fix(deps): update go dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/collector/cmd/builder	v0.147.0 → v0.148.0
google.golang.org/grpc	v1.79.2 → v1.79.3

---

Release Notes

open-telemetry/opentelemetry-collector (go.opentelemetry.io/collector/cmd/builder)

v0.148.0

Compare Source

❗ Known Issues ❗

• service: The collector's internal Prometheus metrics endpoint (:8888) now emits OTel service labels with underscore
  names (service_name, service_instance_id, service_version) instead of dot-notation names (service.name,
  service.instance.id, service.version). Users scraping this endpoint with the Prometheus receiver will see these renamed
  labels in resource and datapoint attributes. As a workaround, add the following metric_relabel_configs to your scrape
  config in prometheus receiver:

  metric_relabel_configs:
    - source_labels: [service_name]
      target_label: service.name
    - source_labels: [service_instance_id]
      target_label: service.instance.id
    - source_labels: [service_version]
      target_label: service.version
    - regex: service_name|service_instance_id|service_version
      action: labeldrop

  See #​14814 for details and updates.

🛑 Breaking changes 🛑

• all: Change metric units to be singular to match OTel specification, e.g. {requests} -> {request} (#​14753)

💡 Enhancements 💡

• cmd/mdatagen: Add deprecated_type field to allow specifying an alias for component types. (#​14718)
• cmd/mdatagen: Generate entity-scoped MetricsBuilder API that enforces entity-metric associations at compile time (#​14659)
• cmd/mdatagen: Skip generating reaggregation config options for metrics that have no aggregatable attributes. (#​14689)
• pkg/service: The internal status reporter no longer drops repeated Ok and RecoverableError statuses (#​14282)
  Status events can now carry metadata and there's value in allowing them to be emitted despite the status value itself
  not changing.

🧰 Bug fixes 🧰

• cmd/builder: Add .exe to output binary names when building for Windows targets. (#​12591)

• exporter/debug: Add printing of metric metadata in detailed verbosity. (#​14667)

• exporter/otlp_grpc: Prevent nil pointer panic when push methods are called before the OTLP exporter initializes its gRPC clients. (#​14663)
  When the sending queue and retry are disabled, calling ConsumeTraces,
  ConsumeMetrics, ConsumeLogs, or ConsumeProfiles before the OTLP exporter
  initializes its gRPC clients could cause a nil pointer dereference panic.
  The push methods now return an error instead of panicking.

• exporter/otlp_http: Show the actual destination URL in error messages when request URL is modified by middleware. (#​14673)
  Unwraps the *url.Error returned by http.Client.Do() to prevent misleading error logs when a middleware extension dynamically updates the endpoint.

• pdata/pprofile: Switch the dictionary of dictionary tables entries only once when merging profiles (#​14709)
  For dictionary table data, we used to switch their dictionaries when doing
  the switch for the data that uses them.
  However, when an entry is associated with multiple other data (several
  samples can use the same stack), we would have been switching the
  dictionaries of the entry multiple times.

  We now switch dictionaries for dictionary table data only once, before
  switching the resource profiles.

grpc/grpc-go (google.golang.org/grpc)

v1.79.3: Release 1.79.3

Compare Source

Security

• server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#​8981)

---

Configuration

📅 Schedule: Branch creation - "before 8am every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.