From f069d944cd8f8d292462f6a2e6333076a06c5a06 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 14:40:59 +0000 Subject: [PATCH 1/3] build(deps): bump the go-modules group across 1 directory with 3 updates Bumps the go-modules group with 3 updates in the / directory: [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go), [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) and [golang.org/x/sys](https://github.com/golang/sys). Updates `go.opentelemetry.io/otel` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.46.0...v1.47.0) Updates `go.opentelemetry.io/otel/trace` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.46.0...v1.47.0) Updates `golang.org/x/sys` from 0.48.0 to 0.49.0 - [Commits](https://github.com/golang/sys/compare/v0.48.0...v0.49.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/sys dependency-version: 0.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules ... Signed-off-by: dependabot[bot] --- go.mod | 9 +++++---- go.sum | 18 ++++++++++-------- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 9146249..ec03c08 100644 --- a/go.mod +++ b/go.mod @@ -4,9 +4,9 @@ go 1.26.6 require ( github.com/atrinik/protocol v1.5.6-0.20261004163427-58ed75f13fab - go.opentelemetry.io/otel v1.46.0 - go.opentelemetry.io/otel/trace v1.46.0 - golang.org/x/sys v0.48.0 + go.opentelemetry.io/otel v1.47.0 + go.opentelemetry.io/otel/trace v1.47.0 + golang.org/x/sys v0.49.0 ) require ( @@ -14,7 +14,8 @@ require ( github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/otel/metric v1.46.0 // indirect + go.opentelemetry.io/otel/log v1.47.0 // indirect + go.opentelemetry.io/otel/metric v1.47.0 // indirect golang.org/x/net v0.59.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/protobuf v1.36.11 // indirect diff --git a/go.sum b/go.sum index bd55019..1f5c399 100644 --- a/go.sum +++ b/go.sum @@ -13,18 +13,20 @@ github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWD github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc= -go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE= -go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8= -go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o= -go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c= -go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= From 2c2346de52a6a84361a1883fb7c4d5198638830a Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Sun, 11 Oct 2026 09:52:02 -0500 Subject: [PATCH 2/3] fix(build): use patched Go toolchain for validation --- .go-version | 2 +- README.md | 2 +- go.mod | 2 +- policy/dependencies.json | 2 +- tools/validate.sh | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.go-version b/.go-version index f250c8f..3cd33cd 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.26.6 +1.26.9 diff --git a/README.md b/README.md index d22800a..9c09d03 100644 --- a/README.md +++ b/README.md @@ -62,7 +62,7 @@ commands inward and immutable snapshots and committed events travel outward. ## Build and inspect -Go 1.26.6 is required. +Go 1.26.9 is required. ```sh go build ./cmd/atrinik-server diff --git a/go.mod b/go.mod index ec03c08..1e41ac4 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/atrinik/server -go 1.26.6 +go 1.26.9 require ( github.com/atrinik/protocol v1.5.6-0.20261004163427-58ed75f13fab diff --git a/policy/dependencies.json b/policy/dependencies.json index 31b88c7..fa5f748 100644 --- a/policy/dependencies.json +++ b/policy/dependencies.json @@ -23,7 +23,7 @@ "validation": "go mod verify, Linux and Windows go list -deps, govulncheck, go-licenses, tests, Syft release SBOM" }, "tools": [ - {"name": "Go", "version": "1.26.6", "source": "https://go.dev/dl/", "license": "BSD-3-Clause"}, + {"name": "Go", "version": "1.26.9", "source": "https://go.dev/dl/", "license": "BSD-3-Clause"}, {"name": "staticcheck", "version": "0.7.0", "source": "https://pkg.go.dev/honnef.co/go/tools/cmd/staticcheck", "license": "MIT"}, {"name": "govulncheck", "version": "1.6.0", "source": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck", "license": "BSD-3-Clause"}, {"name": "go-licenses", "version": "1.6.0", "source": "https://github.com/google/go-licenses", "license": "Apache-2.0"}, diff --git a/tools/validate.sh b/tools/validate.sh index ccfe5af..ad1b2b8 100755 --- a/tools/validate.sh +++ b/tools/validate.sh @@ -4,7 +4,7 @@ set -euo pipefail repository=$(git rev-parse --show-toplevel) cd "${repository}" -test "$(go version | awk '{print $3}')" = go1.26.6 +test "$(go version | awk '{print $3}')" = go1.26.9 for command in go staticcheck govulncheck go-licenses jq syft; do command -v "${command}" >/dev/null || { echo "missing required tool: ${command}" >&2; exit 1; } done From e1ec91b38bc5c0b13793d7ca1902e2aaff78ded0 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Sun, 11 Oct 2026 09:56:59 -0500 Subject: [PATCH 3/3] fix(deps): record OpenTelemetry logging module notices --- THIRD_PARTY_NOTICES.md | 1 + policy/dependencies.json | 1 + 2 files changed, 2 insertions(+) diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 4331d0b..72bf5e1 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -12,6 +12,7 @@ This file is generated from the effective Go dependency graph and | `github.com/go-logr/stdr` | `Apache-2.0` | https://github.com/go-logr/stdr | | `go.opentelemetry.io/auto/sdk` | `Apache-2.0` | https://github.com/open-telemetry/opentelemetry-go-instrumentation | | `go.opentelemetry.io/otel` | `Apache-2.0` | https://github.com/open-telemetry/opentelemetry-go | +| `go.opentelemetry.io/otel/log` | `Apache-2.0` | https://github.com/open-telemetry/opentelemetry-go | | `go.opentelemetry.io/otel/metric` | `Apache-2.0` | https://github.com/open-telemetry/opentelemetry-go | | `go.opentelemetry.io/otel/trace` | `Apache-2.0` | https://github.com/open-telemetry/opentelemetry-go | | `golang.org/x/net` | `BSD-3-Clause` | https://go.googlesource.com/net | diff --git a/policy/dependencies.json b/policy/dependencies.json index fa5f748..3c697e0 100644 --- a/policy/dependencies.json +++ b/policy/dependencies.json @@ -9,6 +9,7 @@ {"name": "github.com/go-logr/stdr", "license": "Apache-2.0", "source": "https://github.com/go-logr/stdr"}, {"name": "go.opentelemetry.io/auto/sdk", "license": "Apache-2.0", "source": "https://github.com/open-telemetry/opentelemetry-go-instrumentation"}, {"name": "go.opentelemetry.io/otel", "license": "Apache-2.0", "source": "https://github.com/open-telemetry/opentelemetry-go"}, + {"name": "go.opentelemetry.io/otel/log", "license": "Apache-2.0", "source": "https://github.com/open-telemetry/opentelemetry-go"}, {"name": "go.opentelemetry.io/otel/metric", "license": "Apache-2.0", "source": "https://github.com/open-telemetry/opentelemetry-go"}, {"name": "go.opentelemetry.io/otel/trace", "license": "Apache-2.0", "source": "https://github.com/open-telemetry/opentelemetry-go"}, {"name": "golang.org/x/net", "license": "BSD-3-Clause", "source": "https://go.googlesource.com/net"},