build(deps): update lock file maintenance golang by renovate[bot] · Pull Request #2542 · open-telemetry/opentelemetry-lambda

renovate · 2026-08-19T00:55:27Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
github.com/cenkalti/backoff/v5	`v5.0.3` → `v7.0.0`	indirect	major
github.com/fxamacker/cbor/v2	`v2.9.2` → `v2.9.3`	indirect	patch
github.com/hashicorp/golang-lru	`v1.0.2` → `v2.0.7`	indirect	major
github.com/mattn/go-runewidth	`v0.0.27` → `v0.0.28`	indirect	patch
github.com/open-telemetry/opentelemetry-collector-contrib/connector/spanmetricsconnector	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/exporter/prometheusremotewriteexporter	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/extension/basicauthextension	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/extension/internal/basicauth	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/extension/internal/credentialsfile	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/extension/sigv4authextension	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/internal/filter	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/internal/pdatautil	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/ottl	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/pdatautil	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/resourcetotelemetry	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/sampling	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/prometheus	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/prometheusremotewrite	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/processor/attributesprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/processor/probabilisticsamplerprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourceprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/processor/spanprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/open-telemetry/opentelemetry-collector-contrib/processor/transformprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
github.com/pierrec/lz4/v4	`v4.1.28` → `v4.1.29`	indirect	patch
github.com/prometheus/client_golang/exp	`0c5dccd` → `d8e38e0`	indirect	digest
github.com/prometheus/prometheus	`v0.313.2` → `v0.314.0`	indirect	minor
github.com/sirupsen/logrus	`v1.10.0` → `v1.10.1`	indirect	patch
github.com/stretchr/testify	`v1.11.1` → `v1.12.1`	indirect	minor
go.opentelemetry.io/collector	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/client	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/component/componentstatus	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/component/componenttest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/config/configauth	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/configcompression	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/configgrpc	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/confighttp	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/config/configmiddleware	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/confignet	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/configopaque	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/configoptional	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/configretry	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/config/configtelemetry	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/config/configtls	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/confmap	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/confmap/xconfmap	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/connector	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/connector/connectortest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/connector/xconnector	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/consumer	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/consumer/consumererror	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/consumer/consumererror/xconsumererror	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/consumer/consumertest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/consumer/xconsumer	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/exporter/debugexporter	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter/exporterhelper	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter/exporterhelper/xexporterhelper	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter/exportertest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter/otlpexporter	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter/otlphttpexporter	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/exporter/xexporter	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/extension	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/extension/extensionauth	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/extension/extensioncapabilities	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/extension/extensionmiddleware	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/extension/extensiontest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/extension/xextension	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/featuregate	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/internal/componentalias	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/internal/fanoutconsumer	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/internal/memorylimiter	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/internal/sharedcomponent	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/internal/telemetry	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/pdata	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/pdata/pprofile	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/pdata/testdata	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/pdata/xpdata	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/pipeline	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/pipeline/xpipeline	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/processor	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/processor/batchprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/processor/memorylimiterprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/processor/processorhelper	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/processor/processorhelper/xprocessorhelper	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/processor/processortest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/processor/xprocessor	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/receiver	`v1.64.0` → `v1.65.0`	indirect	minor
go.opentelemetry.io/collector/receiver/otlpreceiver	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/receiver/receiverhelper	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/receiver/receivertest	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/receiver/xreceiver	`v0.158.0` → `v0.159.0`	indirect	minor
go.opentelemetry.io/collector/service/hostcapabilities	`v0.158.0` → `v0.159.0`	indirect	minor
go.yaml.in/yaml/v2	`v2.4.4` → `v3.0.5`	indirect	major
golang.org/x/telemetry	`d8c1694` → `0a2e198`	indirect	digest
google.golang.org/genproto/googleapis/api	`ec0a776` → `08b0e42`	indirect	digest
google.golang.org/genproto/googleapis/rpc	`ec0a776` → `08b0e42`	indirect	digest
google.golang.org/grpc	`v1.83.0` → `v1.83.1`	indirect	patch
mvdan.cc/unparam	`3570034` → `3f964bc`	indirect	digest

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

⚠️ MAJOR VERSION UPDATE ⚠️ - if diff is empty, revert last commit, manually update the imports within this project to the new version and re-run go mod tidy.

Release Notes

cenkalti/backoff (github.com/cenkalti/backoff/v5)

fxamacker/cbor (github.com/fxamacker/cbor/v2)

`v2.9.3`

Compare Source

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

Skip data item when decoding to time.Time fails under certain conditions by @fxamacker in #803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

hashicorp/golang-lru (github.com/hashicorp/golang-lru)

`v2.0.7`: golang-lru 2.0.7

Compare Source

What's Changed

expirable LRU: fix so that Get/Peek cannot return an ok and empty value by @irenarindos in #156
add a Resize method to 2Q by @veloting in #151

New Contributors

@irenarindos made their first contribution in #156
@veloting made their first contribution in #151

Full Changelog: hashicorp/golang-lru@v2.0.6...v2.0.7

`v2.0.6`: golang-lru 2.0.6

Compare Source

This release removes calling the eviction callback when the Add method is called with an item that is already in the cache (#154); it reverts PR #135 which caused issue #141.

What's Changed

[COMPLIANCE] Add Copyright and License Headers by @hashicorp-copywrite in #149
Revert #135 and add tests for eviction callback by @mgaffney in #154

Full Changelog: hashicorp/golang-lru@v2.0.5...v2.0.6

`v2.0.5`: Add expirable LRU

Compare Source

This release adds an expirable LRU package.

`v2.0.4`: Add eviction callback on replace

Compare Source

This release encompasses #135

`v2.0.3`: Add Values() and separate ARC

Compare Source

This release adds the Values() method on caches and removes ARC from the main module so that it does not need to be imported along with the rest of the module for those concerned around its patent status.

The code/API is the same, but is now found at github.com/hashicorp/golang-lru/arc/v2.

`v2.0.2`: Reduce memory usage

Compare Source

Minor fixes to reduce some memory usage

`v2.0.1`

Compare Source

`v2.0.0`: Generics

Compare Source

This release adds support for generics, and bumps the package version appropriately.

mattn/go-runewidth (github.com/mattn/go-runewidth)

`v0.0.28`

Compare Source

open-telemetry/opentelemetry-collector-contrib (github.com/open-telemetry/opentelemetry-collector-contrib/connector/spanmetricsconnector)

`v0.159.0`

Compare Source

🛑 Breaking changes 🛑

all: Removes the kafkatopicsobserver extension after being deprecated for 3 months (#48186)
Use the kafkareceiver with topic regex support instead.
extension/observer: Removes the kafka.topics endpoint type along with the kafkatopicsobserver extension (#48186)
The observer.KafkaTopicType endpoint type and its observer.KafkaTopic details struct are
removed, as the kafkatopicsobserver was the only observer emitting them. The receivercreator
no longer accepts type == "kafka.topics" rules or resource attributes for that endpoint type.
processor/dynamic_sampling: Reserve the "" prefix in rule names for processor-internal decision labels, and rename the unmatched-drop sentinel to _unmatched (#49311)
Configs with rule names starting with "" are now rejected at validation, so user rule
names can never collide with the processor-owned sentinel labels on decision metrics
(_eviction, _root_span_condition). The rule attribute value for traces dropped with
no matching rule changes from unmatched to _unmatched to follow the same convention.
receiver/file_log: ordering_criteria::top_n: 0 now means 'match all files' instead of silently behaving like top_n: 1. (#47444)
To restore the previous behavior of matching the first file only, set ordering_criteria::top_n: 1.

🚩 Deprecations 🚩

exporter/azure_monitor: Rename azuremonitor to azure_monitor (#45339)
exporter/signalfx: Remove the logic sending trace correlation. (#50166)
The trace correlation endpoint is no longer processing requests as the logic has moved
to be handled by the backend. With this change, the exporter continues to accept spans
but will no longer send them to the correlation endpoint.
receiver/file_log: Deprecate the implicit ordering_criteria.top_n default of 1 when ordering_criteria.sort_by is configured. Enable the filelog.requireExplicitTopN feature gate to require top_n to be set explicitly. (#47444)
When ordering_criteria.sort_by is configured without top_n, the matcher
silently defaults top_n to 1, returning only the single highest-priority file
per poll. With multiple actively-written files this causes severe log
duplication: the other matching files cycle in and out of the tracker and a

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 8am on Wednesday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-08-19T00:55:29Z