deps: bump production dependencies (otel v1.46.0, natspubsub v0.8.5) and fix CI breakage - #695
Merged
Merged
Conversation
…58 updates --- updated-dependencies: - dependency-name: buf.build/go/protovalidate dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/nats-io/nats.go dependency-version: 1.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/testcontainers/testcontainers-go dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/testcontainers/testcontainers-go/modules/nats dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/testcontainers/testcontainers-go/modules/valkey dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/valkey-io/valkey-go dependency-version: 1.0.77 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/bridges/otelslog dependency-version: 0.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/exporters/autoexport dependency-version: 0.71.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp dependency-version: 0.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-version: 0.71.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/log dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/metric dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/sdk/log dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/sdk/metric dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/net dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: google.golang.org/api dependency-version: 0.294.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go dependency-version: 1.36.12-20260825204119-511051f7f437.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: cel.dev/expr dependency-version: 0.25.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: cloud.google.com/go/auth dependency-version: 0.23.2 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: cloud.google.com/go/iam dependency-version: 1.13.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: cloud.google.com/go/pubsub dependency-version: 1.51.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: cloud.google.com/go/pubsub/v2 dependency-version: 2.7.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/googleapis/enterprise-certificate-proxy dependency-version: 0.3.20 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: github.com/googleapis/gax-go/v2 dependency-version: 2.24.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2 dependency-version: 2.30.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/klauspost/compress dependency-version: 1.19.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: github.com/moby/go-archive dependency-version: 0.3.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: github.com/moby/sys/userns dependency-version: 0.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/sirupsen/logrus dependency-version: 1.10.2 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/bridges/prometheus dependency-version: 0.71.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc dependency-version: 0.70.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/propagators/aws dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/propagators/b3 dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/propagators/jaeger dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/contrib/propagators/ot dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc dependency-version: 0.22.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp dependency-version: 0.22.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/prometheus dependency-version: 0.68.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdoutlog dependency-version: 0.22.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdoutmetric dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace dependency-version: 1.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/crypto dependency-version: 0.55.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: google.golang.org/genproto/googleapis/api dependency-version: 0.0.0-20260825221802-da73d73af1c5 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260825221802-da73d73af1c5 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
….26 breakage
- github.com/pitabwire/natspubsub v0.8.4 -> v0.8.5
- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 -> v0.71.0
(completes the otel v1.46.0 / contrib v0.71.0 family bump)
- telemetry: move semconv import to v1.43.0 to match the schema URL used by
resource.Default() in otel/sdk >= v1.45.0; the mismatch made every
resource.Merge fail with "conflicting Schema URL" and broke service startup
across the test suite.
- security/openid: build EC JWKs via ecdsa.ParseUncompressedPublicKey instead
of the ecdsa.PublicKey{X, Y} literal deprecated in Go 1.26 (staticcheck
SA1019 failing CI lint). Coordinates are left-padded to the curve size so
issuers that strip leading zeros still parse.
Claude-Session: https://claude.ai/code/session_019TZcnhbJoDSoDgz4WsTTS3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #694 (and the closed #693): takes dependabot's production-dependencies bump and adds the fixes needed for CI to pass.
Dependencies
Fixes
telemetry/manager.go: semconv import v1.41.0 → v1.43.0, matchingresource.Default()in otel/sdk ≥ v1.45.0. The mismatch causedconflicting Schema URL: .../1.43.0 and .../1.41.0on everyresource.Merge, which failed ~74 tests (and a nil-deref inserver_connect_test.godownstream of it).security/openid/jwt_token_authenticator.go: EC JWKs are built withecdsa.ParseUncompressedPublicKeyinstead of theecdsa.PublicKey{X, Y}literal deprecated in Go 1.26 (staticcheck SA1019 was failing lint). Coordinates are left-padded to the curve size so issuers that strip leading zeros still parse.Chore
.githooks/(pre-commit / pre-push) used across the sibling antinvestor repos.Verification
go build ./...,golangci-lint run→ 0 issuesgo test -p 1 ./...→ all 64 packages passhttps://claude.ai/code/session_019TZcnhbJoDSoDgz4WsTTS3