build(deps): bump the minor-and-patch group across 1 directory with 6 updates

[dependabot]

Bumps the minor-and-patch group with 5 updates in the / directory:

Package	From	To
github.com/a-h/templ	0.3.1001	0.3.1020
github.com/redis/go-redis/v9	9.21.0	9.22.0
github.com/xraph/forge	1.9.13	1.9.14
go.mongodb.org/mongo-driver/v2	2.5.0	2.8.2
go.opentelemetry.io/otel	1.44.0	1.46.0

Updates github.com/a-h/templ from 0.3.1001 to 0.3.1020

Release notes

Sourced from github.com/a-h/templ's releases.

v0.3.1020

Changelog

• 09d6b02 chore: bump version
• a411f13 chore: fix linter warning in test code
• 524cd39 feat: add -check flag, closes #1007 (#1373)
• f3d595c feat: add Range to ExpressionAttribute nodes (#1347)
• 82af17c feat: add Range to GoCode nodes (#1348)
• cf98cdc feat: add Range to StringExpression nodes (#1349)
• ff38cee feat: add ranges for attribute node values (#1383)
• 552ed02 feat: support concurrent rendering of templ components (#1359)
• b310a97 fix(generatecmd): check cmd.Start() error before inserting cmd in to running map (#1382)
• 410a80e fix(lsp): delete $GOROOT hack in uri.File
• 95a0854 fix: allow JSFuncCall on arbitrary HTML attributes (#1375)
• e581c01 fix: attributes containing a conditional, are always multiline (#1380)
• b2952ed fix: clear children context in Fragment.Render (#1360)
• 8fecf2d fix: prevent corrupted output in watch mode with gzip, fixes #1365 (#1366)
• 7adcb62 fix: show correct updates based on written Go files without watch (#1363)
• aa493e0 fix: track Range for non-JavaScript ScriptExpression nodes (#1350)
• d52d64e fix: use dedicated shadow host in Suspense example to ensure header is rendered (#1370)
• 83176f9 fix: vulnerabilities in x/net (only affects templ watch mode and tests), fixes #1354

Commits

• 09d6b02 chore: bump version
• ff38cee feat: add ranges for attribute node values (#1383)
• e581c01 fix: attributes containing a conditional, are always multiline (#1380)
• b310a97 fix(generatecmd): check cmd.Start() error before inserting cmd in to `run...
• 95a0854 fix: allow JSFuncCall on arbitrary HTML attributes (#1375)
• 8fecf2d fix: prevent corrupted output in watch mode with gzip, fixes #1365 (#1366)
• a411f13 chore: fix linter warning in test code
• 524cd39 feat: add -check flag, closes #1007 (#1373)
• d52d64e fix: use dedicated shadow host in Suspense example to ensure header is render...
• 552ed02 feat: support concurrent rendering of templ components (#1359)
• Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.22.0

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

• Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
• WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @​ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

• AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.
• AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/HEAD/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @​ndyakov, with help from @​cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

• HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
• LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
• SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
• XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
• TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
• FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.22.0 (2026-08-03)

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

• Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
• WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @​ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

• AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.
• AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/master/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @​ndyakov, with help from @​cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

• HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
• LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
• SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
• XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
• TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
• FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Commits

• c7f59a2 chore(release): prepare 9.22.0 (#3947)
• c994cfc feat(autopipeline): automatic command pipelining (#3942)
• 228b463 chore(deps): bump actions/stale from 10 to 11 (#3944)
• a6be850 feat(csc): add standalone client-side caching (#3941)
• 82b0213 chore(release): prepare 9.22.0-beta.1 (#3940)
• 8eb9583 fix(rediscmd): redact credential args in AppendCmd (#3939)
• 90fd088 chore(ci): point 8.10 testing at custom client-libs-test image (#3938)
• 93f961a feat(timeseries): support multiple aggregators per key in TS.NRANGE (#3937)
• 49e0041 feat(himport): HIMPORT command with lazy per-connection prepare (#3919)
• 3dd9675 fix(proto): peek push notification name without demanding 36 bytes (#3936)
• Additional commits viewable in compare view

Updates github.com/xraph/forge from 1.9.13 to 1.9.14

Release notes

Sourced from github.com/xraph/forge's releases.

v1.9.14

Forge Framework v1.9.14 (2026-08-27T18:23:39Z)

Welcome to this new release of Forge Framework!

Changelog

Documentation Updates

• 96b4325279a766b589287db3c909da269d889a97: docs(changelog): update CHANGELOG.md for v1.9.13 (@​github-actions[bot])

Build System

• 813cae820fc44df953ac1dc997e7b2bf7365abcc: build(cmd/forge): require a forge that has the symbols it calls (@​juicycleff)
• 5c26a7e33dc952a85a1597f179d0fd3fcc8379b7: build: require nested modules at versions that exist (@​juicycleff)

Installation

Using Go Install

go install github.com/xraph/forge/cmd/forge@v1.9.14

Download Binary

Download the appropriate binary for your platform from the assets below.

Using Package Managers

# Homebrew (macOS/Linux)
brew install xraph/tap/forge
Scoop (Windows)
scoop bucket add xraph https://github.com/xraph/scoop-bucket
scoop install forge

What's Changed

Full changelog: xraph/forge@v1.9.13...v1.9.14

Changelog

Sourced from github.com/xraph/forge's changelog.

1.9.14 (2026-08-27)

Maintenance

• cmd/forge: require a forge that has the symbols it calls (813cae82)
• require nested modules at versions that exist (5c26a7e3)
• changelog: update CHANGELOG.md for v1.9.13 (96b43252)

Commits

• 813cae8 build(cmd/forge): require a forge that has the symbols it calls
• 5c26a7e build: require nested modules at versions that exist
• 96b4325 docs(changelog): update CHANGELOG.md for v1.9.13
• See full diff in compare view

Updates go.mongodb.org/mongo-driver/v2 from 2.5.0 to 2.8.2

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.8.2

The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.

What's Changed

🐛 Fixed

• GODRIVER-4025 fix: Preserve the last non-nil WriteConcernError across bulk write batches by @​zigzagdev in mongodb/mongo-go-driver#2555
• GODRIVER-4075 Return an error if there are invalid characters in the database name for bulkWrite. by @​matthewdale

Full Changelog: mongodb/mongo-go-driver@v2.8.1...v2.8.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 2.8.1

The MongoDB Go Driver Team is pleased to release version 2.8.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug where failed writes could look like they succeeded. If a write operation's first attempt failed with a NoWritesPerformed error label, the driver could return a nil/ErrNoDocuments result instead of the real failure, and the caller would end up decoding the server's error document as if it were a normal result. The bug has been fixed so the driver now surfaces the real server error, letting applications detect and retry the failure correctly.

What's Changed

🐛 Fixed

• GODRIVER-4088 Return the server error when the first attempt fails with NoWritesPerformed. by @​qingyang-hu in mongodb/mongo-go-driver#2549

Full Changelog: mongodb/mongo-go-driver@v2.8.0...v2.8.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 2.8.0

The MongoDB Go Driver Team is pleased to release version 2.8.0 of the official MongoDB Go Driver.

Release Highlights

This release supports the general availability of Queryable Encryption string queries. The query types prefix, suffix, and substring are added as generally available for MongoDB 9.0+ and libmongocrypt 1.20.0. The query types prefixPreview, suffixPreview, and substringPreview remain experimental for 8.2–8.x servers and may be removed in a future release.

... (truncated)

Commits

• 1af6d00 BUMP v2.8.2
• 2ccb9c0 Merge commit from fork
• 0c032cb GODRIVER-4075 Return an error if there are invalid characters in the database...
• faeba4a GODRIVER-4025 cherry-pick: Preserve the last non-nil WriteConcernError across...
• 847433b BUMP v2.8.1
• 1d6850a GODRIVER-4088 Return the server error when the first attempt fails with NoWri...
• 6948126 GODRIVER-4064 Skip tests that fail due to SERVER-128517 (#2525)
• 994762e GODRIVER-4026 [release/2.8] Use cmake<4.4 for libmongocrypt build. (#2487)
• b724f0a BUMP v2.8.0
• 794aab6 GODRIVER-4002: Add substring to QE GA (#2471)
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.44.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

• Support testing of Go 1.27. (#8811)
• Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
• Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

• Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
• Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
• Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

• Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
• Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
• Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
• Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
• Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
• Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
• The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
• Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

• chore(deps): update github/codeql-action action to v4.37.6 by @​renovate[bot] in open-telemetry/opentelemetry-go#8697
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.64.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8698
• chore(deps): update golang.org/x/telemetry digest to bdd03c3 by @​renovate[bot] in open-telemetry/opentelemetry-go#8699
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.64.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8700
• chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8701
• chore(deps): update module github.com/rogpeppe/go-internal to v1.16.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8702
• chore(deps): update module github.com/cloudflare/circl to v1.6.5 by @​renovate[bot] in open-telemetry/opentelemetry-go#8703
• Record processor.{span,log}.processed before invoking the exporter in simple processors by @​cijothomas in open-telemetry/opentelemetry-go#8705
• perf(sdk/metric): reduce benchmark suite execution time (#8683) by @​dashpole in open-telemetry/opentelemetry-go#8688
• chore(deps): update codspeedhq/action action to v5.0.3 by @​renovate[bot] in open-telemetry/opentelemetry-go#8710
• attempt 2: Lazily compute filtered and dropped attributes by @​dashpole in open-telemetry/opentelemetry-go#8598
• fix(deps): update googleapis to c8921c7 by @​renovate[bot] in open-telemetry/opentelemetry-go#8712
• chore(deps): update module github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3 by @​renovate[bot] in open-telemetry/opentelemetry-go#8708
• chore(deps): update github.com/charmbracelet/ultraviolet digest to 402eeaa by @​renovate[bot] in open-telemetry/opentelemetry-go#8716
• chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8715
• chore(deps): update mvdan.cc/unparam digest to a64391f by @​renovate[bot] in open-telemetry/opentelemetry-go#8717
• fix(deps): update golang.org/x to a8b543c by @​renovate[bot] in open-telemetry/opentelemetry-go#8720
• fix(deps): update googleapis to ec0a776 by @​renovate[bot] in open-telemetry/opentelemetry-go#8719

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

• Support testing of [Go 1.27]. (#8811)
• Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
• Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

• Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
• Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
• Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

• Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
• Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
• Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
• Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
• Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
• Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
• The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
• Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

• Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
• Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
• Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
• Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
• Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
• Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
• Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
• Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
• Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.

... (truncated)

Commits

• 58db4c8 Release v1.46.0 (#8858)
• 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
• 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
• cfbeab5 attribute: clarify xxhash test purpose (#8753)
• 3599b59 sdk/log: Add interface stability markers (#8855)
• 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
• d720f5a otlplog: export dropped attribute count (#8829)
• 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
• 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
• 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/trace's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

• Support testing of Go 1.27. (#8811)
• Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
• Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

• Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
• Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
• Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

• Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
• Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
• Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
• Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
• Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
• Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
• The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
• Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

• chore(deps): update github/codeql-action action to v4.37.6 by @​renovate[bot] in open-telemetry...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.