deps: otel/log 1.47.0 deprecates log/global — 9 SA1019 findings hold the go-deps group red #732

Area: observability · dependencies — gap · found via PR-stream triage

Expected: bumping go.opentelemetry.io/otel/log inside the go-deps dependabot group leaves make verify green, as the other 21 updates in that group do.

Actual: otel/log 0.22.0 → 1.47.0 graduates the log API to 1.0 and deprecates the whole go.opentelemetry.io/otel/log/global subpackage. Lint fails with 9 SA1019 staticcheck findings — internal/observability/logger.go:11,77, internal/observability/provider.go:20,75,131,245, internal/observability/provider_test.go:13,79,84 — all of them global.GetLoggerProvider / global.SetLoggerProvider or the import itself. Measured on PR #730 (go-deps, 22 updates), run 37338669551, job 111859855420, 2026-10-05: make verify exits 1 on Makefile:552 with 9 issues: * staticcheck: 9.

Impact: a third independent blocker on the go-deps group, alongside #643 (grpc vulncheck) and #707 (nats-server 2.15.0 assertions) — all three fail on the same PR, so clearing either of the other two still leaves the group red. The group has merged nothing since PR #570 on 2026-09-09.

The constraint that makes this different from #281. The replacement the deprecation points at does not exist at the version main pins. At go.opentelemetry.io/otel v1.46.0 the top-level package exports only Get/SetTracerProvider, Get/SetMeterProvider, Get/SetTextMapPropagator, Get/SetErrorHandler and SetLogger — there is no GetLoggerProvider/SetLoggerProvider and no log.go. So otel.GetLoggerProvider arrives with the bump, and the call-site change cannot land ahead of it the way #281's chi replacement could.

Note for whoever picks it up: a 10th identical call, global.GetLoggerProvider() at internal/observability/provider_test.go:103, is not among the 9 reported.

Related: #643, #707, #281 (closed — the same shape: a deprecated API holding the go-deps group red)

From a WaveHouse PM triage sweep of the PR stream; validated by code-read against 32e03a0a on 2026-10-06 (call sites and the otel v1.46.0 export surface), and against PR #730's CI log for the failure itself.