Bump the go_modules group across 1 directory with 7 updates

[dependabot]

Bumps the go_modules group with 6 updates in the / directory:

Package	From	To
github.com/hashicorp/go-retryablehttp	0.7.5	0.7.7
github.com/jackc/pgx/v5	5.5.0	5.5.4
github.com/lestrrat-go/jwx/v2	2.0.12	2.0.21
go.opentelemetry.io/otel/sdk	1.21.0	1.40.0
golang.org/x/crypto	0.21.0	0.45.0
google.golang.org/protobuf	1.31.0	1.33.0

Updates github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7

Changelog

Sourced from github.com/hashicorp/go-retryablehttp's changelog.

0.7.7 (May 30, 2024)

BUG FIXES:

• client: avoid potentially leaking URL-embedded basic authentication credentials in logs (#158)

0.7.6 (May 9, 2024)

ENHANCEMENTS:

• client: support a RetryPrepare function for modifying the request before retrying (#216)
• client: support HTTP-date values for Retry-After header value (#138)
• client: avoid reading entire body when the body is a *bytes.Reader (#197)

BUG FIXES:

• client: fix a broken check for invalid server certificate in go 1.20+ (#210)

Commits

• 1542b31 v0.7.7
• defb9f4 v0.7.7
• a99f07b Merge pull request #158 from dany74q/danny/redacted-url-in-logs
• 8a28c57 Merge branch 'main' into danny/redacted-url-in-logs
• 86e852d Merge pull request #227 from hashicorp/dependabot/github_actions/actions/chec...
• 47fe99e Bump actions/checkout from 4.1.5 to 4.1.6
• 490fc06 Merge pull request #226 from testwill/ioutil
• f3e9417 chore: remove refs to deprecated io/ioutil
• d969eaa Merge pull request #225 from hashicorp/manicminer-patch-2
• 2ad8ed4 v0.7.6
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.5.0 to 5.5.4

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.5.4 (March 4, 2024)

Fix CVE-2024-27304

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Thanks to Paul Gerste for reporting this issue.

• Fix behavior of CollectRows to return empty slice if Rows are empty (Felix)
• Fix simple protocol encoding of json.RawMessage
• Fix *Pipeline.getResults should close pipeline on error
• Fix panic in TryFindUnderlyingTypeScanPlan (David Kurman)
• Fix deallocation of invalidated cached statements in a transaction
• Handle invalid sslkey file
• Fix scan float4 into sql.Scanner
• Fix pgtype.Bits not making copy of data from read buffer. This would cause the data to be corrupted by future reads.

5.5.3 (February 3, 2024)

• Fix: prepared statement already exists
• Improve CopyFrom auto-conversion of text-ish values
• Add ltree type support (Florent Viel)
• Make some properties of Batch and QueuedQuery public (Pavlo Golub)
• Add AppendRows function (Edoardo Spadolini)
• Optimize convert UUID [16]byte to string (Kirill Malikov)
• Fix: LargeObject Read and Write of more than ~1GB at a time (Mitar)

5.5.2 (January 13, 2024)

• Allow NamedArgs to start with underscore
• pgproto3: Maximum message body length support (jeremy.spriet)
• Upgrade golang.org/x/crypto to v0.17.0
• Add snake_case support to RowToStructByName (Tikhon Fedulov)
• Fix: update description cache after exec prepare (James Hartig)
• Fix: pipeline checks if it is closed (James Hartig and Ryan Fowler)
• Fix: normalize timeout / context errors during TLS startup (Samuel Stauffer)
• Add OnPgError for easier centralized error handling (James Hartig)

5.5.1 (December 9, 2023)

• Add CopyFromFunc helper function. (robford)
• Add PgConn.Deallocate method that uses PostgreSQL protocol Close message.
• pgx uses new PgConn.Deallocate method. This allows deallocating statements to work in a failed transaction. This fixes a case where the prepared statement map could become invalid.
• Fix: Prefer driver.Valuer over json.Marshaler for json fields. (Jacopo)
• Fix: simple protocol SQL sanitizer previously panicked if an invalid $0 placeholder was used. This now returns an error instead. (maksymnevajdev)
• Add pgtype.Numeric.ScanScientific (Eshton Robateau)

Commits

• da6f2c9 Update changelog
• c543134 SQL sanitizer wraps arguments in parentheses
• 20344df Check for overflow on uint16 sizes in pgproto3
• adbb38f Do not allow protocol messages larger than ~1GB
• c1b0a01 Fix behavior of CollectRows to return empty slice if Rows are empty
• 88dfc22 Fix simple protocol encoding of json.RawMessage
• 2e84dcc *Pipeline.getResults should close pipeline on error
• d149d3f Fix panic in TryFindUnderlyingTypeScanPlan
• 046f497 deallocateInvalidatedCachedStatements now runs in transactions
• 8896bd6 Handle invalid sslkey file
• Additional commits viewable in compare view

Updates github.com/lestrrat-go/jwx/v2 from 2.0.12 to 2.0.21

Release notes

Sourced from github.com/lestrrat-go/jwx/v2's releases.

v2.0.21 07 Mar 2024

[Security]

• [jwe] Added jwe.Settings(jwe.WithMaxDecompressBufferSize(int64)) to specify the maximum size of a decompressed JWE payload. The default value is 10MB. If you are compressing payloads greater than this and want to decompress it during a call to jwe.Decrypt, you need to explicitly set a value large enough to hold that data.

  The same option can be passed to jwe.Decrypt to control this behavior on a per-message basis.

• [jwe] Added documentation stating that jwe.WithMaxBufferSize option will be renamed in future versions, i.e. v3

v2.0.20 20 Feb 2024

[New Features]

• [jwe] Added jwe.Settings(WithMaxBufferSize(int64)) to set the maximum size of internal buffers. The default value is 256MB. Most users do not need to change this value.
• [jws] Allow jws.WithCompact() and jws.WithJSON() to be passed to jws.Parse() and jws.Verify(). These options control the expected serialization format for the JWS message.
• [jwt] Add jwt.WithCompactOnly() to specify that only compact serialization can be used for jwt.Parse(). Previously, by virtue of jws.Parse() allowing either JSON or Compact serialization format, jwt.Parse() also alloed JSON serialization where as RFC7519 explicitly states that only compact serialization should be used. For backward compatibility the default behavior is not changed, but you can set this global option for jwt: jwt.Settings(jwt.WithCompactOnly(true))

[Miscellaneous]

• Internal key conversions should now allow private keys to be used in place of public keys. This would allow you to pass private keys where public keys are expected.

v2.0.19

v2.0.19 09 Jan 2024
[New Features]
  * [jws] Added jws.IsVerificationError to check if the error returned by `jws.Verify`
    was caused by actual verification step or something else, for example, while fetching
    a key from datasource
[Security Fixes]


[jws] JWS messages formated in full JSON format (i.e. not the compact format, which
consists of three base64 strings concatenated with a '.') with missing "protected"
headers could cause a panic, thereby introducing a possiblity of a DoS.
This has been fixed so that the jws.Parse function succeeds in parsing a JWS message
lacking a protected header. Calling jws.Verify on this same JWS message will result
in a failed verification attempt. Note that this behavior will differ slightly when
parsing JWS messages in compact form, which result in an error.
</tr></table>

... (truncated)

Changelog

Sourced from github.com/lestrrat-go/jwx/v2's changelog.

v2.0.21 07 Mar 2024 [Security]

• [jwe] Added jwe.Settings(jwe.WithMaxDecompressBufferSize(int64)) to specify the maximum size of a decompressed JWE payload. The default value is 10MB. If you are compressing payloads greater than this and want to decompress it during a call to jwe.Decrypt, you need to explicitly set a value large enough to hold that data.

  The same option can be passed to jwe.Decrypt to control this behavior on a per-message basis.

• [jwe] Added documentation stating that jwe.WithMaxBufferSize option will be renamed in future versions, i.e. v3

v2.0.20 20 Feb 2024 [New Features]

• [jwe] Added jwe.Settings(WithMaxBufferSize(int64)) to set the maximum size of internal buffers. The default value is 256MB. Most users do not need to change this value.
• [jws] Allow jws.WithCompact() and jws.WithJSON() to be passed to jws.Parse() and jws.Verify(). These options control the expected serialization format for the JWS message.
• [jwt] Add jwt.WithCompactOnly() to specify that only compact serialization can be used for jwt.Parse(). Previously, by virtue of jws.Parse() allowing either JSON or Compact serialization format, jwt.Parse() also alloed JSON serialization where as RFC7519 explicitly states that only compact serialization should be used. For backward compatibility the default behavior is not changed, but you can set this global option for jwt: jwt.Settings(jwt.WithCompactOnly(true))

[Miscellaneous]

• Internal key conversions should now allow private keys to be used in place of public keys. This would allow you to pass private keys where public keys are expected.

v2.0.19 09 Jan 2024 [New Features]

• [jws] Added jws.IsVerificationError to check if the error returned by jws.Verify was caused by actual verification step or something else, for example, while fetching a key from datasource

[Security Fixes]

• [jws] JWS messages formated in full JSON format (i.e. not the compact format, which consists of three base64 strings concatenated with a '.') with missing "protected" headers could cause a panic, thereby introducing a possiblity of a DoS.

  This has been fixed so that the jws.Parse function succeeds in parsing a JWS message lacking a protected header. Calling jws.Verify on this same JWS message will result in a failed verification attempt. Note that this behavior will differ slightly when parsing JWS messages in compact form, which result in an error.

v2.0.18 03 Dec 2023

... (truncated)

Commits

• 611d914 Merge pull request #1091 from lestrrat-go/develop/v2
• 551073b fix keyset suboption documentation (#1090)
• cdfaccf silence linter
• 17e2da9 Update Changes
• d43f2ce Merge pull request from GHSA-hj3v-m684-v259
• 778ed27 Bump golang.org/x/crypto from 0.19.0 to 0.21.0 (#1086)
• 38d258e Bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (#1084)
• ffcb990 Update httprc to v1.0.5 (#1088)
• c3b3a17 Merge branch 'develop/v2' into v2
• ace7a77 Update Changes
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.21.0 to 1.40.0

Release notes

Sourced from go.opentelemetry.io/otel/sdk's releases.

Release v1.23.0-rc.1

This is a release candidate for the v1.23.0 release. That release is expected to include the v1 release of the following modules:

• go.opentelemetry.io/otel/bridge/opencensus
• go.opentelemetry.io/otel/bridge/opencensus/test
• go.opentelemetry.io/otel/example/opencensus
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
• go.opentelemetry.io/otel/exporters/stdout/stdoutmetric

See our versioning policy for more information about these stability guarantees.

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

• Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
• Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
• Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

• Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
• Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
• Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
• Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
• Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
• Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
• Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
• The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
• The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

• Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
• Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
• Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)
• WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

Deprecated

• Deprecate go.opentelemetry.io/otel/exporters/zipkin. For more information, see the OTel blog post deprecating the Zipkin exporter. (#7670)

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

• Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)
• Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)
• Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)
• Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)
• Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)
• Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)
• Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)

... (truncated)

Commits

• a3a5317 Release v1.40.0 (#7859)
• 77785da chore(deps): update github/codeql-action action to v4.32.1 (#7858)
• 56fa1c2 chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (#7857)
• 298cbed Upgrade semconv use to v1.39.0 (#7854)
• 3264bf1 refactor: modernize code (#7850)
• fd5d030 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
• 8d3b4cb chore(deps): update actions/cache action to v5.0.3 (#7847)
• 91f7cad chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (#7845)
• fdad1eb chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
• c46d3ba chore(deps): update golang.org/x/telemetry digest to fcf36f6 (#7843)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.21.0 to 0.45.0

Commits

• 4e0068c go.mod: update golang.org/x dependencies
• e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
• f91f7a7 ssh/agent: prevent panic on malformed constraint
• 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
• bcf6a84 acme: pass context to request
• b4f2b62 ssh: fix error message on unsupported cipher
• 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
• 122a78f go.mod: update golang.org/x dependencies
• c0531f9 all: eliminate vet diagnostics
• 0997000 all: fix some comments
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.21.0 to 0.47.0

Commits

• 9a29643 go.mod: update golang.org/x dependencies
• 07cefd8 context: deprecate
• 5ac9dac publicsuffix: don't treat ip addresses as domain names
• d1f64cc quic: use testing/synctest
• fff0469 http2: document that RFC 7540 prioritization does not work with small payloads
• f35e3a4 http2: fix weight overflow in RFC 7540 write scheduler
• 89adc90 http2: fix typo referring to RFC 9218 as RFC 9128 instead
• 8d76a2c quic: don't defer MAX_STREAMS frames indefinitely
• 027f8b7 quic: fix expected ACK Delay in client's ACK after HANDSHAKE_DONE
• dec9fe7 dns/dnsmessage: update SVCB packing to prohibit name compression
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.31.0 to 1.33.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.