fix(deps): bump the gomod-group group across 1 directory with 5 updates by dependabot[bot] · Pull Request #327 · openkcm/common-sdk

dependabot · 2026-09-14T17:24:40Z

Bumps the gomod-group group with 5 updates in the / directory:

Package	From	To
github.com/XSAM/otelsql	`0.43.0`	`0.44.0`
github.com/go-jose/go-jose/v4	`4.1.4`	`4.1.5`
github.com/thomaspoignant/go-feature-flag	`1.55.2`	`1.55.3`
go.opentelemetry.io/collector/pdata	`1.65.0`	`1.66.0`
golang.org/x/time	`0.15.0`	`0.16.0`

Updates github.com/XSAM/otelsql from 0.43.0 to 0.44.0

Release notes

Sourced from github.com/XSAM/otelsql's releases.

Release v0.44.0

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

Support testing of Go 1.27. (#650)

Add WithSpanErrorAttributesGetter option to set additional attributes (e.g., db.response.status_code) on spans when an operation returns an error. (#651)

Add SpanOptions.RowsChildOfQuery to create sql.rows spans as children of the sql.conn.query or sql.stmt.query span that produced them, so concurrent queries can be correlated with their result iteration. (#652)

Support driver.RowsColumnScanner on Go 1.27. (#649)

Changed

Replace ErrorTypeAttributes with ErrorTypeAttribute to avoid allocating an additional slice. (#643)

Upgrade OTel to v1.46.0. (#644)

Fixed

db.client.operation.duration histogram now uses the explicit bucket boundaries recommended by the OTel Semantic Conventions (0.001 to 10 seconds) instead of the SDK defaults, which placed virtually all database operations in the first bucket. (#632)

What's Changed

Use semconv-recommended bucket boundaries for db.client.operation.duration by @kitosforos in XSAM/otelsql#632

Fix changelog entry by @XSAM in XSAM/otelsql#645

perf: add ErrorTypeAttribute to eliminate extra slice allocation by @gaiaz-iusipov in XSAM/otelsql#643

Protect released changelog in CI by @XSAM in XSAM/otelsql#646

Update module github.com/stretchr/testify to v1.12.1 by @renovate[bot] in XSAM/otelsql#647

Update module github.com/golangci/golangci-lint/v2 to v2.13.2 by @renovate[bot] in XSAM/otelsql#648

Update opentelemetry-go monorepo by @renovate[bot] in XSAM/otelsql#644

Support Go 1.27 by @XSAM in XSAM/otelsql#650

Add WithSpanErrorAttributesGetter to set error attributes on spans by @XSAM in XSAM/otelsql#651

Update actions/checkout action to v7.0.1 by @renovate[bot] in XSAM/otelsql#640

Update actions/setup-go action to v7 by @renovate[bot] in XSAM/otelsql#639

Add SpanOptions.RowsChildOfQuery to make sql.rows spans children of query spans by @XSAM in XSAM/otelsql#652

Support RowsColumnScanner on Go 1.27 by @XSAM in XSAM/otelsql#649

Fix OpenTelemetry release note wording by @XSAM in XSAM/otelsql#653

Release v0.44.0 by @XSAM in XSAM/otelsql#654

New Contributors

@kitosforos made their first contribution in XSAM/otelsql#632

@gaiaz-iusipov made their first contribution in XSAM/otelsql#643

Full Changelog: XSAM/otelsql@v0.43.0...v0.44.0

Changelog

Sourced from github.com/XSAM/otelsql's changelog.

[0.44.0] - 2026-09-06

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

Support testing of [Go 1.27]. (#650)

Add WithSpanErrorAttributesGetter option to set additional attributes (e.g., db.response.status_code) on spans when an operation returns an error. (#651)

Add SpanOptions.RowsChildOfQuery to create sql.rows spans as children of the sql.conn.query or sql.stmt.query span that produced them, so concurrent queries can be correlated with their result iteration. (#652)

Support driver.RowsColumnScanner on [Go 1.27]. (#649)

Changed

Replace ErrorTypeAttributes with ErrorTypeAttribute to avoid allocating an additional slice. (#643)

Upgrade OTel to v1.46.0. (#644)

Fixed

db.client.operation.duration histogram now uses the explicit bucket boundaries recommended by the OTel Semantic Conventions (0.001 to 10 seconds) instead of the SDK defaults, which placed virtually all database operations in the first bucket. (#632)

Commits

5c3d0aa Release v0.44.0 (#654)
aeca9a1 Fix OpenTelemetry release note wording (#653)
a7f3be3 Support RowsColumnScanner on Go 1.27 (#649)
f1fb0b8 Add SpanOptions.RowsChildOfQuery to make sql.rows spans children of query spa...
dd18659 Update actions/setup-go action to v7 (#639)
e899e09 Update actions/checkout action to v7.0.1 (#640)
97ff1d0 Add WithSpanErrorAttributesGetter to set error attributes on spans (#651)
59ba93b Support Go 1.27 (#650)
f71ab21 Update opentelemetry-go monorepo (#644)
c4ac030 Update module github.com/golangci/golangci-lint/v2 to v2.13.2 (#648)
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.5

Fixed security issues

cipher/cbc_hmac: don't panic on empty ciphertext (#292)

cipher/cbc_hmac: don't panic on invalid key (#291)

json: limit stack depth (#290)

jwt: reject out-of-range NumericDate values (#278)

Check alg against pubkey curve during verify. (#293)

Reject malformed Ed25519 JWKs (#250)

jws: choose verification key per-signature (#243)

Changed

Verify OpaqueSigner's Public() return is public (#260)

jws: skip signature on ErrJWKSKidNotFound (#248)

Handle JWE JSON without protected header (#240)

jws: don't strip internal whitespace before parsing JSON (#239)

jws: fewer calls to OpaqueSigner.Public() (#224)

Return a specific error when parsing empty string (#216)

Reject typed nil at Verify time (#285)

Commits

b10771e Reject typed nil at Verify time
56f3866 Check alg against pubkey curve during verify. (#293)
74114c2 cipher/cbc_hmac: don't panic on empty ciphertext (#292)
6b364f3 cipher/cbc_hmac: don't panic on invalid key (#291)
a31af25 json: limit stack depth (#290)
7f5beb3 jwt: reject out-of-range NumericDate values (#278)
e37f31a Test on Go 1.26 and 1.27 (#284)
5b371ae Reject malformed Ed25519 JWKs (#250)
ad7f32d Bump actions/setup-python from 6 to 7 (#275)
1563054 Bump actions/setup-go from 6 to 7 (#274)
Additional commits viewable in compare view

Updates github.com/thomaspoignant/go-feature-flag from 1.55.2 to 1.55.3

Release notes

Sourced from github.com/thomaspoignant/go-feature-flag's releases.

v1.55.3

1.55.3 (2026-09-08)

🐛 Bug Fixes

deps: bump thrift, x/crypto and x/mod to clear ArtifactHub CVEs (#6003) (b597016)

register the version header middleware on the monitoring server (#6015) (691663b)

🔧 Chores

Bump @types/react-dom in /examples/openfeature_react/react-app (#5974) (5e48825)

Bump @typescript-eslint/eslint-plugin (#5882) (b525ea7)

Bump @typescript-eslint/eslint-plugin (#5973) (2b4e216)

Bump @vitejs/plugin-react (#5913) (139e9ac)

Bump actions/setup-java from 5.7.0 to 6.0.0 (#5991) (20e69f3)

Bump anthropics/claude-code-action from 1.0.187 to 1.0.199 (#5927) (45e65b2)

Bump anthropics/claude-code-action from 1.0.199 to 1.0.210 (#5990) (70bef65)

Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#5887) (95edf86)

Bump cloud.google.com/go/bigquery from 1.79.1 to 1.81.0 (#5920) (ae6875b)

Bump cloud.google.com/go/bigquery from 1.81.0 to 1.82.0 (#5982) (ac6c51d)

Bump cloud.google.com/go/pubsub from 1.51.0 to 1.51.1 (#5915) (6e3bc37)

Bump cloud.google.com/go/pubsub/v2 from 2.6.1 to 2.6.2 (#5905) (6297176)

Bump cloud.google.com/go/pubsub/v2 from 2.6.2 to 2.7.0 (#5979) (52b3038)

Bump cloud.google.com/go/storage from 1.64.0 to 1.65.0 (#5907) (aee8e8f)

Bump cloud.google.com/go/storage from 1.65.0 to 1.65.1 (#5960) (491924d)

Bump cloud.google.com/go/storage from 1.65.1 to 1.66.0 (#5978) (45cd359)

Bump dev.openfeature:sdk (#5969) (9e1d252)

Bump dev.openfeature:sdk (#5988) (717a30d)

Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#5925) (8ac502d)

Bump eslint in /examples/openfeature_react/react-app (#5883) (bfc8c9d)

Bump eslint in /examples/openfeature_react/react-app (#5971) (9f94eb5)

Bump eslint in /examples/openfeature_web/webapp (#5879) (8c8a18e)

Bump eslint in /examples/openfeature_web/webapp (#5970) (efb9754)

Bump eslint-plugin-react-refresh (#5884) (4223382)

Bump eslint-plugin-react-refresh (#5975) (3726dc3)

Bump github.com/aws/aws-lambda-go from 1.54.0 to 1.55.0 (#5981) (7ad4aca)

Bump github.com/aws/aws-sdk-go-v2 from 1.44.0 to 1.45.0 (#5977) (8c7a613)

Bump github.com/aws/aws-sdk-go-v2/config from 1.32.36 to 1.32.38 (#5916) (51cd7b6)

Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.32.39 (#5948) (b30f26b)

Bump github.com/aws/aws-sdk-go-v2/config from 1.32.39 to 1.32.40 (#5962) (adbe126)

Bump github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.1 (#5985) (2e23ba5)

Bump github.com/aws/aws-sdk-go-v2/config from 1.33.1 to 1.33.2 (#6011) (a41d4bd)

Bump github.com/aws/aws-sdk-go-v2/credentials (#5914) (3e9c2d8)

Bump github.com/aws/aws-sdk-go-v2/credentials (#6007) (1307951)

Bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager (#5921) (6832d4a)

Bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager (#5950) (f608d38)

Bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager (#5963) (8b98930)

Bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager (#5987) (5b02530)

... (truncated)

Commits

98a70ea chore(main): release 1.55.3 (#5877)
691663b fix: register the version header middleware on the monitoring server (#6015)
763614e refactor: extract the API server lifecycle into its own file (#5999)
bc61d03 feat: vendor the etag middleware into cmdhelpers/api/middleware (#5998)
a666722 chore: Bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager (#6006)
d005599 chore: Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 (#6008)
69039a8 chore: Bump org.apache.maven.plugins:maven-surefire-plugin (#6014)
66d30ee chore: Bump github.com/aws/aws-sdk-go-v2/service/s3 (#6013)
a41d4bd chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.33.1 to 1.33.2 (#6011)
5df3e47 chore: Bump google.golang.org/api from 0.295.0 to 0.296.0 (#6012)
Additional commits viewable in compare view

Updates go.opentelemetry.io/collector/pdata from 1.65.0 to 1.66.0

Changelog

Sourced from go.opentelemetry.io/collector/pdata's changelog.

v1.66.0/v0.160.0

🛑 Breaking changes 🛑

pkg/service: telemetry.Factory.CreateResource and telemetry.CreateResourceFunc now return (pcommon.Resource, string, error) instead of (pcommon.Resource, error) to expose the resource's schema URL. (#15129) The telemetry.Factory interface is experimental and cannot be implemented externally (it has an unexported method). Callers using telemetry.WithCreateResource must update the function signature to return a third string value for the schema URL.

🚩 Deprecations 🚩

pkg/confighttp: Deprecate flat keepalive fields in client and server config in favor of the new keepalive section. (#14020) The following client configuration fields are deprecated in favor of the keepalive section:

idle_conn_timeout -> keepalive::idle_conn_timeout

max_idle_conns -> keepalive::max_idle_conns

max_idle_conns_per_host -> keepalive::max_idle_conns_per_host

disable_keep_alives: true -> keepalive::enabled: false The following server configuration fields are deprecated in favor of the keepalive section:

idle_timeout -> keepalive::idle_timeout

keep_alives_enabled: false -> keepalive::enabled: false Deprecated fields set in the configuration keep working exactly as before and produce a deprecation warning when the client or server is created. Setting deprecated fields together with the new keepalive section is an error. Code migrating off the deprecated fields can use the new NewDefaultKeepaliveClientConfig and NewDefaultKeepaliveServerConfig functions to build a keepalive section with the default values.

💡 Enhancements 💡

pkg/component: Add ResourceSchemaURL field to component.TelemetrySettings to expose the collector resource's schema URL to components. (#15129)

pkg/exporterhelper: Migrate TimeoutConfig to schema-based configuration generated by mdatagen. (#15505)

🧰 Bug fixes 🧰

pkg/pprofile: add bounds checks to FromLocationIndices and switchDictionary (#15697) FromLocationIndices now returns an error instead of panicking on an out-of-range or negative location index, mirroring FromAttributeIndices. The index checks used when merging profiles now also reject negative indices. These were previously reachable with a negative index decoded from an OTLP payload, which panicked the collector via Profiles.MergeTo.

Commits

cd3455c [chore] Prepare release v1.66.0/v0.160.0 (#15888)
f3de30d [chore][internal/tools] Pin go.yaml.in/yaml/v4 to rc.3 to fix actionlint buil...
70226e9 [chore] add comment on G705 ignore (#15859)
566f953 Update module github.com/shirou/gopsutil/v4 to v4.26.8 - abandoned (#15873)
da3346d Update module github.com/prometheus/client_model to v0.6.3 (#15872)
6e5f082 [chore][cmd/mdatagen] Follow golang conventions when generating doc comments ...
032b1c0 [exporterhelper] Cache request size per sizer type (#15587)
c62353b [exporter/exporterhelper] Migrate TimeoutConfig to schema-based configurati...
a183c9c Update module github.com/golangci/golangci-lint/v2 to v2.13.1 - abandoned (#1...
a274931 [chore] try using ubuntu-slim for some jobs (#15852)
Additional commits viewable in compare view

Updates golang.org/x/time from 0.15.0 to 0.16.0

Commits

fb013b3 all: upgrade go directive to at least 1.26.0 [generated]
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the gomod-group group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/XSAM/otelsql](https://github.com/XSAM/otelsql) | `0.43.0` | `0.44.0` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.4` | `4.1.5` | | [github.com/thomaspoignant/go-feature-flag](https://github.com/thomaspoignant/go-feature-flag) | `1.55.2` | `1.55.3` | | [go.opentelemetry.io/collector/pdata](https://github.com/open-telemetry/opentelemetry-collector) | `1.65.0` | `1.66.0` | | [golang.org/x/time](https://github.com/golang/time) | `0.15.0` | `0.16.0` | Updates `github.com/XSAM/otelsql` from 0.43.0 to 0.44.0 - [Release notes](https://github.com/XSAM/otelsql/releases) - [Changelog](https://github.com/XSAM/otelsql/blob/main/CHANGELOG.md) - [Commits](XSAM/otelsql@v0.43.0...v0.44.0) Updates `github.com/go-jose/go-jose/v4` from 4.1.4 to 4.1.5 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.4...v4.1.5) Updates `github.com/thomaspoignant/go-feature-flag` from 1.55.2 to 1.55.3 - [Release notes](https://github.com/thomaspoignant/go-feature-flag/releases) - [Commits](thomaspoignant/go-feature-flag@v1.55.2...v1.55.3) Updates `go.opentelemetry.io/collector/pdata` from 1.65.0 to 1.66.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-collector/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-collector/blob/main/CHANGELOG-API.md) - [Commits](open-telemetry/opentelemetry-collector@pdata/v1.65.0...pdata/v1.66.0) Updates `golang.org/x/time` from 0.15.0 to 0.16.0 - [Commits](golang/time@v0.15.0...v0.16.0) --- updated-dependencies: - dependency-name: github.com/XSAM/otelsql dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-group - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-group - dependency-name: github.com/thomaspoignant/go-feature-flag dependency-version: 1.55.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-group - dependency-name: go.opentelemetry.io/collector/pdata dependency-version: 1.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-group - dependency-name: golang.org/x/time dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-group ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-14T17:24:47Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 110d4637-0b14-4c9f-a64d-cb2ab28fd7f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code minor labels Sep 14, 2026

aselyecan approved these changes Sep 17, 2026

View reviewed changes

cb80 approved these changes Sep 17, 2026

View reviewed changes

cb80 merged commit 4655525 into main Sep 17, 2026
7 checks passed

cb80 deleted the dependabot/go_modules/gomod-group-57b9e6de58 branch September 17, 2026 12:06

push-tags-from-workflow Bot mentioned this pull request Sep 18, 2026

chore(main): release 1.19.3 #329

Merged

Navigation Menu

fix(deps): bump the gomod-group group across 1 directory with 5 updates - #327

fix(deps): bump the gomod-group group across 1 directory with 5 updates#327
cb80 merged 1 commit into
mainfrom
dependabot/go_modules/gomod-group-57b9e6de58

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

Release v0.44.0

Added

Changed

Fixed

What's Changed

New Contributors

[0.44.0] - 2026-09-06

Added

Changed

Fixed

v4.1.5

Fixed security issues

Changed

v1.55.3

1.55.3 (2026-09-08)

🐛 Bug Fixes

🔧 Chores

v1.66.0/v0.160.0

🛑 Breaking changes 🛑

🚩 Deprecations 🚩

💡 Enhancements 💡

🧰 Bug fixes 🧰

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants