grpc/grpc-go#8650)
  • Special Thanks: @marek-szews

Bug Fixes

• credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (credentials/tls: Strip port before validating authority override grpc/grpc-go#8726)
  • Special Thanks: @Atul1710
• xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (priority: prevent init timer restarting when a child transitions from CONNECTING to CONNECTING grpc/grpc-go#8813)
• health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (grpc: initialize decompressor for health check streams grpc/grpc-go#8765)
  • Special Thanks: @sanki92
• transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (transport: http2 server must validates header list size when early aborting stream grpc/grpc-go#8769)
  • Special Thanks: @joybestourous
• server: Propagate status detail headers, if availab

(truncated)

v1.78.0

Behavior Changes

• client: Align URL validation with Go 1.26+ to now reject target URLs with unbracketed colons in the hostname. (dns: drop test depending on invalid URL "dns://::1/foo.bar.com" grpc/grpc-go#8716)
  • Special Thanks: @neild
• transport/client : Return status code Unknown on malformed grpc-status. (transport/client: Return status code Unknown on malformed grpc-status grpc/grpc-go#8735)
• • xds/resolver:

(truncated — see source for full notes)

go.opentelemetry.io/otel/sdk (v1.20.0 → v1.43.0) — GitHub Release

v1.43.0

Added

• Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
  for W3C Trace Context Level 2 Random Trace ID Flag support. (trace: add Random Trace ID Flag open-telemetry/opentelemetry-go#8012)
• Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (resource: add WithService detector option open-telemetry/opentelemetry-go#7642)
• Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (sdk/resource: add WithContext variants for Default and Environment (#7808) open-telemetry/opentelemetry-go#8051)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
  Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (Add support for the development per-series starttime feature open-telemetry/opentelemetry-go#8060)
• Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (sdk/metric: Support specifying cardinality limits per instrument kinds open-telemetry/opentelemetry-go#7855)

Changed

• Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
  The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
  See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (Revert "Revert "Generate semconv/v1.40.0"" open-telemetry/opentelemetry-go#7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (log: add error field to Record and make SDK to emit exception attributes open-telemetry/opentelemetry-go#7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (TracerProvider ForceFlush() Error Fix open-telemetry/opentelemetry-go#7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (support stdlib request.GetBody on metrics open-telemetry/opentelemetry-go#7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (fix: generated semconv helpers skipping attributes open-telemetry/opentelemetry-go#7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (Feat: Have SpanContext support the new W3C random flag. open-telemetry/opentelemetry-go#7834)

Removed

• Drop support for Go 1.24. (Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984)

What's Changed

• fix changelog protection marker by @pellared in fix changelog protection marker open-telemetry/opentelemetry-go#7986
• Drop support for Go 1.24 by @MrAlias in Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984
• fix(deps): update golang.org/x by @renovate[bot] in fix(deps): update golang.org/x open-telemetry/opentelemetry-go#7907
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @renovate[bot] in chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 open-telemetry/opentelemetry-go#7981
• chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @renovate[bot] in chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 open-telemetry/opentelemetry-go#7989
• fix(deps):

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

• Support testing of Go 1.26. (Support Go 1.26 open-telemetry/opentelemetry-go#7902)

Fixed

• Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (Comply with W3C Baggage specification limits open-telemetry/opentelemetry-go#7880)

What's Changed

(truncated — see source for full notes)

google.golang.org/protobuf (v1.31.0 → v1.36.11) — GitHub Release

v1.36.11

Full Changelog: protocolbuffers/protobuf-go@v1.36.10...v1.36.11

User-visible changes:
CL/726780: encoding/prototext: Support URL chars in type URLs in text-format.

Bug fixes:
CL/728680: internal/impl: check recursion limit in lazy decoding validation
CL/711015: reflect/protodesc: fix handling of import options in dynamic builds

Maintenance:
CL/728681: reflect/protodesc: add support for edition unstable
CL/727960: all: add EDITION_UNSTABLE support
CL/727940: types: regenerate using latest protobuf v33.2 release
CL/727140: internal/testprotos/lazy: convert .proto files to editions
CL/723440: cmd/protoc-gen-go: add missing annotations for few generated protobuf symbols.
CL/720980: internal/filedesc: remove duplicative Message.unmarshalOptions
CL/716360: internal/encoding/tag: use proto3 defaults if proto3
CL/716520: proto: un-flake TestHasExtensionNoAlloc
CL/713342: compiler/protogen: properly filter option dependencies in go-protobuf plugin.
CL/711200: proto: add test for oneofs containing messages with required fields
CL/710855: proto: add explicit test for a non-nil but empty byte slice

v1.36.10

Full Changelog: protocolbuffers/protobuf-go@v1.36.9...v1.36.10

Bug fixes:
CL/704415: reflect/protodesc: edition-2024-specific properties should not be lost when converting FileDescriptorProto to protoreflect.FileDescriptor

Maintenance:
CL/708555: internal/race_test: add missing impl.LazyEnabled() t.Skip
CL/703295: proto: add more invalid group encoding test cases
CL/703276: internal/impl: verify lazy unmarshal on Deterministic encoding
CL/703275: internal/impl: stop using deprecated .Field in lazy_test.go
CL/702795: all: update to latest github.com/google/go-cmp

v1.36.9

Full Changelog: protocolbuffers/protobuf-go@v1.36.8...v1.36.9

User-visible changes:
CL/699715: cmd/protoc-gen-go: add test for "import option" directive
CL/699115: internal/editionssupport: declare support for edition 2024
CL/697595: editions: Fix spelling mistake in panic message

v1.36.8

Maintenance:

CL/696316: all: set Go language version to Go 1.23
CL/696315: types: regenerate using latest protobuf v32 release

v1.36.7

Maintenance / optimizations:

CL/683955: encoding/protowire: micro-optimize SizeVarint (-20% on Intel)
CL/674055: internal/impl: remove unnecessary atomic access for non-lazy lists
CL/674015: impl: remove unnecessary nil check from presence.Present
CL/673495: types/descriptorpb: regenerate using latest protobuf v31 release
CL/670516: cmd/protoc-gen-go: centralize presence and lazy logic into filedesc
CL/670515: internal: move usePresenceForField to internal/filedesc
CL/670275: internal/impl: clean up usePresenceForField() (no-op)

v1.36.6

Full Changelog: protocolbuffers/protobuf-go@v1.36.5...v1.36.6

User-visible changes:
CL/657895: internal_gengo: generate a const string literal for the raw descriptor
CL/653536: proto: Add CloneOf[M Message](m M) M

Maintenance:
CL/649135: all: set Go language version to Go 1.22
CL/654955: types/descriptorpb: regenerate using latest protobuf v30 release

v1.36.5

Full Changelog: protocolbuffers/protobuf-go@v1.36.4...v1.36.5

Bug fixes:
CL/644437: protogen: fix name mangling for fields with identical GoCamelCase

Maintenance:
CL/641655: all: remove weak field support

v1.36.4

Full Changelog: protocolbuffers/protobuf-go@v1.36.3...v1.36.4

Bug fixes:
CL/642975: reflect/protodesc: fix panic when working with dynamicpb

Maintenance:

(truncated — see source for full notes)

github.com/IBM/sarama (v1.42.1 → v1.47.0) — GitHub Release

v1.47.0

What's Changed

🎉 New Features / Improvements

• perf(admin): modernize DescribeCluster RPC handling by @DCjanus in perf(admin): modernize DescribeCluster RPC handling IBM/sarama#3390
• test: expand Java interop tests to cover all compression codecs by @dnwe in test: expand Java interop tests to cover all compression codecs IBM/sarama#3423

🐛 Fixes

• fix(client): add nilguards to updateBroker by @dnwe in fix(client): add nilguards to updateBroker IBM/sarama#3393
• fix(broker): auto-close broken connections by @DCjanus in fix(broker): auto-close broken connections IBM/sarama#3412
• fix: set version from IBM/sarama, not main app by @adamdecaf in fix: set version from IBM/sarama, not main app IBM/sarama#3415

🔧 Maintenance

• chore: finish up the move to atomic types by @puellanivis in chore: finish up the move to atomic types IBM/sarama#3399
• chore: tear down zk in functional tests by @edoardocomar in chore: tear down zk in functional tests IBM/sarama#3420
• chore: migrate from eapache/go-xerial-snappy to klauspost/compress/sn… by @edoardocomar in chore: migrate from eapache/go-xerial-snappy to klauspost/compress/sn… IBM/sarama#3421
• fix(test): resolve FVT issues in Kafka v2.x interop tests by @edoardocomar in fix(test): resolve FVT issues in Kafka v2.x interop tests IBM/sarama#3424
• feat: add kafka 4.1.1 constants and use in FVT by @dnwe in feat: add kafka 4.1.1 constants and use in FVT IBM/sarama#3437
• chore: add Kafka 4.0.1 and replace 4.0.0 in FVT by @edoardocomar in chore: add Kafka 4.0.1 and replace 4.0.0 in FVT IBM/sarama#3439
• ci(lint): unblock Go 1.26 lint and handle gosec noise by @DCjanus in ci(lint): unblock Go 1.26 lint and handle gosec noise IBM/sarama#3454

📦 Dependency updates

• chore(deps): update module golang.org/x/crypto to v0.45.0 [security] → v0.48.0 by @renovate[bot] in chore(deps): update module golang.org/x/crypto to v0.45.0 [security] IBM/sarama#3383, chore(deps): update module golang.org/x/crypto to v0.48.0 - autoclosed IBM/sarama#3425
• chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 across /examples (consumergroup, exactly_once, sasl_scram_client, http_server, txn_producer, interceptors) by @dependabot[bot] in chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /examples/consumergroup IBM/sarama#3382, chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /examples/exactly_once IBM/sarama#3381, chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /examples/sasl_scram_client IBM/sarama#3380, chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /examples/http_server IBM/sarama#3379, chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /examples/txn_producer IBM/sarama#3378, chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /examples/interceptors IBM/sarama#3377
• fix(deps): update module golang.org/x/sync to v0.18.0 by @renovate[bot] in fix(deps): update module golang.org/x/sync to v0.18.0 IBM/sarama#3385
• fix(deps): upd

(truncated)

v1.46.3

What's Changed

🐛 Fixes

• fix: wrap KError into error returned by IncrementalAlterConfig by @prestona in fix: wrap KError into error returned by IncrementalAlterConfig IBM/sarama#3352
• fix: assign sequence when flushing retry buffers by @dnwe in fix: assign sequence when flushing retry buffers IBM/sarama#3362

📦 Dependency updates

• chore(deps): update dependency dominikh/go-tools to v2025 by @renovate[bot] in chore(deps): update dependency dominikh/go-tools to v2025 IBM/sarama#3351
• chore(deps): update dependency vearutop/teststat to v0.1.27 by @renovate[bot] in chore(deps): update dependency vearutop/teststat to v0.1.27 IBM/sarama#3350
• fix(deps): update module github.com/klauspost/compress to v1.18.1 by @renovate[bot] in fix(deps): update module github.com/klauspost/compress to v1.18.1 IBM/sarama#3355

🔧 Maintenance

• chore(ci): extract tool versions and add renovate customManagers by @dnwe in chore(ci): extract tool versions and add renovate customManagers IBM/sarama#3346

Full Changelog: IBM/sarama@v1.46.2...v1.46.3

v1.46.2

What's Changed

A big focus on improving our support for newer protocol versions in this release, particularly supporting a wider range of flexible versions

🎉 New Features / Improvements

• chore: support V5 ListOffsets by @dnwe in chore: support V5 ListOffsets IBM/sarama#3308
• feat: support DeleteGroups V2 protocol by @hindessm in feat: support DeleteGroups V2 protocol IBM/sarama#3320
• feat: support DeleteTopics V4 protocol by @hindessm in feat: support DeleteTopics V4 protocol IBM/sarama#3321
• feat: support CreateTopics V5 protocol by @hindessm in feat: support CreateTopics V5 protocol IBM/sarama#3322
• feat: support IncrementalAlterConfigs V1 protocol by @hindessm in feat: support IncrementalAlterConfigs V1 protocol IBM/sarama#3319
• feat: support DescribeGroups V5 protocol by @hindessm in feat: support DescribeGroups V5 protocol IBM/sarama#3331
• feat: support SyncGroup V4 protocol by @hindessm in feat: support SyncGroup V4 protocol IBM/sarama#3332
• feat: support LeaveGroup V4 protocol by @hindessm in feat: support LeaveGroup V4 protocol IBM/sarama#3334
• feat: support Heartbeat V4 protocol by @hindessm in feat: support Heartbeat V4 protocol IBM/sarama#3335
• feat: support JoinGroup V6 protocol by @hindessm in feat: support JoinGroup V6 protocol IBM/sarama#3339
• feat: support DescribeClientQuotas V1 protocol by @dnwe in feat: support DescribeClientQuotas V1 protocol IBM/sarama#3342

🐛 Fixes

• fix: update map rather than create a new map by @hindessm in fix: update map rather than create a new map IBM/sarama#3302
• fix: metadata_response valid version range by @hindessm in fix: metadata_response valid version range IBM/sarama#3304
• fix: add V4 as valid CreateTopicsResponse by @dnwe in fix: add V4 as valid CreateTopicsResponse IBM/sarama#3305
• fix: correct requiredVersion for DescribeLogDirsResponse by @dnwe in fix: correct requiredVersion for DescribeLogDirsResponse IBM/sarama#3306
• fix: extend TestAllocateBodyProtocolVersions for more testing by @dnwe in fix: extend TestAllocateBodyProtocolVersions for more testing IBM/sarama#3307
• fix: non-flexible ElectLeadersRequest V0/V1 encode/decode by @hindessm in https://git

(truncated)

v1.46.1

[!NOTE]
The go.mod directive has been bumped to 1.24.0 as the minimum version of Go required for the module. This was necessary to continue to receive updates from some of the third party dependencies that Sarama makes use of.

What's Changed

🎉 New Features / Improvements

• feat: support more describe log dirs versions (V2-V4) by @hindessm in feat: support more describe log dirs versions (V2-V4) IBM/sarama#3293
• feat: support V5 ListConsumerGroups protocol by @hindessm in feat: support V5 ListConsumerGroups protocol IBM/sarama#3292

(truncated — see source for full notes)

go.opentelemetry.io/otel (v1.20.0 → v1.43.0) — GitHub Release

v1.43.0

Added

• Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
  for W3C Trace Context Level 2 Random Trace ID Flag support. (trace: add Random Trace ID Flag open-telemetry/opentelemetry-go#8012)
• Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (resource: add WithService detector option open-telemetry/opentelemetry-go#7642)
• Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (sdk/resource: add WithContext variants for Default and Environment (#7808) open-telemetry/opentelemetry-go#8051)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
  Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (Add support for the development per-series starttime feature open-telemetry/opentelemetry-go#8060)
• Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (sdk/metric: Support specifying cardinality limits per instrument kinds open-telemetry/opentelemetry-go#7855)

Changed

• Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
  The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
  See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (Revert "Revert "Generate semconv/v1.40.0"" open-telemetry/opentelemetry-go#7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (log: add error field to Record and make SDK to emit exception attributes open-telemetry/opentelemetry-go#7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (TracerProvider ForceFlush() Error Fix open-telemetry/opentelemetry-go#7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (support stdlib request.GetBody on metrics open-telemetry/opentelemetry-go#7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (fix: generated semconv helpers skipping attributes open-telemetry/opentelemetry-go#7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (Feat: Have SpanContext support the new W3C random flag. open-telemetry/opentelemetry-go#7834)

Removed

• Drop support for Go 1.24. (Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984)

What's Changed

• fix changelog protection marker by @pellared in fix changelog protection marker open-telemetry/opentelemetry-go#7986
• Drop support for Go 1.24 by @MrAlias in Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984
• fix(deps): update golang.org/x by @renovate[bot] in fix(deps): update golang.org/x open-telemetry/opentelemetry-go#7907
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @renovate[bot] in chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 open-telemetry/opentelemetry-go#7981
• chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @renovate[bot] in chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 open-telemetry/opentelemetry-go#7989
• fix(deps):

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

• Support testing of Go 1.26. (Support Go 1.26 open-telemetry/opentelemetry-go#7902)

Fixed

• Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (Comply with W3C Baggage specification limits open-telemetry/opentelemetry-go#7880)

What's Changed

(truncated — see source for full notes)

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (v1.20.0 → v1.43.0) — GitHub Release

v1.43.0

Added

• Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
  for W3C Trace Context Level 2 Random Trace ID Flag support. (trace: add Random Trace ID Flag open-telemetry/opentelemetry-go#8012)
• Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (resource: add WithService detector option open-telemetry/opentelemetry-go#7642)
• Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (sdk/resource: add WithContext variants for Default and Environment (#7808) open-telemetry/opentelemetry-go#8051)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
  Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (Add support for the development per-series starttime feature open-telemetry/opentelemetry-go#8060)
• Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (sdk/metric: Support specifying cardinality limits per instrument kinds open-telemetry/opentelemetry-go#7855)

Changed

• Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
  The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
  See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (Revert "Revert "Generate semconv/v1.40.0"" open-telemetry/opentelemetry-go#7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (log: add error field to Record and make SDK to emit exception attributes open-telemetry/opentelemetry-go#7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (TracerProvider ForceFlush() Error Fix open-telemetry/opentelemetry-go#7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (support stdlib request.GetBody on metrics open-telemetry/opentelemetry-go#7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (fix: generated semconv helpers skipping attributes open-telemetry/opentelemetry-go#7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (Feat: Have SpanContext support the new W3C random flag. open-telemetry/opentelemetry-go#7834)

Removed

• Drop support for Go 1.24. (Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984)

What's Changed

• fix changelog protection marker by @pellared in fix changelog protection marker open-telemetry/opentelemetry-go#7986
• Drop support for Go 1.24 by @MrAlias in Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984
• fix(deps): update golang.org/x by @renovate[bot] in fix(deps): update golang.org/x open-telemetry/opentelemetry-go#7907
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @renovate[bot] in chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 open-telemetry/opentelemetry-go#7981
• chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @renovate[bot] in chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 open-telemetry/opentelemetry-go#7989
• fix(deps):

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

• Support testing of Go 1.26. (Support Go 1.26 open-telemetry/opentelemetry-go#7902)

Fixed

• Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (Comply with W3C Baggage specification limits open-telemetry/opentelemetry-go#7880)

What's Changed

(truncated — see source for full notes)

go.opentelemetry.io/otel/trace (v1.20.0 → v1.43.0) — GitHub Release

v1.43.0

Added

• Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
  for W3C Trace Context Level 2 Random Trace ID Flag support. (trace: add Random Trace ID Flag open-telemetry/opentelemetry-go#8012)
• Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (resource: add WithService detector option open-telemetry/opentelemetry-go#7642)
• Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (sdk/resource: add WithContext variants for Default and Environment (#7808) open-telemetry/opentelemetry-go#8051)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (attribute: change INVALID Type to EMPTY and mark INVALID as deprecated open-telemetry/opentelemetry-go#8038)
• Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
  Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (Add support for the development per-series starttime feature open-telemetry/opentelemetry-go#8060)
• Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (sdk/metric: Support specifying cardinality limits per instrument kinds open-telemetry/opentelemetry-go#7855)

Changed

• Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
  The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
  See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (Revert "Revert "Generate semconv/v1.40.0"" open-telemetry/opentelemetry-go#7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (log: add error field to Record and make SDK to emit exception attributes open-telemetry/opentelemetry-go#7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (TracerProvider ForceFlush() Error Fix open-telemetry/opentelemetry-go#7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (support stdlib request.GetBody on metrics open-telemetry/opentelemetry-go#7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (fix: generated semconv helpers skipping attributes open-telemetry/opentelemetry-go#7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (Feat: Have SpanContext support the new W3C random flag. open-telemetry/opentelemetry-go#7834)

Removed

• Drop support for Go 1.24. (Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984)

What's Changed

• fix changelog protection marker by @pellared in fix changelog protection marker open-telemetry/opentelemetry-go#7986
• Drop support for Go 1.24 by @MrAlias in Drop support for Go 1.24 open-telemetry/opentelemetry-go#7984
• fix(deps): update golang.org/x by @renovate[bot] in fix(deps): update golang.org/x open-telemetry/opentelemetry-go#7907
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @renovate[bot] in chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 open-telemetry/opentelemetry-go#7981
• chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @renovate[bot] in chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 open-telemetry/opentelemetry-go#7989
• fix(deps):

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

• Support testing of Go 1.26. (Support Go 1.26 open-telemetry/opentelemetry-go#7902)

Fixed

• Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (Comply with W3C Baggage specification limits open-telemetry/opentelemetry-go#7880)

What's Changed

(truncated — see source for full notes)

github.com/sirupsen/logrus (v1.9.3 → v1.9.4) — GitHub Release

Notable changes

• go.mod: update minimum supported go version to v1.17 go.mod: bump up deps; CI: remove appveyor, add macOS sirupsen/logrus#1460
• go.mod: bump up dependencies go.mod: bump up deps; CI: remove appveyor, add macOS sirupsen/logrus#1460
• Touch-up godoc and add "doc" links.
• README: fix links, grammar, and update examples.
• Add GNU/Hurd support Add GNU/Hurd support sirupsen/logrus#1364
• Add WASI wasip1 support Add WASI wasip1 support sirupsen/logrus#1388
• Remove uses of deprecated ioutil package refactor: replace the deprecated function in the ioutil package sirupsen/logrus#1472
• CI: update actions and golangci-lint CI: update actions and golangci-lint sirupsen/logrus#1459
• CI: remove appveyor, add macOS go.mod: bump up deps; CI: remove appveyor, add macOS sirupsen/logrus#1460

Full Changelog: sirupsen/logrus@v1.9.3...v1.9.4

---

Generated by ADMS Sources: 8 GitHub Releases, 2 not available.

[seberm-6]

Hey, sorry for the noise. This was caused by a bug in our automated dependency update system that incorrectly included upstream changelog content in PR comments, triggering notifications to external contributors. The feature flag has been turned off and we're working on a fix. Sorry about that again.