chore: merge main - #941
Open
wim07101993 wants to merge 68 commits into
Open
Conversation
This safely ignores unknown key type errors on JWKS while returning all other errors. Returned errors are wrap to easily identify which key in the set is problematic if any. Jose v4.0.3 was handling this correctly according to spec, but it was reverted in v4.0.4 as the implementation was a breaking change due to the custom UnmarshalJSON on the key set. For details see: - go-jose/go-jose#136 - go-jose/go-jose#137 Jose v4.0.4 also provided a handy static error to check for unknown web key types. Sadly this was removed: a prefix match on the error message is the best option until Jose improves it's error handling. Hopefully, Jose will not change the error message in a patch or minor version release. But just in case, test cases have been added to detect it. Closes #541 ### Definition of Ready - [x] I am happy with the code - [x] Short description of the feature/issue is added in the pr description - [x] PR is linked to the corresponding user story - [ ] Acceptance criteria are met - [ ] All open todos and follow ups are defined in a new ticket and justified - [ ] Deviations from the acceptance criteria and design are agreed with the PO and documented. - [x] No debug or dead code - [x] My code has no repetitions - [x] Critical parts are tested automatically - [x] Where possible E2E tests are implemented - [x] Documentation/examples are up-to-date - [x] All non-functional requirements are met - [ ] Functionality of the acceptance criteria is checked manually on the dev system. Co-authored-by: Wim Van Laer <wim07101993@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.33.0 to 0.34.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/oauth2/commit/acc38155b7f6f36aefcb58faff6f36d314dd915c"><code>acc3815</code></a> endpoints: fix %q verb use with wrong type</li> <li>See full diff in <a href="https://github.com/golang/oauth2/compare/v0.33.0...v0.34.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#823) Bumps [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) from 1.38.0 to 1.39.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel/trace's releases</a>.</em></p> <blockquote> <h2>v1.39.0</h2> <h2>Overview</h2> <h3>Added</h3> <ul> <li>Greatly reduce the cost of recording metrics in <code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map keys. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li> <li>Add <code>WithInstrumentationAttributeSet</code> option to <code>go.opentelemetry.io/otel/log</code>, <code>go.opentelemetry.io/otel/metric</code>, and <code>go.opentelemetry.io/otel/trace</code> packages. This provides a concurrent-safe and performant alternative to <code>WithInstrumentationAttributes</code> by accepting a pre-constructed <code>attribute.Set</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li> <li>Add experimental observability for the Prometheus exporter in <code>go.opentelemetry.io/otel/exporters/prometheus</code>. Check the <code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code> package documentation for more information. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li> <li>Add temporality selector functions <code>DeltaTemporalitySelector</code>, <code>CumulativeTemporalitySelector</code>, <code>LowMemoryTemporalitySelector</code> to <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li> <li>Add experimental observability metrics for simple log processor in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7486">#7486</a>)</li> <li>Add experimental observability metrics for simple span processor in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7374">#7374</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7512">#7512</a>)</li> <li>Add experimental observability metrics for manual reader in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7524">#7524</a>)</li> <li>Add experimental observability metrics for periodic reader in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7571">#7571</a>)</li> <li>Support <code>OTEL_EXPORTER_OTLP_LOGS_INSECURE</code> and <code>OTEL_EXPORTER_OTLP_INSECURE</code> environmental variables in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7608">#7608</a>)</li> <li>Add <code>Enabled</code> method to the <code>Processor</code> interface in <code>go.opentelemetry.io/otel/sdk/log</code>. All <code>Processor</code> implementations now include an <code>Enabled</code> method. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li> <li>The <code>go.opentelemetry.io/otel/semconv/v1.38.0</code> package. The package contains semantic conventions from the <code>v1.38.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.38.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.37.0.</code>(<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7648">#7648</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>Distinct</code> in <code>go.opentelemetry.io/otel/attribute</code> is no longer guaranteed to uniquely identify an attribute set. Collisions between <code>Distinct</code> values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li> <li><code>WithInstrumentationAttributes</code> in <code>go.opentelemetry.io/otel/trace</code> synchronously de-duplicates the passed attributes instead of delegating it to the returned <code>TracerOption</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li> <li><code>WithInstrumentationAttributes</code> in <code>go.opentelemetry.io/otel/meter</code> synchronously de-duplicates the passed attributes instead of delegating it to the returned <code>MeterOption</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li> <li><code>WithInstrumentationAttributes</code> in <code>go.opentelemetry.io/otel/log</code> synchronously de-duplicates the passed attributes instead of delegating it to the returned <code>LoggerOption</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li> <li>Rename the <code>OTEL_GO_X_SELF_OBSERVABILITY</code> environment variable to <code>OTEL_GO_X_OBSERVABILITY</code> in <code>go.opentelemetry.io/otel/sdk/trace</code>, <code>go.opentelemetry.io/otel/sdk/log</code>, and <code>go.opentelemetry.io/otel/exporters/stdout/stdouttrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7302">#7302</a>)</li> <li>Improve performance of histogram <code>Record</code> in <code>go.opentelemetry.io/otel/sdk/metric</code> when min and max are disabled using <code>NoMinMax</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7306">#7306</a>)</li> <li>Improve error handling for dropped data during translation by using <code>prometheus.NewInvalidMetric</code> in <code>go.opentelemetry.io/otel/exporters/prometheus</code>.⚠️ <strong>Breaking Change:</strong> Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a <code>NewInvalidMetric</code>, and Prometheus scrapes <strong>fail with HTTP 500</strong> by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: <code>promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7363">#7363</a>)</li> <li>Replace fnv hash with xxhash in <code>go.opentelemetry.io/otel/attribute</code> for better performance. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7371">#7371</a>)</li> <li>The default <code>TranslationStrategy</code> in <code>go.opentelemetry.io/exporters/prometheus</code> is changed from <code>otlptranslator.NoUTF8EscapingWithSuffixes</code> to <code>otlptranslator.UnderscoreEscapingWithSuffixes</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7421">#7421</a>)</li> <li>Improve performance of concurrent measurements in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7427">#7427</a>)</li> <li>Include W3C TraceFlags (bits 0–7) in the OTLP <code>Span.Flags</code> field in <code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp</code> and <code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7438">#7438</a>)</li> <li>The <code>ErrorType</code> function in <code>go.opentelemetry.io/otel/semconv/v1.37.0</code> now handles custom error types. If an error implements an <code>ErrorType() string</code> method, the return value of that method will be used as the error type. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7442">#7442</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>WithInstrumentationAttributes</code> options in <code>go.opentelemetry.io/otel/trace</code>, <code>go.opentelemetry.io/otel/metric</code>, and <code>go.opentelemetry.io/otel/log</code> to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7300">#7300</a>)</li> <li>The equality of <code>attribute.Set</code> when using the <code>Equal</code> method is not affected by the user overriding the empty set pointed to by <code>attribute.EmptySet</code> in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7357">#7357</a>)</li> <li>Return partial OTLP export errors to the caller in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li> <li>Return partial OTLP export errors to the caller in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li> <li>Return partial OTLP export errors to the caller in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li> <li>Return partial OTLP export errors to the caller in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li> <li>Return partial OTLP export errors to the caller in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li> <li>Return partial OTLP export errors to the caller in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li> <li>Fix <code>AddAttributes</code>, <code>SetAttributes</code>, <code>SetBody</code> on <code>Record</code> in <code>go.opentelemetry.io/otel/sdk/log</code> to not mutate input. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7403">#7403</a>)</li> <li>Do not double record measurements of <code>RecordSet</code> methods in <code>go.opentelemetry.io/otel/semconv/v1.37.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7655">#7655</a>)</li> <li>Do not double record measurements of <code>RecordSet</code> methods in <code>go.opentelemetry.io/otel/semconv/v1.36.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7656">#7656</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/trace's changelog</a>.</em></p> <blockquote> <h2>[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05</h2> <h3>Added</h3> <ul> <li>Greatly reduce the cost of recording metrics in <code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map keys. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li> <li>Add <code>WithInstrumentationAttributeSet</code> option to <code>go.opentelemetry.io/otel/log</code>, <code>go.opentelemetry.io/otel/metric</code>, and <code>go.opentelemetry.io/otel/trace</code> packages. This provides a concurrent-safe and performant alternative to <code>WithInstrumentationAttributes</code> by accepting a pre-constructed <code>attribute.Set</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li> <li>Add experimental observability for the Prometheus exporter in <code>go.opentelemetry.io/otel/exporters/prometheus</code>. Check the <code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code> package documentation for more information. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li> <li>Add temporality selector functions <code>DeltaTemporalitySelector</code>, <code>CumulativeTemporalitySelector</code>, <code>LowMemoryTemporalitySelector</code> to <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li> <li>Add experimental observability metrics for simple log processor in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7486">#7486</a>)</li> <li>Add experimental observability metrics for simple span processor in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7374">#7374</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7512">#7512</a>)</li> <li>Add experimental observability metrics for manual reader in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7524">#7524</a>)</li> <li>Add experimental observability metrics for periodic reader in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7571">#7571</a>)</li> <li>Support <code>OTEL_EXPORTER_OTLP_LOGS_INSECURE</code> and <code>OTEL_EXPORTER_OTLP_INSECURE</code> environmental variables in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7608">#7608</a>)</li> <li>Add <code>Enabled</code> method to the <code>Processor</code> interface in <code>go.opentelemetry.io/otel/sdk/log</code>. All <code>Processor</code> implementations now include an <code>Enabled</code> method. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li> <li>The <code>go.opentelemetry.io/otel/semconv/v1.38.0</code> package. The package contains semantic conventions from the <code>v1.38.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.38.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.37.0.</code>(<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7648">#7648</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>Distinct</code> in <code>go.opentelemetry.io/otel/attribute</code> is no longer guaranteed to uniquely identify an attribute set. Collisions between <code>Distinct</code> values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li> <li><code>WithInstrumentationAttributes</code> in <code>go.opentelemetry.io/otel/trace</code> synchronously de-duplicates the passed attributes instead of delegating it to the returned <code>TracerOption</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li> <li><code>WithInstrumentationAttributes</code> in <code>go.opentelemetry.io/otel/meter</code> synchronously de-duplicates the passed attributes instead of delegating it to the returned <code>MeterOption</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li> <li><code>WithInstrumentationAttributes</code> in <code>go.opentelemetry.io/otel/log</code> synchronously de-duplicates the passed attributes instead of delegating it to the returned <code>LoggerOption</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li> <li>Rename the <code>OTEL_GO_X_SELF_OBSERVABILITY</code> environment variable to <code>OTEL_GO_X_OBSERVABILITY</code> in <code>go.opentelemetry.io/otel/sdk/trace</code>, <code>go.opentelemetry.io/otel/sdk/log</code>, and <code>go.opentelemetry.io/otel/exporters/stdout/stdouttrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7302">#7302</a>)</li> <li>Improve performance of histogram <code>Record</code> in <code>go.opentelemetry.io/otel/sdk/metric</code> when min and max are disabled using <code>NoMinMax</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7306">#7306</a>)</li> <li>Improve error handling for dropped data during translation by using <code>prometheus.NewInvalidMetric</code> in <code>go.opentelemetry.io/otel/exporters/prometheus</code>.⚠️ <strong>Breaking Change:</strong> Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a <code>NewInvalidMetric</code>, and Prometheus scrapes <strong>fail with HTTP 500</strong> by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: <code>promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7363">#7363</a>)</li> <li>Replace fnv hash with xxhash in <code>go.opentelemetry.io/otel/attribute</code> for better performance. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7371">#7371</a>)</li> <li>The default <code>TranslationStrategy</code> in <code>go.opentelemetry.io/exporters/prometheus</code> is changed from <code>otlptranslator.NoUTF8EscapingWithSuffixes</code> to <code>otlptranslator.UnderscoreEscapingWithSuffixes</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7421">#7421</a>)</li> <li>Improve performance of concurrent measurements in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7427">#7427</a>)</li> <li>Include W3C TraceFlags (bits 0–7) in the OTLP <code>Span.Flags</code> field in <code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp</code> and <code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7438">#7438</a>)</li> <li>The <code>ErrorType</code> function in <code>go.opentelemetry.io/otel/semconv/v1.37.0</code> now handles custom error types. If an error implements an <code>ErrorType() string</code> method, the return value of that method will be used as the error type. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7442">#7442</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>WithInstrumentationAttributes</code> options in <code>go.opentelemetry.io/otel/trace</code>, <code>go.opentelemetry.io/otel/metric</code>, and <code>go.opentelemetry.io/otel/log</code> to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7300">#7300</a>)</li> <li>The equality of <code>attribute.Set</code> when using the <code>Equal</code> method is not affected by the user overriding the empty set pointed to by <code>attribute.EmptySet</code> in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7357">#7357</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6ce14298b9d58647295280560205307768400496"><code>6ce1429</code></a> Release v1.39.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7676">#7676</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/12e421a7061c1ab5c25a1851ca168e1c3ac11bbb"><code>12e421a</code></a> sdk/log: move Enabled method from FilterProcessor to Processor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/5982f16d244fafebffcfc92b4673dbeb565b4e7b"><code>5982f16</code></a> fix(deps): update module golang.org/x/sys to v0.39.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7684">#7684</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/928837830da34dea636b48a468149d480cc41058"><code>9288378</code></a> chore(deps): update module golang.org/x/sync to v0.19.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7683">#7683</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ee3dfef45d9462e209d92e0651a58d2417c1305f"><code>ee3dfef</code></a> chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7682">#7682</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9345d1f64d874fa8df5f6ca4e14acaeb44532cd3"><code>9345d1f</code></a> fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7680">#7680</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/d03b03395dc9436d79d5ba7b5ea77053b18a9915"><code>d03b033</code></a> Check context prior to delaying retry in OTLP exporters (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7678">#7678</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/61765e78a620994b5922e34e776e029da1a2b983"><code>61765e7</code></a> Fix flaky <code>TestClientInstrumentation</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7677">#7677</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/a54721cc8052fcd497d6f637a463d1aba787012c"><code>a54721c</code></a> chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7679">#7679</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/746d0860d70bb9c1e875afe1c7e41e9060387d46"><code>746d086</code></a> chore(deps): update github/codeql-action action to v4.31.7 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7675">#7675</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.38.0...v1.39.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.31.0 to 0.32.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/0dd57a6ef90c283b902525213f15d6b2a59cc84b"><code>0dd57a6</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/087616b6cde9434a9f6f788f4fe975b40651be26"><code>087616b</code></a> transform: fix %q verb use with wrong type</li> <li><a href="https://github.com/golang/text/commit/16f85a7ff268a4e26c78cf3c4202152a7a1d6d90"><code>16f85a7</code></a> all: eliminate vet diagnostics</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.31.0...v0.32.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.1 to 5.5.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h2>What's Changed</h2> <ul> <li>check gpg only when skip-validation = false by <a href="https://github.com/maxweng-sentry"><code>@maxweng-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1894">codecov/codecov-action#1894</a></li> <li>chore: <code>disable_search</code> alignment by <a href="https://github.com/freemanzMrojo"><code>@freemanzMrojo</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1881">codecov/codecov-action#1881</a></li> <li>chore(release): 5.5.2 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1902">codecov/codecov-action#1902</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/maxweng-sentry"><code>@maxweng-sentry</code></a> made their first contribution in <a href="https://redirect.github.com/codecov/codecov-action/pull/1894">codecov/codecov-action#1894</a></li> <li><a href="https://github.com/freemanzMrojo"><code>@freemanzMrojo</code></a> made their first contribution in <a href="https://redirect.github.com/codecov/codecov-action/pull/1881">codecov/codecov-action#1881</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h3>What's Changed</h3> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codecov/codecov-action/commit/671740ac38dd9b0130fbe1cec585b89eea48d3de"><code>671740a</code></a> chore(release): 5.5.2 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1902">#1902</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/96b38e9e60ee60a8c3911f4612407bba2f9195fb"><code>96b38e9</code></a> chore: <code>disable_search</code> alignment (<a href="https://redirect.github.com/codecov/codecov-action/issues/1881">#1881</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/9b6d1f84bde660b0f784003009b1f0aa4663cdeb"><code>9b6d1f8</code></a> check gpg only when skip-validation = false (<a href="https://redirect.github.com/codecov/codecov-action/issues/1894">#1894</a>)</li> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/zitadel/schema](https://github.com/zitadel/schema) from 1.3.1 to 1.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zitadel/schema/releases">github.com/zitadel/schema's releases</a>.</em></p> <blockquote> <h2>v1.3.2</h2> <h2><a href="https://github.com/zitadel/schema/compare/v1.3.1...v1.3.2">1.3.2</a> (2026-01-05)</h2> <h3>Bug Fixes</h3> <ul> <li>add test (<a href="https://github.com/zitadel/schema/commit/95c7b8f17212cce5d25cddfad47212c2199c2961">95c7b8f</a>)</li> <li>decode error message (<a href="https://github.com/zitadel/schema/commit/1b632a9ad4c13e208228f9298efcc8116f581b4b">1b632a9</a>)</li> <li>fix assertion test (<a href="https://github.com/zitadel/schema/commit/595717facd9c466dad08f298c70b75dab4fea18d">595717f</a>)</li> <li>if default element type of value are setted in slice , raise error (<a href="https://github.com/zitadel/schema/commit/9c250587ea34a64ce051d25649ec5ae8f93eec25">9c25058</a>)</li> <li>indirection through nil pointer to embedded struct (<a href="https://redirect.github.com/zitadel/schema/issues/211">#211</a>) (<a href="https://github.com/zitadel/schema/commit/c3913e416b2fdbe4754081550fcded3e44afef49">c3913e4</a>)</li> <li>test data (<a href="https://github.com/zitadel/schema/commit/2b94d1c4c5d23a1786b09e4a562aafd79a4bcf5b">2b94d1c</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zitadel/schema/commit/be9af1ca12514cf3b1e5e75c14ec84b5edf3594a"><code>be9af1c</code></a> Merge pull request from GHSA-3669-72x9-r9p3</li> <li><a href="https://github.com/zitadel/schema/commit/c3913e416b2fdbe4754081550fcded3e44afef49"><code>c3913e4</code></a> fix: indirection through nil pointer to embedded struct (<a href="https://redirect.github.com/zitadel/schema/issues/211">#211</a>)</li> <li><a href="https://github.com/zitadel/schema/commit/595717facd9c466dad08f298c70b75dab4fea18d"><code>595717f</code></a> fix: fix assertion test</li> <li><a href="https://github.com/zitadel/schema/commit/4fa7028fe7f4a0b3d5a800ccdd1944cac4f7ec60"><code>4fa7028</code></a> fix delete pointer slice test</li> <li><a href="https://github.com/zitadel/schema/commit/01a72cd29b786c43a5246fb1156a3d7a0174a4b7"><code>01a72cd</code></a> fix:test: fix comment</li> <li><a href="https://github.com/zitadel/schema/commit/c9e4629f8bcf904bc2aa425dd745e9fbb120ec88"><code>c9e4629</code></a> fix:test: add assertion</li> <li><a href="https://github.com/zitadel/schema/commit/1b632a9ad4c13e208228f9298efcc8116f581b4b"><code>1b632a9</code></a> fix: decode error message</li> <li><a href="https://github.com/zitadel/schema/commit/2b94d1c4c5d23a1786b09e4a562aafd79a4bcf5b"><code>2b94d1c</code></a> fix: test data</li> <li><a href="https://github.com/zitadel/schema/commit/95c7b8f17212cce5d25cddfad47212c2199c2961"><code>95c7b8f</code></a> fix: add test</li> <li><a href="https://github.com/zitadel/schema/commit/9c250587ea34a64ce051d25649ec5ae8f93eec25"><code>9c25058</code></a> fix: if default element type of value are setted in slice , raise error</li> <li>Additional commits viewable in <a href="https://github.com/zitadel/schema/compare/v1.3.1...v1.3.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.32.0 to 0.33.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/536231a9abc69feaab8d726b5ec75ee8d3620829"><code>536231a</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.32.0...v0.33.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#832) Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) from 4.9.1 to 4.9.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/bmatcuk/doublestar/releases">github.com/bmatcuk/doublestar/v4's releases</a>.</em></p> <blockquote> <h2>Fixed Handling of Paths With Meta Chars Using Alts</h2> <p><a href="https://github.com/toga4"><code>@toga4</code></a> submitted a PR that fixed a small bug with the way paths were handled when the pattern used <code>{alts}</code>: if some part of the on-disk path that came before the <code>{alt}</code> included meta characters (say, a directory name that included the character <code>?</code>), these meta characters were not escaped when they were passed back through the globbing routines. This caused doublestar to interpret them as actual meta characters, rather than a fixed-string path as it should have. Nice find, <a href="https://github.com/toga4"><code>@toga4</code></a> !</p> <h2>What's Changed</h2> <ul> <li>fix: escape meta characters in paths during brace expansion by <a href="https://github.com/toga4"><code>@toga4</code></a> in <a href="https://redirect.github.com/bmatcuk/doublestar/pull/108">bmatcuk/doublestar#108</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/toga4"><code>@toga4</code></a> made their first contribution in <a href="https://redirect.github.com/bmatcuk/doublestar/pull/108">bmatcuk/doublestar#108</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/bmatcuk/doublestar/compare/v4.9.1...v4.9.2">https://github.com/bmatcuk/doublestar/compare/v4.9.1...v4.9.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/bmatcuk/doublestar/commit/3dc83064cf84411e82d1fa4fc734cb4f35778846"><code>3dc8306</code></a> Merge branch 'toga4-fix-brace-exp-with-meta'</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/4db19e22da8418ce3bea1c0b7162a7d07ac59f13"><code>4db19e2</code></a> fix tests</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/4ef2b0039144da38066784f2efa4e51112855878"><code>4ef2b00</code></a> fix: escape meta characters in paths during brace expansion</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/b191bb9ad12123cbf8daf32d3d689d1f0780a396"><code>b191bb9</code></a> test: add failing tests for brace expansion with meta char directories</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/9fded312dd977d7acbb213e9f8a55da8cfd17bcd"><code>9fded31</code></a> notes about globbing</li> <li>See full diff in <a href="https://github.com/bmatcuk/doublestar/compare/v4.9.1...v4.9.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ant OIDC providers (#791) AWS Cognito (and potentially other providers) return `email_verified` and `phone_number_verified` as strings (`"true"`/`"false"`) instead of proper JSON booleans, violating the [OIDC specification](https://openid.net/specs/openid-connect-basic-1_0.html#StandardClaims). AWS Documentation confirms this: > Currently, Amazon Cognito returns the values for email_verified and phone_number_verified as strings. _Source: https://docs.aws.amazon.com/cognito/latest/developerguide/userinfo-endpoint.html#get-userinfo-response-sample_ ### The Problem The `zitadel/oidc` library currently handles this inconsistently: - ✅ `EmailVerified` uses the custom `Bool` type (added in #139) - ❌ `PhoneNumberVerified` uses Go's standard `bool` This forces developers to handle semantically identical fields differently: ```go // Currently inconsistent code path userInfo.EmailVerified = oidc.Bool(emailValue) // Cast userInfo.PhoneNumberVerified = phoneValue // No cast ``` Additionally, the existing `Bool.UnmarshalJSON` implementation meant that false values couldn't overwrite true. ### Solution Applied `Bool` type consistently to both fields and simplified `Bool.UnmarshalJSON` using a direct switch statement to: - Handle standard JSON booleans (true/false) - Handle AWS Cognito string format ("true"/"false") - Return errors on invalid input instead of silently failing - Allow false to overwrite true Updated tests to match codebase conventions, as well. ### Impact `PhoneNumberVerified` changes from `bool` to `Bool` (type alias of `bool`). Most consumer code should work as-is since `Bool` is just a type alias. Direct type assertions would need updating. ### Definition of Ready - [X] I am happy with the code - [X] Short description of the feature/issue is added in the pr description - [ ] PR is linked to the corresponding user story - [X] Acceptance criteria are met - [ ] All open todos and follow ups are defined in a new ticket and justified - [ ] Deviations from the acceptance criteria and design are agreed with the PO and documented. - [X] No debug or dead code - [X] My code has no repetitions - [X] Critical parts are tested automatically - [x] Where possible E2E tests are implemented - [X] Documentation/examples are up-to-date - [ ] All non-functional requirements are met - [x] Functionality of the acceptance criteria is checked manually on the dev system. Co-authored-by: Wim Van Laer <wim07101993@users.noreply.github.com>
Closes #808 - Made the Tracer public to allow users to customize it, similar to how it’s done in the client. - Private global var tracer renamed to public global var Tracer Co-authored-by: v.i.khegay <v.i.khegay@tbank.ru>
Bumps [github.com/zitadel/logging](https://github.com/zitadel/logging) from 0.6.2 to 0.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zitadel/logging/releases">github.com/zitadel/logging's releases</a>.</em></p> <blockquote> <h2>v0.7.0</h2> <h1><a href="https://github.com/zitadel/logging/compare/v0.6.2...v0.7.0">0.7.0</a> (2026-01-15)</h1> <h3>Features</h3> <ul> <li>add deprecation message (<a href="https://redirect.github.com/zitadel/logging/issues/45">#45</a>) (<a href="https://github.com/zitadel/logging/commit/75f2cfbd2481d11408c52467dc58b2c669ea34fd">75f2cfb</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zitadel/logging/commit/75f2cfbd2481d11408c52467dc58b2c669ea34fd"><code>75f2cfb</code></a> feat: add deprecation message (<a href="https://redirect.github.com/zitadel/logging/issues/45">#45</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/0060b1e04407f26aee507e748c0ae7734eabe354"><code>0060b1e</code></a> chore: go upgrade to 1.24.10 (<a href="https://redirect.github.com/zitadel/logging/issues/44">#44</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/13e81f69390306a7be48e4f18078ce644c56859a"><code>13e81f6</code></a> chore(deps): bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/zitadel/logging/issues/43">#43</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/be03d53d1f932cedcf2da18526988cb748bdad41"><code>be03d53</code></a> chore(deps): bump cycjimmy/semantic-release-action from 5 to 6 (<a href="https://redirect.github.com/zitadel/logging/issues/42">#42</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/efac6cc6edcbe8b9fccd7343d8230a51efe72f90"><code>efac6cc</code></a> chore(deps): bump actions/setup-go from 5 to 6 (<a href="https://redirect.github.com/zitadel/logging/issues/41">#41</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/be827fa5316c24e406af5cd62ef965ed4c5a2cec"><code>be827fa</code></a> chore(deps): bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/zitadel/logging/issues/36">#36</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/b0541b6bca72d352acb786b5769f51d0948dd3f1"><code>b0541b6</code></a> chore(deps): bump cycjimmy/semantic-release-action from 4 to 5 (<a href="https://redirect.github.com/zitadel/logging/issues/40">#40</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/d9c4c409f9a6db0fffa2c7c3bb009e37ca442545"><code>d9c4c40</code></a> chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 (<a href="https://redirect.github.com/zitadel/logging/issues/39">#39</a>)</li> <li><a href="https://github.com/zitadel/logging/commit/4f659bd321b9812d60f2091d15f7b29dd49809b0"><code>4f659bd</code></a> chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (<a href="https://redirect.github.com/zitadel/logging/issues/37">#37</a>)</li> <li>See full diff in <a href="https://github.com/zitadel/logging/compare/v0.6.2...v0.7.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Am I wrong or the Example op Introspection is missing the expiry check? My access tokens were always "active" even if they were expired.
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.3 to 5.2.4. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/chi/commit/6eb35881c0e438ffb663ddbad3a61babaa5e5d8a"><code>6eb3588</code></a> middleware: harden RedirectSlashes handler (<a href="https://redirect.github.com/go-chi/chi/issues/1044">#1044</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/de0d16e6d23092aeef0b6e78f146799369160651"><code>de0d16e</code></a> Update comment about min Go version (<a href="https://redirect.github.com/go-chi/chi/issues/1023">#1023</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/9fb4a15daa6d4ccd5e7286c1227d58872f89f4cb"><code>9fb4a15</code></a> update reverseMethodMap in RegisterMethod (<a href="https://redirect.github.com/go-chi/chi/issues/1022">#1022</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/51c977c2da872d16d05531d5bc49ccd027599ce2"><code>51c977c</code></a> Refactor to use atomic type (<a href="https://redirect.github.com/go-chi/chi/issues/1019">#1019</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/563ab118626b47810852303c3a60c2106a6bc23c"><code>563ab11</code></a> Refactor graceful shutdown example (<a href="https://redirect.github.com/go-chi/chi/issues/994">#994</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/a52c582b532cd261dbedc4c811d809d6e024c1ff"><code>a52c582</code></a> Bump minimum Go and use new features (<a href="https://redirect.github.com/go-chi/chi/issues/1017">#1017</a>)</li> <li>See full diff in <a href="https://github.com/go-chi/chi/compare/v5.2.3...v5.2.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.9.3 to 1.9.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sirupsen/logrus/releases">github.com/sirupsen/logrus's releases</a>.</em></p> <blockquote> <h2>v1.9.4</h2> <h2>Notable changes</h2> <ul> <li>go.mod: update minimum supported go version to v1.17 <a href="https://redirect.github.com/sirupsen/logrus/pull/1460">sirupsen/logrus#1460</a></li> <li>go.mod: bump up dependencies <a href="https://redirect.github.com/sirupsen/logrus/pull/1460">sirupsen/logrus#1460</a></li> <li>Touch-up godoc and add "doc" links.</li> <li>README: fix links, grammar, and update examples.</li> <li>Add GNU/Hurd support <a href="https://redirect.github.com/sirupsen/logrus/pull/1364">sirupsen/logrus#1364</a></li> <li>Add WASI wasip1 support <a href="https://redirect.github.com/sirupsen/logrus/pull/1388">sirupsen/logrus#1388</a></li> <li>Remove uses of deprecated <code>ioutil</code> package <a href="https://redirect.github.com/sirupsen/logrus/pull/1472">sirupsen/logrus#1472</a></li> <li>CI: update actions and golangci-lint <a href="https://redirect.github.com/sirupsen/logrus/pull/1459">sirupsen/logrus#1459</a></li> <li>CI: remove appveyor, add macOS <a href="https://redirect.github.com/sirupsen/logrus/pull/1460">sirupsen/logrus#1460</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sirupsen/logrus/compare/v1.9.3...v1.9.4">https://github.com/sirupsen/logrus/compare/v1.9.3...v1.9.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sirupsen/logrus/commit/b61f268f75b6ff134a62cd62aee1095fa12e8d2e"><code>b61f268</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1472">#1472</a> from goldlinker/master</li> <li><a href="https://github.com/sirupsen/logrus/commit/15c29db7129cc15331e9c52493d5aaab217146c7"><code>15c29db</code></a> refactor: replace the deprecated function in the ioutil package</li> <li><a href="https://github.com/sirupsen/logrus/commit/cb253f3080f18ec7e55b4c8f15b62fe0a806f130"><code>cb253f3</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1464">#1464</a> from thaJeztah/touchup_godoc</li> <li><a href="https://github.com/sirupsen/logrus/commit/29b233793060a07fb76eda791f604d87e08d23d1"><code>29b2337</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1468">#1468</a> from thaJeztah/touchup_readme</li> <li><a href="https://github.com/sirupsen/logrus/commit/d9168199e06807d8959126bc8c823ad8b96e3969"><code>d916819</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1427">#1427</a> from dolmen/fix-testify-usage</li> <li><a href="https://github.com/sirupsen/logrus/commit/135e4820b2140747fb868073e4dca1619996417a"><code>135e482</code></a> README: small touch-ups</li> <li><a href="https://github.com/sirupsen/logrus/commit/2c5fa36b73abb8b007474417571e268685d0d84e"><code>2c5fa36</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1467">#1467</a> from thaJeztah/rm_old_badge</li> <li><a href="https://github.com/sirupsen/logrus/commit/877ecec10d61675855189ece38d70d8804302fa4"><code>877ecec</code></a> README: remove travis badge</li> <li><a href="https://github.com/sirupsen/logrus/commit/55cf2560b5e5fd3f0e6ff59e6ce766eb12db4522"><code>55cf256</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1393">#1393</a> from jsoref/grammar</li> <li><a href="https://github.com/sirupsen/logrus/commit/21bae50b76794e93449c3f0f845ea0ac903847db"><code>21bae50</code></a> Merge pull request <a href="https://redirect.github.com/sirupsen/logrus/issues/1426">#1426</a> from dolmen/testing-fix-use-of-math-rand</li> <li>Additional commits viewable in <a href="https://github.com/sirupsen/logrus/compare/v1.9.3...v1.9.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….0 (#841) Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) from 4.9.2 to 4.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/bmatcuk/doublestar/releases">github.com/bmatcuk/doublestar/v4's releases</a>.</em></p> <blockquote> <h2>Added WithNoHidden option</h2> <p>Added support for a <code>WithNoHidden</code> option to ignore hidden files in patterns that might unintentionally match them. For example, a <code>.config</code> directory would not be matched by <code>*</code> or recursed into by <code>**</code>, but <em>would</em> be matched by <code>.*</code> or recursed by <code>.config/**</code>.</p> <p>Thanks to <a href="https://github.com/lukasngl"><code>@lukasngl</code></a> for the initial PR and idea!</p> <h2>What's Changed</h2> <ul> <li>feat: add WithNoHidden option to skip hidden files by <a href="https://github.com/lukasngl"><code>@lukasngl</code></a> in <a href="https://redirect.github.com/bmatcuk/doublestar/pull/109">bmatcuk/doublestar#109</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lukasngl"><code>@lukasngl</code></a> made their first contribution in <a href="https://redirect.github.com/bmatcuk/doublestar/pull/109">bmatcuk/doublestar#109</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/bmatcuk/doublestar/compare/v4.9.2...v4.10.0">https://github.com/bmatcuk/doublestar/compare/v4.9.2...v4.10.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/bmatcuk/doublestar/commit/a9ad9e0ef4d6b7e4443090e9a7201d847a881711"><code>a9ad9e0</code></a> allow starting test manually</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/9987c0c624376f84f44515adca73ddcdfdcdf453"><code>9987c0c</code></a> update docs</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/d3b2184d103391fcd0fcca6590c16367310eee65"><code>d3b2184</code></a> windows support for WithNoHidden; better tests</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/5d6a6cd76ba3e45482d13140f332be36451f5a48"><code>5d6a6cd</code></a> Merge branch 'lukasngl-feat/no-hidden'</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/e8319d206e9dab8d51d41e662811cdfb9af72b24"><code>e8319d2</code></a> run tests when a branch/tag is created</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/614b331133390c7682c227740c51ff65dea2de65"><code>614b331</code></a> run tests when a branch/tag is created</li> <li><a href="https://github.com/bmatcuk/doublestar/commit/df2e03fb0b91b726e0366c0d9ba1c5e580e2d0c9"><code>df2e03f</code></a> feat: add WithNoHidden option to skip hidden files</li> <li>See full diff in <a href="https://github.com/bmatcuk/doublestar/compare/v4.9.2...v4.10.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#842) Bumps [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/trace's changelog</a>.</em></p> <blockquote> <h2>[1.40.0/0.62.0/0.16.0] 2026-02-02</h2> <h3>Added</h3> <ul> <li>Add <code>AlwaysRecord</code> sampler in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7724">#7724</a>)</li> <li>Add <code>Enabled</code> method to all synchronous instrument interfaces (<code>Float64Counter</code>, <code>Float64UpDownCounter</code>, <code>Float64Histogram</code>, <code>Float64Gauge</code>, <code>Int64Counter</code>, <code>Int64UpDownCounter</code>, <code>Int64Histogram</code>, <code>Int64Gauge</code>,) in <code>go.opentelemetry.io/otel/metric</code>. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7763">#7763</a>)</li> <li>Add <code>go.opentelemetry.io/otel/semconv/v1.39.0</code> package. The package contains semantic conventions from the <code>v1.39.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.39.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.38.0.</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7783">#7783</a>, <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7789">#7789</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Improve the concurrent performance of <code>HistogramReservoir</code> in <code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> by 4x. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7443">#7443</a>)</li> <li>Improve the concurrent performance of <code>FixedSizeReservoir</code> in <code>go.opentelemetry.io/otel/sdk/metric/exemplar</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7447">#7447</a>)</li> <li>Improve performance of concurrent histogram measurements in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7474">#7474</a>)</li> <li>Improve performance of concurrent synchronous gauge measurements in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7478">#7478</a>)</li> <li>Add experimental observability metrics in <code>go.opentelemetry.io/otel/exporters/stdout/stdoutmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7492">#7492</a>)</li> <li><code>Exporter</code> in <code>go.opentelemetry.io/otel/exporters/prometheus</code> ignores metrics with the scope <code>go.opentelemetry.io/contrib/bridges/prometheus</code>. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7688">#7688</a>)</li> <li>Improve performance of concurrent exponential histogram measurements in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7702">#7702</a>)</li> <li>The <code>rpc.grpc.status_code</code> attribute in the experimental metrics emitted from <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code> is replaced with the <code>rpc.response.status_code</code> attribute to align with the semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7854">#7854</a>)</li> <li>The <code>rpc.grpc.status_code</code> attribute in the experimental metrics emitted from <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code> is replaced with the <code>rpc.response.status_code</code> attribute to align with the semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7854">#7854</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix bad log message when key-value pairs are dropped because of key duplication in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7662">#7662</a>)</li> <li>Fix <code>DroppedAttributes</code> on <code>Record</code> in <code>go.opentelemetry.io/otel/sdk/log</code> to not count the non-attribute key-value pairs dropped because of key duplication. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7662">#7662</a>)</li> <li>Fix <code>SetAttributes</code> on <code>Record</code> in <code>go.opentelemetry.io/otel/sdk/log</code> to not log that attributes are dropped when they are actually not dropped. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7662">#7662</a>)</li> <li>Fix missing <code>request.GetBody</code> in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code> to correctly handle HTTP/2 <code>GOAWAY</code> frame. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7794">#7794</a>)</li> <li><code>WithHostID</code> detector in <code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for <code>ioreg</code> command on Darwin (macOS). (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7818">#7818</a>)</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecate <code>go.opentelemetry.io/otel/exporters/zipkin</code>. For more information, see the <a href="https://opentelemetry.io/blog/2025/deprecating-zipkin-exporters/">OTel blog post deprecating the Zipkin exporter</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7670">#7670</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/a3a5317c5caed1656fb5b301b66dfeb3c4c944e0"><code>a3a5317</code></a> Release v1.40.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7859">#7859</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/77785da545d67b38774891cbdd334368bfacdfd8"><code>77785da</code></a> chore(deps): update github/codeql-action action to v4.32.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7858">#7858</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/56fa1c297bf71f0ada3dbf4574a45d0607812cc0"><code>56fa1c2</code></a> chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7857">#7857</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/298cbedf256b7a9ab3c21e41fc5e3e6d6e4e94aa"><code>298cbed</code></a> Upgrade semconv use to v1.39.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7854">#7854</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/3264bf171b1e6cd70f6be4a483f2bcb84eda6ccf"><code>3264bf1</code></a> refactor: modernize code (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7850">#7850</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fd5d030c0aa8b5bfe786299047bc914b5714d642"><code>fd5d030</code></a> chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/8d3b4cb2501dec9f1c5373123e425f109c43b8d2"><code>8d3b4cb</code></a> chore(deps): update actions/cache action to v5.0.3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7847">#7847</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/91f7cadfcac363d67030f6913687c6dbbe086823"><code>91f7cad</code></a> chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7845">#7845</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fdad1eb7f350ee1f5fdb3d9a0c6855cc88ee9d75"><code>fdad1eb</code></a> chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/c46d3bac181ddaaa83286e9ccf2cd9f7705fd3d9"><code>c46d3ba</code></a> chore(deps): update golang.org/x/telemetry digest to fcf36f6 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7843">#7843</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.40.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.4 to 5.2.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's releases</a>.</em></p> <blockquote> <h2>v5.2.5</h2> <h2>What's Changed</h2> <ul> <li>Bump minimum Go to 1.22 and use new features by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1017">go-chi/chi#1017</a></li> <li>Refactor graceful shutdown example by <a href="https://github.com/mikereid1"><code>@mikereid1</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/994">go-chi/chi#994</a></li> <li>Refactor to use atomic type by <a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1019">go-chi/chi#1019</a></li> <li>update reverseMethodMap in RegisterMethod by <a href="https://github.com/cixel"><code>@cixel</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1022">go-chi/chi#1022</a></li> <li>Update comment about min Go version by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1023">go-chi/chi#1023</a></li> <li>middleware: harden RedirectSlashes handler by <a href="https://github.com/pkieltyka"><code>@pkieltyka</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1044">go-chi/chi#1044</a></li> <li>Fix(middleware): Prevent double handler invocation in RouteHeaders with empty router by <a href="https://github.com/mahanadh"><code>@mahanadh</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1045">go-chi/chi#1045</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mikereid1"><code>@mikereid1</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/994">go-chi/chi#994</a></li> <li><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1019">go-chi/chi#1019</a></li> <li><a href="https://github.com/cixel"><code>@cixel</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1022">go-chi/chi#1022</a></li> <li><a href="https://github.com/mahanadh"><code>@mahanadh</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1045">go-chi/chi#1045</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/chi/compare/v5.2.3...v5.2.5">https://github.com/go-chi/chi/compare/v5.2.3...v5.2.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/chi/commit/05f1ef7bb50b8a8cb33a9dd3ba1c5b94bff0f723"><code>05f1ef7</code></a> fix(middleware): add missing return in RouteHeaders empty check (<a href="https://redirect.github.com/go-chi/chi/issues/1045">#1045</a>)</li> <li>See full diff in <a href="https://github.com/go-chi/chi/compare/v5.2.4...v5.2.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Use `GrantTypeDeviceCode` in device code error message The error message was incorrectly referencing `GrantTypeCode`(authorization_code) instead of `GrantTypeDeviceCode` when validation failed.
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.34.0 to 0.35.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/oauth2/commit/89ff2e1ac388c1a234a687cb2735341cde3f7122"><code>89ff2e1</code></a> google: add safer credentials JSON loading options.</li> <li>See full diff in <a href="https://github.com/golang/oauth2/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wim Van Laer <van.laer.wim@gmail.com>
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.33.0 to 0.34.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/817fba9abd337b4d9097b10c61a540c74feaaeff"><code>817fba9</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/3264de9174be11be843825a6dae979beffb483a2"><code>3264de9</code></a> all: clean up old Go hacks</li> <li><a href="https://github.com/golang/text/commit/74af29835a6da65bf18d985619fa645e04a01549"><code>74af298</code></a> all: fix tags in remaining Unicode tables</li> <li><a href="https://github.com/golang/text/commit/117e03b3060d70a9f514eef78f07e5210cc44a4c"><code>117e03b</code></a> all: delete old Unicode tables</li> <li><a href="https://github.com/golang/text/commit/9463ea4393e969a59c7a0af1b497b4361ff1dc52"><code>9463ea4</code></a> all: update to Unicode 17</li> <li><a href="https://github.com/golang/text/commit/7278b25aaff94e106b7de0bfaaa4a1861d3b3c89"><code>7278b25</code></a> internal/export/idna: update for post-Unicode 10 idna changes</li> <li><a href="https://github.com/golang/text/commit/f964ad80f9e4185588298009b5195d8ecfe34d1b"><code>f964ad8</code></a> internal/export/idna: delete old code</li> <li><a href="https://github.com/golang/text/commit/678d34e5c1bfbefd51bbd8e6a639744c36be73fd"><code>678d34e</code></a> unicode/norm: preserve QC Maybe bit in packed forminfo</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.33.0...v0.34.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#803) I have an authentication provider that only accepts client secrets from the request headers. Because of this, the refresh token and revoke token requests fail — the Authorization header is missing. This PR adds the Authorization header with the client credentials to those requests. Additionally, I’ve updated how the header is added in other requests to follow the same approach. I’d appreciate any feedback and am happy to adjust the PR as needed. --------- Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.34.0 to 0.35.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/7ca2c6d99153f6456168837916829c735c67d355"><code>7ca2c6d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/73d1ba91404d0de47cb6a9b3fb52a31565ca4d25"><code>73d1ba9</code></a> all: upgrade go directive to at least 1.25.0 [generated]</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.34.0...v0.35.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.35.0 to 0.36.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/oauth2/commit/4d954e69a88d9e1ccb8439f8d5b6cbef230c4ef9"><code>4d954e6</code></a> all: upgrade go directive to at least 1.25.0 [generated]</li> <li>See full diff in <a href="https://github.com/golang/oauth2/compare/v0.35.0...v0.36.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#853) Bumps [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) from 1.40.0 to 1.42.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/trace's changelog</a>.</em></p> <blockquote> <h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2> <h3>Added</h3> <ul> <li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package. The package contains semantic conventions from the <code>v1.40.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li> <li>Add <code>Err</code> and <code>SetErr</code> on <code>Record</code> in <code>go.opentelemetry.io/otel/log</code> to attach an error and set record exception attributes in <code>go.opentelemetry.io/otel/log/sdk</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>TracerProvider.ForceFlush</code> in <code>go.opentelemetry.io/otel/sdk/trace</code> joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix missing <code>request.GetBody</code> in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code> to correctly handle HTTP2 GOAWAY frame. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7931">#7931</a>)</li> <li>Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7964">#7964</a>)</li> <li>Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in <code>go.opentelemetry.io/otel/propagation</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7834">#7834</a>)</li> </ul> <h3>Removed</h3> <ul> <li>Drop support for [Go 1.24]. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7984">#7984</a>)</li> </ul> <h2>[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02</h2> <p>This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].</p> <h3>Added</h3> <ul> <li>Support testing of [Go 1.26]. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7902">#7902</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Update <code>Baggage</code> in <code>go.opentelemetry.io/otel/propagation</code> and <code>Parse</code> and <code>New</code> in <code>go.opentelemetry.io/otel/baggage</code> to comply with W3C Baggage specification limits. <code>New</code> and <code>Parse</code> now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7880">#7880</a>)</li> <li>Return an error when the endpoint is configured as insecure and with TLS configuration in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7914">#7914</a>)</li> <li>Return an error when the endpoint is configured as insecure and with TLS configuration in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7914">#7914</a>)</li> <li>Return an error when the endpoint is configured as insecure and with TLS configuration in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7914">#7914</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/a3941ff595235e952774f0a581c7655bec93b0ab"><code>a3941ff</code></a> Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8006">#8006</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6059c47bc64a1329618d8c06d31098cd1eee7750"><code>6059c47</code></a> chore(deps): update golang.org/x/telemetry digest to e526e8a (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8010">#8010</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/44c7edf896e0672b8b522700dcb9d56011349897"><code>44c7edf</code></a> chore(deps): update module github.com/mgechev/revive to v1.15.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8009">#8009</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/de5fb3ad101bc8de082bcaae93d4129ce467ad8c"><code>de5fb3a</code></a> fix(deps): update module google.golang.org/grpc to v1.79.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8007">#8007</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/0b82ded815a410d3bc0fc8b30802fd3a41059db3"><code>0b82ded</code></a> chore(deps): update codspeedhq/action action to v4.11.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8001">#8001</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/aa3660f77e65ad0873ae7f06084bfc9ddc62948b"><code>aa3660f</code></a> chore(deps): update github/codeql-action action to v4.32.6 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8004">#8004</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9be8c92a131a085c8b33b32bf19b3e16c413e2ae"><code>9be8c92</code></a> chore(deps): update dependency codespell to v2.4.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8003">#8003</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/c9d20155fcfa8d7dad13d1358fcdf63989113693"><code>c9d2015</code></a> log: add error field to Record and make SDK to emit exception attributes (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7924">#7924</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fdd1320c39ebc4b8e976f58e0af55965f25411c7"><code>fdd1320</code></a> TracerProvider ForceFlush() Error Fix (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7856">#7856</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/78f99042e2b038c4c86c5fa1ffd0609ec498c1db"><code>78f9904</code></a> chore(deps): update golang.org/x/telemetry digest to 18da590 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8000">#8000</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...v1.42.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.2 to 5.5.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v5.5.3</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1874">codecov/codecov-action#1874</a></li> <li>chore(release): bump to 5.5.3 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1922">codecov/codecov-action#1922</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3">https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codecov/codecov-action/commit/1af58845a975a7985b0beb0cbe6fbbb71a41dbad"><code>1af5884</code></a> chore(release): bump to 5.5.3 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1922">#1922</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/c143300dea6c9a730986ff862c5bf4d458927ef8"><code>c143300</code></a> build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1874">#1874</a>)</li> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.3 to 6.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24.⚠️ </h2> <h2>What's Changed</h2> <ul> <li>Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1929">codecov/codecov-action#1929</a></li> <li>Th/6.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1928">codecov/codecov-action#1928</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0">https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0</a></p> <h2>v5.5.4</h2> <p>This is a mirror of <code>v5.5.2</code>. <code>v6</code> will be released which requires <code>node24</code></p> <h2>What's Changed</h2> <ul> <li>Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1926">codecov/codecov-action#1926</a></li> <li>chore(release): 5.5.4 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1927">codecov/codecov-action#1927</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4">https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h3>What's Changed</h3> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p> <h2>v5.5.1</h2> <h3>What's Changed</h3> <ul> <li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li> <li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li> <li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li> <li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li> <li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li> <li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p> <h2>v5.5.0</h2> <h3>What's Changed</h3> <ul> <li>feat: upgrade wrapper to 0.2.4 by <a href="https://github.com/jviall"><code>@jviall</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li> <li>Pin actions/github-script by Git SHA by <a href="https://github.com/martincostello"><code>@martincostello</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li> <li>fix: check reqs exist by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li> <li>fix: Typo in README by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li> <li>docs: Refine OIDC docs by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p> <h2>v5.4.3</h2> <h3>What's Changed</h3> <ul> <li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li> <li>fix: OIDC on forks by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p> <h2>v5.4.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codecov/codecov-action/commit/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"><code>57e3a13</code></a> Th/6.0.0 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1928">#1928</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/f67d33dda8a42b51c42a8318a1f66468119e898b"><code>f67d33d</code></a> Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...</li> <li><a href="https://github.com/codecov/codecov-action/commit/75cd11691c0faa626561e295848008c8a7dddffe"><code>75cd116</code></a> chore(release): 5.5.4 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1927">#1927</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/87d39f4a2cec2673cf9505764fb20a38792ea722"><code>87d39f4</code></a> Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (<a href="https://redirect.github.com/codecov/codecov-action/issues/1926">#1926</a>)</li> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/v5.5.3...v6.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…p writer (#848) The cookie handler used for .CheckCookie() and .SetCookie() is needlessly constrained and not reusable outside of the scope of an http resp writer. See #847 ### Definition of Ready - [X] I am happy with the code - [X] Short description of the feature/issue is added in the pr description - [X] PR is linked to the corresponding user story - [X] Acceptance criteria are met - [X] All open todos and follow ups are defined in a new ticket and justified - [X] Deviations from the acceptance criteria and design are agreed with the PO and documented. - [X] No debug or dead code - [X] My code has no repetitions - [X] Critical parts are tested automatically - [X] Where possible E2E tests are implemented - [X] Documentation/examples are up-to-date - [X] All non-functional requirements are met - [X] Functionality of the acceptance criteria is checked manually on the dev system.
Upgraded all packages to latest patch versions. For jose there was a breaking change in errors. - Updated signature parsing error handling to use `errors.As` for `ErrUnexpectedSignatureAlgorithm` so wrapped errors are handled consistently. - Updated JWKS unmarshalling to ignore unsupported key types using `errors.Is`. - Improved test assertions in `jwks_test.go` to use `assert.NotErrorIs` for proper error identity checking instead of brittle string matching. ### Definition of Ready - [ ] I am happy with the code - [ ] Short description of the feature/issue is added in the pr description - [ ] PR is linked to the corresponding user story - [ ] Acceptance criteria are met - [ ] All open todos and follow ups are defined in a new ticket and justified - [ ] Deviations from the acceptance criteria and design are agreed with the PO and documented. - [ ] No debug or dead code - [ ] My code has no repetitions - [ ] Critical parts are tested automatically - [ ] Where possible E2E tests are implemented - [ ] Documentation/examples are up-to-date - [ ] All non-functional requirements are met - [ ] Functionality of the acceptance criteria is checked manually on the dev system. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.0 to 5.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's releases</a>.</em></p> <blockquote> <h2>v5.3.1</h2> <h2>What's Changed</h2> <ul> <li>Honor Discard() in httpFancyWriter.ReadFrom by <a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li>Tidy build directives by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1113">go-chi/chi#1113</a></li> <li>feat(middleware): add text/xml and application/xml to default compressible types by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1127">go-chi/chi#1127</a></li> <li>Fix defaultLogEntry.Panic not respecting NoColor setting by <a href="https://github.com/doganarif"><code>@doganarif</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li>middleware: document printPrettyStack and harden NoColor panic test by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1131">go-chi/chi#1131</a></li> <li>feat(mux): support http QUERY method ietf rfc10008 by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1132">go-chi/chi#1132</a></li> <li>ci: pin GitHub Actions to full commit SHAs by <a href="https://github.com/XananasX7"><code>@XananasX7</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li><a href="https://github.com/doganarif"><code>@doganarif</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li><a href="https://github.com/XananasX7"><code>@XananasX7</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/chi/commit/8b258c7bb28f97a5f2a856ff7ef962578fec9215"><code>8b258c7</code></a> ci: pin GitHub Actions to full commit SHAs (<a href="https://redirect.github.com/go-chi/chi/issues/1116">#1116</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/caf87e6e1bd9f29326f2ffdb93d8098139f08e4f"><code>caf87e6</code></a> feat(mux): support http QUERY method ietf rfc10008 (<a href="https://redirect.github.com/go-chi/chi/issues/1132">#1132</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/7fcb8a20364d7b72e2d5a0e413ae80346e1c99c8"><code>7fcb8a2</code></a> middleware: document printPrettyStack and harden NoColor panic test (<a href="https://redirect.github.com/go-chi/chi/issues/1131">#1131</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/878fe71fc9e506a63ea6957ed09c9ce84f789e97"><code>878fe71</code></a> Fix defaultLogEntry.Panic not respecting NoColor setting (<a href="https://redirect.github.com/go-chi/chi/issues/1050">#1050</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/d7b767bcbea51e486bdc9fd06d25136767ec14b5"><code>d7b767b</code></a> feat(middleware): add text/xml and application/xml to default compressible ty...</li> <li><a href="https://github.com/go-chi/chi/commit/3b50c7cc35ff25f384202409733c3332c150e0ec"><code>3b50c7c</code></a> Tidy build directives (<a href="https://redirect.github.com/go-chi/chi/issues/1113">#1113</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/2b9fca258f92830fc8232582e9e05a4d4a572a5d"><code>2b9fca2</code></a> Honor Discard() in httpFancyWriter.ReadFrom (<a href="https://redirect.github.com/go-chi/chi/issues/1110">#1110</a>)</li> <li>See full diff in <a href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <p>⚠️ Due to migration issues with keybase, we are unable to update our keys under the <code>codecovsecurity</code> account. We have deleted the account and are using <code>codecovsecops</code> with the original gpg key</p> <h2>What's Changed</h2> <ul> <li>ci: remove Enforce License Compliance workflow by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1950">codecov/codecov-action#1950</a></li> <li>chore(release): 7.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1957">codecov/codecov-action#1957</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0">https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0</a></p> <h2>v6.0.2</h2> <p>This is a copy of the <code>v7.0.0</code> release to make updates easier</p> <h2>What's Changed</h2> <ul> <li>ci: remove Enforce License Compliance workflow by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1950">codecov/codecov-action#1950</a></li> <li>chore(release): 7.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1957">codecov/codecov-action#1957</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2">https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h3>What's Changed</h3> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p> <h2>v5.5.1</h2> <h3>What's Changed</h3> <ul> <li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li> <li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li> <li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li> <li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li> <li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li> <li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p> <h2>v5.5.0</h2> <h3>What's Changed</h3> <ul> <li>feat: upgrade wrapper to 0.2.4 by <a href="https://github.com/jviall"><code>@jviall</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li> <li>Pin actions/github-script by Git SHA by <a href="https://github.com/martincostello"><code>@martincostello</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li> <li>fix: check reqs exist by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li> <li>fix: Typo in README by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li> <li>docs: Refine OIDC docs by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p> <h2>v5.4.3</h2> <h3>What's Changed</h3> <ul> <li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li> <li>fix: OIDC on forks by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p> <h2>v5.4.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codecov/codecov-action/commit/fb8b3582c8e4def4969c97caa2f19720cb33a72f"><code>fb8b358</code></a> chore(release): 7.0.0 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1957">#1957</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/ca0a928a4cb3911011e868128a5cd90437c12db1"><code>ca0a928</code></a> ci: remove Enforce License Compliance workflow (<a href="https://redirect.github.com/codecov/codecov-action/issues/1950">#1950</a>)</li> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…tes (#915) Bumps the go_modules group with 1 update in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/a1c0d9929856c8aba2b31f079340f00578eda803"><code>a1c0d99</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/3c7c86938f4541c333d506f719388d9c42d4763d"><code>3c7c869</code></a> ssh: fix deadlock on unexpected channel responses</li> <li><a href="https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"><code>533fb3f</code></a> ssh: fix source-address critical option bypass</li> <li><a href="https://github.com/golang/crypto/commit/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"><code>abbc44d</code></a> ssh: fix incorrect operator order</li> <li><a href="https://github.com/golang/crypto/commit/e052873987615dc96fe67607a9a6adb76311344f"><code>e052873</code></a> ssh: fix infinite loop on large channel writes due to integer overflow</li> <li><a href="https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456"><code>b61cf85</code></a> ssh: enforce user presence verification for security keys</li> <li><a href="https://github.com/golang/crypto/commit/9c2cd33e8d96a96133fd6ff732510ebba539c2bd"><code>9c2cd33</code></a> ssh: enforce strict limits on DSA key parameters</li> <li><a href="https://github.com/golang/crypto/commit/890731877d85f71cfdc9554e7a27fec4684fc4c4"><code>8907318</code></a> ssh: reject RSA keys with excessively large moduli</li> <li><a href="https://github.com/golang/crypto/commit/ffd87b4878fa98ca2908ec534e1a410bf095a35e"><code>ffd87b4</code></a> ssh: fix panic when authority callbacks are nil</li> <li><a href="https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946"><code>4e7a738</code></a> ssh: fix deadlock on unexpected global responses</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.49.0...v0.52.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.52.0 to 0.54.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/b138e06246cb323f2f380c2b7f7dd91f581dd56b"><code>b138e06</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/689f70a42abd350f3a1aaa70b0d13eb9543d927a"><code>689f70a</code></a> quic: fix wrong final size being used for RESET_STREAM frame</li> <li><a href="https://github.com/golang/net/commit/208f306b2f0fd008b388bee2c2644be279778e94"><code>208f306</code></a> http3: increase handshake timeout</li> <li><a href="https://github.com/golang/net/commit/49810da71b9026da9e0d028a6ad8c7730c52d9c4"><code>49810da</code></a> http2: enable net/http wrapping when go >= 1.27</li> <li><a href="https://github.com/golang/net/commit/5e11a5ab891c117eda83b4304d60dd13286c1c76"><code>5e11a5a</code></a> quic: fix data race in streamForFrame</li> <li><a href="https://github.com/golang/net/commit/8c63081cd380ea768db5651941614b73472160ff"><code>8c63081</code></a> http2: use empty Transport rather than DefaultTransport in http2wrap</li> <li><a href="https://github.com/golang/net/commit/fc7b466ca49cb204039630533ece4fc557eb35cd"><code>fc7b466</code></a> http2: add http2wrap test</li> <li><a href="https://github.com/golang/net/commit/15c2cb1875fd727313dc4de909b3ee149422fbe2"><code>15c2cb1</code></a> http2: avoid overflowing 32-bit int when http2wrap enabled</li> <li><a href="https://github.com/golang/net/commit/64651885c2f2d745d77af2d7af2edbf568c179af"><code>6465188</code></a> http2: add wrapped Server</li> <li><a href="https://github.com/golang/net/commit/72f419a894cb0597dd5b6bcf119086bf2af41231"><code>72f419a</code></a> http2: add wrapped ClientConn</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.52.0...v0.54.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/zitadel/oidc/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…dules group across 0 directory (#916) Updates `golang.org/x/net` from 0.54.0 to 0.55.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/7770ec48d03fec35e378665337b4faca93c38423"><code>7770ec4</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905"><code>4ece7b6</code></a> html: escape greater-than symbol in doctype identifiers</li> <li><a href="https://github.com/golang/net/commit/08be507abce89191d78cd49da60f4501fc910472"><code>08be507</code></a> html: improve Noah's Ark clause performance</li> <li><a href="https://github.com/golang/net/commit/a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"><code>a8fb2fe</code></a> html: properly render fostered elements in foreign content</li> <li><a href="https://github.com/golang/net/commit/0dc5b7a5f81d7155ade6d5e9db35992998679932"><code>0dc5b7a</code></a> html: properly check namespace in "in body" any other end tag</li> <li><a href="https://github.com/golang/net/commit/a452f3cc17168a60bc3f439a3ae0fcffc32eca0e"><code>a452f3c</code></a> html: ignore duplicate attributes during tokenization</li> <li><a href="https://github.com/golang/net/commit/f8651996b24ba47d89dd9eb97fd47758e6d1886f"><code>f865199</code></a> quic: fix appendMaxDataFrame erroneously accumulating sentLimit</li> <li><a href="https://github.com/golang/net/commit/210ed3cb901cb549818aefa04b71dadaf149d05d"><code>210ed3c</code></a> quic: establish a "happened-before" relationship between stream write and read</li> <li><a href="https://github.com/golang/net/commit/ad8140e0aa2ec41b37ea478b4525a423bcc21af9"><code>ad8140e</code></a> quic: fix buffer slicing when handling overlapping stream data</li> <li><a href="https://github.com/golang/net/commit/23ee2efe81a3ff183b4eca46c42f749af7efca45"><code>23ee2ef</code></a> http2: avoid API changes when built with go1.27</li> <li>See full diff in <a href="https://github.com/golang/net/compare/v0.54.0...v0.55.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/zitadel/oidc/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.39.0 to 0.40.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/724af9c35838492dcaacc1ac51a8a0187c994c54"><code>724af9c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/bf5b9d658a03d36bd3459b3babdb23a9f56038cb"><code>bf5b9d6</code></a> internal/export/idna: always treat Punycode encoding pure ASCII as an error</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.39.0...v0.40.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#896) Bumps [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) from 1.43.0 to 1.44.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/trace's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27</h2> <h3>Added</h3> <ul> <li>Add <code>ByteSlice</code> and <code>ByteSliceValue</code> functions for new <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7948">#7948</a>)</li> <li>Apply attribute value limit to the <code>KindBytes</code> attribute type in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Apply attribute value limit to the <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Add <code>String</code> method for <code>Value</code> type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8142">#8142</a>)</li> <li>Add <code>Slice</code> and <code>SliceValue</code> functions for new <code>SLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8166">#8166</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Apply <code>AttributeValueLengthLimit</code> to <code>attribute.SLICE</code> type attribute values in <code>go.opentelemetry.io/otel/sdk/trace</code>, recursively truncating contained string values. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8217">#8217</a>)</li> <li>Add <code>Error</code> field on <code>Record</code> type in <code>go.opentelemetry.io/otel/log/logtest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8148">#8148</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>Settable</code> to <code>go.opentelemetry.io/otel/metric/x</code> to allow reusing attribute options. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8178">#8178</a>)</li> <li>Add experimental support for splitting metric data across multiple batches in <code>go.opentelemetry.io/otel/sdk/metric</code>. Set <code>OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size></code> to enable for all periodic readers. See <code>go.opentelemetry.io/otel/sdk/metric/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8071">#8071</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8192">#8192</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8194">#8194</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/stdout/stdoutlog/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8263">#8263</a>)</li> <li>Add <code>WithDefaultAttributes</code> to <code>go.opentelemetry.io/otel/metric/x</code> to support setting default attributes on instruments. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8135">#8135</a>)</li> <li>Add <code>go.opentelemetry.io/otel/semconv/v1.41.0</code> package. The package contains semantic conventions from the <code>v1.41.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.41.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.40.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8324">#8324</a>)</li> <li>Add Observable variants of instruments to <code>go.opentelemetry.io/otel/semconv/v1.41.0</code> package. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8350">#8350</a>)</li> <li>Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in <code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8002">#8002</a>)</li> </ul> <h3>Changed</h3> <ul> <li>⚠️ <strong>Breaking Change:</strong> <code>go.opentelemetry.io/otel/sdk/metric</code> now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing <code>attribute.Bool("otel.metric.overflow", true)</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b62d92831b2dd142f5a0cc89c828270274196877"><code>b62d928</code></a> Release 1.44.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8376">#8376</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/94132a0a729e94c5aa6e9e1ce7640c0f802dcfea"><code>94132a0</code></a> chore(deps): update golang.org/x/telemetry digest to 5997936 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8379">#8379</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6fdcf82adfebc3becfb5d357957546d6d7258469"><code>6fdcf82</code></a> feat: add self-observability metrics to otlpmetricgrpc metric exporters (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8192">#8192</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/761bbfc2f4ae002f4a54f8c57c12b8a58135a741"><code>761bbfc</code></a> fix(deps): update golang.org/x (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8377">#8377</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/3a91dc62d3852313bab40ff151bb3e11fae1745e"><code>3a91dc6</code></a> fix(deps): update googleapis to 3dc84a4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8375">#8375</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f593185679130f56e14bed3c337fa7f8f60756b1"><code>f593185</code></a> exporters/otlp: default max request size to 64 MiB (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8365">#8365</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f02feacf8652b69c051851cfa2945d2ed5f0d568"><code>f02feac</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/36c2f1bfd1a6a789dc575f8886399093d7600586"><code>36c2f1b</code></a> semconvkit: add invariant test for histogram-exclusion rule (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8370">#8370</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/d0b6cbdff5346557923fd05bd3f5f34df002aeee"><code>d0b6cbd</code></a> sdk/metric: document unit-sensitivity of DefaultAggregationSelector (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8224">#8224</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9a68034bd45c6f24c481d9f9c87ebbee0a61482f"><code>9a68034</code></a> add self observability for stdout exporter (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8263">#8263</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0">compare view</a></li> </ul> </details> <br /> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
… oidc providers (#877) # Which Problems Are Solved When a client requested userinfo with a lowercase authorization header (`bearer` instead of `Bearer`), the server would reject it because it is not compliant to the spec. # How the Problems Are Solved - made the bearer scheme check case-insensitive # Additional Changes # Additional Context - Closes #876
…lidator (#910) ### Definition of Ready - [x] I am happy with the code - [x] Short description of the feature/issue is added in the PR description - [x] PR is linked to the corresponding user story ## Which Problems Are Solved Fixes #909. `op.Authorize` panics with a nil-pointer dereference in `RedirectToLogin` when the `Authorizer` implements the `op.AuthorizeValidator` interface. `Authorize` populates its local `client` only inside the *default* validation closure; supplying a custom `AuthorizeValidator` replaces that closure, so `client` stays `nil` and `RedirectToLogin` (`client.LoginURL`) panics for any well-formed auth request. ## How the Problems Are Solved Before the login redirect, if `client` is still `nil` (a custom validator was used and did not assign it), resolve it via `Storage().GetClientByClientID`, mapping a lookup error to the standard `AuthRequestError` path. ## Additional Context - The `AuthorizeValidator` interface is documented as the seam to customize validation, but using it currently crashes the standard login-redirect path. - The change passes the existing `pkg/op` test suite unchanged. - Happy to add a regression test in your preferred style — the path needs an `Authorizer` that also implements `AuthorizeValidator`, and `op.AuthRequest` has no mock today, so I wanted to confirm the approach/test conventions with you first. --------- Signed-off-by: abuobaida <mho1910@gmail.com> Co-authored-by: abuobaida <mho1910@gmail.com> Co-authored-by: zaki <zaki@hermes.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Wim Van Laer <wim@wvl.app>
LegacyServer.CodeExchange looks up the auth request by code only,
without checking that the authenticated client owns it.
The modern path in ValidateAccessTokenRequest (token_code.go:59) checks:
if client.GetID() != authReq.GetClientID() { return error }
This adds the same check to LegacyServer.CodeExchange.
---------
Co-authored-by: Wim Van Laer <wim@wvl.app>
according to the RFC 6749 §2.3 `The client MUST NOT use more than one authentication method in each request.` this PR resolve issue #857 1. add the logic to only have one authenticate method in client side 2. add the restrict on the OP side to only allow one authenticate method. 3. deprecated interface `ClientSecretBasicAuthRequest` and the Auth() function 4. add interface `AuthenticatedTokenRequestAuthMethodChecker` and added the only one auth method check for input tokens that implemented such checker interface. NOTE: the Auth() function is no longer invoked after this PR, but we keep the public API. test: added united test ### Definition of Ready - [x] I am happy with the code - [x] Short description of the feature/issue is added in the pr description ~~- [ ] PR is linked to the corresponding user story~~ - [ ] Acceptance criteria are met ~~- [ ] All open todos and follow ups are defined in a new ticket and justified~~ ~~- [ ] Deviations from the acceptance criteria and design are agreed with the PO and documented.~~ - [x] No debug or dead code - [x] My code has no repetitions - [x] Critical parts are tested automatically ~~- [ ] Where possible E2E tests are implemented~~ ~~- [ ] Documentation/examples are up-to-date~~ - [ ] All non-functional requirements are met ~~- [ ] Functionality of the acceptance criteria is checked manually on the dev system.~~ --------- Co-authored-by: Wim Van Laer <wim@wvl.app> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/763">actions/setup-go#763</a></li> <li>chore(deps): bump <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v7.0.0">https://github.com/actions/setup-go/compare/v6...v7.0.0</a></p> <h2>v6.5.0</h2> <h2>What's Changed</h2> <h3>Dependency update</h3> <ul> <li>Upgrade actions dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li> <li>Upgrade <code>@types/node</code> and typescript-eslint dependencies to resolve npm audit findings by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/755">actions/setup-go#755</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li> <li>Upgrade version to 6.5.0 in package.json and package-lock.json by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/762">actions/setup-go#762</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.5.0">https://github.com/actions/setup-go/compare/v6...v6.5.0</a></p> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add go-download-base-url input for custom Go distributions by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li> </ul> <h3>Documentation update</h3> <ul> <li>Rearrange README.md, add advanced-usage.md by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li> <li>Fix Microsoft build of Go link by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gdams"><code>@gdams</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <ul> <li>Update default Go module caching to use go.mod by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/705">actions/setup-go#705</a></li> <li>Fix golang download url to go.dev by <a href="https://github.com/178inaba"><code>@178inaba</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/469">actions/setup-go#469</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.3.0">https://github.com/actions/setup-go/compare/v6...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"><code>b7ad1da</code></a> chore(deps): bump <code>@actions/cache</code> to 6.2.0 (<a href="https://redirect.github.com/actions/setup-go/issues/771">#771</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/0778a10ce47b5d450cf60fb94fafad4330008a35"><code>0778a10</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-go/issues/763">#763</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-go/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary - Removes the legacy `.github/workflows/issue.yml` (`actions/add-to-project` targeting project 2 with `ADD_TO_PROJECT_PAT`). - Adds `.github/workflows/issues.yml`, calling the shared `zitadel/.github/.github/workflows/kanban.yml` reusable workflow so new issues/PRs are added to the org kanban project (project 15) instead. ## Test plan - [ ] Merge and open a test issue/PR to confirm it gets added to the kanban project.
# Which Problems Are Solved - The OIDC server maintains provider-owned logger instances instead of using the global `slog` logger configured by applications. - The project depends on `github.com/zitadel/logging`, which is being deprecated. - Context-aware logging is duplicated even though applications can populate context data through their middleware. # How the Problems Are Solved - Replaces provider-owned logging calls with global `slog` functions. - Uses the default logger configured by the application. - Removes all references to and the dependency on `github.com/zitadel/logging`. - Retains the existing logger options as deprecated no-ops for source compatibility. - Documents how to configure or disable logging through `slog.SetDefault`. # Additional Changes - Removes the remaining `logrus` references and dependency. - Updates examples to use `slog`. - Adds upgrading guidance for applications using the deprecated logger options. # Additional Context - Closes #829
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/oidc/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. --> # Which Problems Are Solved Would like to update the content of Resources to help the readers able to find the resources. # How the Problems Are Solved 1. update the link for OIDC/OAuth Flow in Zitadel. 2. the link for OIDC is now incorporating errata set 2. # Additional Changes # Additional Context Co-authored-by: Wim Van Laer <wim@wvl.app>
…ata (#905) # Which Problems Are Solved A provider built on this library cannot advertise support for the OAuth Client ID Metadata Document (CIMD) spec in its discovery document, because `DiscoveryConfiguration` has no field for the standard `client_id_metadata_document_supported` Authorization Server Metadata property. # How the Problems Are Solved - Add an additive boolean field `ClientIDMetadataDocumentSupported` to `DiscoveryConfiguration` in `pkg/oidc/discovery.go`, serialized as `client_id_metadata_document_supported` with `omitempty`. - Extend `TestDiscover` to cover JSON serialization of the new field. # Additional Changes - None. No change to the `op.Server` interface, no handler, no CIMD resolution logic. The flag defaults to false and is omitted from existing discovery output via `omitempty`, so there is no behavior change for current providers. # Additional Context - Spec: draft-ietf-oauth-client-id-metadata-document (OAuth WG), Section 5, field `client_id_metadata_document_supported`: https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/ - Context: RFC 8414 (Authorization Server Metadata), OpenID Connect Discovery 1.0. - Use case: MCP client identification, SEP-991: modelcontextprotocol/modelcontextprotocol#991 - Closes #904 - Complementary to #782 (dynamic client registration); additive, no interface change. --------- Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>
# Which Problems Are Solved
- The CLI authorization flow always opens
`http://localhost:<port>/login`, regardless of the loopback host
configured in the redirect URI.
- The callback server always listens on `:<port>`, ignoring an explicit
IPv4 or IPv6 loopback address in the redirect URI.
- Consequently, callers cannot ensure that the callback server and
browser use the same explicit loopback address.
- Invalid or inconsistent callback configurations are not detected
before the server starts.
# How the Problems Are Solved
- Derives both the callback listener address and the browser `/login`
URL from the configured redirect URI.
- Binds directly to explicit IPv4 and IPv6 loopback addresses, ensuring
that the browser and callback server use the same address family.
- Validates that the redirect URI:
- uses HTTP
- contains an explicit port matching the CLI port
- uses `localhost` or a loopback IP address
- contains the expected callback path
- does not contain user information or a fragment
- Preserves the existing `:<port>` listener behavior for callers using
`localhost`, avoiding a backward-incompatible single-address-family
change.
# Additional Changes
- Updates the client examples to use `127.0.0.1`, avoiding `localhost`
address-family ambiguity.
- Renames the `StartServer` parameter from `port` to `address` to
reflect that it receives a complete listening address.
- Adds tests covering IPv4, IPv6, existing `localhost` behavior, missing
and mismatched ports, non-loopback hosts, hostname lookalikes, HTTPS,
and callback path mismatches.
# Additional Context
Callers using an explicit loopback IP now get deterministic
address-family behavior. Existing callers using `localhost` retain the
previous wildcard listener behavior for compatibility.
Chromium resolves `localhost` to both IPv6 and IPv4, placing the IPv6
loopback address first. This can be observed on macOS by starting
separate IPv6 and IPv4 listeners.
In the first terminal:
```console
$ nc -k -6 -l 3000
```
In the second terminal:
```console
$ nc -k -4 -l 3000
```
Both listeners can be confirmed with:
```console
$ lsof -n -P -i:3000
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nc 61660 suku 3u IPv4 0xaf57491278098f95 0t0 TCP *:3000 (LISTEN)
nc 61696 suku 3u IPv6 0x86b12b3afee37ced 0t0 TCP *:3000 (LISTEN)
```
Opening `http://localhost:3000` in Chromium connects to the IPv6
listener. Because that connection succeeds, Chromium does not need to
fall back to IPv4. This demonstrates that `localhost` is not equivalent
to explicitly selecting `127.0.0.1`.
Chromium's
[`ResolveLocalHostname`](https://source.chromium.org/chromium/chromium/src/+/c70cbba2e0b73e622ff5899294e76974be0083f2:net/dns/host_resolver_manager.cc;l=332)
adds the IPv6 loopback address before the IPv4 loopback address.
This is a callback reliability and loopback-hardening change. It does
not claim that every wildcard Go listener encounters an address-family
failure.
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/oidc/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. --> # Which Problems Are Solved Azure split issuer by tenent id `https://login.microsoftonline.com/{tenantid}/v2.0` when we want support more general users, like both company and personal users, the issuer is dynamically different by the tenent. the discovery endpoint [https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration](https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration) shows the `{tenantid}` pattern as well. This PR support customized issuer verifier to support dynamic issuer. reference: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#find-your-apps-openid-configuration-document-uri # How the Problems Are Solved This PR support customized issuer verifier to support dynamic issuer. # Additional Changes change all the usage to use the new function `oidc.CheckIssuerWithISSVerifier(claims, v.Issuer, v.ISS)` it does not change current or default usage, just add option to support cusomized issuer verifier. # Additional Context
# Which Problems Are Solved
A token exchange asking for
`requested_token_type=urn:ietf:params:oauth:token-type:jwt` returns
`200` with an empty token:
{"access_token":"","issued_token_type":"urn:ietf:params:oauth:token-type:jwt","token_type":"","scope":"openid
offline_access"}
`ValidateTokenExchangeRequest` accepts the type, since
`TokenType.IsSupported` covers all of `AllTokenTypes`.
`CreateTokenExchangeResponse` has no case for it, and its `default:`
branch builds the error but never returns it, so `token` and `tokenType`
stay empty and are marshalled as a success. RFC 8693 §2.2.1 makes
`access_token` and `token_type` REQUIRED in a successful response; a
client that checks the status code takes the empty string as its token.
# How the Problems Are Solved
Returns the error that branch already constructs, matching the other
error paths in the function. The response becomes `400
{"error":"invalid_request","error_description":"requested_token_type is
invalid"}`. Behaviour is unchanged for `access_token`, `refresh_token`
and `id_token`.
# Additional Changes
Adds a `TestRoutes` case for the jwt requested token type. I verified it
fails without the one-line change (`expected: 400, actual: 200`) and
passes with it.
# Additional Context
Compatibility: an omitted or empty `requested_token_type` reaches the
same `default:` branch, so a `TokenExchangeStorage` that does not
default it in `ValidateTokenExchangeRequest` — `pkg/op/storage.go:90`
recommends it, nothing enforces it — moves from that same empty `200` to
a `400`. Happy to default that case instead of rejecting it, if you
would prefer.
`go vet ./...` is clean; `go test -race ./pkg/...` passes apart from the
pre-existing `"expires_in":299` assertions, which flake on darwin/arm64
here for reasons unrelated to this change.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Wim Van Laer <wim@wvl.app>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> <h2>v4.36.2</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>v4.36.1</h2> <p>No user facing changes.</p> <h2>v4.36.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>v4.35.5</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>v4.35.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/18420e3271f74589575af831a523c833acda327f"><code>18420e3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4043">#4043</a> from github/mbg/ts/changelog</li> <li><a href="https://github.com/github/codeql-action/commit/7e8d8970f03ec5a78ab372fc0778e8e4194111a5"><code>7e8d897</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4046">#4046</a> from github/mbg/repo-prop/code-quality</li> <li><a href="https://github.com/github/codeql-action/commit/2d4c474c2ca5ea2965b9e53fabb7b67b0100016c"><code>2d4c474</code></a> Log <code>!analysisKindSupported</code> case</li> <li><a href="https://github.com/github/codeql-action/commit/98c05a17d327d7c4055fca83114434ab56baacf6"><code>98c05a1</code></a> Fix argument validation in <code>rollback-changelog.ts</code></li> <li><a href="https://github.com/github/codeql-action/commit/8289a49271cbb335d374e7e2e7a50c1576be0afe"><code>8289a49</code></a> Ignore repository property for unsupported analysis kinds</li> <li><a href="https://github.com/github/codeql-action/commit/2a8731cc0636c612147a349ccc88166bd482a9e1"><code>2a8731c</code></a> Move <code>config-file</code> computation after determining the <code>analysisKinds</code></li> <li><a href="https://github.com/github/codeql-action/commit/3434fbbc53af0fe47685ef3897703b39ef77b5cb"><code>3434fbb</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4044">#4044</a> from github/mbg/ff/promote-toolcache</li> <li><a href="https://github.com/github/codeql-action/commit/3013ac07bdb913cf5b7a1a8a63fe51422ce5a91e"><code>3013ac0</code></a> Promote <code>AllowToolcacheInput</code> feature</li> <li><a href="https://github.com/github/codeql-action/commit/74b15aa2c6c649153cb2e5f7a9d3bd2f0c8f82d1"><code>74b15aa</code></a> Install JS deps if needed in <code>post-release-mergeback</code> workflow</li> <li><a href="https://github.com/github/codeql-action/commit/f00f809405a0571f02079a483378ba1102bd3d1e"><code>f00f809</code></a> Fix checking keys rather than values</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4...v4.37.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wim Van Laer <wim@wvl.app>
#935) - pkg/client/rp/relying_party.go:881 — EndSession tracing span was named "RefreshTokens"; now "EndSession". - pkg/op/token_request.go:89 — rewrote the AuthenticatedTokenRequestAuthMethodChecker doc comment to say what it does, that ParseAuthenticatedTokenRequest uses it to enforce RFC 6749 §2.3, and that requests not implementing it are skipped. - example/server/exampleop/op.go:38 — slog.SetDefault(logger) now guarded against a nil logger, with a note that replacing the process-wide logger is example-only behaviour. <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/oidc/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. --> # Which Problems Are Solved - pkg/client/rp/relying_party.go:881 — EndSession tracing span was named "RefreshTokens"; now "EndSession". - pkg/op/token_request.go:89 — rewrote the AuthenticatedTokenRequestAuthMethodChecker doc comment to say what it does, that ParseAuthenticatedTokenRequest uses it to enforce RFC 6749 §2.3, and that requests not implementing it are skipped. - example/server/exampleop/op.go:38 — slog.SetDefault(logger) now guarded against a nil logger, with a note that replacing the process-wide logger is example-only behaviour. # How the Problems Are Solved # Additional Changes # Additional Context
# Conflicts: # UPGRADING.md # example/client/app/app.go # example/client/device/device.go # example/server/crypto.go # example/server/exampleop/device.go # example/server/exampleop/op.go # pkg/client/client.go # pkg/client/rp/device.go # pkg/client/rp/relying_party.go # pkg/op/crypto.go # pkg/op/server_http.go # pkg/op/server_legacy_test.go # pkg/op/session_test.go # pkg/op/token_request.go # pkg/op/token_request_test.go
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s CodeQL GitHub Actions workflow as part of syncing with main, specifically by changing the github/codeql-action references from the floating v4 major tag to a specific v4.37.4 tag.
Changes:
- Pin CodeQL workflow steps (
init,autobuild,analyze) from@v4to@v4.37.4.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Collaborator
|
It's unclear what you're trying to do. Some commits I see here were already merged to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which Problems Are Solved
The previous pr was merged with a squash
How the Problems Are Solved
Additional Changes
Additional Context