chore(deps): bump the everything-else group across 1 directory with 16 updates

[dependabot]

Bumps the everything-else group with 12 updates in the / directory:

Package	From	To
github.com/alecthomas/chroma/v2	2.26.1	2.27.0
github.com/consensys/gnark-crypto	0.20.1	0.21.0
github.com/cosmos/ledger-cosmos-go	1.0.0	1.0.1
github.com/dgraph-io/ristretto/v2	2.4.0	2.4.2
github.com/erigontech/mdbx-go	0.40.1	0.42.0
github.com/rogpeppe/go-internal	1.15.0	1.16.0
github.com/stretchr/testify	1.11.1	1.12.0
go.opentelemetry.io/otel	1.44.0	1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	1.44.0	1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	1.44.0	1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.44.0	1.45.0
google.golang.org/protobuf	1.36.11	1.36.12

Updates github.com/alecthomas/chroma/v2 from 2.26.1 to 2.27.0

Release notes

Sourced from github.com/alecthomas/chroma/v2's releases.

v2.27.0

Changelog

• a6d00fe fix(html): make mode class output opt-in via WithModeClasses
• f52d015 chore: some house-keeping
• f08a9ab chore: add fmt + test to BUILD.bit
• 6da8f88 fix(yaml): comments can be key-values (#1289)
• 67785a4 chore(deps): update all non-major dependencies (#1285)
• d9dd73f Add templ XML lexer (#1283)
• effffdb chore(deps): update all non-major dependencies (#1280)
• 03236a4 support for PostScript font files (#1282)
• e10d532 Fix YAML slash comments with colons (#1278)

Commits

• a6d00fe fix(html): make mode class output opt-in via WithModeClasses
• f52d015 chore: some house-keeping
• f08a9ab chore: add fmt + test to BUILD.bit
• 6da8f88 fix(yaml): comments can be key-values (#1289)
• 67785a4 chore(deps): update all non-major dependencies (#1285)
• d9dd73f Add templ XML lexer (#1283)
• effffdb chore(deps): update all non-major dependencies (#1280)
• 03236a4 support for PostScript font files (#1282)
• e10d532 Fix YAML slash comments with colons (#1278)
• See full diff in compare view

Updates github.com/consensys/gnark-crypto from 0.20.1 to 0.21.0

Release notes

Sourced from github.com/consensys/gnark-crypto's releases.

v0.21.0

⚠️ Breaking Changes

• FRI & Plookup relocated — The fri and plookup packages are gone from all curves. FRI primitives now live under field/koalabear.
• Parallel goes public — internal/parallel is now exported as parallel; the worker pool moved to utils.
• Stricter EdDSA key parsing:
  • PublicKey.SetBytes now rejects points outside the prime-order subgroup.
  • PrivateKey.SetBytes now rejects malformed scalars and public keys that don't match their scalar.
  • Keys that used to load may now error.

🔒 Security

• shplonk & fflonk were missing subgroup membership checks on digests and proof points before verifying.
• KZG MPC setup — Verify was checking the ratio on the previous SRS instead of the contributed one, and never bound the G1 update to the proof.
• Subgroup membership tests added to all twistededwards curves.
• Fp2.Sqrt returned a wrong result on (non-QR, 0) inputs.
• Fixed a 4-byte overread in the innerProdVec AVX-512 path.

✨ New

• Cube roots in Fp and Fp2.
• FFT over degree-6 extensions for koalabear and babybear.
• Generic BitReverse / BitReverseCopy helpers in utils.
• Fixed-base scalar multiplication on twisted Edwards curves (used by eddsa).
• secp256r1: Fp2 tower + Cardano cube-root solver.

⚡ Faster

• 4-bit sliding window exponentiation across all fields.
• Lazy-reduction 𝔽p2 multiplication assembly for BLS12-381, BLS12-377, BLS24-315 & BLS24-317, plus improved Expt/mulBySeed chains and faster hash-to-G1 in the highly 2-adic Fp case.
• New SIMD work on the small fields:
  • AVX-512 & NEON kernels for Poseidon2 compression and VectorE6
  • AVX-512 batch ops for E6 FFT (2.97×)
  • Inlined E6 arithmetic for 31-bit primes (2.07×)
  • Unrolled FFT kernels

Changelog

Sourced from github.com/consensys/gnark-crypto's changelog.

[v0.21.0] - 2026-08-10

Breaking

• remove fri package from all curves; FRI primitives now live in field/koalabear (#856, #871)
• remove plookup package from all curves (#862)
• internal/parallel is now public as parallel; the worker pool moved to utils (#819, #823)
• eddsa PublicKey.SetBytes rejects points outside the prime-order subgroup; PrivateKey.SetBytes rejects malformed scalars and public keys that don't match the scalar (#859)

Security

• eddsa: reject small-subgroup public keys (#859)
• shplonk, fflonk: check digests and proof points are in the subgroup before verifying (#858)
• kzg: MpcSetup.Verify checked the ratio on the previous SRS instead of the contributed one, and did not bind the G1 update to the proof (#857)
• add subgroup membership tests to all twistededwards curves (#833)

Feat

• cube roots in Fp and Fp2 (#825)
• FFT over degree-6 extension for koalabear and babybear (#838, #772)
• generic BitReverse/BitReverseCopy (naive and Cobra) in utils (#871)
• koalabear: Compressx16Columns, Compressx16ColumnsWithState and VectorE6.MulAccByElement (#865, #866, #871)
• twistededwards: fixed-base ScalarMultiplicationBase, used by eddsa (#839)
• secp256r1: Fp2 tower and Cardano cube-root solver (#831)

Fix

• Fp2.Sqrt returned a wrong result on (non-QR, 0) inputs (#845)
• amd64: 4-byte overread in the innerProdVec AVX-512 path (#841)
• restore ExecuteAligned behavior lost in the Execute refactor (#836)
• macOS build
• fft/domain: stale FinerGenerator/GeneratorSqrt comment (#744)

Perf

• 4-bit sliding window exponentiation for all fields (#817)
• lazy-reduction 𝔽p2 multiplication assembly (BLS12-381, BLS12-377, BLS24-315, BLS24-317) (#861)
• add-sub chains in Expt/mulBySeed and optimal Karabina 0-runs (#860)
• hash-to-G1 in the highly 2-adic Fp case (#830)
• inline E6.Mul/E6.Square for 31-bit primes (2.07x) (#842)
• AVX-512 batch ops for E6 FFT on koalabear (2.97x) (#843)
• koalabear: unrolled FFT kernels and faster SIS LimbIterator (#834)
• koalabear: AVX-512 VectorE6 scalar mul-acc kernels (#868)
• koalabear: NEON Compressx16Columns kernel (arm64) (#870)
• F31 Poseidon2: permutation16_avx512 (-17%) (#829)
• generalize Compressx16 AVX-512 for variable colSize (#824)
• kzg mpc setup: drop the parallel pool, use batch subgroup checks (#823)

Build

• deps: bump golang.org/x/crypto to 0.54.0, x/sys to 0.47.0, x/sync to 0.22.0
• pin GitHub Actions to commit SHAs (#837)
• apply go fix modernizations (#820)

Commits

• 0a975d7 v0.21.0 (#872)
• a71790d feat(koalabear): upstream FRI primitives (#871)
• e2a02f7 perf(koalabear): NEON kernel for Compressx16Columns (arm64) (#870)
• e4cf874 fix: KZG MPC setup consistency (#857)
• bc5b07e fix: prevent small subgroup public keys (#859)
• 039783a Perf: Lazy-reduction 𝔽p2 multiplication assembly (BLS12-381, BLS12-377, BLS24...
• 24876de feat(koalabear): AVX-512 VectorE6 scalar mul-acc kernels (#868)
• 0d62bae deps(actions)(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#864)
• 5736a0e deps(actions)(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the core-ac...
• f1c4fca feat(koalabear): vectorized VectorE6.MulAccByElement (#866)
• Additional commits viewable in compare view

Updates github.com/cosmos/ledger-cosmos-go from 1.0.0 to 1.0.1

Release notes

Sourced from github.com/cosmos/ledger-cosmos-go's releases.

v1.0.1

What's Changed

• chore(deps): dependabot roundup + master CI repair by @​chcmedeiros in cosmos/ledger-cosmos-go#95

Full Changelog: cosmos/ledger-cosmos-go@v1.0.0...v1.0.1

Commits

• e7ac9d7 chore(deps): dependabot roundup + master CI repair (#95)
• See full diff in compare view

Updates github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2

Release notes

Sourced from github.com/dgraph-io/ristretto/v2's releases.

v2.4.2

Fixed

• Revert eager pre-allocation of the sampledLFU keyCosts map (#482), which allocated NumCounters/10 map buckets at boot and caused a large RSS regression for caches with high NumCounters (#494, fixes #493)

Full Changelog: dgraph-io/ristretto@v2.4.1...v2.4.2

v2.4.1

Changed

• Pre-allocate keyCosts map in sampledLFU (#482)

Fixed

• Handle mremap size mismatch on Linux s390x (#491)

Full Changelog: dgraph-io/ristretto@v2.4.0...v2.4.1

Changelog

Sourced from github.com/dgraph-io/ristretto/v2's changelog.

[v2.4.2] - 2026-07-07

Fixed

• Revert eager pre-allocation of the sampledLFU keyCosts map (#482), which allocated NumCounters/10 map buckets at boot and caused a large RSS regression for caches with high NumCounters

Full Changelog: dgraph-io/ristretto@v2.4.1...v2.4.2

[v2.4.1] - 2026-07-06

Changed

• Pre-allocate keyCosts map in sampledLFU (#482)

Fixed

• Handle mremap size mismatch on Linux s390x (#491)

Full Changelog: dgraph-io/ristretto@v2.4.0...v2.4.1

Commits

• 8d05e8a fix: revert eager sampledLFU keyCosts pre-allocation (#482) (#494)
• e89d89a chore: prepare release v2.4.1 (#492)
• fe05eab fix: handle mremap size mismatch on Linux s390x
• bb27952 chore(ci): add stale Action (#488)
• 7aac03a docs: add contributing guide and code of conduct
• b483e0c perf: pre-allocate keyCosts map in sampledLFU
• 469a1a0 Update trunk conf
• 3ac041b chore: update ci-ristretto-tests.yml
• See full diff in compare view

Updates github.com/erigontech/mdbx-go from 0.40.1 to 0.42.0

Release notes

Sourced from github.com/erigontech/mdbx-go's releases.

v0.42.0

Go-side release. Vendored libmdbx is unchanged from v0.41.x — still v0.14.2 (530d0265).

Backward compatibility breaks

• Txn.Unpark gains a result value (#236): Unpark() error → Unpark() (restarted bool, err error). Single-value assignments need _, err =. MDBX_RESULT_TRUE from mdbx_txn_unpark — ousted and restarted on a newer snapshot — was previously collapsed into plain success while the cached Txn.ID() kept the pre-restart value.
• Cursor and Txn can no longer be copied (#250): both carry a noCopy marker, so go vet copylocks flags any copy. Copying either was always a bug — the copy would share the same C handle and double-close it. Embedding as a struct field is not a copy and stays fine.

New

• Cursor.Open(txn, db) (#248) initializes an unopened Cursor in place, so callers may embed Cursor by value instead of holding a *Cursor. Txn.OpenCursor keeps its signature and delegates. Cursor.IsClosed() exposes the closed state that callers previously read off a nil *Cursor; it is nil-safe.

Fixes

• Unpark reported errors under the op name mdbx_txn_park (#236).
• Park/Unpark checked env._env without the close guard that abort() takes, racing Env.Close (#236).

CI

• golangci-lint config simplified, nilness bug-catcher added, workflows hardened (#244).

v0.41.2

Patch release on top of v0.41.1. Compile-time only — no runtime behaviour change.

noCopy on the C-handle types

v0.41.1 added Cursor.Open so a Cursor can be embedded by value, which also makes copying one easy to do by accident. A Cursor or Txn owns a raw libmdbx handle, so a copy hands two Go values one handle: closing either frees it while the other still points at it, and the second close is a double free into cgo.

type	before	now
Env	already rejected — holds sync.RWMutex	unchanged
Txn	unguarded	noCopy
Cursor	unguarded	noCopy

go vet -copylocks now rejects the copy:

assignment copies lock value to b: mdbx.Cursor contains mdbx.noCopy

Embedding by value — the reason Open exists — is unaffected; noCopy bars copying a value, not holding one. sizeof(Cursor) is unchanged at 16 bytes.

Full changelog: erigontech/mdbx-go@v0.41.1...v0.41.2

v0.41.1

Patch release on top of v0.41.0. One change, backported from #248 via #249.

Cursor.Open — in-place initialization

Txn.OpenCursor always heap-allocates a *Cursor. Cursor.Open initializes an existing Cursor in place, so callers can embed one by value and drop a per-cursor allocation:

... (truncated)

Commits

• 155c45c mdbx: bar copying Cursor and Txn with noCopy (#250)
• 171527e mdbx: Cursor.Open initializes in place so callers can embed Cursor by value (...
• 854e48c mdbx: Unpark reports the ousted-and-restarted outcome; Park/Unpark take the c...
• 1d7b3d8 ci: simplify golangci-lint config, add nilness bug-catcher, harden workflows ...
• 03f9f60 mdbx: fix cursor leak on Close after write-txn end + cursor lifecycle hardeni...
• c5f6c3a build: require Go 1.25, enable another batch of linters (#243)
• 56a86f2 ci: golangci-lint v2.12.2, more linters enabled, findings fixed (#242)
• fd54c87 mdbx: Env.Close surfaces mdbx_env_close errors instead of leaking the handle ...
• 0236f7d mdbx: Cursor.Get converts the C result directly, dropping the Txn scratch rou...
• ed1d4bf docs: Get returns zero-copy mmap views — remove stale RawRead references (#233)
• Additional commits viewable in compare view

Updates github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0

Commits

• 49d4e9d testscript/plugin: new package (#307)
• b82995b testscript: add dynamic command capability (#306)
• 5cab5df goproxytest: make .mod and .info files optional (#305)
• See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in stretchr/testify#1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in stretchr/testify#1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in stretchr/testify#1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in stretchr/testify#1842
• EMERITUS.md: add @​tylerb by @​dolmen in stretchr/testify#1812
• CI: test also with Go 1.24 by @​alexandear in stretchr/testify#1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in stretchr/testify#1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in stretchr/testify#1883
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in stretchr/testify#1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in stretchr/testify#1885
• _codegen: modernize by @​dolmen in stretchr/testify#1890
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in stretchr/testify#1906
• mock: Mock.Return does not exist anymore by @​Kentzo in stretchr/testify#1905

New Contributors

• @​mutaiib made their first contribution in stretchr/testify#1775
• @​vyas-git made their first contribution in stretchr/testify#1665
• @​olivergondza made their first contribution in stretchr/testify#1400
• @​egawata made their first contribution in stretchr/testify#1792
• @​ubunatic made their first contribution in stretchr/testify#1815
• @​Baxromumarov made their first contribution in stretchr/testify#1850
• @​a2not made their first contribution in stretchr/testify#1821

... (truncated)

Commits

• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• d2699be _codegen: modernize
• a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.44.0 to 1.45.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

Overview

Added

• Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
• Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
• Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
• Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
• Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
• Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
• Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
• Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
• Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

• HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
• ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
• Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
• Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
• ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
• ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

• Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

• ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
• ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

• Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
• Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
• Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
• Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

• Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
• Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
• Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
• Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
• Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
• Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
• Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
• Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
• Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

• HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
• ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
• Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
• Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
• ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
• ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

• Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

• ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
• ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

• Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
• Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
• Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
• Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
• Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

... (truncated)

Commits

• 93a693e Release v1.45.0 (#8693)
• c65d435 Merge commit from fork
• 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
• 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
• a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
• 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
• cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
• e814a72 Merge commit from fork

[Gno2D2]

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Pending initial approval by a review team member, or review from tech-staff

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Automated Checks

Pending initial approval by a review team member, or review from tech-staff

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Not (🔴 Pull request author is a member of the team: tech-staff)

Then

🟢 Requirement satisfied
└── 🟢 If
    ├── 🟢 Condition
    │   └── 🟢 Or
    │       ├── 🟢 User jefft0 already reviewed PR 6080 with state APPROVED
    │       ├── 🔴 At least 1 user(s) of the team tech-staff reviewed pull request
    │       └── 🔴 This pull request is a draft
    └── 🟢 Then
        └── 🟢 Not (🔴 This label is applied to pull request: review/triage-pending)

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission

[jefft0]

This dependabot PR does minor version upgrades in the main go.mod . make tidy propagates to sub projects. CI checks pass. Note that this replaces #6070 where, following advice from gfanton, we did https://github.com/dependabot ignore github.com/yuin/goldmark minor version because the "minor" version upgrade is actually a breaking change. Ready for core dev review.