Bump the minor-and-patch group across 1 directory with 7 updates by dependabot[bot] · Pull Request #95 · monoscope-tech/monoscope-go

dependabot · 2026-02-02T06:15:55Z

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
github.com/valyala/fasthttp	`1.68.0`	`1.69.0`
github.com/go-chi/chi/v5	`5.2.3`	`5.2.4`
github.com/gofiber/fiber/v2	`2.52.10`	`2.52.11`
github.com/labstack/echo/v4	`4.13.4`	`4.15.0`
go.opentelemetry.io/otel	`1.38.0`	`1.39.0`
go.opentelemetry.io/otel/sdk	`1.32.0`	`1.39.0`

Updates github.com/valyala/fasthttp from 1.68.0 to 1.69.0

Release notes

Sourced from github.com/valyala/fasthttp's releases.

v1.69.0

What's Changed

Add sortkeys by @pjebs in valyala/fasthttp#2118

Expose header parsing error variables by @ReneWerner87 in valyala/fasthttp#2096

Add documentation that modifying during iteration can panic by @erikdubbelboer in valyala/fasthttp#2122

update readme by @pjebs in valyala/fasthttp#2114

chore(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in valyala/fasthttp#2092

chore(deps): bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in valyala/fasthttp#2095

chore(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by @dependabot[bot] in valyala/fasthttp#2094

chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 by @dependabot[bot] in valyala/fasthttp#2098

chore(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 by @dependabot[bot] in valyala/fasthttp#2097

chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @dependabot[bot] in valyala/fasthttp#2099

chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in valyala/fasthttp#2101

chore(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by @dependabot[bot] in valyala/fasthttp#2103

chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 by @dependabot[bot] in valyala/fasthttp#2109

chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in valyala/fasthttp#2111

chore(deps): bump securego/gosec from 2.22.10 to 2.22.11 by @dependabot[bot] in valyala/fasthttp#2110

Full Changelog: valyala/fasthttp@v1.68.0...v1.69.0

Commits

7cf1fb7 Add documentation that modifying during iteration can panic (#2122)
7b5cb77 Add sortkeys (#2118)
42f89fb update readme (#2114)
fb6b6d1 chore(deps): bump securego/gosec from 2.22.10 to 2.22.11 (#2110)
fe7e70d chore(deps): bump actions/upload-artifact from 5 to 6 (#2111)
69ef8f7 chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 (#2109)
c2db561 chore(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 (#2103)
ec00ff0 chore(deps): bump actions/checkout from 5 to 6 (#2101)
5d415ac chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#2099)
cc8220f chore(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 (#2097)
Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4

Commits

6eb3588 middleware: harden RedirectSlashes handler (#1044)
de0d16e Update comment about min Go version (#1023)
9fb4a15 update reverseMethodMap in RegisterMethod (#1022)
51c977c Refactor to use atomic type (#1019)
563ab11 Refactor graceful shutdown example (#994)
a52c582 Bump minimum Go and use new features (#1017)
See full diff in compare view

Updates github.com/gofiber/fiber/v2 from 2.52.10 to 2.52.11

Release notes

Sourced from github.com/gofiber/fiber/v2's releases.

v2.52.11

What's Changed

🧹 Updates

Improve mount functionality by @gaby in gofiber/fiber#3900

🐛 Bug Fixes

Backport defensive copying fixes from #3828 and #3829 to v2 by @sixcolors in gofiber/fiber#3888

Fixes and improvements for limiter middleware by @gaby in gofiber/fiber#3899

Full Changelog: gofiber/fiber@v2.52.10...v2.52.11

Commits

65b0f3d Bump version to 2.52.11
1b53334 Modernize error handling in UUID functions (#3941)
eb874b6 Merge commit from fork
4ff945a 🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)
68d80a0 🩹 bug: Fix Fprint to use format instead of fmtArgs (#3924)
5346c81 🔧 chore: Upgrade setup-go action from v5 to v6 in workflow files
54fa41d Update AGENTS.md with coding practices and commands
a290d14 🐛 bug: Fixes and improvements for limiter middleware (#3899)
3927e17 🧹 chore: Improve mount functionality (#3900)
0786b39 🐛 Backport defensive copying fixes from #3828 and #3829 to v2 (#3888)
See full diff in compare view

Updates github.com/labstack/echo/v4 from 4.13.4 to 4.15.0

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.0

Security

WARNING: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship between the request origin and the target. The middleware uses this to make security decisions:

same-origin or none: Requests are allowed (exact origin match or direct user navigation)

same-site: Falls back to token validation (e.g., subdomain to main domain)

cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to traditional token-based CSRF protection.

New Configuration Options:

TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)

AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

Example:
e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    // Allow OAuth callbacks from trusted provider
    TrustedOrigins: []string{"https://oauth-provider.com"},
// Custom validation for same-site requests
AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
    // Your custom authorization logic here
    return validateCustomAuth(c), nil
    // return true, err  // blocks request with error
    // return true, nil  // allows CSRF request through
    // return false, nil // falls back to legacy token logic
},

}))
PR: labstack/echo#2858

Type-Safe Generic Parameter Binding

Added generic functions for type-safe parameter extraction and context access by @aldas in labstack/echo#2856

Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion, eliminating manual string parsing and type assertions.

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.0 - 2026-01-01

Security

NB: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship between the request origin and the target. The middleware uses this to make security decisions:

same-origin or none: Requests are allowed (exact origin match or direct user navigation)

same-site: Falls back to token validation (e.g., subdomain to main domain)

cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to traditional token-based CSRF protection.

New Configuration Options:

TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)

AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

Example:
e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    // Allow OAuth callbacks from trusted provider
    TrustedOrigins: []string{"https://oauth-provider.com"},
// Custom validation for same-site requests
AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
    // Your custom authorization logic here
    return validateCustomAuth(c), nil
    // return true, err  // blocks request with error
    // return true, nil  // allows CSRF request through
    // return false, nil // falls back to legacy token logic
},

}))
PR: labstack/echo#2858

Type-Safe Generic Parameter Binding

Added generic functions for type-safe parameter extraction and context access by @aldas in labstack/echo#2856

Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion,

... (truncated)

Commits

482bb46 v4.15.0 changelog
d0f9d1e CRSF with Sec-Fetch-Site=same-site falls back to legacy token
f3fc618 CRSF with Sec-Fetch-Site checks
4dcb9b4 licence headers
cbc0ac1 Add PathParam(Or)/QueryParam(Or)/FormParam(Or) generic functions
6b14f4e Add Context.Get generic functions
321530d disable test - returns different error under Windows
c8abd9f disable flaky test
9fe43f7 fix Rate limiter disallows fractional rates
1b5122a document things to reduce false positives
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.38.0 to 1.39.0

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)

Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)

Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)

Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)

Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)

Add experimental observability metrics for simple span processor in go.opentelemetry.io/otel/sdk/trace. (#7374)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)

Add experimental observability metrics for manual reader in go.opentelemetry.io/otel/sdk/metric. (#7524)

Add experimental observability metrics for periodic reader in go.opentelemetry.io/otel/sdk/metric. (#7571)

Support OTEL_EXPORTER_OTLP_LOGS_INSECURE and OTEL_EXPORTER_OTLP_INSECURE environmental variables in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)

Add Enabled method to the Processor interface in go.opentelemetry.io/otel/sdk/log. All Processor implementations now include an Enabled method. (#7639)

The go.opentelemetry.io/otel/semconv/v1.38.0 package. The package contains semantic conventions from the v1.38.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.37.0.(#7648)

Changed

Distinct in go.opentelemetry.io/otel/attribute is no longer guaranteed to uniquely identify an attribute set. Collisions between Distinct values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)

WithInstrumentationAttributes in go.opentelemetry.io/otel/trace synchronously de-duplicates the passed attributes instead of delegating it to the returned TracerOption. (#7266)

WithInstrumentationAttributes in go.opentelemetry.io/otel/meter synchronously de-duplicates the passed attributes instead of delegating it to the returned MeterOption. (#7266)

WithInstrumentationAttributes in go.opentelemetry.io/otel/log synchronously de-duplicates the passed attributes instead of delegating it to the returned LoggerOption. (#7266)

Rename the OTEL_GO_X_SELF_OBSERVABILITY environment variable to OTEL_GO_X_OBSERVABILITY in go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)

Improve performance of histogram Record in go.opentelemetry.io/otel/sdk/metric when min and max are disabled using NoMinMax. (#7306)

Improve error handling for dropped data during translation by using prometheus.NewInvalidMetric in go.opentelemetry.io/otel/exporters/prometheus. ⚠️ Breaking Change: Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)

Replace fnv hash with xxhash in go.opentelemetry.io/otel/attribute for better performance. (#7371)

The default TranslationStrategy in go.opentelemetry.io/exporters/prometheus is changed from otlptranslator.NoUTF8EscapingWithSuffixes to otlptranslator.UnderscoreEscapingWithSuffixes. (#7421)

Improve performance of concurrent measurements in go.opentelemetry.io/otel/sdk/metric. (#7427)

Include W3C TraceFlags (bits 0–7) in the OTLP Span.Flags field in go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)

The ErrorType function in go.opentelemetry.io/otel/semconv/v1.37.0 now handles custom error types. If an error implements an ErrorType() string method, the return value of that method will be used as the error type. (#7442)

Fixed

Fix WithInstrumentationAttributes options in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/log to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)

The equality of attribute.Set when using the Equal method is not affected by the user overriding the empty set pointed to by attribute.EmptySet in go.opentelemetry.io/otel/attribute. (#7357)

... (truncated)

Commits

6ce1429 Release v1.39.0 (#7676)
12e421a sdk/log: move Enabled method from FilterProcessor to Processor (#7639)
5982f16 fix(deps): update module golang.org/x/sys to v0.39.0 (#7684)
9288378 chore(deps): update module golang.org/x/sync to v0.19.0 (#7683)
ee3dfef chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (#7682)
9345d1f fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2 (#7680)
d03b033 Check context prior to delaying retry in OTLP exporters (#7678)
61765e7 Fix flaky TestClientInstrumentation (#7677)
a54721c chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (#7679)
746d086 chore(deps): update github/codeql-action action to v4.31.7 (#7675)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.32.0 to 1.39.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)

Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)

Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)

Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)

Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)

Add experimental observability metrics for simple span processor in go.opentelemetry.io/otel/sdk/trace. (#7374)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)

Add experimental observability metrics for manual reader in go.opentelemetry.io/otel/sdk/metric. (#7524)

Add experimental observability metrics for periodic reader in go.opentelemetry.io/otel/sdk/metric. (#7571)

Support OTEL_EXPORTER_OTLP_LOGS_INSECURE and OTEL_EXPORTER_OTLP_INSECURE environmental variables in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)

Add Enabled method to the Processor interface in go.opentelemetry.io/otel/sdk/log. All Processor implementations now include an Enabled method. (#7639)

The go.opentelemetry.io/otel/semconv/v1.38.0 package. The package contains semantic conventions from the v1.38.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.37.0.(#7648)

Changed

Distinct in go.opentelemetry.io/otel/attribute is no longer guaranteed to uniquely identify an attribute set. Collisions between Distinct values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)

WithInstrumentationAttributes in go.opentelemetry.io/otel/trace synchronously de-duplicates the passed attributes instead of delegating it to the returned TracerOption. (#7266)

WithInstrumentationAttributes in go.opentelemetry.io/otel/meter synchronously de-duplicates the passed attributes instead of delegating it to the returned MeterOption. (#7266)

WithInstrumentationAttributes in go.opentelemetry.io/otel/log synchronously de-duplicates the passed attributes instead of delegating it to the returned LoggerOption. (#7266)

Rename the OTEL_GO_X_SELF_OBSERVABILITY environment variable to OTEL_GO_X_OBSERVABILITY in go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)

Improve performance of histogram Record in go.opentelemetry.io/otel/sdk/metric when min and max are disabled using NoMinMax. (#7306)

Improve error handling for dropped data during translation by using prometheus.NewInvalidMetric in go.opentelemetry.io/otel/exporters/prometheus. ⚠️ Breaking Change: Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)

Replace fnv hash with xxhash in go.opentelemetry.io/otel/attribute for better performance. (#7371)

The default TranslationStrategy in go.opentelemetry.io/exporters/prometheus is changed from otlptranslator.NoUTF8EscapingWithSuffixes to otlptranslator.UnderscoreEscapingWithSuffixes. (#7421)

Improve performance of concurrent measurements in go.opentelemetry.io/otel/sdk/metric. (#7427)

Include W3C TraceFlags (bits 0–7) in the OTLP Span.Flags field in go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)

The ErrorType function in go.opentelemetry.io/otel/semconv/v1.37.0 now handles custom error types. If an error implements an ErrorType() string method, the return value of that method will be used as the error type. (#7442)

Fixed

Fix WithInstrumentationAttributes options in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/log to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)

The equality of attribute.Set when using the Equal method is not affected by the user overriding the empty set pointed to by attribute.EmptySet in go.opentelemetry.io/otel/attribute. (#7357)

... (truncated)

Commits

6ce1429 Release v1.39.0 (#7676)
12e421a sdk/log: move Enabled method from FilterProcessor to Processor (#7639)
5982f16 fix(deps): update module golang.org/x/sys to v0.39.0 (#7684)
9288378 chore(deps): update module golang.org/x/sync to v0.19.0 (#7683)
ee3dfef chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (#7682)
9345d1f fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2 (#7680)
d03b033 Check context prior to delaying retry in OTLP exporters (#7678)
61765e7 Fix flaky TestClientInstrumentation (#7677)
a54721c chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (#7679)
746d086 chore(deps): update github/codeql-action action to v4.31.7 (#7675)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/trace from 1.38.0 to 1.39.0

Changelog

Sourced from go.opentelemetry.io/otel/trace's changelog.

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)

Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)

Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)

Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)

Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)

Add experimental observability metrics for simple span processor in go.opentelemetry.io/otel/sdk/trace. (#7374)

Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)

Add experimental observability metrics for manual reader in go.opentelemetry.io/otel/sdk/metric. (#7524)

Add experimental observability metrics for periodic reader in go.opentelemetry.io/otel/sdk/metric. (#7571)

Support OTEL_EXPORTER_OTLP_LOGS_INSECURE and OTEL_EXPORTER_OTLP_INSECURE environmental variables in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)

Add Enabled method to the Processor interface in go.opentelemetry.io/otel/sdk/log. All Processor implementations now include an Enabled method. (#7639)

The go.opentelemetry.io/otel/semconv/v1.38.0 package. The package contains semantic conventions from the v1.38.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.37.0.(#7648)

Changed

Distinct in go.opentelemetry.io/otel/attribute is no longer guaranteed to uniquely identify an attribute set. Collisions between Distinct values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)

WithInstrumentationAttributes in go.opentelemetry.io/otel/trace synchronously de-duplicates the passed attributes instead of delegating it to the returned TracerOption. (#7266)

WithInstrumentationAttributes in go.opentelemetry.io/otel/meter synchronously de-duplicates the passed attributes instead of delegating it to the returned MeterOption. (#7266)

WithInstrumentationAttributes in go.opentelemetry.io/otel/log synchronously de-duplicates the passed attributes instead of delegating it to the returned LoggerOption. (#7266)

Rename the OTEL_GO_X_SELF_OBSERVABILITY environment variable to OTEL_GO_X_OBSERVABILITY in go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)

Improve performance of histogram Record in go.opentelemetry.io/otel/sdk/metric when min and max are disabled using NoMinMax. (#7306)

Improve error handling for dropped data during translation by using prometheus.NewInvalidMetric in go.opentelemetry.io/otel/exporters/prometheus. ⚠️ Breaking Change: Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)

Replace fnv hash with xxhash in go.opentelemetry.io/otel/attribute for better performance. (#7371)

The default TranslationStrategy in go.opentelemetry.io/exporters/prometheus is changed from otlptranslator.NoUTF8EscapingWithSuffixes to otlptranslator.UnderscoreEscapingWithSuffixes. (#7421)

Improve performance of concurrent measurements in go.opentelemetry.io/otel/sdk/metric. (#7427)

Include W3C TraceFlags (bits 0–7) in the OTLP Span.Flags field in go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)

The ErrorType function in go.opentelemetry.io/otel/semconv/v1.37.0 now handles custom error types. If an error implements an ErrorType() string method, the return value of that method will be used as the error type. (#7442)

Fixed

Fix WithInstrumentationAttributes options in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/log to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)

The equality of attribute.Set when using the Equal method is not affected by the user overriding the empty set pointed to by attribute.EmptySet in go.opentelemetry.io/otel/attribute. (#7357)

... (truncated)

Commits

6ce1429 Release v1.39.0 (#7676)
12e421a sdk/log: move Enabled method from FilterProcessor to Processor (#7639)
5982f16 fix(deps): update module golang.org/x/sys to v0.39.0 (#7684)
9288378 chore(deps): update module golang.org/x/sync to v0.19.0 (#7683)
ee3dfef chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (#7682)
9345d1f fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2 (#7680)
d03b033 Check context prior to delaying retry in OTLP exporters (#7678)
61765e7 Fix flaky TestClientInstrumentation (#7677)
a54721c chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (#7679)
746d086 chore(deps): update github/codeql-action action to v4.31.7 (#7675)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp) | `1.68.0` | `1.69.0` | | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.3` | `5.2.4` | | [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber) | `2.52.10` | `2.52.11` | | [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.13.4` | `4.15.0` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.39.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.32.0` | `1.39.0` | Updates `github.com/valyala/fasthttp` from 1.68.0 to 1.69.0 - [Release notes](https://github.com/valyala/fasthttp/releases) - [Commits](valyala/fasthttp@v1.68.0...v1.69.0) Updates `github.com/go-chi/chi/v5` from 5.2.3 to 5.2.4 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.2.3...v5.2.4) Updates `github.com/gofiber/fiber/v2` from 2.52.10 to 2.52.11 - [Release notes](https://github.com/gofiber/fiber/releases) - [Commits](gofiber/fiber@v2.52.10...v2.52.11) Updates `github.com/labstack/echo/v4` from 4.13.4 to 4.15.0 - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md) - [Commits](labstack/echo@v4.13.4...v4.15.0) Updates `go.opentelemetry.io/otel` from 1.38.0 to 1.39.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.39.0) Updates `go.opentelemetry.io/otel/sdk` from 1.32.0 to 1.39.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.32.0...v1.39.0) Updates `go.opentelemetry.io/otel/trace` from 1.38.0 to 1.39.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.39.0) --- updated-dependencies: - dependency-name: github.com/valyala/fasthttp dependency-version: 1.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/gofiber/fiber/v2 dependency-version: 2.52.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: go.opentelemetry.io/otel dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Feb 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the minor-and-patch group across 1 directory with 7 updates#95

Bump the minor-and-patch group across 1 directory with 7 updates#95
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/minor-and-patch-2c6dc223ef

dependabot bot commented on behalf of github Feb 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.69.0

What's Changed

v2.52.11

What's Changed

🧹 Updates

🐛 Bug Fixes

v4.15.0

v4.15.0 - 2026-01-01

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

Changed

Fixed

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

Changed

Fixed

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

Changed

Fixed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Feb 2, 2026 •

edited

Loading