build(deps): bump the all-gomod group across 2 directories with 11 updates

[dependabot]

Bumps the all-gomod group with 10 updates in the / directory:

Package	From	To
modernc.org/sqlite	1.59.0	1.60.1
github.com/moby/moby/api	1.56.0	1.56.1
github.com/moby/moby/client	0.6.0	0.6.1
github.com/ncruces/go-strftime	1.0.0	1.1.0
github.com/shirou/gopsutil/v4	4.26.8	4.26.9
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	0.71.0	0.72.0
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/trace	1.46.0	1.47.0
modernc.org/libc	1.75.7	1.77.1

Bumps the all-gomod group with 11 updates in the /tests directory:

Package	From	To
modernc.org/sqlite	1.59.0	1.60.1
github.com/moby/moby/api	1.56.0	1.56.1
github.com/moby/moby/client	0.6.0	0.6.1
github.com/ncruces/go-strftime	1.0.0	1.1.0
github.com/power-devops/perfstat	0.0.0-20240221224432-82ca36839d55	0.0.0-20260805114148-88456608a4f6
github.com/shirou/gopsutil/v4	4.26.8	4.26.9
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	0.71.0	0.72.0
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/trace	1.46.0	1.47.0
modernc.org/libc	1.75.7	1.77.1

Updates modernc.org/sqlite from 1.59.0 to 1.60.1

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

• 2026-09-30 v1.61.0:

  • Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@​r27153733)!
  • Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).
  • Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@​TedlaBrandsema)!
  • Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.

• 2026-09-29 v1.60.1:

  • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

• 2026-09-28 v1.60.0:

  • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
  • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
  • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
  • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
  • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
  • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
  • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
  • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
  • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
  • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
  • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
  • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
  • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

• 2026-09-15 v1.59.0:

  • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
  • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
  • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

• 2026-09-01 v1.58.0:

  • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add opt-in support for Linux Open File Description (OFD) locks on database files, off by default; without opting in, locking behavior is byte-for-byte that of previous releases. A POSIX record lock is owned by the (process, inode) pair, so any Close of any descriptor of the database file anywhere in the process silently strips SQLite's locks; OFD locks survive that. Enable it process-wide with MODERNC_SQLITE_OFD_LOCK=1 in the environment, or with the new OFDLocking(true) before the first connection is opened; OFDLockingEnabled reports the mode in effect, and the new ErrOFDLockingTooLate and ErrOFDLockingUnavailable report a switch attempted too late and a platform or filesystem without the feature. Why it is process-wide rather than a DSN parameter, what WAL's -shm coordination still uses, and the /proc/locks measurements behind the design are in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255).
  • Resolves [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255). See [GitLab merge request #136](https://gitlab.com/cznic/sqlite/-/merge_requests/136), thanks Nathan Herring (@​technosloth), and thanks Gani Georgiev (@​ganigeorgiev) for pressing the opt-in default!

• 2026-08-19 v1.57.0:

  • Add an opt-in _defensive DSN query parameter turning on SQLite's defensive mode for the connection. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables and to sqlite_dbpage fail. It is a hardening measure, not a sandbox for hostile database files, for which it is only one of the steps SQLite recommends, and it is a property of the connection, not of the file. Absent, or _defensive=0, nothing changes.
  • Reject _defensive=1 together with _journal_mode=OFF (or _journal=OFF) instead of opening a connection in which neither was honoured: SQLite turns that PRAGMA into a no-op that still reports success. Only DSNs using the new parameter can be affected. See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
  • Ship the sqlite-vec license notice this module has been missing since vec/ arrived in v1.47.0. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT; the text now ships as LICENSE-SQLITE_VEC, and make vendor fails rather than quietly dropping it.
  • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged. The rename is what makes go mod vendor carry both notices into downstream vendor/ trees: it selects license files by name prefix, so a name merely ending in LICENSE was never propagated.
  • Let a caller-constructed Driver register its own functions, collations and virtual table modules, through new RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule methods plus Must* variants, and let vtab.RegisterModule honour its db argument. Behavior change: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard db and land on the registered sqlite driver, reaching every connection in the process; it now lands on that Driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module. Everything else is additive, and the isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here. See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!
  • Promote freebsd/386, freebsd/arm and netbsd/amd64 from experimental to fully supported. The package documentation's platform table had carried seventeen entries while this module shipped, cross-built and tested twenty; all three have been in the builder matrix since v1.53.0 and pass the full suite on this release's commit. Documentation only — lib/ is byte-for-byte what v1.56.0 shipped.

• 2026-08-03 v1.56.0:

  • Re-vendor the transpiled sources, picking up modernc.org/libsqlite3's patch for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. A crash during the commit of a multi-database (ATTACH) transaction can leave a hot journal whose zeroed super-journal name still validates, so pager_playback() deletes it without playing it back and leaves the database corrupted. Not a transpilation artifact: a plain gcc build of stock 3.53.3 fails on the same bytes. The SQLite version is unchanged at 3.53.3, every supported target carries the patch, and it will be dropped once upstream ships its own fix.

... (truncated)

Commits

• b122d04 conn: bind statement arguments in linear time
• 7d5a376 CHANGELOG.md: slim the v1.60.0 section
• a604165 CHANGELOG.md: the SEH emulation, the re-vendor and the removed lib constants;...
• fb4aac4 vendor.json: stamp lib/ from libsqlite3 v1.15.0 and vec/ from libsqlite_vec v...
• 0f7ae7d Merge branch 'master' into seh-emulation
• 2e43324 lib: re-vendor from modernc.org/libsqlite3 v1.15.0 (SEH emulation), pin libc ...
• 50380ee lib, tests: Go side of the wal.c SEH emulation for Windows in-page faults (#221)
• 4552e53 Merge branch 'vendor-stamp' into 'master'
• 3775177 Makefile, doc.go, IRP.md: VENDORFLAGS for debug builds; name every refusal
• 86c97d4 CHANGELOG.md: link merge request !140
• Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.56.0 to 1.56.1

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.1

1.56.1

Changelog

• api/scripts: Allow isolated model generation with an API directory. moby/moby#53629
• api/swagger: Improve OpenAPI compatibility. moby/moby#53626
• api/swagger: Quote HTTP response status codes. moby/moby#53759
• api/templates: schema: disable validators and serializer sections. moby/moby#53751
• api: fix G117 (gosec). moby/moby#53721
• api: swagger ImageManifestSummary.ImageData: fix invalid required field. moby/moby#53750
• api: update go-swagger to v0.36.6. moby/moby#53754
• fix: invalid swagger YAML indentation. moby/moby#53606

Commits

• 14ebc60 Merge pull request #53830 from tonistiigi/update-buildkit-v0.34.0-rc1
• 8eded0e Merge pull request #53671 from thaJeztah/add_WithHTTPRequestHook
• c4e39af Merge pull request #53596 from vvoland/c8d-refactor-imgload
• b8a569e client: add WithHTTPRequestHook option
• 0fed273 Merge pull request #53803 from thaJeztah/etchosts_cleanups
• 80c72a3 Merge pull request #53831 from corhere/fix-dnsproxy-servfail-test
• 1cfa161 daemon/containerd: Split image loading into import and unpack steps
• e7272aa Merge pull request #53606 from flostellbrink/fix/swagger-yaml-indentation
• 357096e libnetwork/etchosts: keep file open when updating hosts
• 012b2ef libnetwork/etchosts: propagate file close errors
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.6.0 to 0.6.1

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.6.1

0.6.1

Changelog

• client: add WithHTTPRequestHook option. moby/moby#53671
• client: deprecate WithResponseHook in favor of WithHTTPResponseHook. moby/moby#53666
• client: fix WithHTTPResponseHook hooks not being called for hijacked HTTP connections. moby/moby#53821
• client: postRaw: use consistent order or arguments. moby/moby#53677
• client: prevent response hooks from consuming response body. moby/moby#53667
• client: remove redundant cloning of response hooks. moby/moby#53822
• client: update github.com/docker/go-connections v0.8.1. moby/moby#53708
• golangci-lint: enable usetesting linter. moby/moby#53720
• vendor: github.com/moby/moby/api v1.56.1. moby/moby#53837

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.6.1 (2013-08-23)

• Registry: Pass "meta" headers in API calls to the registry

• Packaging: Use correct upstart script with new build tool
• Packaging: Use libffi-dev, don't build it from sources
• Packaging: Removed duplicate mercurial install command

Commits

• 5105263 Bump to v0.6.1
• 7b5c579 Use correct upstart script with new build tool
• 15d658d Removed duplicate mercurial install command
• 59281d6 use libffi-dev, don't build it from sources
• 29be20f Fixed: ImagePull in runtime test
• 5a8c32d Use additional decorator in RequestFactory to pass meta headers to registry
• 588f8e1 Merge pull request #1628 from dotcloud/bump_0.6.0
• See full diff in compare view

Updates github.com/ncruces/go-strftime from 1.0.0 to 1.1.0

Commits

• fa91ab7 Tweaks.
• 81f4398 Negative centuries.
• See full diff in compare view

Updates github.com/shirou/gopsutil/v4 from 4.26.8 to 4.26.9

Release notes

Sourced from github.com/shirou/gopsutil/v4's releases.

v4.26.9

What's Changed

cpu

• [cpu][linux]: expose raw tick counters through ExLinux by @​fzlzjerry in shirou/gopsutil#2149
• [cpu][darwin]: don't crash in getFrequency when pmgr lacks voltage-states5-sram by @​hsdfat in shirou/gopsutil#2163

docker

• [docker][linux]: support cgroup v2 in Cgroup* functions by @​hsdfat in shirou/gopsutil#2143
• [docker][linux]: fix the "all cgroup" case on cgroup v1 by @​shirou in shirou/gopsutil#2154

host

• [linux] host: add nixos by @​stepbrobd in shirou/gopsutil#2144

mem

• [mem][linux]: document that Cached includes SReclaimable by @​shirou in shirou/gopsutil#2155

net

• net: fix MIB_IF_ROW2 layout on Windows 386 by @​zhangli091011 in shirou/gopsutil#2120
• fix(net): include FIFO errors in aggregate I/O counters by @​jakezwang in shirou/gopsutil#2153
• [net][linux]: skip ESRCH from /proc//fd in getProcInodesAll by @​KobayashiKosuke in shirou/gopsutil#2161

process

• [ci][windows]: run the test suite on windows/386 by @​shirou in shirou/gopsutil#2151
• feat(darwin): implement EnvironWithContext for Darwin processes by @​nako-ruru in shirou/gopsutil#2135
• Return an error on empty OpenBSD KinfoProc by @​AshSgDe29071999 in shirou/gopsutil#2142

Other Changes

• Bump perfstat to fix memory leaks by @​pgimalac in shirou/gopsutil#2148
• [common]: use reflect.Pointer instead of the deprecated reflect.Ptr by @​shirou in shirou/gopsutil#2156

New Contributors

• @​nako-ruru made their first contribution in shirou/gopsutil#2135
• @​AshSgDe29071999 made their first contribution in shirou/gopsutil#2142
• @​stepbrobd made their first contribution in shirou/gopsutil#2144
• @​zhangli091011 made their first contribution in shirou/gopsutil#2120
• @​hsdfat made their first contribution in shirou/gopsutil#2143
• @​fzlzjerry made their first contribution in shirou/gopsutil#2149
• @​jakezwang made their first contribution in shirou/gopsutil#2153
• @​KobayashiKosuke made their first contribution in shirou/gopsutil#2161

Full Changelog: shirou/gopsutil@v4.26.8...v4.26.9

Commits

• 81236e0 Merge pull request #2161 from KobayashiKosuke/fix/net-linux-skip-esrch
• f14807f Merge pull request #2157 from shirou/dependabot/github_actions/vmactions/free...
• 7e182cc Merge pull request #2153 from jakezwang/fix/net-total-fifo-counters
• 80bec83 Merge pull request #2163 from hsdfat/darwin-arm64-cpu-freq-guard
• 65c1f08 Merge pull request #2149 from fzlzjerry/feat/2147-linux-raw-cpu-times
• b689427 [cpu][darwin]: don't crash in getFrequency when pmgr lacks voltage-states5-sram
• 729a322 [net][linux]: skip ESRCH from /proc/<pid>/fd in getProcInodesAll
• 729ee51 [cpu][linux]: rename TimesStatEx to ExTimesStat and share the /proc/stat parser
• 3588a77 Merge pull request #2158 from shirou/dependabot/go_modules/github.com/ebiteng...
• bc366d3 chore(deps): bump github.com/ebitengine/purego from 0.10.2 to 0.11.1
• Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.71.0 to 0.72.0

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog.

[1.47.0/2.6.0/0.72.0/0.38.0/0.27.0/0.21.0/0.17.0/0.19.0] - 2026-10-03

Added

• Add NewResourceDetectorWithOptions and the WithAWSLogger option to go.opentelemetry.io/contrib/detectors/aws/ec2/v2, allowing a custom AWS SDK logging.Logger to be supplied to the EC2 resource detector. (#9132)
• Add go.opentelemetry.io/contrib/detectors/openshift, a new resource detector for OpenShift 4 clusters, ported from processor/resourcedetectionprocessor/internal/openshift in opentelemetry-collector-contrib. Detects k8s.cluster.name, and cloud.provider, cloud.platform and cloud.region for clusters running on AWS, Google Cloud and IBM Cloud; Azure clusters report cloud.provider and cloud.platform only. (#9499)
• Add go.opentelemetry.io/contrib/detectors/kubeadm, a new resource detector for kubeadm-provisioned Kubernetes clusters, ported from processor/resourcedetectionprocessor/internal/kubeadm in opentelemetry-collector-contrib. Detects k8s.cluster.name from the ClusterConfiguration document in the kube-system/kubeadm-config ConfigMap and k8s.cluster.uid from the kube-system namespace UID. (#9500)

Changed

• Client metrics in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp no longer include attributes from the server-side Labeler, preventing attributes such as http.route from leaking into outbound requests. This is a breaking change for applications that use ContextWithLabeler to add custom client metric attributes: use ContextWithClientLabeler / ClientLabelerFromContext or the WithMetricAttributesFn option instead. Server-side use of ContextWithLabeler / LabelerFromContext is unchanged. (#8924)
• Stop emitting the legacy http.read_bytes and http.wrote_bytes attributes on the per-operation span events enabled by WithMessageEvents in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. The read and write events remain, while total body sizes continue to be recorded on the server span as http.request.body.size and http.response.body.size according to HTTP semantic conventions. (#9624)

Deprecated

• Deprecate go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws. (#9707)
• Deprecate go.opentelemetry.io/contrib/propagators/aws. (#9706)
• Deprecate go.opentelemetry.io/contrib/samplers/probability/consistent. (#9633)
• Deprecate ReadBytesKey, ReadErrorKey, WroteBytesKey, and WriteErrorKey in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. The identifiers remain available and their values are unchanged, but WithMessageEvents no longer emits http.read_bytes or http.wrote_bytes. There is no semantic-convention replacement for per-read or per-write byte counts or the human-readable error fields. Use HTTPRequestBodySizeKey and HTTPResponseBodySizeKey from go.opentelemetry.io/otel/semconv/v1.43.0 to record total body sizes on the span. If an error causes the HTTP request to fail, set the span status to Error and record ErrorType(err) from go.opentelemetry.io/otel/semconv/v1.43.0 on the span. (#9624)

Fixed

• Treat empty Prometheus exporter environment variable values as unset in go.opentelemetry.io/contrib/exporters/autoexport, restoring the documented defaults. (#9636)
• Bound converter-owned recursive map, slice, array, and pointer traversal in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. A field requiring more than 100 such levels is replaced with <max-depth-exceeded> and the record continues to be emitted. Existing fmt and user-method behavior remains unchanged. (#9691)
• Format span attributes in go.opentelemetry.io/contrib/zpages using attribute.Value.String instead of the deprecated attribute.Value.Emit, following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#9453)
• Set error.type on the span and on the request-duration, request-body-size, and response-body-size metrics when a client disconnects mid-request in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin, using the request context's cancellation error as the classification source when the handler has not already recorded an error via c.Error. Previously a disconnect was recorded with span status Error and no error.type, indistinguishable from a genuine server fault. (#9394)
• Report Prometheus metrics HTTP server errors in go.opentelemetry.io/contrib/otelconf when using the v0.2.0 configuration schema. The error check was inverted, so a clean shutdown (http.ErrServerClosed) was reported as unexpected while real Serve errors were ignored. (#9653)
• Fix temporary file cleanup for multipart requests in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp by copying the parsed multipart form back to the original request during deferred cleanup, preserving net/http cleanup during panic unwinding for HTTP/2 panic handling and outer recovery middleware paths. Unrecovered HTTP/1 handler panics remain uncleaned because net/http skips finishRequest in that path. (#9685)
• Fix http.client.request.body.size recording for streaming request bodies in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8684)
• Bound Kubernetes ConfigMap requests in go.opentelemetry.io/contrib/detectors/aws/eks with a 10-second timeout so Detect cannot hang indefinitely when the caller-provided context has no deadline. (#9419)

Removed

• Drop support for [Go 1.25]. (#9584)
• Remove go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho. Use github.com/labstack/echo-opentelemetry instead. (#9613)

Commits

• 0c76f61 Release v1.47.0/v2.6.0/v0.72.0/v0.38.0/v0.27.0/v0.21.0/v0.17.0/v0.19.0 (#9802)
• 318f5f9 Add timeout on Kubernetes API calls for EKS detector (#9419)
• f848a15 test(detector/ecs): increase unit test coverage (#9774)
• c0d84de Restore gofumpt clothe-returns and balance-calls (#9793)
• 6215054 fix(deps): update aws-sdk-go-v2 monorepo (#9785)
• 9a2e8ea fix(deps): update kubernetes monorepo to v0.37.1
• 3d8e338 chore(deps): update sigs.k8s.io/json digest to 11ed52e
• be5b688 chore(deps): update go-openapi packages
• e382b4d chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.4
• 97f9e88 fix(deps): update module github.com/moby/moby/client to v0.6.1
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.46.0 to 1.47.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.47.0/v0.69.0/v0.23.0/v0.1.0

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
• Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
• Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
• Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
• Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

• Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
• Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
• Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
• Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
• Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
• Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
• Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
• Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8801)
• Ensure metric helpers in go.opentelemetry.io/otel/semconv/v1.32.0, go.opentelemetry.io/otel/semconv/v1.33.0, and go.opentelemetry.io/otel/semconv/v1.34.0 record measurements only once when no attributes are provided. (#8849)
• Treat empty OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG values as unset in go.opentelemetry.io/otel/sdk/trace. (#8873)
• Normalize global OTEL_EXPORTER_OTLP_ENDPOINT path joining in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp so trailing-slash base URLs do not produce double-slash log export paths. (#8864)
• Prevent a deadlock when formatting an error passed to RecordError calls back into the span in go.opentelemetry.io/otel/sdk/trace. (#8815)
• Prevent SimpleSpanProcessor.Shutdown from panicking when constructed with a nil exporter in go.opentelemetry.io/otel/sdk/trace. (#8844)
• Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in go.opentelemetry.io/otel/exporters/prometheus. (#8839)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.47.0/0.69.0/0.23.0/0.1.0] - 2026-10-02

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the