Skip to content

build(deps): bump the go-dependencies group across 1 directory with 13 updates - #69

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-dependencies-d4431d1e98
Open

build(deps): bump the go-dependencies group across 1 directory with 13 updates#69
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-dependencies-d4431d1e98

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 8 updates in the / directory:

Package From To
github.com/ClickHouse/clickhouse-go/v2 2.44.0 2.48.0
github.com/getkin/kin-openapi 0.134.0 0.146.0
github.com/oapi-codegen/runtime 1.4.1 1.6.0
github.com/prometheus/client_golang 1.23.2 1.24.1
github.com/sirupsen/logrus 1.9.4 1.10.0
github.com/testcontainers/testcontainers-go/modules/clickhouse 0.41.0 0.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.43.0 1.45.0
google.golang.org/protobuf 1.36.11 1.36.12

Updates github.com/ClickHouse/clickhouse-go/v2 from 2.44.0 to 2.48.0

Release notes

Sourced from github.com/ClickHouse/clickhouse-go/v2's releases.

v2.48.0

What's Changed

Enhancements 🚀

Bug fixes 🐛

Other Changes 🛠

New Contributors

Full Changelog: ClickHouse/clickhouse-go@v2.47.0...v2.48.0

v2.47.0

... (truncated)

Changelog

Sourced from github.com/ClickHouse/clickhouse-go/v2's changelog.

v2.48.0, 2026-08-04

What's Changed

Enhancements 🚀

Bug fixes 🐛

Other Changes 🛠

New Contributors

Full Changelog: ClickHouse/clickhouse-go@v2.47.0...v2.48.0

v2.47.0, 2026-06-26

... (truncated)

Commits
  • 69b5195 Update release notes
  • bbc3549 Merge pull request #1949 from ClickHouse/kavirajk/perf-exception-parser
  • 46e0fe9 chore: review remarks
  • 222cf04 chore: doc string fixes
  • 41bfcca perf: make safeLen() linear runtime in exception parser
  • 8fd6f43 Merge pull request #1944 from fallintoplace/fix/tuple-map-scan-error
  • d502655 Merge pull request #1947 from ClickHouse/pr-review-fable
  • 6f469c9 use fable for code review
  • 95ae021 fix: return errors when scanning Tuple maps
  • b67d227 Merge pull request #1937 from fallintoplace/remove-http-compression-debug-output
  • Additional commits viewable in compare view

Updates github.com/getkin/kin-openapi from 0.134.0 to 0.146.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.146.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.145.0...v0.146.0

v0.145.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.144.0...v0.145.0

v0.144.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.143.0...v0.144.0

v0.143.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.142.0...v0.143.0

v0.142.0

What's Changed

... (truncated)

Commits
  • 335f4e6 openapi3: store field locations in a slice, not a map (#1235)
  • f5441d6 Merge commit from fork
  • d090e36 Merge commit from fork
  • 947498e openapi3: keep a document's origin tree only when it can be read (#1234)
  • 88aa64c Merge commit from fork
  • f1a5b52 Merge commit from fork
  • 27bc028 openapi3: stop InternalizeRefs panicking on unresolved discriminator mappings...
  • f0407d5 Merge commit from fork
  • c947670 some fixes to please my moulinette (#1232)
  • 68ac2af Merge commit from fork
  • Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.4.1 to 1.6.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

Allow customization of parameter encoding

This is a small release which adds a global encoding setting on the runtime, to allow users to customize how to handle spaces in query arguments. This is a new minor release, since we're adding new API, even though this is a very minor feature. I imagine that in the future, we will add more settings, rather than making behavior assumptions.

🚀 New features and improvements

📦 Dependency updates

  • chore(deps): update module github.com/golangci/golangci-lint to v2.12.2 (#112) @renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

Sponsors

We would like to thank our sponsors for their support during this release.

v1.5.0: RFC3339 durations, and bug fixes

This is mainly a bugfix release, but we're bumping the minor version since we also introduce a new type, Duration into our types/ package, which allows for parsing and emitting RFC3339 durations. Rather than trying to parse a duration string into a time.Duration, which requires assumptions that may not be right for everyone, we decided not to make those decisions and just store all possible fields as provided. Users can convert this to Go Duration as they see fit.

🚀 New features and improvements

🐛 Bug fixes

📝 Documentation updates

... (truncated)

Commits
  • 01be2fa chore(deps): update module github.com/golangci/golangci-lint to v2.12.2 (#112)
  • 1463938 Allow customizing default query encoder (#145)
  • 540d34a fix(deps): update module github.com/labstack/echo/v5 to v5.3.0 (#142)
  • e89dbb8 Add types.Duration for the RFC 3339 duration format (#144)
  • 324e57f Let generated code declare whether styled parameter values are escaped (#143)
  • 95c13c0 Explain how to send nested objects when style serialization fails (#141)
  • 7c889f3 Prefer the form struct tag over json for form encoding (#140)
  • d0d5c3a chore(deps): update golang/govulncheck-action action to v1.1.0 (#137)
  • 67e86fd chore(deps): update oapi-codegen/actions action to v0.8.0 (#130)
  • df140cb fix(deps): update module github.com/labstack/echo/v5 to v5.2.1 (#126)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

  • [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • d6087ee release: cut v1.24.1 (#2076)
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • Additional commits viewable in compare view

Updates github.com/sirupsen/logrus from 1.9.4 to 1.10.0

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.10.0

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

  • ~17% lower geomean runtime across the benchmark suite
  • ~27% higher geomean formatter throughput
  • Common enabled logging paths are ~30–44% faster
  • WithError is ~40% faster
  • Chained fields are ~46% faster
  • TextFormatter paths are up to ~40% faster
  • Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

  • Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
  • Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

JSONFormatter itself remains largely unchanged in runtime performance, with small allocation reductions.

🔄 log/slog interoperability

v1.10 adds bidirectional interoperability between Logrus and Go's log/slog:

  • A Logrus slog hook can forward existing Logrus entries to an slog logger.
  • hooks/slog.NewHandler implements slog.Handler, allowing log/slog records to use an existing Logrus logger and its hooks, formatter, and output.
  • The handler preserves levels, fields, groups, context, record timestamps, and optionally caller information.
  • Caller reporting is configured per handler, without requiring Logrus's logger-wide ReportCaller option.
  • Custom slog levels can be mapped to Logrus levels.
  • The hook and handler can be combined, providing a practical path for incrementally migrating from Logrus to log/slog without requiring an all-at-once transition.

This allows applications to migrate their logging API and logging backend independently: existing Logrus call sites can start using an slog backend, while new slog code can continue using an established Logrus setup.

🔒 Concurrency & Correctness

  • Fix reentrant logging deadlocks, including logging from within MarshalJSON or formatter code.
  • Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel, contrary to their documented behavior.
  • Eliminate race conditions in entry and formatter paths.
  • Improve locking boundaries around formatters and hooks.

➕ Added

  • TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching behavior on other platforms.
  • Entry.Caller can now be set explicitly and is preserved across derived entries. When caller reporting is enabled, Logrus only detects and populates caller information when none was provided, allowing custom caller detection and wrapper-aware logging without adding additional caller configuration APIs.
  • Add minimal, composable logging interfaces for each log level, allowing consumers to depend on narrower interfaces and making logging implementations easier to substitute or adapt.
  • Expand CI verification to include TinyGo and every cross-compile target reported by go tool dist list, improving coverage across alternative toolchains and platforms.

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.10.0

Fixes:

  • Fix reentrant logging deadlocks in formatter paths.
  • Fix race conditions in formatter and entry handling.
  • Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel. Use the corresponding Panic methods when panic behavior is desired.
  • Improve concurrency safety around formatter and hook access.

Features:

  • Add slog hook for forwarding Logrus entries to log/slog.
  • Add slog.Handler for forwarding log/slog records to a Logrus logger, including levels, fields, groups, context, time, and optional caller reporting. The hook and handler can also be combined to help migrate between Logrus and log/slog.
  • Add minimal, composable logging interfaces for each log level. This enables consumers to depend on narrower interfaces, making it easier to substitute or adapt logging implementations.
  • Allow Entry.Caller to be set explicitly and preserve it across derived entries, enabling custom caller detection without Logrus overwriting caller information when ReportCaller is enabled.

Changed:

  • Raise minimum supported Go version to 1.23.
  • TextFormatter now renders []byte values as raw/quoted strings instead of slice-of-ints.
  • TextFormatter now uses distinct dimmed colors for debug and trace output.
  • TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching the behavior on other platforms.
  • Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly.
  • Deprecated MutexWrap, which was unintentionally exposed as public API. It remains available as an alias for compatibility but should not be used directly.

Performance:

  • Significantly improve TextFormatter performance and reduce allocations.
  • Optimize common Entry and Logger hot paths.
  • Reduce allocations in caller reporting.
  • ~17% lower geomean runtime and ~27% higher formatter throughput overall.
  • Common enabled logging paths are ~30–44% faster.
  • TextFormatter paths are up to ~40% faster, with allocation counts reduced by 25–74% across the measured formatter cases.
Commits
  • 457e372 Merge pull request #1573 from thaJeztah/update_colors
  • 6b6a3a6 formatter: differentiate debug and trace colors
  • 8ebae73 Merge pull request #1572 from thaJeztah/update_logs
  • f156a33 docs: clarify formatter field handling
  • 84cedf9 Merge pull request #1571 from thaJeztah/slog_hookopts
  • a3e1580 hooks/slog: add HookOptions
  • e5b377a Merge pull request #1570 from thaJeztah/slog_leveler
  • 30a5487 hooks/slog: add level adapters
  • 0cee61e Merge pull request #1569 from thaJeztah/slog_noleveler
  • 4069973 hooks/slog: use concrete slog.Level for hook level mapping
  • Additional commits viewable in compare view

Updates `github.com/te...

Description has been truncated

@dependabot
build(deps): bump the go-dependencies group across 1 directory with 1…
aca4355 
…3 updates

Bumps the go-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/ClickHouse/clickhouse-go/v2](https://github.com/ClickHouse/clickhouse-go) | `2.44.0` | `2.48.0` |
| [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) | `0.134.0` | `0.146.0` |
| [github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime) | `1.4.1` | `1.6.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` |
| [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.4` | `1.10.0` |
| [github.com/testcontainers/testcontainers-go/modules/clickhouse](https://github.com/testcontainers/testcontainers-go) | `0.41.0` | `0.44.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.45.0` |
| google.golang.org/protobuf | `1.36.11` | `1.36.12` |



Updates `github.com/ClickHouse/clickhouse-go/v2` from 2.44.0 to 2.48.0
- [Release notes](https://github.com/ClickHouse/clickhouse-go/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-go/blob/main/CHANGELOG.md)
- [Commits](ClickHouse/clickhouse-go@v2.44.0...v2.48.0)

Updates `github.com/getkin/kin-openapi` from 0.134.0 to 0.146.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.134.0...v0.146.0)

Updates `github.com/oapi-codegen/runtime` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/oapi-codegen/runtime/releases)
- [Commits](oapi-codegen/runtime@v1.4.1...v1.6.0)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.1)

Updates `github.com/sirupsen/logrus` from 1.9.4 to 1.10.0
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.9.4...v1.10.0)

Updates `github.com/testcontainers/testcontainers-go/modules/clickhouse` from 0.41.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.41.0...v0.44.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.67.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.67.0...zpages/v0.69.0)

Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.43.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.45.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.43.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.45.0)

Updates `go.opentelemetry.io/otel/trace` from 1.43.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.45.0)

Updates `google.golang.org/grpc` from 1.80.0 to 1.83.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.80.0...v1.83.0)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: github.com/ClickHouse/clickhouse-go/v2
  dependency-version: 2.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.146.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/oapi-codegen/runtime
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/testcontainers/testcontainers-go/modules/clickhouse
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 17, 2026
@dependabot
dependabot Bot requested a review from mattevans as a code owner August 17, 2026 04:35
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 17, 2026
@redpandabot

redpandabot Bot commented Aug 17, 2026

Copy link
Copy Markdown

Summary

Mechanical Dependabot group bump: 13 direct Go deps (clickhouse-go 2.44→2.48, kin-openapi 0.134→0.146, oapi-codegen/runtime 1.4.1→1.6.0, client_golang 1.23.2→1.24.1, logrus 1.9.4→1.10.0, testcontainers-clickhouse 0.41→0.44, otel family 1.43→1.45, grpc 1.80→1.83, protobuf 1.36.11→1.36.12) plus transitive go.mod/go.sum churn (docker/docker→moby split, go-openapi/swag→swag/jsonname, etc.). I verified go.mod/go.sum consistency (all 99 requires have matching hashes), OSV-scanned every new direct and key new indirect version, and checked the repo's actual usage against the new upstream sources for the risky bumps (clickhouse driver.Conn, testcontainers-clickhouse, kin-openapi, otel) — all API-compatible; the PR table lists 8 packages but the diff bumps 13, matching the title. The bump is a security win: it moves x/crypto from a version carrying the June-2026 SSH CVE batch (all fixed in 0.52.0) to v0.54.0.

Issues

  • 🟡 go.mod:102 — only OSV flag on any new version: x/crypto GO-2026-5932 (openpgp, unactionable) — OSV on all bumped/new versions returns a non-empty result only for golang.org/x/crypto v0.54.0: GO-2026-5932. That advisory is version-independent (range introduced:0, no fixed version), covers only the unmaintained x/crypto/openpgp package, which this module never imports, so there is no fix to take and it is not reachable here. Flagging it for awareness: every x/crypto version is affected, so it cannot block this (or any) bump; the prior v0.49.0 was the one actually carrying fixable CVEs (CVE-2026-39827/39829/39830/39832/39833/39834/46595/46597, fixed in v0.52.0), which this upgrade resolves.

Reviewed @ aca4355d
Red pandas descend trees headfirst, thanks to ankles that rotate 180°.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mattevans mattevans Awaiting requested review from mattevans mattevans is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants