Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel/sdk	v1.38.0 → v1.43.0

---

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq

More information

Details

Impact

The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

Patches

This has been patched in d45961b, which was released with v1.40.0.

References

• CWE-426: Untrusted Search Path

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq
• https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53
• https://nvd.nist.gov/vuln/detail/CVE-2026-24051
• https://pkg.go.dev/vuln/GO-2026-4394
• https://github.com/advisories/GHSA-9h8m-3fm2-qjrq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

CVE-2026-39883 / GHSA-hfvc-g4fc-pqhx

More information

Details

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
2. Attacker places a malicious kenv binary earlier in $PATH
3. Application initializes OpenTelemetry resource detection at startup
4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

Severity

• CVSS Score: 7.3 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx
• http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-39883
• https://github.com/advisories/GHSA-hfvc-g4fc-pqhx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk)

v1.43.0: /v0.65.0/v0.19.0

Compare Source

Added

• Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
  for W3C Trace Context Level 2 Random Trace ID Flag support. (#​8012)
• Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#​7642)
• Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#​8051)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#​8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#​8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8038)
• Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8038)
• Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
  Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#​8060)
• Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#​7855)

Changed

• Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#​8038)
• Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#​8039)
• Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#​8067)
• Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8073)

Deprecated

• Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#​8038)

Fixed

• Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
  make the implementation spec-compliant. (#​8027)
• Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#​8056)
• Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
  Responses exceeding the limit are treated as non-retryable errors. (#​8108)
• Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
  Responses exceeding the limit are treated as non-retryable errors. (#​8108)
• Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
  Responses exceeding the limit are treated as non-retryable errors. (#​8108)
• WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#​8113)
• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#​8096)

What's Changed

• chore(deps): update module github.com/jgautheron/goconst to v1.9.0 by @​renovate[bot] in #​8014
• fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to 190d7d4 by @​renovate[bot] in #​8013
• chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by @​renovate[bot] in #​8016
• fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.1 by @​renovate[bot] in #​8011
• fix(deps): update golang.org/x by @​renovate[bot] in #​8023
• fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.2 by @​renovate[bot] in #​8020
• chore(deps): update module github.com/mattn/go-runewidth to v0.0.21 by @​renovate[bot] in #​8017
• chore(deps): update module codeberg.org/chavacava/garif to v0.2.1 by @​renovate[bot] in #​8019
• Add doc on how to upgrade to new semconv by @​jmmcorreia in #​7807
• fix(deps): update module go.opentelemetry.io/proto/otlp to v1.10.0 by @​renovate[bot] in #​8028
• resource: add WithService detector option by @​codeboten in #​7642
• fix(deps): update googleapis to a57be14 by @​renovate[bot] in #​8031
• fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.3 by @​renovate[bot] in #​8032
• chore(deps): update module github.com/prometheus/procfs to v0.20.1 by @​renovate[bot] in #​8034
• chore(deps): update github.com/securego/gosec/v2 digest to 8895462 by @​renovate[bot] in #​8036
• chore(deps): update module github.com/sonatard/noctx to v0.5.1 by @​renovate[bot] in #​8040
• chore(deps): update github.com/securego/gosec/v2 digest to 6e66a94 by @​renovate[bot] in #​8043
• docs(otlp): document HTTP/protobuf insecure env vars by @​marcschaeferger in #​8037
• Rebuild semconvkit and verifyreadmes on changes by @​MrAlias in #​7995
• chore(sdk/trace): join errors properly by @​ash2k in #​8030
• fix(deps): update googleapis to 84a4fc4 by @​renovate[bot] in #​8048
• attribute: change INVALID Type to EMPTY and mark INVALID as deprecated by @​pellared in #​8038
• fix(sdk/trace): return spec-compliant TraceIdRatioBased description by @​ash2k in #​8027
• linting: add depguard rule to enforce semconv version by @​ajuijas in #​8041
• chore(deps): update actions/download-artifact action to v8.0.1 by @​renovate[bot] in #​8046
• chore(deps): update github.com/securego/gosec/v2 digest to b7b2c7b by @​renovate[bot] in #​8044
• fix(deps): update golang.org/x by @​renovate[bot] in #​8045
• Optimize attribute slice conversion by @​MrAlias in #​8039
• Add benchmarks for end-to-end metrics SDK usage by @​dashpole in #​7768
• fix(deps): update golang.org/x by @​renovate[bot] in #​8052
• chore(deps): update github.com/securego/gosec/v2 digest to befce8d by @​renovate[bot] in #​8053
• trace: add Random Trace ID Flag by @​yuanyuanzhao3 in #​8012
• Improve aggregation concurrent safe tests by @​dashpole in #​8021
• Add tests for exponential histogram concurrent-safety edge-cases by @​dashpole in #​8024
• exphist: replace min, max, sum, and count with atomics by @​dashpole in #​8025
• chore(deps): update github.com/securego/gosec/v2 digest to c2dfcec by @​renovate[bot] in #​8055
• chore(deps): update otel/weaver docker tag to v0.22.0 by @​renovate[bot] in #​8058
• chore(deps): update github.com/securego/gosec/v2 digest to dec52c4 by @​renovate[bot] in #​8063
• chore(deps): update otel/weaver docker tag to v0.22.1 by @​renovate[bot] in #​8061
• chore(deps): update github/codeql-action action to v4.33.0 by @​renovate[bot] in #​8065
• Fix race in the lastvalue aggregation where 0 could be observed by @​dashpole in #​8056
• chore(deps): update github.com/securego/gosec/v2 digest to 744bfb5 by @​renovate[bot] in #​8064
• Migrate to new bare metal runner (Ubuntu 24) by @​trask in #​8068
• sdk/resource: add WithContext variants for Default and Environment (#​7808) by @​ajuijas in #​8051
• Use atomics for exponential histogram buckets by @​dashpole in #​8057
• Added the internal/observ package to stdoutlog by @​yumosx in #​7735
• Add support for the development per-series starttime feature by @​dashpole in #​8060
• sdk/trace/internal/observ: guard SpanStarted and spanLive with Enabled by @​kouji-yoshimura in #​8067
• Cleanup exemplar featuregate readme by @​dashpole in #​8072
• chore(deps): update codecov/codecov-action action to v5.5.3 by @​renovate[bot] in #​8080
• chore(deps): update module github.com/ryanrolds/sqlclosecheck to v0.6.0 by @​renovate[bot] in #​8083
• fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to de6f1cc by @​renovate[bot] in #​8082
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.54.0 by @​renovate[bot] in #​8085
• chore(deps): update module github.com/securego/gosec/v2 to v2.25.0 by @​renovate[bot] in #​8084
• chore(deps): update module github.com/protonmail/go-crypto to v1.4.1 by @​renovate[bot] in #​8081
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.54.0 by @​renovate[bot] in #​8086
• chore(deps): update actions/cache action to v5.0.4 by @​renovate[bot] in #​8079
• chore(deps): update module github.com/fatih/color to v1.19.0 by @​renovate[bot] in #​8087
• fix(deps): update googleapis to d00831a by @​renovate[bot] in #​8078
• chore(deps): update golang.org/x/telemetry digest to b6b0c46 by @​renovate[bot] in #​8076
• fix(deps): update module google.golang.org/grpc to v1.79.3 [security] by @​renovate[bot] in #​8075
• sdk/metric: Support specifying cardinality limits per instrument kinds by @​petern48 in #​7855
• chore(deps): update github/codeql-action action to v4.34.0 by @​renovate[bot] in #​8088
• chore(deps): update codspeedhq/action action to v4.12.1 by @​renovate[bot] in #​8089
• chore(deps): update github/codeql-action action to v4.34.1 by @​renovate[bot] in #​8090
• fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.4 by @​renovate[bot] in #​8092
• chore: fix noctx issues by @​mmorel-35 in #​8008
• chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.0 by @​renovate[bot] in #​8095
• chore(deps): update codecov/codecov-action action to v5.5.4 by @​renovate[bot] in #​8097
• chore(deps): update codecov/codecov-action action to v6 by @​renovate[bot] in #​8098
• chore(deps): update module github.com/tetafro/godot to v1.5.6 by @​renovate[bot] in #​8099
• chore(deps): update module github.com/butuzov/ireturn to v0.4.1 by @​renovate[bot] in #​8100
• chore(deps): update github/codeql-action action to v4.35.0 by @​renovate[bot] in #​8101
• chore(deps): update actions/setup-go action to v6.4.0 by @​renovate[bot] in #​8107
• chore(deps): update module github.com/go-git/go-git/v5 to v5.17.1 by @​renovate[bot] in #​8106
• chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.0 by @​renovate[bot] in #​8103
• chore(deps): update github/codeql-action action to v4.35.1 by @​renovate[bot] in #​8102
• chore(deps): update module github.com/hashicorp/go-version to v1.9.0 by @​renovate[bot] in #​8109
• metricdatatest: Improve printing of diffs by @​dashpole in #​8073
• fix(deps): update googleapis to d5a96ad by @​renovate[bot] in #​8112
• chore(deps): update codspeedhq/action action to v4.13.0 by @​renovate[bot] in #​8114
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.55.0 by @​renovate[bot] in #​8119
• chore(deps): update fossas/fossa-action action to v1.9.0 by @​renovate[bot] in #​8118
• chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 by @​renovate[bot] in #​8115
• fix(deps): update googleapis to 9d38bb4 by @​renovate[bot] in #​8117
• fix: support getBody in otelploghttp by @​Tpuljak in #​8096
• fix(deps): update module google.golang.org/grpc to v1.80.0 by @​renovate[bot] in #​8121
• Use an absolute path when calling bsd kenv by @​dmathieu in #​8113
• limit response body size for OTLP HTTP exporters by @​pellared in #​8108
• chore(deps): update github.com/golangci/dupl digest to c99c5cf by @​renovate[bot] in #​8122
• chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 by @​renovate[bot] in #​8131
• Release v1.43.0 / v0.65.0 / v0.19.0 by @​dmathieu in #​8128

New Contributors

• @​jmmcorreia made their first contribution in #​7807
• @​marcschaeferger made their first contribution in #​8037
• @​ajuijas made their first contribution in #​8041
• @​yuanyuanzhao3 made their first contribution in #​8012
• @​kouji-yoshimura made their first contribution in #​8067
• @​Tpuljak made their first contribution in #​8096

Full Changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

v1.42.0: /v0.64.0/v0.18.0/v0.0.16

Compare Source

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
  The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
  See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#​7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#​7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#​7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#​7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#​7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#​7834)

Removed

• Drop support for [Go 1.24]. (#​7984)

What's Changed

• fix changelog protection marker by @​pellared in #​7986
• Drop support for Go 1.24 by @​MrAlias in #​7984
• fix(deps): update golang.org/x by @​renovate[bot] in #​7907
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.53.0 by @​renovate[bot] in #​7981
• chore(deps): update benchmark-action/github-action-benchmark action to v1.21.0 by @​renovate[bot] in #​7989
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.53.0 by @​renovate[bot] in #​7982
• Revert "Revert "Generate semconv/v1.40.0"" by @​MrAlias in #​7985
• support stdlib request.GetBody on metrics by @​marifari-hue in #​7931
• attribute: add TestNotEquivalence and equality operator tests by @​pellared in #​7979
• Refactor benchmark CI by @​XSAM in #​7873
• chore(deps): update module github.com/securego/gosec/v2 to v2.24.7 by @​renovate[bot] in #​7988
• chore(deps): pin codspeedhq/action action to df47568 by @​renovate[bot] in #​7996
• chore(deps): update actions/checkout action to v6.0.2 by @​renovate[bot] in #​7997
• chore(deps): update codspeedhq/action action to v4.11.0 by @​renovate[bot] in #​7999
• Upgrade to semconv/v1.40.0 by @​MrAlias in #​7991
• Regenerate semconv/v1.40.0/MIGRATION.md by @​MrAlias in #​7992
• fix: generated semconv helpers skipping attributes by @​victoraugustolls in #​7964
• Feat: Have SpanContext support the new W3C random flag. by @​nikhilmantri0902 in #​7834
• Semconv metric helper caller-slice mutation fix by @​MrAlias in #​7993
• Fix semconv generated error type to check error chain for custom type declaration by @​MrAlias in #​7994
• refactor: replace uint64 and int32 with atomic types in tests by @​alexandear in #​7941
• chore(deps): update golang.org/x/telemetry digest to 18da590 by @​renovate[bot] in #​8000
• TracerProvider ForceFlush() Error Fix by @​sawamurataxman in #​7856
• log: add error field to Record and make SDK to emit exception attributes by @​iblancasa in #​7924
• chore(deps): update dependency codespell to v2.4.2 by @​renovate[bot] in #​8003
• chore(deps): update github/codeql-action action to v4.32.6 by @​renovate[bot] in #​8004
• chore(deps): update codspeedhq/action action to v4.11.1 by @​renovate[bot] in #​8001
• fix(deps): update module google.golang.org/grpc to v1.79.2 by @​renovate[bot] in #​8007
• chore(deps): update module github.com/mgechev/revive to v1.15.0 by @​renovate[bot] in #​8009
• chore(deps): update golang.org/x/telemetry digest to e526e8a by @​renovate[bot] in #​8010
• Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 by @​pellared in #​8006

New Contributors

• @​marifari-hue made their first contribution in #​7931
• @​victoraugustolls made their first contribution in #​7964
• @​sawamurataxman made their first contribution in #​7856
• @​iblancasa made their first contribution in #​7924

Full Changelog: open-telemetry/opentelemetry-go@v1.41.0...v1.42.0

v1.41.0: /v0.63.0/v0.17.0/v0.0.15

Compare Source

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

• Support testing of Go 1.26. (#​7902)

Fixed

• Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#​7880)

What's Changed

• fix(deps): update googleapis to ce8ad4c by @​renovate[bot] in #​7860
• chore(deps): update otel/weaver docker tag to v0.21.0 by @​renovate[bot] in #​7865
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.51.0 by @​renovate[bot] in #​7863
• chore(deps): update golang.org/x/telemetry digest to fe4bb1c by @​renovate[bot] in #​7861
• chore(deps): update golang.org/x/telemetry digest to aaaaaa5 by @​renovate[bot] in #​7869
• sdk/log/observ: guard LogProcessed with Enabled by @​NesterovYehor in #​7848
• stdouttrace observability: skip metric work when instruments are disabled by @​NesterovYehor in #​7853
• chore(deps): update otel/weaver docker tag to v0.21.2 by @​renovate[bot] in #​7870
• fix(deps): update googleapis to 546029d by @​renovate[bot] in #​7871
• stdoutmetric observ: skip metric work when instruments are disabled by @​NesterovYehor in #​7868
• chore(deps): update fossas/fossa-action action to v1.8.0 by @​renovate[bot] in #​7879
• chore(deps): update github/codeql-action action to v4.32.2 by @​renovate[bot] in #​7878
• chore(deps): update module github.com/ghostiam/protogetter to v0.3.20 by @​renovate[bot] in #​7877
• chore(deps): update golang.org/x/telemetry digest to 86a5c4b by @​renovate[bot] in #​7876
• fix(deps): update module golang.org/x/sys to v0.41.0 by @​renovate[bot] in #​7885
• chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.6.0 by @​renovate[bot] in #​7884
• Checked if instrument enabled before measuring in prometheus by @​itssaharsh in #​7866
• exporter/otlploghttp: guard observ metrics with Enabled checks by @​NesterovYehor in #​7813
• chore(deps): update module github.com/go-git/go-git/v5 to v5.16.5 by @​renovate[bot] in #​7886
• chore(deps): update golang.org/x by @​renovate[bot] in #​7887
• fix(deps): update golang.org/x by @​renovate[bot] in #​7890
• fix(deps): update golang.org/x to 2842357 by @​renovate[bot] in #​7891
• fix(deps): update googleapis to 4cfbd41 by @​renovate[bot] in #​7889
• Checked if instrument enabled before measuring in oteltracegrpc by @​itssaharsh in #​7825
• Checked if Instrument Enabled before measuring in otlpgrpc by @​itssaharsh in #​7824
• chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27.8 by @​renovate[bot] in #​7892
• chore(deps): update module github.com/golangci/golines to v0.15.0 by @​renovate[bot] in #​7893
• chore(deps): update module github.com/golangci/misspell to v0.8.0 by @​renovate[bot] in #​7894
• chore(deps): update golang.org/x/telemetry digest to 9f66fae by @​renovate[bot] in #​7898
• fix(deps): update module google.golang.org/grpc to v1.79.0 by @​renovate[bot] in #​7906
• Support Go 1.26 by @​dmathieu in #​7902
• fix(deps): update module google.golang.org/grpc to v1.79.1 by @​renovate[bot] in #​7908
• chore(deps): update github/codeql-action action to v4.32.3 by @​renovate[bot] in #​7909
• chore(deps): update module github.com/kevinburke/ssh_config to v1.5.0 by @​renovate[bot] in #​7911
• chore(deps): update module github.com/kevinburke/ssh_config to v1.6.0 by @​renovate[bot] in #​7913
• chore(deps): update actions/stale action to v10.2.0 by @​renovate[bot] in #​7917
• chore(deps): update module github.com/godoc-lint/godoc-lint to v0.11.2 by @​renovate[bot] in #​7916
• chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.7.0 by @​renovate[bot] in #​7915
• chore(deps): update module github.com/mattn/go-runewidth to v0.0.20 by @​renovate[bot] in #​7918
• chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.28.0 by @​renovate[bot] in #​7921
• Checked if Operation Enabled in otlptracehttp before performing operation by @​itssaharsh in #​7881
• chore(deps): update github/codeql-action action to v4.32.4 by @​renovate[bot] in #​7936
• chore(deps): update module github.com/mirrexone/unqueryvet to v1.5.4 by @​renovate[bot] in #​7939
• chore(deps): update module github.com/uudashr/gocognit to v1.2.1 by @​renovate[bot] in #​7947
• chore(deps): update module github.com/alexkohler/prealloc to v1.0.3 by @​renovate[bot] in #​7950
• chore(deps): update module github.com/go-git/go-billy/v5 to v5.8.0 by @​renovate[bot] in #​7953
• chore(deps): update lycheeverse/lychee-action action to v2.8.0 by @​renovate[bot] in #​7959
• chore(deps): update module github.com/go-git/go-git/v5 to v5.17.0 by @​renovate[bot] in #​7960
• chore(deps): update actions/setup-go action to v6.3.0 by @​renovate[bot] in #​7962
• Document metric api interfaces that methods need to be safe to be called concurrently by @​dashpole in #​7952
• ci: add govulncheck job to CI workflow and update lint target by @​pellared in #​7971
• Comply with W3C Baggage specification limits by @​XSAM in #​7880
• chore(deps): update module github.com/mgechev/revive to v1.14.0 by @​renovate[bot] in #​7895
• chore(deps): update github artifact actions (major) by @​renovate[bot] in #​7963
• chore(deps): update module github.com/kis

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel/sdk/metric	v1.38.0 -> v1.43.0
go.opentelemetry.io/otel	v1.41.0 -> v1.43.0
go.opentelemetry.io/otel/metric	v1.41.0 -> v1.43.0
go.opentelemetry.io/otel/trace	v1.41.0 -> v1.43.0
golang.org/x/sys	v0.38.0 -> v0.42.0

[greptile-apps]

PR author is in the excluded authors list.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.3%. Comparing base (48d4f3a) to head (6a5a69a).

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.