Skip to content

fix(deps): update go module updates minor#301

Merged
ChBLA merged 3 commits into
mainfrom
renovate/go-module-updates-minor
May 18, 2026
Merged

fix(deps): update go module updates minor#301
ChBLA merged 3 commits into
mainfrom
renovate/go-module-updates-minor

Conversation

@netic-renovate
Copy link
Copy Markdown
Contributor

@netic-renovate netic-renovate Bot commented Apr 6, 2026

This PR contains the following updates:

Package Change Age Confidence
github.com/anchore/grype v0.110.0v0.112.0 age confidence
github.com/anchore/syft v1.42.4v1.44.0 age confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0v1.43.0 age confidence
go.opentelemetry.io/otel/exporters/prometheus v0.64.0v0.65.0 age confidence
golang.org/x/crypto v0.50.0v0.51.0 age confidence
golang.org/x/mod v0.35.0v0.36.0 age confidence
golang.org/x/term v0.42.0v0.43.0 age confidence
helm.sh/helm/v3 v3.20.2v3.21.0 age confidence
k8s.io/apimachinery v0.35.4v0.36.1 age confidence

Release Notes

anchore/grype (github.com/anchore/grype)

v0.112.0

Compare Source

Added Features
Additional Changes

(Full Changelog)

v0.111.1

Compare Source

Bug Fixes

(Full Changelog)

v0.111.0

Compare Source

Added Features
Bug Fixes
Additional Changes

(Full Changelog)

anchore/syft (github.com/anchore/syft)

v1.44.0

Compare Source

Added Features
Bug Fixes

(Full Changelog)

v1.43.0

Compare Source

Added Features
Bug Fixes
Additional Changes

(Full Changelog)

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc)

v1.43.0: /v0.65.0/v0.19.0

Compare Source

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
    for W3C Trace Context Level 2 Random Trace ID Flag support. (#​8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#​7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#​8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
    Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#​8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#​7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#​8038)
  • Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#​8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#​8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#​8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
    make the implementation spec-compliant. (#​8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#​8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#​8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#​8096)

What's Changed

New Contributors

Full Changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

helm/helm (helm.sh/helm/v3)

v3.21.0: Helm v3.21.0

Compare Source

Helm v3.21.0 is a feature release. Users are encouraged to upgrade for the best experience.

[!WARNING]
Helm v3 is approaching end-of-life. Please update to Helm v4.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Kubernetes client libraries to v1.36
  • notable changes here

Installation and Upgrading

Download Helm v3.21.0. The common platform binaries are here:

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.21.1 will contain only bug fixes.
  • 3.22.0 is the next feature release for Kubernetes v1.37

Changelog

  • [v3] Bump to version v3.21 e0878d4 (George Jenkins)
  • fix: upgrade opentelemetry packages to patch CVEs 13d5fc4 (Terry Howe)
  • fix: Chart dot-name path bug 2552884 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow ec05dd5 (Terry Howe)
  • add image index test b0dfec5 (Pedro Tôrres)
  • fix pulling charts from OCI indices e629995 (Pedro Tôrres)
  • chore(deps): bump the k8s-io group with 7 updates 9c854fb (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 a692247 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 9f2a7f6 (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 79f039b (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 45210d5 (dependabot[bot])
  • Remove refactorring changes from coalesce_test.go e2df39f (Evans Mungai)
  • Fix import 97affe0 (Evans Mungai)
  • Update pkg/chart/common/util/coalesce_test.go c264166 (Evans Mungai)
  • Fix lint warning d409df8 (Evans Mungai)
  • Preserve nil values in chart already 6fdd101 (Evans Mungai)
  • fix(values): preserve nil values when chart default is empty map b13743c (Evans Mungai)
  • chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 703999d (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 a04be96 (dependabot[bot])

New Contributors

Full Changelog: helm/helm@v3.20.0...v3.21.0

kubernetes/apimachinery (k8s.io/apimachinery)

v0.36.1

Compare Source

v0.36.0

Compare Source

v0.35.5

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@netic-renovate netic-renovate Bot added the renovate-auto-approve Enables auto approval for Renovate PRs label Apr 6, 2026
@netic-renovate
Copy link
Copy Markdown
Contributor Author

netic-renovate Bot commented Apr 6, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 36 additional dependencies were updated

Details:

Package Change
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 -> v1.31.0
github.com/anchore/clio v0.0.0-20250715152405-a0fa658e5084 -> v0.1.0
github.com/anchore/fangs v0.0.0-20250716230140-94c22408c232 -> v0.1.0
github.com/anchore/go-collections v0.0.0-20251016125210-a3c352120e8c -> v0.1.0
github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d -> v0.1.0
github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 -> v0.1.0
github.com/anchore/go-macholibre v0.0.0-20250320151634-807da7ad2331 -> v0.1.0
github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec -> v0.1.0
github.com/anchore/go-sync v0.0.0-20250714163430-add63db73ad1 -> v0.1.0
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 -> v0.2.0
github.com/anchore/stereoscope v0.1.22 -> v0.1.23
github.com/containerd/containerd/v2 v2.2.1 -> v2.2.2
github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
github.com/docker/cli v29.3.0+incompatible -> v29.4.0+incompatible
github.com/google/go-containerregistry v0.21.2 -> v0.21.5
github.com/lib/pq v1.10.9 -> v1.11.2
github.com/moby/moby/api v1.54.0 -> v1.54.1
github.com/moby/moby/client v0.3.0 -> v0.4.0
github.com/openvex/go-vex v0.2.7 -> v0.2.8
github.com/package-url/packageurl-go v0.1.3 -> v0.1.5
github.com/prometheus/procfs v0.19.2 -> v0.20.1
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 -> v0.68.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 -> v1.43.0
go.opentelemetry.io/proto/otlp v1.9.0 -> v1.10.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/sys v0.43.0 -> v0.44.0
golang.org/x/text v0.36.0 -> v0.37.0
gonum.org/v1/gonum v0.16.0 -> v0.17.0
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 -> v0.0.0-20260401024825-9d38bb4040a9
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 -> v0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/grpc v1.79.3 -> v1.80.0
google.golang.org/protobuf v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/klog/v2 v2.130.1 -> v2.140.0
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260317180543-43fb72c5454a
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2

@netic-renovate netic-renovate Bot requested review from a team and gh-netic-robot as code owners April 6, 2026 07:18
@netic-renovate netic-renovate Bot added the renovate-auto-approve Enables auto approval for Renovate PRs label Apr 6, 2026
gh-netic-robot
gh-netic-robot previously approved these changes Apr 6, 2026
Copy link
Copy Markdown

@gh-netic-robot gh-netic-robot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All checks passed, automatically approving.

@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch from df2fffb to 4d19ac2 Compare April 7, 2026 14:13
@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch 6 times, most recently from dd06eb9 to 00b1464 Compare April 16, 2026 10:07
@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch 3 times, most recently from 7075e1c to 942fd50 Compare April 20, 2026 07:17
@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch 3 times, most recently from 686ff3e to dde0757 Compare April 24, 2026 18:45
@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch 4 times, most recently from ac6d967 to 3bbe722 Compare May 5, 2026 13:08
@netic-renovate
Copy link
Copy Markdown
Contributor Author

netic-renovate Bot commented May 8, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch 5 times, most recently from 6c4adc5 to 8f5ba0f Compare May 15, 2026 07:47
@netic-renovate netic-renovate Bot force-pushed the renovate/go-module-updates-minor branch from 8f5ba0f to 878cd16 Compare May 18, 2026 09:11
@ChBLA ChBLA merged commit f1e4e11 into main May 18, 2026
4 checks passed
@ChBLA ChBLA deleted the renovate/go-module-updates-minor branch May 18, 2026 10:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

renovate-auto-approve Enables auto approval for Renovate PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants