fix(deps): update go dependencies (non-major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/usetero/policy-go	v1.3.10 → v1.8.1
go.opentelemetry.io/collector/pdata	v1.52.0 → v1.60.0
google.golang.org/grpc	v1.79.1 → v1.81.1

---

Release Notes

usetero/policy-go (github.com/usetero/policy-go)

v1.8.1

Compare Source

Bug Fixes

• do not count on policy error (#​73) (1c4e26d)

v1.8.0

Compare Source

Features

• better error handling and validation (#​68) (5bf623a)
• typed implementations (#​72) (74ae3b7)
• upgrade protos to 1.5.0 (#​71) (9864b97)

v1.7.0

Compare Source

Features

• support regex from policy 1.4.0 (#​64) (aec257c)

Bug Fixes

• golangci lint install (#​66) (23eb6bd)

v1.6.0

Compare Source

Features

• optionally include stats (#​62) (644745b)

v1.5.1

Compare Source

Bug Fixes

• lock correctly for reading snapshots during recompilation (#​60) (1deac91)

v1.5.0

Compare Source

Features

• add support for arbitrary rate limit windows (#​58) (5d1f85d)

v1.4.0

Compare Source

Features

• allow setting service metadata (#​54) (7e049c6)

Bug Fixes

• config should be merged with code (#​56) (ec2b76a)
• remove overlay (#​57) (d95ef47)

open-telemetry/opentelemetry-collector (go.opentelemetry.io/collector/pdata)

v1.60.0

🛑 Breaking changes 🛑

• cmd/builder: The --skip-get-modules flag will no longer regenerate your go.mod file. (#​15390)
  This is mostly a bug fix, as it led to adverse behaviour that was unintended in the described flow in the README.
  Now when you run --skip-get-modules, your go.mod file will truly be untouched by ocb as the info log claims.

💡 Enhancements 💡

• pkg/config/configtls: Add include_insecure_cipher_suites to configtls to enable insecure cipher suites. Insecure cipher suites are disabled by default for security. (#​13829)
• pkg/confighttp: Add ExposedHeaders field to CORSConfig to allow setting the Access-Control-Expose-Headers response header. (#​15119)

🧰 Bug fixes 🧰

• cmd/mdatagen: Removes the extra line in the README.md between status and description (#​15306)
• pkg/exporterhelper: Fix nil-pointer panic in sending_queue::batch Unmarshal when sending_queue::sizer is set and sending_queue::batch::enabled is false. (#​14687)
  When sending_queue::sizer was set and sending_queue::batch::enabled: false
  cleared the batch Optional to None, the sizer-inheritance branch in
  queuebatch.Config.Unmarshal dereferenced a nil Optional and crashed the
  collector at startup. The branch now also requires Batch.HasValue().

v1.59.0

🛑 Breaking changes 🛑

• pkg/configoptional: Stabilize feature gate configoptional.AddEnabledField (#​15333)
• pkg/confmap: Stabilize confmap.newExpandedValueSanitizer feature gate (#​15339)
• pkg/exporterhelper: mark exporter.PersistRequestContext as stable (#​15330)
• pkg/otelcol: Stabilize otelcol.printInitialConfig gate (#​15340)
• pkg/pdata: Remove pdata.useCustomProtoEncoding feature gate (#​15332)
• pkg/service: Stabilize telemetry.UseLocalHostAsDefaultMetricsAddress gate (#​15342)
• pkg/xpdata: Stabilize pdata.enableRefCounting feature gate (#​15331)

🧰 Bug fixes 🧰

• pkg/config/configgrpc: Fix memory corruption and fatal error in Snappy (#​15237, #​15320)

v1.58.0

💡 Enhancements 💡

• pkg/exporterhelper: Add otelcol_exporter_in_flight_requests metric to track the number of export requests currently in-flight per exporter. (#​15009)
  This UpDownCounter increments in startOp and decrements in endOp, allowing operators to monitor
  concurrent export activity and detect when an exporter is saturating its worker pool.

🧰 Bug fixes 🧰

• pkg/confighttp: Close the original request body after reading block-format Content-Encoding: snappy requests. (#​15262)

• pkg/confighttp: Recover from panics in decompression libraries, return HTTP 400 instead of 500. (#​13228)

• pkg/confighttp: Enforce max_request_body_size on Content-Encoding: snappy requests before the decoded buffer is allocated. (#​15252)

• pkg/otelcol: Stop emitting verbose gRPC transport messages at WARN during normal client disconnect. (#​5169)
  grpc-go gates chatty per-RPC notices (e.g. "HandleStreams failed to read frame:
  connection reset by peer") behind LoggerV2.V(2). zapgrpc.Logger.V conflates
  grpclog verbosity with zap severity, so V(2) returns true whenever WARN is
  enabled and these messages emit at WARN. Wrap the installed grpclog.LoggerV2
  with a corrected V() that compares against a fixed verbosity threshold,
  matching grpclog's intended semantics. See uber-go/zap#1544.

• pkg/pdata: pcommon.Value.AsString no longer HTML-escapes <, >, and & inside ValueTypeMap and ValueTypeSlice values, matching the behavior already used for ValueTypeStr. (#​14662)

• pkg/service: Fix Prometheus config defaults mismatch when host is explicitly set in telemetry configuration. (#​13867)
  When users explicitly configured the telemetry metrics section (e.g. to change the host),
  the Prometheus exporter boolean fields (WithoutScopeInfo, WithoutUnits, WithoutTypeSuffix)
  defaulted to nil/false instead of true, causing metric name format changes compared to the
  implicit default configuration. This fix applies the correct defaults during config unmarshaling.

• pkg/service: Return noop tracer provider when no trace processors are defined (#​15135)

v1.57.0

🛑 Breaking changes 🛑

• cmd/builder: In the generated Collector source, the replace statements in the Go module will now use relative paths by default. (#​15097)
  We expect that this will not break existing use-cases where the generated collector is only used in an interim manner for builds. It enables the possibility of tracking the generated Collector code as a longer living artifact, allowing it to be run on any machine (whereas absolute paths will be different depending on the machine the Collector source is generated on.) We have added dist::use_absolute_replace_paths to go back to the absolute path behaviour in the case where there is an unforeseen use-case that requires absolute paths.

• pkg/confighttp: Stabilize framedSnappy feature gate. (#​15096)

💡 Enhancements 💡

• all: Add declarative schema support for service telemetry resource configuration. (#​14411)
  The service::telemetry::resource configuration now accepts the declarative schema with explicit name/value pairs:

  service:
    telemetry:
      resource:
        schema_url: https://opentelemetry.io/schemas/1.38.0
        attributes:
          - name: service.name
            value: my-collector
          - name: host.name
            value: collector-host

  The legacy inline attribute map format is still supported for backward compatibility:

  service:
    telemetry:
      resource:
        service.name: my-collector
        host.name: collector-host

  Note: resource.detectors is accepted for forward compatibility but is not yet applied by the collector.

• exporter/otlp_grpc: Added the server.address and url.path attributes to metrics generated by the otlp exporter. (#​14998)

• exporter/otlp_http: Added the server.address and url.path attributes to metrics generated by the otlp_http exporter. (#​14998)

• pkg/config/configgrpc: Add UserAgent field to ClientConfig to allow overriding the default gRPC user-agent string. (#​14686)
  The otlp gRPC exporter was unconditionally setting the User-Agent via
  grpc.WithUserAgent() at dial time, which takes precedence over per-call
  metadata, causing any user-configured User-Agent to be silently discarded.
  A dedicated UserAgent field has been added to ClientConfig which, when
  set, is used in the dial option directly instead of the default BuildInfo-derived string.

• pkg/config/configgrpc: Accept gRPC resolver scheme URIs in client endpoint (e.g. passthrough:///host:port) to allow control over name resolution (#​14990)
  After the migration to grpc.NewClient, some gRPC client components such as the OTLP
  exporter experienced connection issues in dual-stack DNS environments. This can now be
  fixed by using the passthrough:/// gRPC resolver scheme in the endpoint field.

• pkg/config/confignet: Add support for Windows Named Pipe (npipe) transport (#​15085)

• pkg/service: Emit a warning when using the old v0.2.0 declarative config format (#​15088)

🧰 Bug fixes 🧰

• pkg/otelcol: Print components exactly once in the otelcol components command (#​14682)
  This resolves an issue where aliased components were skipped.

• pkg/otelcol: Synchronize Collector Run and Shutdown lifecycles so that Shutdown blocks until Run completes all cleanup. (#​4947)
  Shutdown now blocks until Run finishes cleanup, matching http.Server semantics.
  If Shutdown is called before Run, the next Run call returns nil after cleaning up
  the config provider.

• pkg/pdata: Use spec-compliant string representation for NaN, Infinity, and -Infinity in Value.AsString(). (#​14487)

• pkg/pprofile: Fix data corruption of resource and scope attributes after marshal-unmarshal-merge round-trip. (#​15084)

• pkg/service: Non-string resource attributes in telemetry configuration now return an error instead of panicking (#​15171)

• pkg/xscraperhelper: fix the merge of profiles in the profiling scraper helpers (#​14790)

• receiver/otlp: Fix profiles receiver reporting its samples as spans (#​15089)

v1.56.0

💡 Enhancements 💡

• all: Update semconv package from 1.38.0 to 1.40.0 (#​15095)
• cmd/mdatagen: Only allow the ToVersion feature flag attribute to be set for the Stable and Deprecated stages. (#​15040)
  To better match the feature flag README
  (https://github.com/open-telemetry/opentelemetry-collector/blob/main/featuregate/README.md#feature-lifecycle).

🧰 Bug fixes 🧰

• exporter/debug: Guard from out of bounds profiles dictionary indices (#​14803)

• pdata/pprofile: create a copy when the input is marked as read-only (#​15080)

• pkg/otelcol: Fix missing default values in unredacted print-config command by introducing confmap.WithUnredacted MarshalOption. (#​14750)
  Resolves an issue where the unredacted mode output omitted all default-valued options. By introducing a new MarshalOption to disable redaction directly at the confmap encoding level, the unredacted mode now preserves all component defaults natively without requiring post-processing.

• pkg/service: Headers on the internal telemetry OTLP exporter are now redacted when the configuration is marshaled (#​14756)

v1.55.0

🛑 Breaking changes 🛑

• pkg/service: Remove service_name, service_instance_id, and service_version as constant labels on every internal metric datapoint. These attributes are already present in target_info and were being duplicated on each series for OpenCensus backwards compatibility. (#​14811)
  Previously, the collector stamped every internal metric series (e.g. otelcol_process_runtime_heap_alloc_bytes)
  with service_name, service_instance_id, and service_version labels to match the old OpenCensus behavior.
  These attributes are now only present in the target_info metric, which is the correct Prometheus/OTel convention.
  Users who filter or group by these labels on individual metrics will need to update their queries to use
  target_info joins instead.

💡 Enhancements 💡

• all: Move aix/ppc64 to tier 3 support (#​13380)

• all: Upgrade the profiles stability status to alpha (#​14817)
  The following components have their profiles status upgraded from development to alpha:

  • pdata/pprofile
  • connector/forward
  • exporter/debug
  • receiver/nop
  • exporter/nop
  • exporter/otlp_grpc
  • exporter/otlp_http

• cmd/mdatagen: Add semconv reference for attributes (#​13297)

🧰 Bug fixes 🧰

• cmd/mdatagen: Fix entity code generation so extra_attributes are emitted as resource attributes instead of entity descriptive attributes. (#​14778)

v1.54.0

❗ Known Issues ❗

• service: The collector's internal Prometheus metrics endpoint (:8888) now emits OTel service labels with underscore
  names (service_name, service_instance_id, service_version) instead of dot-notation names (service.name,
  service.instance.id, service.version). Users scraping this endpoint with the Prometheus receiver will see these renamed
  labels in resource and datapoint attributes. As a workaround, add the following metric_relabel_configs to your scrape
  config in prometheus receiver:

  metric_relabel_configs:
    - source_labels: [service_name]
      target_label: service.name
    - source_labels: [service_instance_id]
      target_label: service.instance.id
    - source_labels: [service_version]
      target_label: service.version
    - regex: service_name|service_instance_id|service_version
      action: labeldrop

  See #​14814 for details and updates.

🛑 Breaking changes 🛑

• all: Change metric units to be singular to match OTel specification, e.g. {requests} -> {request} (#​14753)

💡 Enhancements 💡

• cmd/mdatagen: Add deprecated_type field to allow specifying an alias for component types. (#​14718)
• cmd/mdatagen: Generate entity-scoped MetricsBuilder API that enforces entity-metric associations at compile time (#​14659)
• cmd/mdatagen: Skip generating reaggregation config options for metrics that have no aggregatable attributes. (#​14689)
• pkg/service: The internal status reporter no longer drops repeated Ok and RecoverableError statuses (#​14282)
  Status events can now carry metadata and there's value in allowing them to be emitted despite the status value itself
  not changing.

🧰 Bug fixes 🧰

• cmd/builder: Add .exe to output binary names when building for Windows targets. (#​12591)

• exporter/debug: Add printing of metric metadata in detailed verbosity. (#​14667)

• exporter/otlp_grpc: Prevent nil pointer panic when push methods are called before the OTLP exporter initializes its gRPC clients. (#​14663)
  When the sending queue and retry are disabled, calling ConsumeTraces,
  ConsumeMetrics, ConsumeLogs, or ConsumeProfiles before the OTLP exporter
  initializes its gRPC clients could cause a nil pointer dereference panic.
  The push methods now return an error instead of panicking.

• exporter/otlp_http: Show the actual destination URL in error messages when request URL is modified by middleware. (#​14673)
  Unwraps the *url.Error returned by http.Client.Do() to prevent misleading error logs when a middleware extension dynamically updates the endpoint.

• pdata/pprofile: Switch the dictionary of dictionary tables entries only once when merging profiles (#​14709)
  For dictionary table data, we used to switch their dictionaries when doing
  the switch for the data that uses them.
  However, when an entry is associated with multiple other data (several
  samples can use the same stack), we would have been switching the
  dictionaries of the entry multiple times.

  We now switch dictionaries for dictionary table data only once, before
  switching the resource profiles.

v1.53.0

💡 Enhancements 💡

• exporter/debug: Output bucket counts for exponential histogram data points in normal verbosity. (#​10463)
• pkg/exporterhelper: Add metadata_keys configuration to sending_queue.batch.partition to partition batches by client metadata (#​14139)
  The metadata_keys configuration option is now available in the sending_queue.batch.partition section for all exporters.
  When specified, batches are partitioned based on the values of the listed metadata keys, allowing separate batching per metadata partition. This feature
  is automatically configured when using exporterhelper.WithQueue().

🧰 Bug fixes 🧰

• cmd/builder: Fix duplicate error output when CLI command execution fails in the builder tool. (#​14436)

• cmd/mdatagen: Fix duplicate error output when CLI command execution fails in the mdatagen tool. (#​14436)

• cmd/mdatagen: Fix semconv URL validation for metrics with underscores in their names (#​14583)
  Metrics like system.disk.io_time now correctly validate against semantic convention URLs containing underscores in the anchor tag.

• extension/memory_limiter: Use ChainUnaryInterceptor instead of UnaryInterceptor to allow multiple interceptors. (#​14634)
  If multiple extensions that use the UnaryInterceptor are set the binary panics at start time.

• extension/memory_limiter: Add support for streaming services. (#​14634)

• pkg/config/configmiddleware: Add context.Context to HTTP middleware interface constructors. (#​14523)
  This is a breaking API change for components that implement or use extensionmiddleware.

• pkg/confmap: Fix another issue where configs could fail to decode when using interpolated values in string fields. (#​14034)
  For example, a resource attribute can be set via an environment variable to a string that is parseable as a number, e.g. 1234.

  (A similar bug was fixed in a previous release: that one was triggered when the field was nested in a struct,
  whereas this one is triggered when the field internally has type "pointer to string" rather than "string".)

• pkg/otelcol: The featuregate subcommand now rejects extra positional arguments instead of silently ignoring them. (#​14554)

• pkg/queuebatch: Fix data race in partition_batcher where resetTimer() was called outside mutex, causing concurrent timer.Reset() calls and unpredictable batch flush timing under load. (#​14491)

• pkg/scraperhelper: Log scrapers now emit log-appropriate receiver telemetry (#​14654)
  Log scrapers previously emitted the same receiver telemetry as metric scrapers,
  such as the otelcol_receiver_accepted_metric_points metric (instead of otelcol_receiver_accepted_log_records),
  or spans named receiver/myreceiver/MetricsReceived (instead of receiver/myreceiver/LogsReceived).

  This did not affect scraper-specific spans and metrics.

• processor/batch: Fixes a bug where the batch processor would not copy SchemaUrl metadata from resource and scope containers during partial batch splits. (#​12279, #​14620)

grpc/grpc-go (google.golang.org/grpc)

v1.81.1: Release 1.81.1

Compare Source

Security

• xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#​9111)
  • Special Thanks: @​al4an444

v1.81.0: Release 1.81.0

Compare Source

Behavior Changes

• balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#​8808)

Dependencies

• Minimum supported Go version is now 1.25. (#​8969)

Bug Fixes

• xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (#​8956)
• transport: Send a RST_STREAM when receiving an END_STREAM when the stream is not already half-closed. (#​8832)
• xds: Fix ADS resource name validation to prevent a panic. (#​8970)

New Features

• grpc/stats: Add support for custom labels in per-call metrics (gRFC A108). (#​9008)
• xds: Add support for Server Name Indication (SNI) and SAN validation (gRFC A101). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_SNI=true environment variable. (#​9016)
• xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (gRFC A85). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true. (#​9005)
• xds: Add metrics to track xDS client connectivity and cached resource state (gRFC A78). (#​8807)
• stats/otel: Enhance grpc.subchannel.disconnections metric by adding disconnection reason to the grpc.disconnect_error label (gRFC A94). This provides granular insights into why subchannels are closing. (#​8973)
• mem: Add mem.Buffer.Slice() API to slice the buffer like a slice. (#​8977)
  • Special Thanks: @​ash2k

Performance Improvements

• alts: Pool read buffers to lower memory utilization when sockets are unreadable. (#​8964)
• transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false and report any issues. (#​9032)

v1.80.0

Compare Source

v1.79.3: Release 1.79.3

Compare Source

Security

• server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#​8981)

v1.79.2: Release 1.79.2

Compare Source

Bug Fixes

• stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (#​8874)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm every weekday,before 6am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: runners/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/collector/featuregate	v1.52.0 -> v1.55.0
golang.org/x/net	v0.50.0 -> v0.51.0
google.golang.org/grpc	v1.79.1 -> v1.79.3

File name: server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.48.0 -> v0.49.0
golang.org/x/sys	v0.39.0 -> v0.40.0
golang.org/x/text	v0.32.0 -> v0.33.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260120174246-409b4a993575 -> v0.0.0-20260120221211-b8f7ae30c516

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: server/go.sum

Command failed: go get -t ./...
go: github.com/usetero/policy-go@v1.8.1 (replaced by ../../policy-go): reading ../../policy-go/go.mod: open /tmp/renovate/repos/github/usetero/policy-go/go.mod: no such file or directory