chore(deps): bump the security-updates group across 1 directory with 15 updates

[dependabot]

Bumps the security-updates group with 10 updates in the / directory:

Package	From	To
github.com/prometheus/client_golang	1.24.0	1.24.1
github.com/redis/go-redis/v9	9.21.0	9.22.0
go.etcd.io/etcd/api/v3	3.5.21	3.7.1
go.etcd.io/etcd/client/v3	3.5.21	3.7.1
go.etcd.io/etcd/server/v3	3.5.21	3.7.1
go.opentelemetry.io/contrib/propagators/autoprop	0.63.0	0.70.0
go.opentelemetry.io/contrib/samplers/jaegerremote	0.37.0	0.37.2
go.opentelemetry.io/otel/bridge/opentracing	1.36.0	1.45.0
go.opentelemetry.io/otel/exporters/jaeger	1.16.0	1.17.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.36.0	1.45.0

Updates github.com/prometheus/client_golang from 1.24.0 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

• [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Commits

• d6087ee release: cut v1.24.1 (#2076)
• See full diff in compare view

Updates github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.22.0

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

• Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
• WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @​ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

• AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.
• AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/HEAD/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @​ndyakov, with help from @​cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

• HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
• LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
• SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
• XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
• TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
• FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.22.0 (2026-08-03)

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

• Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
• WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @​ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

• AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.
• AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/master/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @​ndyakov, with help from @​cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

• HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
• LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
• SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
• XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
• TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
• FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Commits

• c7f59a2 chore(release): prepare 9.22.0 (#3947)
• c994cfc feat(autopipeline): automatic command pipelining (#3942)
• 228b463 chore(deps): bump actions/stale from 10 to 11 (#3944)
• a6be850 feat(csc): add standalone client-side caching (#3941)
• 82b0213 chore(release): prepare 9.22.0-beta.1 (#3940)
• 8eb9583 fix(rediscmd): redact credential args in AppendCmd (#3939)
• 90fd088 chore(ci): point 8.10 testing at custom client-libs-test image (#3938)
• 93f961a feat(timeseries): support multiple aggregators per key in TS.NRANGE (#3937)
• 49e0041 feat(himport): HIMPORT command with lazy per-connection prepare (#3919)
• 3dd9675 fix(proto): peek push notification name without demanding 36 bytes (#3936)
• Additional commits viewable in compare view

Updates go.etcd.io/etcd/api/v3 from 3.5.21 to 3.7.1

Release notes

Sourced from go.etcd.io/etcd/api/v3's releases.

v3.7.1

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux

ETCD_VER=v3.7.1
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)

ETCD_VER=v3.7.1
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits

• 5e7fd0d version: bump up to 3.7.1
• 84badbf Merge pull request #22139 from k8s-infra-cherrypick-robot/cherry-pick-22134-t...
• bbab9ca Merge pull request #22145 from k8s-infra-cherrypick-robot/cherry-pick-22131-t...
• e6415b7 Merge pull request #22141 from k8s-infra-cherrypick-robot/cherry-pick-22130-t...
• c58097a Merge pull request #22147 from k8s-infra-cherrypick-robot/cherry-pick-22132-t...
• a63bc45 Merge pull request #22143 from k8s-infra-cherrypick-robot/cherry-pick-22128-t...
• 66dcf8e Merge pull request #22157 from ivanvc/release-3.7-google.golang.org-grpc-1.82.1
• 93e55bf Merge pull request #22149 from k8s-infra-cherrypick-robot/cherry-pick-22129-t...
• 8374af2 deps: bump google.golang.org/grpc to 1.82.1
• 2f5200d Fix unsynchronized range over leaseCache.entries
• Additional commits viewable in compare view

Updates go.etcd.io/etcd/client/v3 from 3.5.21 to 3.7.1

Release notes

Sourced from go.etcd.io/etcd/client/v3's releases.

v3.7.1

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux

ETCD_VER=v3.7.1
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)

ETCD_VER=v3.7.1
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits

• 5e7fd0d version: bump up to 3.7.1
• 84badbf Merge pull request #22139 from k8s-infra-cherrypick-robot/cherry-pick-22134-t...
• bbab9ca Merge pull request #22145 from k8s-infra-cherrypick-robot/cherry-pick-22131-t...
• e6415b7 Merge pull request #22141 from k8s-infra-cherrypick-robot/cherry-pick-22130-t...
• c58097a Merge pull request #22147 from k8s-infra-cherrypick-robot/cherry-pick-22132-t...
• a63bc45 Merge pull request #22143 from k8s-infra-cherrypick-robot/cherry-pick-22128-t...
• 66dcf8e Merge pull request #22157 from ivanvc/release-3.7-google.golang.org-grpc-1.82.1
• 93e55bf Merge pull request #22149 from k8s-infra-cherrypick-robot/cherry-pick-22129-t...
• 8374af2 deps: bump google.golang.org/grpc to 1.82.1
• 2f5200d Fix unsynchronized range over leaseCache.entries
• Additional commits viewable in compare view

Updates go.etcd.io/etcd/server/v3 from 3.5.21 to 3.7.1

Release notes

Sourced from go.etcd.io/etcd/server/v3's releases.

v3.7.1

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux

ETCD_VER=v3.7.1
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)

ETCD_VER=v3.7.1
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits

• 5e7fd0d version: bump up to 3.7.1
• 84badbf Merge pull request #22139 from k8s-infra-cherrypick-robot/cherry-pick-22134-t...
• bbab9ca Merge pull request #22145 from k8s-infra-cherrypick-robot/cherry-pick-22131-t...
• e6415b7 Merge pull request #22141 from k8s-infra-cherrypick-robot/cherry-pick-22130-t...
• c58097a Merge pull request #22147 from k8s-infra-cherrypick-robot/cherry-pick-22132-t...
• a63bc45 Merge pull request #22143 from k8s-infra-cherrypick-robot/cherry-pick-22128-t...
• 66dcf8e Merge pull request #22157 from ivanvc/release-3.7-google.golang.org-grpc-1.82.1
• 93e55bf Merge pull request #22149 from k8s-infra-cherrypick-robot/cherry-pick-22129-t...
• 8374af2 deps: bump google.golang.org/grpc to 1.82.1
• 2f5200d Fix unsynchronized range over leaseCache.entries
• Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/propagators/autoprop from 0.63.0 to 0.70.0

Release notes

Sourced from go.opentelemetry.io/contrib/propagators/autoprop's releases.

Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0

Overview

Added

• Add go.opentelemetry.io/contrib/detectors/ibmcloud/vpc, a new resource detector for IBM Cloud VPC virtual server instances, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, cloud.account.id, cloud.resource_id, host.id, host.image.id, host.image.name, host.name, and host.type. (#9011)
• Add go.opentelemetry.io/contrib/detectors/k8sapi, a new resource detector that queries the Kubernetes API. Detects k8s.node.name and k8s.node.uid when K8S_NODE_NAME is set via the downward API, and k8s.cluster.uid derived from the kube-system namespace UID (works on any Kubernetes distribution). (#9108)
• Add new elasticbeanstalk resource detector for AWS Elastic Beanstalk, ported from processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk in opentelemetry-collector-contrib. (#8993)
• The resource created by go.opentelemetry.io/contrib/otelconf now includes default SDK attributes. (#8990)
• Add support for the aws.ecs resource detector in go.opentelemetry.io/contrib/otelconf/x. (#8915)
• Add support for the aws.eks resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9138)
• Add support for the azure.vm resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9074)
• Add support for the gcp resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9137)
• Add go.opentelemetry.io/contrib/detectors/azure/azureappservice, a new resource detector for Azure App Service. Detects cloud.*, service.name, azure.resource_group.name, azure.app_service.instance.id, and deployment.environment.name from the WEBSITE_* and REGION_NAME environment variables. (#9289)
• Add azurecontainerapps resource detector for Azure Container Apps. (#8939)
• Add go.opentelemetry.io/contrib/detectors/azure/azurefunctions, a new resource detector for Azure Functions. Detects cloud.*, service.name, azure.resource_group.name, faas.instance, and deployment.environment.name from the FUNCTIONS_*, WEBSITE_*, CONTAINER_NAME, and REGION_NAME environment variables. (#9290)
• Add NewResourceDetector along with the WithAttributeFilter and WithTagKeyFilter options in go.opentelemetry.io/contrib/detectors/azure/azurevm. WithAttributeFilter restricts the returned resource to the attributes the filter accepts. WithTagKeyFilter opts in to azure.tag.<name> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (#9162)
• Add go.opentelemetry.io/contrib/detectors/vultr — a new resource detector for Vultr Cloud Compute instances, ported from processor/resourcedetectionprocessor/internal/vultr in opentelemetry-collector-contrib. Detects cloud.provider, cloud.platform, cloud.region, host.id, and host.name. (#8995)

Changed

• Upgrade go.opentelemetry.io/otel/semconv to v1.43.0, including updates across instrumentation and detector modules. See semantic-conventions v1.43.0 release for complete details. (#9337)
• Upgrade go.opentelemetry.io/otel/semconv to v1.42.0, including updates across instrumentation and detector modules. See semantic-conventions v1.42.0 release for complete details. (#9196)
• Use direct normalized-key lookups in Carrier.Get and Carrier.Keys in go.opentelemetry.io/contrib/propagators/envcar. (#9112)
• Update log bridge conversions to use attribute key-values instead of the removed log key-values in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. (#9180)
• The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux has been replaced by const Version. (#9076)
• Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin. (#8977)
• Prefer the gRPC dial target over the resolved peer IP for the server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8904)
• The detector in go.opentelemetry.io/contrib/detectors/azure/azurevm now also detects cloud.account.id, cloud.availability_zone, azure.vm.name, azure.vm.size, azure.vm.scaleset.name, and azure.resource_group.name, and prefers osProfile.computerName for host.name (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (#9162)

Fixed

• Fix Prometheus reader resource label filter configuration in go.opentelemetry.io/contrib/otelconf/v0.2.0. (#9062)
• Apply resource.detection/development.attributes.included and excluded filtering to resource detector attributes in go.opentelemetry.io/contrib/otelconf/x. (#9131)
• Honor the context configured with WithContext when constructing resources in go.opentelemetry.io/contrib/otelconf and go.opentelemetry.io/contrib/otelconf/x. (#9160)
• Handle nil response bodies from custom RoundTripper implementations in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp without panicking. (#9184)
• Fix incorrect (overestimated) sum calculation for runtime histograms in go.opentelemetry.io/contrib/instrumentation/runtime. (#9063)
• Fix Severity.UnmarshalText round trip for positive FATAL offsets above the named range in go.opentelemetry.io/contrib/processors/minsev. (#9197)
• Reduce binary size by fetching ConfigMaps via rest.HTTPClientFor instead of the Kubernetes clientset in go.opentelemetry.io/contrib/detectors/aws/eks. (#9284)
• TextMapPropagator in go.opentelemetry.io/contrib/propagators/autoprop returns the no-op propagator for empty input, matching the behavior of none. An unknown OTEL_PROPAGATORS value still returns an error with a nil propagator so NewTextMapPropagator falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (#9163)
• Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in go.opentelemetry.io/contrib/bridges/otelslog. (#9238)
• Fix a data race in go.opentelemetry.io/contrib/bridges/otelslog where concurrent Handle calls could corrupt each other's log attributes because kvBuffer.KeyValues returned a slice aliasing a shared buffer. (#9229)
• Avoid a panic in go.opentelemetry.io/contrib/bridges/otelzap when a malformed error field contains a nil or non-error value. (#9068)
• Use azure.container_app.instance.id instead of service.instance.id for the replica name detected by go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps. (#9208)
• Preserve the underlying metadata errors returned with partial resources from go.opentelemetry.io/contrib/detectors/gcp. (#9069)
• Copy MultipartForm back to the request otelmux.Middleware was given after the wrapped handler returns, so net/http can find and remove the temp files ParseMultipartForm created on the context-derived request copy, when otelmux.Middleware wraps a handler directly, in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. This does not cover a handler panic, nor the common router.Use(...) integration, where gorilla/mux's own routing step makes an additional request copy the middleware cannot write back through; see gorilla/mux#777. (#9361)
• Report the b3 header from Fields() for the default B3Unspecified single-header injection encoding, matching what Inject writes, in go.opentelemetry.io/contrib/propagators/b3. (#9273)
• Fix go.opentelemetry.io/contrib/propagators/aws/xray producing deterministic trace and span IDs when the seed read from crypto/rand silently failed, by switching to math/rand/v2's concurrency-safe top-level generator. (#9359)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/propagators/autoprop's changelog.

[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03

Added

• Add go.opentelemetry.io/contrib/detectors/ibmcloud/vpc, a new resource detector for IBM Cloud VPC virtual server instances, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, cloud.account.id, cloud.resource_id, host.id, host.image.id, host.image.name, host.name, and host.type. (#9011)
• Add go.opentelemetry.io/contrib/detectors/k8sapi, a new resource detector that queries the Kubernetes API. Detects k8s.node.name and k8s.node.uid when K8S_NODE_NAME is set via the downward API, and k8s.cluster.uid derived from the kube-system namespace UID (works on any Kubernetes distribution). (#9108)
• Add new elasticbeanstalk resource detector for AWS Elastic Beanstalk, ported from processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk in opentelemetry-collector-contrib. (#8993)
• The resource created by go.opentelemetry.io/contrib/otelconf now includes default SDK attributes. (#8990)
• Add support for the aws.ecs resource detector in go.opentelemetry.io/contrib/otelconf/x. (#8915)
• Add support for the aws.eks resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9138)
• Add support for the azure.vm resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9074)
• Add support for the gcp resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9137)
• Add go.opentelemetry.io/contrib/detectors/azure/azureappservice, a new resource detector for Azure App Service. Detects cloud.*, service.name, azure.resource_group.name, azure.app_service.instance.id, and deployment.environment.name from the WEBSITE_* and REGION_NAME environment variables. (#9289)
• Add azurecontainerapps resource detector for Azure Container Apps. (#8939)
• Add go.opentelemetry.io/contrib/detectors/azure/azurefunctions, a new resource detector for Azure Functions. Detects cloud.*, service.name, azure.resource_group.name, faas.instance, and deployment.environment.name from the FUNCTIONS_*, WEBSITE_*, CONTAINER_NAME, and REGION_NAME environment variables. (#9290)
• Add NewResourceDetector along with the WithAttributeFilter and WithTagKeyFilter options in go.opentelemetry.io/contrib/detectors/azure/azurevm. WithAttributeFilter restricts the returned resource to the attributes the filter accepts. WithTagKeyFilter opts in to azure.tag.<name> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (#9162)
• Add go.opentelemetry.io/contrib/detectors/vultr — a new resource detector for Vultr Cloud Compute instances, ported from processor/resourcedetectionprocessor/internal/vultr in opentelemetry-collector-contrib. Detects cloud.provider, cloud.platform, cloud.region, host.id, and host.name. (#8995)

Changed

• Upgrade go.opentelemetry.io/otel/semconv to v1.43.0, including updates across instrumentation and detector modules. See semantic-conventions v1.43.0 release for complete details. (#9337)
• Upgrade go.opentelemetry.io/otel/semconv to v1.42.0, including updates across instrumentation and detector modules. See semantic-conventions v1.42.0 release for complete details. (#9196)
• Use direct normalized-key lookups in Carrier.Get and Carrier.Keys in go.opentelemetry.io/contrib/propagators/envcar. (#9112)
• Update log bridge conversions to use attribute key-values instead of the removed log key-values in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. (#9180)
• The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux has been replaced by const Version. (#9076)
• Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin. (#8977)
• Prefer the gRPC dial target over the resolved peer IP for the server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8904)
• The detector in go.opentelemetry.io/contrib/detectors/azure/azurevm now also detects cloud.account.id, cloud.availability_zone, azure.vm.name, azure.vm.size, azure.vm.scaleset.name, and azure.resource_group.name, and prefers osProfile.computerName for host.name (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (#9162)

Fixed

• Fix Prometheus reader resource label filter configuration in go.opentelemetry.io/contrib/otelconf/v0.2.0. (#9062)
• Apply resource.detection/development.attributes.included and excluded filtering to resource detector attributes in go.opentelemetry.io/contrib/otelconf/x. (#9131)
• Honor the context configured with WithContext when constructing resources in go.opentelemetry.io/contrib/otelconf and go.opentelemetry.io/contrib/otelconf/x. (#9160)
• Handle nil response bodies from custom RoundTripper implementations in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp without panicking. (#9184)
• Fix incorrect (overestimated) sum calculation for runtime histograms in go.opentelemetry.io/contrib/instrumentation/runtime. (#9063)
• Fix Severity.UnmarshalText round trip for positive FATAL offsets above the named range in go.opentelemetry.io/contrib/processors/minsev. (#9197)
• Reduce binary size by fetching ConfigMaps via rest.HTTPClientFor instead of the Kubernetes clientset in go.opentelemetry.io/contrib/detectors/aws/eks. (#9284)
• TextMapPropagator in go.opentelemetry.io/contrib/propagators/autoprop returns the no-op propagator for empty input, matching the behavior of none. An unknown OTEL_PROPAGATORS value still returns an error with a nil propagator so NewTextMapPropagator falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (#9163)
<...

Description has been truncated

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}