fix(deps): update go dependencies (non-major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/usetero/policy-go/proto	v1.9.1 → v1.10.0
go.opentelemetry.io/collector/pdata	v1.52.0 → v1.62.0

---

Release Notes

open-telemetry/opentelemetry-collector (go.opentelemetry.io/collector/pdata)

v1.62.0

💡 Enhancements 💡

• cmd/mdatagen: Add support for defining stability levels for resource attributes (#​15312)
• cmd/mdatagen: Add semantic convention reference to resource attributes (#​15313)
• processor/memory_limiter: Adding health events for the memorylimiter (#​14700)
  Publish health event from memorylimiter using componentstatus.ReportStatus

🧰 Bug fixes 🧰

• cmd/mdatagen: Removes the extra line in the documentation.md between extended description and table (#​15458)

• exporter/otlp_http: Treat errors parsing successful (2xx) HTTP response bodies as permanent errors to prevent retrying already-accepted data. (#​15386)
  When a server returns a 2xx status but the response body exceeds the 64kB read limit,
  the body is truncated and proto unmarshaling fails. Previously this was treated as a
  retryable error, causing duplicate data to be exported. Now it is marked as a permanent
  error so the retry logic will not re-send data that was already accepted by the server.

• pkg/config/configretry: Always validate BackOffConfig fields regardless of the Enabled flag. (#​15437)

• pkg/service: Ensure receivers always start after all other components (#​15495)
  There was previously a race condition where multiple receivers using a shared internal implementation,
  such as the OTLP receiver, could start sending telemetry into a pipeline before all its components had fully started.

• processor/memory_limiter: Fix degenerate collector performance when exporter has problems causing permanent CPU-burning GC loop (#​4981)
  Forced GC runs now use exponential backoff when deemed ineffective
  (still above soft limit and less than 5% reclaimed) to avoid preventing
  recovery by overloading CPU with excessive GC runs. The cap on the
  backoff interval is exposed via max_gc_interval_when_soft_limited and
  max_gc_interval_when_hard_limited (both default 30s); set either to
  0 to disable backoff on that path.

• provider/env: Fix empty env var default resolving to nil instead of empty string (#​14587)
  When using ${env:VAR:-} with an unset variable, the empty default now correctly
  resolves to an empty string instead of nil.

v1.61.0

🛑 Breaking changes 🛑

• pkg/confighttp: Remove stabilized gate confighttp.framedSnappy (#​15420)
• pkg/configoptional: Remove stabilized gate configoptional.AddEnabledField. (#​15421)
• pkg/confmap: Remove stabilized featuregate confmap.newExpandedValueSanitizer (#​15418)
• pkg/exporterhelper: Remove stable gate exporter.PersistRequestContext. (#​15424)
• pkg/otelcol: Remove stable gate otelcol.printInitialConfig (#​15425)
• pkg/service: Remove stable featuregate telemetry.UseLocalHostAsDefaultMetricsAddress (#​15419)
• pkg/xpdata: Remove stable gate pdata.enableRefCounting. (#​15426)
• processor/memory_limiter: Rename deprecated memory limiter metrics to include the memory_limiter prefix (e.g. otelcol_processor_memory_limiter_*) to clarify they are specific to this processor. (#​11203)

🚀 New components 🚀

• cmd/schemagen: Move the schemagen CLI from opentelemetry-collector-contrib to this repository as cmd/schemagen. (#​14543)
  The tool's source is identical to the upstream contrib version
  (github.com/open-telemetry/opentelemetry-collector-contrib/cmd/schemagen) except for the module path and
  the test fixtures' namespace, which now reflect the collector module
  (go.opentelemetry.io/collector/cmd/schemagen). A contrib-only integration test that pointed at three
  contrib components is removed; contrib's existing make generate-schemas + git-diff CI continues to
  exercise the FactoryMaps feature against real-world components.

💡 Enhancements 💡

• cmd/mdatagen: Add support for versioned metrics (#​15309)
  Allows metadata to specify versioned metrics for migrating to new semantic conventions.
  There are two scenarios catered for when the metric name stays the same during migration.
  When a metric name stays the same but its type differs, just the latest metric is
  emitted with the new type.
  When a metric name stays the same but its attributes differ, the latest version
  is emitted with combined attributes during the migration period.

• cmd/schemagen: Add overlayFile support to deep-merge hand-curated schema fragments into generated schemas. (#​14543)
  Components can declare an overlayFile in .schemagen.yaml pointing to a YAML file
  whose keys are recursively merged into the auto-generated schema after generation.
  This allows injecting descriptions, constraints, or additional properties that cannot
  be derived from Go types.
  Originally added to the contrib copy of cmd/schemagen in
  open-telemetry/opentelemetry-collector-contrib#48917 and brought over with the tool
  in this move.

• cmd/schemagen: Add -p flag to specify a custom Go package pattern for the config struct. (#​14543)
  The new -p flag lets callers override the default . package pattern with an arbitrary
  Go package selector (e.g. a sub-package whose Config type schemagen should walk).
  Originally added to the contrib copy of cmd/schemagen in
  open-telemetry/opentelemetry-collector-contrib#48966 and brought over with the tool
  in this move.

🧰 Bug fixes 🧰

• cmd/mdatagen: Fix an issue when the last feature gate is removed, stale files are left. (#​15423)
• cmd/mdatagen: Fix known acronyms at the end of generated Go identifiers to be all-caps, same as in any other position (#​15438)
• cmd/schemagen: Fix mode detection when using -p to target a package outside the current directory. (#​15453)
  A new -m component|package flag is available as a manual override when auto-detection is not possible.

v1.60.0

🛑 Breaking changes 🛑

• cmd/builder: The --skip-get-modules flag will no longer regenerate your go.mod file. (#​15390)
  This is mostly a bug fix, as it led to adverse behaviour that was unintended in the described flow in the README.
  Now when you run --skip-get-modules, your go.mod file will truly be untouched by ocb as the info log claims.

💡 Enhancements 💡

• pkg/config/configtls: Add include_insecure_cipher_suites to configtls to enable insecure cipher suites. Insecure cipher suites are disabled by default for security. (#​13829)
• pkg/confighttp: Add ExposedHeaders field to CORSConfig to allow setting the Access-Control-Expose-Headers response header. (#​15119)

🧰 Bug fixes 🧰

• cmd/mdatagen: Removes the extra line in the README.md between status and description (#​15306)
• pkg/exporterhelper: Fix nil-pointer panic in sending_queue::batch Unmarshal when sending_queue::sizer is set and sending_queue::batch::enabled is false. (#​14687)
  When sending_queue::sizer was set and sending_queue::batch::enabled: false
  cleared the batch Optional to None, the sizer-inheritance branch in
  queuebatch.Config.Unmarshal dereferenced a nil Optional and crashed the
  collector at startup. The branch now also requires Batch.HasValue().

v1.59.0

🛑 Breaking changes 🛑

• pkg/configoptional: Stabilize feature gate configoptional.AddEnabledField (#​15333)
• pkg/confmap: Stabilize confmap.newExpandedValueSanitizer feature gate (#​15339)
• pkg/exporterhelper: mark exporter.PersistRequestContext as stable (#​15330)
• pkg/otelcol: Stabilize otelcol.printInitialConfig gate (#​15340)
• pkg/pdata: Remove pdata.useCustomProtoEncoding feature gate (#​15332)
• pkg/service: Stabilize telemetry.UseLocalHostAsDefaultMetricsAddress gate (#​15342)
• pkg/xpdata: Stabilize pdata.enableRefCounting feature gate (#​15331)

🧰 Bug fixes 🧰

• pkg/config/configgrpc: Fix memory corruption and fatal error in Snappy (#​15237, #​15320)

v1.58.0

💡 Enhancements 💡

• pkg/exporterhelper: Add otelcol_exporter_in_flight_requests metric to track the number of export requests currently in-flight per exporter. (#​15009)
  This UpDownCounter increments in startOp and decrements in endOp, allowing operators to monitor
  concurrent export activity and detect when an exporter is saturating its worker pool.

🧰 Bug fixes 🧰

• pkg/confighttp: Close the original request body after reading block-format Content-Encoding: snappy requests. (#​15262)

• pkg/confighttp: Recover from panics in decompression libraries, return HTTP 400 instead of 500. (#​13228)

• pkg/confighttp: Enforce max_request_body_size on Content-Encoding: snappy requests before the decoded buffer is allocated. (#​15252)

• pkg/otelcol: Stop emitting verbose gRPC transport messages at WARN during normal client disconnect. (#​5169)
  grpc-go gates chatty per-RPC notices (e.g. "HandleStreams failed to read frame:
  connection reset by peer") behind LoggerV2.V(2). zapgrpc.Logger.V conflates
  grpclog verbosity with zap severity, so V(2) returns true whenever WARN is
  enabled and these messages emit at WARN. Wrap the installed grpclog.LoggerV2
  with a corrected V() that compares against a fixed verbosity threshold,
  matching grpclog's intended semantics. See uber-go/zap#1544.

• pkg/pdata: pcommon.Value.AsString no longer HTML-escapes <, >, and & inside ValueTypeMap and ValueTypeSlice values, matching the behavior already used for ValueTypeStr. (#​14662)

• pkg/service: Fix Prometheus config defaults mismatch when host is explicitly set in telemetry configuration. (#​13867)
  When users explicitly configured the telemetry metrics section (e.g. to change the host),
  the Prometheus exporter boolean fields (WithoutScopeInfo, WithoutUnits, WithoutTypeSuffix)
  defaulted to nil/false instead of true, causing metric name format changes compared to the
  implicit default configuration. This fix applies the correct defaults during config unmarshaling.

• pkg/service: Return noop tracer provider when no trace processors are defined (#​15135)

v1.57.0

🛑 Breaking changes 🛑

• cmd/builder: In the generated Collector source, the replace statements in the Go module will now use relative paths by default. (#​15097)
  We expect that this will not break existing use-cases where the generated collector is only used in an interim manner for builds. It enables the possibility of tracking the generated Collector code as a longer living artifact, allowing it to be run on any machine (whereas absolute paths will be different depending on the machine the Collector source is generated on.) We have added dist::use_absolute_replace_paths to go back to the absolute path behaviour in the case where there is an unforeseen use-case that requires absolute paths.

• pkg/confighttp: Stabilize framedSnappy feature gate. (#​15096)

💡 Enhancements 💡

• all: Add declarative schema support for service telemetry resource configuration. (#​14411)
  The service::telemetry::resource configuration now accepts the declarative schema with explicit name/value pairs:

  service:
    telemetry:
      resource:
        schema_url: https://opentelemetry.io/schemas/1.38.0
        attributes:
          - name: service.name
            value: my-collector
          - name: host.name
            value: collector-host

  The legacy inline attribute map format is still supported for backward compatibility:

  service:
    telemetry:
      resource:
        service.name: my-collector
        host.name: collector-host

  Note: resource.detectors is accepted for forward compatibility but is not yet applied by the collector.

• exporter/otlp_grpc: Added the server.address and url.path attributes to metrics generated by the otlp exporter. (#​14998)

• exporter/otlp_http: Added the server.address and url.path attributes to metrics generated by the otlp_http exporter. (#​14998)

• pkg/config/configgrpc: Add UserAgent field to ClientConfig to allow overriding the default gRPC user-agent string. (#​14686)
  The otlp gRPC exporter was unconditionally setting the User-Agent via
  grpc.WithUserAgent() at dial time, which takes precedence over per-call
  metadata, causing any user-configured User-Agent to be silently discarded.
  A dedicated UserAgent field has been added to ClientConfig which, when
  set, is used in the dial option directly instead of the default BuildInfo-derived string.

• pkg/config/configgrpc: Accept gRPC resolver scheme URIs in client endpoint (e.g. passthrough:///host:port) to allow control over name resolution (#​14990)
  After the migration to grpc.NewClient, some gRPC client components such as the OTLP
  exporter experienced connection issues in dual-stack DNS environments. This can now be
  fixed by using the passthrough:/// gRPC resolver scheme in the endpoint field.

• pkg/config/confignet: Add support for Windows Named Pipe (npipe) transport (#​15085)

• pkg/service: Emit a warning when using the old v0.2.0 declarative config format (#​15088)

🧰 Bug fixes 🧰

• pkg/otelcol: Print components exactly once in the otelcol components command (#​14682)
  This resolves an issue where aliased components were skipped.

• pkg/otelcol: Synchronize Collector Run and Shutdown lifecycles so that Shutdown blocks until Run completes all cleanup. (#​4947)
  Shutdown now blocks until Run finishes cleanup, matching http.Server semantics.
  If Shutdown is called before Run, the next Run call returns nil after cleaning up
  the config provider.

• pkg/pdata: Use spec-compliant string representation for NaN, Infinity, and -Infinity in Value.AsString(). (#​14487)

• pkg/pprofile: Fix data corruption of resource and scope attributes after marshal-unmarshal-merge round-trip. (#​15084)

• pkg/service: Non-string resource attributes in telemetry configuration now return an error instead of panicking (#​15171)

• pkg/xscraperhelper: fix the merge of profiles in the profiling scraper helpers (#​14790)

• receiver/otlp: Fix profiles receiver reporting its samples as spans (#​15089)

v1.56.0

💡 Enhancements 💡

• all: Update semconv package from 1.38.0 to 1.40.0 (#​15095)
• cmd/mdatagen: Only allow the ToVersion feature flag attribute to be set for the Stable and Deprecated stages. (#​15040)
  To better match the feature flag README
  (https://github.com/open-telemetry/opentelemetry-collector/blob/main/featuregate/README.md#feature-lifecycle).

🧰 Bug fixes 🧰

• exporter/debug: Guard from out of bounds profiles dictionary indices (#​14803)

• pdata/pprofile: create a copy when the input is marked as read-only (#​15080)

• pkg/otelcol: Fix missing default values in unredacted print-config command by introducing confmap.WithUnredacted MarshalOption. (#​14750)
  Resolves an issue where the unredacted mode output omitted all default-valued options. By introducing a new MarshalOption to disable redaction directly at the confmap encoding level, the unredacted mode now preserves all component defaults natively without requiring post-processing.

• pkg/service: Headers on the internal telemetry OTLP exporter are now redacted when the configuration is marshaled (#​14756)

v1.55.0

🛑 Breaking changes 🛑

• pkg/service: Remove service_name, service_instance_id, and service_version as constant labels on every internal metric datapoint. These attributes are already present in target_info and were being duplicated on each series for OpenCensus backwards compatibility. (#​14811)
  Previously, the collector stamped every internal metric series (e.g. otelcol_process_runtime_heap_alloc_bytes)
  with service_name, service_instance_id, and service_version labels to match the old OpenCensus behavior.
  These attributes are now only present in the target_info metric, which is the correct Prometheus/OTel convention.
  Users who filter or group by these labels on individual metrics will need to update their queries to use
  target_info joins instead.

💡 Enhancements 💡

• all: Move aix/ppc64 to tier 3 support (#​13380)

• all: Upgrade the profiles stability status to alpha (#​14817)
  The following components have their profiles status upgraded from development to alpha:

  • pdata/pprofile
  • connector/forward
  • exporter/debug
  • receiver/nop
  • exporter/nop
  • exporter/otlp_grpc
  • exporter/otlp_http

• cmd/mdatagen: Add semconv reference for attributes (#​13297)

🧰 Bug fixes 🧰

• cmd/mdatagen: Fix entity code generation so extra_attributes are emitted as resource attributes instead of entity descriptive attributes. (#​14778)

v1.54.0

❗ Known Issues ❗

• service: The collector's internal Prometheus metrics endpoint (:8888) now emits OTel service labels with underscore
  names (service_name, service_instance_id, service_version) instead of dot-notation names (service.name,
  service.instance.id, service.version). Users scraping this endpoint with the Prometheus receiver will see these renamed
  labels in resource and datapoint attributes. As a workaround, add the following metric_relabel_configs to your scrape
  config in prometheus receiver:

  metric_relabel_configs:
    - source_labels: [service_name]
      target_label: service.name
    - source_labels: [service_instance_id]
      target_label: service.instance.id
    - source_labels: [service_version]
      target_label: service.version
    - regex: service_name|service_instance_id|service_version
      action: labeldrop

  See #​14814 for details and updates.

🛑 Breaking changes 🛑

• all: Change metric units to be singular to match OTel specification, e.g. {requests} -> {request} (#​14753)

💡 Enhancements 💡

• cmd/mdatagen: Add deprecated_type field to allow specifying an alias for component types. (#​14718)
• cmd/mdatagen: Generate entity-scoped MetricsBuilder API that enforces entity-metric associations at compile time (#​14659)
• cmd/mdatagen: Skip generating reaggregation config options for metrics that have no aggregatable attributes. (#​14689)
• pkg/service: The internal status reporter no longer drops repeated Ok and RecoverableError statuses (#​14282)
  Status events can now carry metadata and there's value in allowing them to be emitted despite the status value itself
  not changing.

🧰 Bug fixes 🧰

• cmd/builder: Add .exe to output binary names when building for Windows targets. (#​12591)

• exporter/debug: Add printing of metric metadata in detailed verbosity. (#​14667)

• exporter/otlp_grpc: Prevent nil pointer panic when push methods are called before the OTLP exporter initializes its gRPC clients. (#​14663)
  When the sending queue and retry are disabled, calling ConsumeTraces,
  ConsumeMetrics, ConsumeLogs, or ConsumeProfiles before the OTLP exporter
  initializes its gRPC clients could cause a nil pointer dereference panic.
  The push methods now return an error instead of panicking.

• exporter/otlp_http: Show the actual destination URL in error messages when request URL is modified by middleware. (#​14673)
  Unwraps the *url.Error returned by http.Client.Do() to prevent misleading error logs when a middleware extension dynamically updates the endpoint.

• pdata/pprofile: Switch the dictionary of dictionary tables entries only once when merging profiles (#​14709)
  For dictionary table data, we used to switch their dictionaries when doing
  the switch for the data that uses them.
  However, when an entry is associated with multiple other data (several
  samples can use the same stack), we would have been switching the
  dictionaries of the entry multiple times.

  We now switch dictionaries for dictionary table data only once, before
  switching the resource profiles.

v1.53.0

💡 Enhancements 💡

• exporter/debug: Output bucket counts for exponential histogram data points in normal verbosity. (#​10463)
• pkg/exporterhelper: Add metadata_keys configuration to sending_queue.batch.partition to partition batches by client metadata (#​14139)
  The metadata_keys configuration option is now available in the sending_queue.batch.partition section for all exporters.
  When specified, batches are partitioned based on the values of the listed metadata keys, allowing separate batching per metadata partition. This feature
  is automatically configured when using exporterhelper.WithQueue().

🧰 Bug fixes 🧰

• cmd/builder: Fix duplicate error output when CLI command execution fails in the builder tool. (#​14436)

• cmd/mdatagen: Fix duplicate error output when CLI command execution fails in the mdatagen tool. (#​14436)

• cmd/mdatagen: Fix semconv URL validation for metrics with underscores in their names (#​14583)
  Metrics like system.disk.io_time now correctly validate against semantic convention URLs containing underscores in the anchor tag.

• extension/memory_limiter: Use ChainUnaryInterceptor instead of UnaryInterceptor to allow multiple interceptors. (#​14634)
  If multiple extensions that use the UnaryInterceptor are set the binary panics at start time.

• extension/memory_limiter: Add support for streaming services. (#​14634)

• pkg/config/configmiddleware: Add context.Context to HTTP middleware interface constructors. (#​14523)
  This is a breaking API change for components that implement or use extensionmiddleware.

• pkg/confmap: Fix another issue where configs could fail to decode when using interpolated values in string fields. (#​14034)
  For example, a resource attribute can be set via an environment variable to a string that is parseable as a number, e.g. 1234.

  (A similar bug was fixed in a previous release: that one was triggered when the field was nested in a struct,
  whereas this one is triggered when the field internally has type "pointer to string" rather than "string".)

• pkg/otelcol: The featuregate subcommand now rejects extra positional arguments instead of silently ignoring them. (#​14554)

• pkg/queuebatch: Fix data race in partition_batcher where resetTimer() was called outside mutex, causing concurrent timer.Reset() calls and unpredictable batch flush timing under load. (#​14491)

• pkg/scraperhelper: Log scrapers now emit log-appropriate receiver telemetry (#​14654)
  Log scrapers previously emitted the same receiver telemetry as metric scrapers,
  such as the otelcol_receiver_accepted_metric_points metric (instead of otelcol_receiver_accepted_log_records),
  or spans named receiver/myreceiver/MetricsReceived (instead of receiver/myreceiver/LogsReceived).

  This did not affect scraper-specific spans and metrics.

• processor/batch: Fixes a bug where the batch processor would not copy SchemaUrl metadata from resource and scope containers during partial batch splits. (#​12279, #​14620)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm every weekday,before 6am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: runners/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/hashicorp/go-version	v1.8.0 -> v1.9.0
go.opentelemetry.io/collector/featuregate	v1.52.0 -> v1.62.0