build(deps): update lock file maintenance golang by renovate[bot] · Pull Request #2518 · open-telemetry/opentelemetry-lambda

renovate · 2026-08-05T00:45:28Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
cloud.google.com/go/auth	`v0.22.0` → `v0.23.1`	indirect	minor
dev.gaijin.team/go/exhaustruct/v5	`v5.0.2` → `v5.0.3`	indirect	patch
github.com/Azure/azure-sdk-for-go/sdk/azcore	`v1.22.0` → `v1.23.0`	indirect	minor
github.com/aws/aws-sdk-go-v2	`v1.43.5` → `v1.43.6`	indirect	patch
github.com/aws/aws-sdk-go-v2	`v1.43.3` → `v1.43.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	`v1.7.17` → `v1.7.18`	indirect	patch
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	`v1.7.16` → `v1.7.18`	indirect	patch
github.com/aws/aws-sdk-go-v2/config	`v1.32.34` → `v1.32.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/credentials	`v1.19.32` → `v1.19.36`	indirect	patch
github.com/aws/aws-sdk-go-v2/credentials	`v1.19.33` → `v1.19.36`	indirect	patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	`v1.18.33` → `v1.18.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	`v1.18.34` → `v1.18.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/configsources	`v1.4.36` → `v1.4.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/configsources	`v1.4.34` → `v1.4.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	`v2.7.36` → `v2.7.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	`v2.7.34` → `v2.7.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/v4a	`v1.4.37` → `v1.4.38`	indirect	patch
github.com/aws/aws-sdk-go-v2/internal/v4a	`v1.4.35` → `v1.4.38`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/dynamodb	`v1.62.3` → `v1.63.3`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	`v1.13.16` → `v1.13.17`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	`v1.13.15` → `v1.13.17`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/checksum	`v1.9.29` → `v1.9.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/checksum	`v1.9.27` → `v1.9.30`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery	`v1.12.11` → `v1.12.14`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	`v1.13.36` → `v1.13.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	`v1.13.34` → `v1.13.37`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	`v1.19.37` → `v1.19.38`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	`v1.19.35` → `v1.19.38`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/s3	`v1.106.3` → `v1.107.2`	indirect	minor
github.com/aws/aws-sdk-go-v2/service/secretsmanager	`v1.44.3` → `v1.44.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/signin	`v1.5.2` → `v1.5.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/signin	`v1.5.3` → `v1.5.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/sns	`v1.42.3` → `v1.42.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/sqs	`v1.46.3` → `v1.46.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/sso	`v1.33.2` → `v1.33.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/sso	`v1.33.3` → `v1.33.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/ssooidc	`v1.38.2` → `v1.38.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/ssooidc	`v1.38.3` → `v1.38.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/sts	`v1.45.2` → `v1.45.6`	indirect	patch
github.com/aws/aws-sdk-go-v2/service/sts	`v1.45.3` → `v1.45.6`	indirect	patch
github.com/aws/smithy-go	`v1.27.7` → `v1.27.8`	indirect	patch
github.com/aws/smithy-go	`v1.27.6` → `v1.27.8`	indirect	patch
github.com/cenkalti/backoff/v5	`v5.0.3` → `v7.0.0`	indirect	major
github.com/cloudflare/circl	`v1.6.4` → `v1.6.5`	indirect	patch
github.com/denis-tingaikin/go-header	`v1.0.0` → `v1.0.1`	indirect	patch
github.com/google/go-github/v89	`v89.0.0` → `v90.0.0`	indirect	major
github.com/google/go-tpm	`8f8f42c` → `9f0977c`	indirect	digest
github.com/googleapis/enterprise-certificate-proxy	`v0.3.19` → `v0.3.20`	indirect	patch
github.com/grpc-ecosystem/grpc-gateway/v2	`v2.29.0` → `v2.30.0`	indirect	minor
github.com/hashicorp/golang-lru	`v1.0.2` → `v2.0.7`	indirect	major
github.com/klauspost/compress	`v1.19.1` → `v1.19.2`	indirect	patch
github.com/knadh/koanf/maps	`v0.1.2` → `v0.1.3`	indirect	patch
github.com/knadh/koanf/providers/confmap	`v1.0.0` → `v1.0.1`	indirect	patch
github.com/knadh/koanf/v2	`v2.3.5` → `v2.3.6`	indirect	patch
github.com/lufia/plan9stats	`477a660` → `341c2f0`	indirect	digest
github.com/pierrec/lz4/v4	`v4.1.27` → `v4.1.28`	indirect	patch
github.com/power-devops/perfstat	`82ca368` → `8845660`	indirect	digest
github.com/prometheus/client_golang/exp	`ecdb825` → `0c5dccd`	indirect	digest
github.com/rogpeppe/go-internal	`v1.15.0` → `v1.16.0`	indirect	minor
github.com/santhosh-tekuri/jsonschema/v6	`v6.0.2` → `v6.0.3`	indirect	patch
github.com/shirou/gopsutil/v4	`v4.26.6` → `v4.26.7`	indirect	patch
github.com/sirupsen/logrus	`v1.9.4` → `v1.10.0`	indirect	minor
go.opentelemetry.io/contrib/bridges/otelzap	`v0.19.0` → `v0.20.0`	indirect	minor
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	`v0.69.0` → `v0.70.0`	indirect	minor
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	`v0.69.0` → `v0.70.0`	indirect	minor
go.opentelemetry.io/contrib/otelconf	`v0.24.0` → `v0.25.0`	indirect	minor
go.opentelemetry.io/contrib/propagators/autoprop	`v0.69.0` → `v0.70.0`	indirect	minor
go.opentelemetry.io/contrib/propagators/aws	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/contrib/propagators/b3	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/contrib/propagators/jaeger	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/contrib/propagators/ot	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	`v0.20.0` → `v0.21.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	`v0.20.0` → `v0.21.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/prometheus	`v0.66.0` → `v0.67.0`	indirect	minor
go.opentelemetry.io/otel/exporters/stdout/stdoutlog	`v0.20.0` → `v0.21.0`	indirect	minor
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/log	`v0.20.0` → `v0.21.0`	indirect	minor
go.opentelemetry.io/otel/metric	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/sdk	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/sdk/log	`v0.20.0` → `v0.21.0`	indirect	minor
go.opentelemetry.io/otel/sdk/metric	`v1.44.0` → `v1.45.0`	indirect	minor
go.opentelemetry.io/otel/trace	`v1.44.0` → `v1.45.0`	indirect	minor
go.yaml.in/yaml/v2	`v2.4.4` → `v3.0.5`	indirect	major
golang.org/x/crypto	`v0.54.0` → `v0.55.0`	indirect	minor
golang.org/x/exp	`b88d891` → `c1d0aac`	indirect	digest
golang.org/x/exp/typeparams	`b88d891` → `c1d0aac`	indirect	digest
golang.org/x/mod	`v0.38.0` → `v0.40.0`	indirect	minor
golang.org/x/net	`v0.57.0` → `v0.58.0`	indirect	minor
golang.org/x/telemetry	`bdb8988` → `d8c1694`	indirect	digest
golang.org/x/text	`v0.40.0` → `v0.41.0`	indirect	minor
google.golang.org/api	`v0.291.0` → `v0.293.0`	indirect	minor
google.golang.org/genproto/googleapis/api	`6ac0973` → `ec0a776`	indirect	digest
google.golang.org/genproto/googleapis/api	`8efbd57` → `ec0a776`	indirect	digest
google.golang.org/genproto/googleapis/rpc	`6ac0973` → `ec0a776`	indirect	digest
google.golang.org/genproto/googleapis/rpc	`8efbd57` → `ec0a776`	indirect	digest
google.golang.org/protobuf	`v1.36.11` → `v1.36.12`	indirect	patch
google.golang.org/protobuf	`v1.36.12-0.20260120151049-f2248ac996af` → `v1.36.12`	indirect	patch
mvdan.cc/unparam	`5beb8c8` → `3570034`	indirect	digest

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

⚠️ MAJOR VERSION UPDATE ⚠️ - if diff is empty, revert last commit, manually update the imports within this project to the new version and re-run go mod tidy.

Release Notes

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.23.0`

Compare Source

bigquery: Add DDL stats to query statistics.
bigtable:
- cbt: Add cells-per-column limit for row lookup.
- cbt: Make it possible to combine read filters.
dlp: v2beta2 client removed. Use the v2 client instead.
firestore, spanner: Fix compilation errors due to protobuf changes.

GaijinEntertainment/go-exhaustruct (dev.gaijin.team/go/exhaustruct/v5)

`v5.0.3`

Compare Source

A patch release removing spurious read errors reported for every standard library struct literal. No configuration, flag, or diagnostic changes otherwise.

Fixes

No more $GOROOT read errors (#166). Every run reported one positionless diagnostic per standard library struct literal:
```
-: read file (filename=$GOROOT/src/strings/builder.go): open $GOROOT/src/strings/builder.go: no such file or directory
```
$GOROOT here is not an unexpanded environment variable. It is a literal placeholder the compiler substitutes for the real GOROOT when recording positions of files in the Go distribution (cmd/internal/objabi.AbsFile). Those paths travel in export data, so any driver that type-checks dependencies from export data — singlechecker, go vet -vettool, golangci-lint — saw every standard library type positioned at a path that cannot be opened on any machine. Resolving a struct literal reads the file that declares its type in order to pick up directives, and for standard library types that read always failed.

Files of the Go distribution are now resolved as directive-free without being read at all, since their sources carry no exhaustruct directives.

Standard library types are still checked. Fields come from go/types, which this change does not touch — only directive resolution is skipped:
```
_ = net.TCPAddr{}         // net.TCPAddr is missing fields IP, Port, Zone
_ = net.TCPAddr{IP: nil}  // net.TCPAddr is missing fields Port, Zone
```
A run over a package using standard library types produces an identical set of findings before and after, minus the read errors.

Internal

Regression coverage at analyzer level loads its fixture from export data, reproducing the $GOROOT positions that analysistest cannot produce (it type-checks dependencies from source, where the same definitions have real, readable paths).
GOROOT prefix matching rejects an empty prefix, so a GOROOT of / cannot match every path.

Upgrading

go install dev.gaijin.team/go/exhaustruct/v5/cmd/exhaustruct@latest

CLI users reinstall. There is nothing to change in configuration — the only difference is the absence of the spurious diagnostics.

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

`v1.43.6`

Compare Source

aws/smithy-go (github.com/aws/smithy-go)

`v1.27.8`

Compare Source

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.27.8
- Bug Fix: Restore draining the HTTP response body in CloseResponseBody to avoid issues with TCP connection reuse.

cenkalti/backoff (github.com/cenkalti/backoff/v5)

cloudflare/circl (github.com/cloudflare/circl)

`v1.6.5`: CIRCL v1.6.5

Compare Source

What's Changed

ascon: don't output plaintext if authentication fails by @bwesterb in #631
Dilithium: don't accept signatures with trailing data by @bwesterb in #632
Fix HPKE/KEM exact-length key unmarshaling by @drmikecrypto in #627
Bump x/crypto and golangci-lint by @bwesterb in #637
ecc/bls12381: reject trailing data in G1/G2 SetBytes by @bwesterb in #636
eddilithium: fail verification if signature is wrong length by @bwesterb in #633
tss/rsa: fix length check to prevent runtime out-of-bounds panic by @bwesterb in #640
dleq: verify: return false instead of panic()ing on nil parameters by @bwesterb in #641
ed448: document verification behaviour by @bwesterb in #642
ed448: reject non-canonical point encodings by @bwesterb in #635
slhdsa: ensure full reads when rand source is provided by @bwesterb in #634
ed{25519,448}: don't accept trailing data for keys by @bwesterb in #643
frodo: pack: fix accidental zero buffer assumption by @bwesterb in #645
secretsharing: check that share ID is not zero. by @bwesterb in #644
kyber: document pk isn't checked like ML-KEM by @bwesterb in #648
zk/dleq: Don't accept trailing data on proof by @bwesterb in #649
slhdsa: don't panic if prehash-hash is out of range by @bwesterb in #647
goldilocks: don't panic when unmarshalling invalid point by @bwesterb in #646
hpke: don't panic when unmarshalling opener/sealer from empty buffer by @bwesterb in #656
ot/simot: don't panic on mismatched ciphertext lengths by @bwesterb in #655
fourq: document point decoding is lenient by @bwesterb in #654
oprf: add note on multiple Point encodings by @bwesterb in #653
tss/rsa: don't panic when combining empty list of shares by @bwesterb in #652
ecc/p384: document that package is not fully constant time by @bwesterb in #651
ristretto: reject non-canonical scalars by @bwesterb in #650
Add more explicit constant time warnings by @bwesterb in #638
mlsbset: make Encode() constant time by @bwesterb in #639
mlsbset: fix stray index in Encode comment by @lukevalenta in #658
removeLen32Prefixed: check for possible data overflow by @mdosch in #629
expander: panic if requested output length overflows DST. by @cjpatton in #664
zk/dleq: add base point a to challenge derivation. by @cjpatton in #663
dh/sidh: document Import() side-effect for kem/sike. by @cjpatton in #662
ecc/fourq: improve constant-timeness of fpSgn, fqSqrt. by @cjpatton in #666
blinsign/blindrsa/partiallyblindrsa: reject malformed moduli. by @cjpatton in #665
blindsign/blindrsa: align PSSZERO behavior with RFC 9474. by @cjpatton in #660
ecc/fourq: fix fqSqr arithmetic error on amd64 by @cjpatton in #659
README: warn that not all packages are constant time by @frangelbarrera in #668
internal/test: unify ACVP test vector parsing by @ihopenre-eng in #667
blindrsa: fix interface documentation by @bwesterb in #672
ecc/fourq: fix legacy (non-BMI2) GF(p^2) multiplication on amd64 by @bwesterb in #669
p384: document assumed reductions by [@bwesterb](https://redirect.github.com/bwest

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 8am on Wednesday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-08-05T00:45:29Z

ℹ️ Artifact update notice

File name: collector/internal/tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`golang.org/x/tools`	`v0.48.0` -> `v0.49.0`

renovate Bot requested a review from a team as a code owner August 5, 2026 00:45

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 5, 2026

github-actions Bot added the go Pull requests that update Go code label Aug 5, 2026

renovate Bot force-pushed the renovate/lock-file-maintenance-golang branch 4 times, most recently from 093fd6b to 8a2c71e Compare August 5, 2026 12:49

tylerbenson approved these changes Aug 5, 2026

View reviewed changes

renovate Bot force-pushed the renovate/lock-file-maintenance-golang branch 21 times, most recently from a6d2316 to 4257b4e Compare August 8, 2026 20:25

renovate Bot force-pushed the renovate/lock-file-maintenance-golang branch 28 times, most recently from 62d4156 to 2d67231 Compare August 10, 2026 21:31

renovate Bot and others added 2 commits August 15, 2026 16:51

build(deps): update lock file maintenance golang

1601490

chore: go mod tidy

dfcd517

Navigation Menu

Uh oh!

build(deps): update lock file maintenance golang - #2518

build(deps): update lock file maintenance golang#2518
wpessers merged 2 commits into
mainfrom
renovate/lock-file-maintenance-golang

renovate Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.23.0

v5.0.3

Fixes

Internal

Upgrading

v1.43.6

v1.27.8

General Highlights

Module Highlights

v7.0.0

v6.0.1

v6.0.0

v1.6.5: CIRCL v1.6.5

What's Changed

Configuration

Uh oh!

renovate Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: collector/internal/tools/go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Aug 5, 2026 •

edited

Loading

`v0.23.0`

`v5.0.3`

`v1.43.6`

`v1.27.8`

`v7.0.0`

`v6.0.1`

`v6.0.0`

`v1.6.5`: CIRCL v1.6.5

renovate Bot commented Aug 5, 2026 •

edited

Loading