releases

mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-12 19:32:48 -06:00

Author	SHA1	Message	Date
Charlie Egan	954196aaa4	cover: Add support for coverage of conjunction exprs (#8809 ) This changes how files like this are covered ```rego package example allow if { true; true; false; false ^^^^^^^^^^^^^^^^^^ -- covered ^^^^^^ -- not covered, after this PR, previously no annotation. } ``` <img width="3456" height="1360" alt="Screenshot 8" src="https://github.com/user-attachments/assets/0a6eaa9b-1d17-42f2-a670-f1fb7e739f87" /> I have also refactored some test cases in the cover package. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-23 14:36:50 +02:00
Sebastian Spaink	dec8333b32	deduplicate change-detection output in pr CI checks (#8808 ) follow up to this suggestion from @srenatus: https://github.com/open-policy-agent/opa/pull/8775#discussion_r3440627903 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-06-23 14:35:20 +02:00
Stephan Renatus	09679abd11	benchmarks: use details+summary comments for benchlab results (#8811 ) This is how it looked previously: https://github.com/open-policy-agent/opa/pull/8752#issuecomment-4662153981 Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-06-23 09:59:33 +01:00
dependabot[bot]	57742e84a9	build(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs (#8807 ) Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.4 to 5.2.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's releases</a>.</em></p> <blockquote> <h2>v5.2.5</h2> <h3>Patch Changes</h3> <ul> <li>Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680">#5680</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md">webpack-dev-server's changelog</a>.</em></p> <blockquote> <h2>5.2.5</h2> <h3>Patch Changes</h3> <ul> <li>Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680">#5680</a>)</li> </ul> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-dev-server/commit/c3ee325819f64ceb77f85dcf727b6b5ede85cbc4"><code>c3ee325</code></a> chore(release): new release (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5682">#5682</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/60173be90873b187b41fc2009a4de253732988a1"><code>60173be</code></a> feat: add changeset validation and release workflow (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5680">#5680</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/948d5e6089bebcd801dac2cbe3ed4f80b64f117a"><code>948d5e6</code></a> fix(proxy): match the HMR upgrade path exactly like the ws server (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5678">#5678</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/93e8996124332a6c94c4d3e0f8e5f2cf95321c67"><code>93e8996</code></a> fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...</li> <li>See full diff in <a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.4...v5.2.5">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for webpack-dev-server since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=webpack-dev-server&package-manager=npm_and_yarn&previous-version=5.2.4&new-version=5.2.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 10:08:13 -05:00
Sebastian Spaink	0e6fe9caa2	Add proto schemas for the IR plan and bundle manifest (#8775 ) This adds two new proto schemas: * v1/bundle/manifest.proto * v1/ir/plan.proto --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-06-22 10:02:15 -05:00
dependabot[bot]	1a68282b0c	build(deps): bump dompurify from 3.4.10 to 3.4.11 in /docs (#8803 ) Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.10 to 3.4.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.11</h2> <ul> <li>Fixed an issue with a leaky config for hooks via <code>setConfig</code>, thanks <a href="https://github.com/trace37labs"><code>@trace37labs</code></a></li> <li>Bumped vulnerable development dependencies to arrive at plain 0 with <code>npm audit</code></li> <li>Updated the <code>osv-scanner</code> suppression list as no vulnerable dependencies are left for now</li> <li>Updated up the linting tool-chain and removed now-redundant lint directives</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a> release: 3.4.11 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.10...3.4.11">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.10&new-version=3.4.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 09:55:25 -05:00
Shuvam Pal	1dcdacbe32	fmt: preserve the multiline but single entry iterables (#8663 ) Fixes #8557. `opa fmt` collapsed single-entry arrays/objects into one line even when the original source spanned multiple rows, making deeply nested structures hard to read. This maintains the structure. Signed-off-by: unichronic <ishuvam.pal@gmail.com>	2026-06-22 09:21:48 -05:00
Stephan Renatus	f75131f0e5	topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801 ) For number inputs whose decimal string is already interned (0–100), builtinFormatInt was round-tripping through strconv.ParseInt to get an int, only to convert it straight back to a string in InternedIntegerString. Add InternedStringTermFromNumber which looks up the interned string term directly from the Number's underlying string, skipping the parse step. ``` goos: darwin goarch: arm64 pkg: github.com/open-policy-agent/opa/v1/topdown cpu: Apple M4 Max │ ../scratch/f10_main.bench │ ../scratch/f10_pr.bench │ │ sec/op │ sec/op vs base │ FormatInt-16 19.48n ± 3% 10.99n ± 1% -43.56% (p=0.000 n=10) │ ../scratch/f10_main.bench │ ../scratch/f10_pr.bench │ │ B/op │ B/op vs base │ FormatInt-16 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ ¹ all samples are equal │ ../scratch/f10_main.bench │ ../scratch/f10_pr.bench │ │ allocs/op │ allocs/op vs base │ FormatInt-16 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ ¹ all samples are equal ``` Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-06-18 19:13:23 +02:00
SEONGHYUN HONG	f4121fb38f	docs: remove duplicated word in Rego style guide (#8800 ) The Rego style guide reads "will fail both in the the undefined case" — removed the duplicated "the". Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>	2026-06-18 11:41:01 -05:00
Sebastian Spaink	b0c824b1a9	fix per-module rego version lookup (#8799 ) Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-06-18 11:36:35 -05:00
Sebastian Spaink	93d6984466	Integrate 1.17.1 patch release (#8798 ) Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-06-18 07:37:36 +02:00
dependabot[bot]	bfda58ebaf	build(deps): bump the gha-dependencies group with 2 updates (#8770 ) Bumps the gha-dependencies group with 2 updates: [jdx/mise-action](https://github.com/jdx/mise-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `jdx/mise-action` from 4.0.1 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jdx/mise-action/releases">jdx/mise-action's releases</a>.</em></p> <blockquote> <h2>v4.1.0: automatic --locked installs</h2> <p>This release adds automatic locked installs when a <code>mise.lock</code> is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.</p> <h2>Added</h2> <h3>Automatic <code>--locked</code> install when <code>mise.lock</code> exists (<a href="https://redirect.github.com/jdx/mise-action/pull/495">#495</a>) by <a href="https://github.com/zeitlinger"><code>@zeitlinger</code></a></h3> <p>When a repo contains <code>mise.lock</code>, the action now automatically passes <code>--locked</code> to <code>mise install</code> (on mise versions that support it). This removes the need to manually set <code>install_args: --locked</code> and prevents <code>mise install</code> from silently mutating the lockfile in CI. Explicit <code>install_args</code> and older mise versions are still respected.</p> <p>Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating <code>mise.lock</code> mid-run — this surfaces lockfile drift rather than hiding it.</p> <h2>Fixed</h2> <ul> <li><strong>Cache key collisions across runner providers</strong> (<a href="https://redirect.github.com/jdx/mise-action/pull/456">#456</a>) — the default cache key now includes the runner image (e.g. <code>macos15</code>, <code>ubuntu24</code> for GitHub-hosted runners; <code>self-hosted</code> otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's <code>~/.local/share/mise/installs/*</code>, causing failures like <code>does not have an executable named '…'</code> or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.</li> <li><strong><code>mise-shim.exe</code> missing on Windows</strong> (<a href="https://redirect.github.com/jdx/mise-action/pull/476">#476</a>) by <a href="https://github.com/risu729"><code>@risu729</code></a> — the action now installs <code>mise-shim.exe</code> alongside <code>mise.exe</code> and repairs restored caches that lack the shim. Fixes <a href="https://redirect.github.com/jdx/mise-action/issues/475">#475</a>.</li> </ul> <h2>Changed</h2> <ul> <li>Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) (<a href="https://redirect.github.com/jdx/mise-action/pull/436">#436</a>). No user-facing behavior change.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0">https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jdx/mise-action/blob/main/CHANGELOG.md">jdx/mise-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <hr /> <h2><a href="https://github.com/jdx/mise-action/compare/v4.0.1..v4.1.0">4.1.0</a> - 2026-06-04</h2> <h3>🚀 Features</h3> <ul> <li>add wings_enabled input (mise-wings cache integration) (<a href="https://redirect.github.com/jdx/mise-action/issues/454">#454</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/454">#454</a></li> <li>lock install when mise.lock is present (<a href="https://redirect.github.com/jdx/mise-action/issues/495">#495</a>) by <a href="https://github.com/zeitlinger"><code>@zeitlinger</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/495">#495</a></li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li><strong>(ci)</strong> add gh auth setup-git to release-plz.sh (<a href="https://redirect.github.com/jdx/mise-action/issues/473">#473</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/473">#473</a></li> <li><strong>(ci)</strong> pin codeql-action with exact version comment (<a href="https://redirect.github.com/jdx/mise-action/issues/481">#481</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/481">#481</a></li> <li>include runner image in cache key to prevent cross-provider collisions (<a href="https://redirect.github.com/jdx/mise-action/issues/456">#456</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/456">#456</a></li> <li>install mise-shim.exe on Windows (<a href="https://redirect.github.com/jdx/mise-action/issues/476">#476</a>) by <a href="https://github.com/risu729"><code>@risu729</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/476">#476</a></li> </ul> <h3>⚙️ Miscellaneous Tasks</h3> <ul> <li><strong>(ci)</strong> use !cancelled() instead of always() for final job (<a href="https://redirect.github.com/jdx/mise-action/issues/460">#460</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/460">#460</a></li> <li><strong>(ci)</strong> remove autofix.ci workflow (<a href="https://redirect.github.com/jdx/mise-action/issues/470">#470</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/470">#470</a></li> <li><strong>(ci)</strong> add zizmor workflow for github actions security analysis (<a href="https://redirect.github.com/jdx/mise-action/issues/471">#471</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/471">#471</a></li> <li><strong>(ci)</strong> close failing or conflicted PRs sooner (<a href="https://redirect.github.com/jdx/mise-action/issues/480">#480</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/480">#480</a></li> <li>add communique to enhance release notes (<a href="https://redirect.github.com/jdx/mise-action/issues/411">#411</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/411">#411</a></li> <li>migrate from ncc (CJS) to rollup (ESM) (<a href="https://redirect.github.com/jdx/mise-action/issues/436">#436</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/436">#436</a></li> <li>add final job to aggregate build-test results (<a href="https://redirect.github.com/jdx/mise-action/issues/438">#438</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/438">#438</a></li> <li>migrate package manager from npm/pnpm/bun to aube (<a href="https://redirect.github.com/jdx/mise-action/issues/455">#455</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/455">#455</a></li> <li>remove pull_request_target workflow (<a href="https://redirect.github.com/jdx/mise-action/issues/469">#469</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/469">#469</a></li> <li>update aube tool version (<a href="https://redirect.github.com/jdx/mise-action/issues/501">#501</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/501">#501</a></li> </ul> <hr /> <h2><a href="https://github.com/jdx/mise-action/compare/v4.0.0..v4.0.1">4.0.1</a> - 2026-03-22</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>run npm install in pre-commit hook before build (<a href="https://redirect.github.com/jdx/mise-action/issues/410">#410</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/410">#410</a></li> </ul> <h3>🚜 Refactor</h3> <ul> <li>extract getCwd() helper to deduplicate working directory resolution (<a href="https://redirect.github.com/jdx/mise-action/issues/403">#403</a>) by <a href="https://github.com/altendky"><code>@altendky</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/403">#403</a></li> </ul> <h3>📚 Documentation</h3> <ul> <li>bump versions listed im README.md (<a href="https://redirect.github.com/jdx/mise-action/issues/407">#407</a>) by <a href="https://github.com/deining"><code>@deining</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/407">#407</a></li> <li>bump more versions listed in README.md (<a href="https://redirect.github.com/jdx/mise-action/issues/408">#408</a>) by <a href="https://github.com/deining"><code>@deining</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/408">#408</a></li> </ul> <h3>⚙️ Miscellaneous Tasks</h3> <ul> <li>add workflow to auto-close stale PRs (<a href="https://redirect.github.com/jdx/mise-action/issues/409">#409</a>) by <a href="https://github.com/jdx"><code>@jdx</code></a> in <a href="https://redirect.github.com/jdx/mise-action/pull/409">#409</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jdx/mise-action/commit/dba19683ed58901619b14f395a24841710cb4925"><code>dba1968</code></a> chore: release v4.1.0 (<a href="https://redirect.github.com/jdx/mise-action/issues/490">#490</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/f91a09d9ef7e5b4ce6e5df3bd166d39901d95f80"><code>f91a09d</code></a> fix(ci): resolve zizmor findings (<a href="https://redirect.github.com/jdx/mise-action/issues/503">#503</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/a9d72a2ac56857d83f06a89da8b45386a519541e"><code>a9d72a2</code></a> chore(deps): update github/codeql-action action to v4.36.0 (<a href="https://redirect.github.com/jdx/mise-action/issues/500">#500</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/1f56d953238b8d47fa71c5f59d86a41a4f1f9b30"><code>1f56d95</code></a> chore(deps): update dependency <code>@actions/cache</code> to v6.0.1 (<a href="https://redirect.github.com/jdx/mise-action/issues/497">#497</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/e47eed9a5f11d7b1c4e4a27e094fdee05dfb6db3"><code>e47eed9</code></a> chore: update aube tool version (<a href="https://redirect.github.com/jdx/mise-action/issues/501">#501</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/69c24ed9206bc145dcdd8fa072fc6031ceb14c8d"><code>69c24ed</code></a> chore(deps): update dependency aube to v1.15.0 (<a href="https://redirect.github.com/jdx/mise-action/issues/498">#498</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/76f84078a8bb3d593bdc3ba28edbfeea1882fcae"><code>76f8407</code></a> chore(deps): update zizmorcore/zizmor-action action to v0.5.4 (<a href="https://redirect.github.com/jdx/mise-action/issues/488">#488</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/4a84c91c82fa1e7d0a1ea17ff19af79ab26643a1"><code>4a84c91</code></a> chore(deps): update dependency eslint to v10.4.0 (<a href="https://redirect.github.com/jdx/mise-action/issues/492">#492</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/4d5418b7bac561ef4739f99987686d4b21475743"><code>4d5418b</code></a> chore(deps): update dependency <code>@types/node</code> to v24.12.4 (<a href="https://redirect.github.com/jdx/mise-action/issues/485">#485</a>)</li> <li><a href="https://github.com/jdx/mise-action/commit/e6760994f7823b9dc6217632e727fb1ff323c0c0"><code>e676099</code></a> chore(deps): update dependency typescript-eslint to v8.59.3 (<a href="https://redirect.github.com/jdx/mise-action/issues/487">#487</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jdx/mise-action/compare/1648a7812b9aeae629881980618f079932869151...dba19683ed58901619b14f395a24841710cb4925">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 4.36.1 to 4.36.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.36.2</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>4.35.2 - 15 Apr 2026</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a> from github/update-v4.36.2-dcb947ce1</li> <li><a href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a> Add additional changelog notes</li> <li><a href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a> Update changelog for v4.36.2</li> <li><a href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a> from github/update-bundle/codeql-bundle-v2.25.6</li> <li><a href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a> Update default bundle to codeql-bundle-v2.25.6</li> <li><a href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a> from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li> <li><a href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a> from github/robertbrignull/waitForProcessing_backoff</li> <li><a href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a> from github/henrymercer/cache-cli-version-info</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Charlie Egan <charlie_egan@apple.com>	2026-06-17 11:37:20 +01:00
dependabot[bot]	1f9005b77a	build(deps): bump hono from 4.12.23 to 4.12.25 in /e2e/api/compile/prisma (#8794 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.25</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>CORS Middleware reflects any Origin with credentials when <code>origin</code> defaults to the wildcard</h3> <p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting the request <code>Origin</code> and sending <code>Access-Control-Allow-Credentials: true</code> when <code>credentials: true</code> is set without an explicit <code>origin</code>, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p> <h3>Body Limit Middleware can be bypassed on AWS Lambda by understating <code>Content-Length</code></h3> <p>Affects: <code>hono/body-limit</code> on AWS Lambda (<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the request being built with the client-declared <code>Content-Length</code> while the body is delivered fully buffered, where a client could declare a small <code>Content-Length</code> with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2</p> <h3>Path traversal in <code>serve-static</code> on Windows via encoded backslash (<code>%5C</code>)</h3> <p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (<code>%5C</code>) decoded to <code>\</code> was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44</p> <h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers into one value, dropping cookies on ALB single-header and Lattice</h3> <p>Affects: <code>hono/aws-lambda</code>. Fixes multiple <code>Set-Cookie</code> response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p> <h3>Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest</h3> <p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as <code>X-Forwarded-For</code> reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p</p> <h2>v4.12.24</h2> <h2>What's Changed</h2> <ul> <li>docs(contribution): simplifyAI Usage Policy by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li> <li>chore: remove <code>@types/glob</code> by <a href="https://github.com/rtritto"><code>@rtritto</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li> <li>fix(bearer-auth): mention verifyToken in missing-options error message by <a href="https://github.com/tan7vir"><code>@tan7vir</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li> <li>refactor(language): Test/improve tests on languages middleware by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li> <li>fix(utils/ipaddr): expand "::" to eight zero groups by <a href="https://github.com/youcefzemmar"><code>@youcefzemmar</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li> <li>fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by <a href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@Mohammad-Faiz-Cloud-Engineer</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li> <li>refactor(timing): Test/add test for middleware timing by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li> <li>fix(utils/ipaddr): render the unspecified address binary as "::" by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a> 4.12.25</li> <li><a href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/74c2cf8ef4f5cc29a876380df1ba230ff7128b3f"><code>74c2cf8</code></a> test(aws-lambda): update integration tests (<a href="https://redirect.github.com/honojs/hono/issues/5012">#5012</a>)</li> <li><a href="https://github.com/honojs/hono/commit/7ae7cbae5d0ed8a40e8b9cc353e13175b9d7e3e1"><code>7ae7cba</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/1b1384815485f9d6590c6966e23a06fd07166cb7"><code>1b13848</code></a> chore(ci): bump codecov-action to v7.0.0 (<a href="https://redirect.github.com/honojs/hono/issues/5011">#5011</a>)</li> <li><a href="https://github.com/honojs/hono/commit/5fdde5ab5a7d7c89eba4d1ceab76f4a7c011cd3b"><code>5fdde5a</code></a> 4.12.24</li> <li><a href="https://github.com/honojs/hono/commit/c78932d745cdf6284ae131a156479ac930da0262"><code>c78932d</code></a> fix(utils/ipaddr): render the unspecified address binary as "::" (<a href="https://redirect.github.com/honojs/hono/issues/4998">#4998</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.25">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.23&new-version=4.12.25)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:33:51 -05:00
dependabot[bot]	369db1718b	build(deps): bump dompurify from 3.4.0 to 3.4.10 in /docs (#8789 ) Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.0 to 3.4.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.10</h2> <ul> <li>Refactored codebase for clarity: extracted the public type declarations into <code>types.ts</code></li> <li>Decomposed the three largest sanitizer functions into focused helpers</li> <li>Removed duplicated defaults and dead branches, consolidated <code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li> <li>Improved per-node performance by hoisting the mXSS probe regexes and testing <code>textContent</code> before <code>innerHTML</code></li> <li>Added a deterministic micro-benchmark harness (<code>npm run bench</code>) with a <code>--compare</code> mode</li> <li>Reduced CI cost by running the full three-engine browser suite once per PR</li> <li>Refreshed the <code>demos/</code> folder so every demo runs again, and added a SVG-via-<code><img></code> demo</li> <li>Documented the bench and <code>test:happydom</code> scripts in the README</li> <li>Completed the Attack Classes & Bypass History wiki page</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.9</h2> <ul> <li>Further improved the handling of Trusted Types config options, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Further improved the handling of <code>IN_PLACE</code> sanitization, thanks <a href="https://github.com/mozfreddyb"><code>@mozfreddyb</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types related usage</li> <li>Bumped several dependencies where possible</li> <li>Updated README and wiki with more accurate documentation & attack samples</li> </ul> <h2>DOMPurify 3.4.8</h2> <ul> <li>Cleaned up the repository root, renamed some and removed unneeded files</li> <li>Fixed an issue with handling of Trusted Types policies, thanks <a href="https://github.com/fulstadev"><code>@fulstadev</code></a></li> <li>Fixed the node iterator for better template scrubbing, thanks <a href="https://github.com/IamLeandrooooo"><code>@IamLeandrooooo</code></a></li> <li>Included formerly missing LICENSE-MPL in published npm package, thanks <a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a></li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.7</h2> <ul> <li>Hardened the handling of Shadow Roots when using <code>IN_PLACE</code>, thanks <a href="https://github.com/GameZoneHacker"><code>@GameZoneHacker</code></a></li> <li>Removed a problem leading to permanent hook pollution, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Refactored the test suite and expanded test coverage significantly</li> </ul> <h2>DOMPurify 3.4.6</h2> <ul> <li>Fixed several issues with DOM Clobbering in <code>IN_PLACE</code> mode, thanks <a href="https://github.com/offset"><code>@offset</code></a> & <a href="https://github.com/Bankde"><code>@Bankde</code></a></li> <li>Hardened the checks for cross-realm <code>IN_PLACE</code> and Shadow DOM sanitization, thanks <a href="https://github.com/offset"><code>@offset</code></a> & <a href="https://github.com/Bankde"><code>@Bankde</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and general DOM Clobbering attacks</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.5</h2> <ul> <li>Fixed a bypass caused by the new HTML element <code>selectedcontent</code> added in 3.4.4, thanks <a href="https://github.com/KabirAcharya"><code>@KabirAcharya</code></a></li> </ul> <p><strong>Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.</strong></p> <h2>DOMPurify 3.4.4</h2> <ul> <li>Added the <code>selectedcontent</code> element to default allow-list, thanks <a href="https://github.com/lukewarlow"><code>@lukewarlow</code></a></li> <li>Added the <code>command</code> and <code>commandfor</code> attributes to default allowed-list, thanks <a href="https://github.com/lukewarlow"><code>@lukewarlow</code></a></li> <li>Added better template scrubbing for <code>IN_PLACE</code> operations, thanks <a href="https://github.com/DEMON1A"><code>@DEMON1A</code></a></li> <li>Added stronger checks for cross-realm windows, thanks <a href="https://github.com/DEMON1A"><code>@DEMON1A</code></a> & <a href="https://github.com/fg0x0"><code>@fg0x0</code></a></li> <li>Updated demo website and made sure it uses the latest from main</li> <li>Updated existing workflows, fuzzer, dependabot, etc., added more tests</li> <li>Bumped several dependencies where possible</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a> release: 3.4.10 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a> release: 3.4.9 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bcdd8285412dc9c4c149652aed2d712e790d6ccf"><code>bcdd828</code></a> release: 3.4.8 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1439">#1439</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"><code>ca30f07</code></a> release: 3.4.7 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1414">#1414</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae"><code>bb7739e</code></a> release: 3.4.6 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1394">#1394</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea"><code>011b0c7</code></a> release: 3.4.5 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1382">#1382</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5817ad969c15e67dfcd6cb37248d6e9c1553e7c3"><code>5817ad9</code></a> release: 3.4.4 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1374">#1374</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/520edb0371a9638f9b51f1798051299a250c686b"><code>520edb0</code></a> release: 3.4.3 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1352">#1352</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6f67fd396a7b8c64294343999fe607ca1f5299c0"><code>6f67fd3</code></a> Sync/3.4.2 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1322">#1322</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5b0cdbbf52331e854c0a2de875b1a3790ecec2b8"><code>5b0cdbb</code></a> chore: merge main into 3.x for 3.4.1 release (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1301">#1301</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.10">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.0&new-version=3.4.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:33:31 -05:00
dependabot[bot]	ed23e2b0b2	build(deps): bump ws in /docs (#8788 ) Bumps and [ws](https://github.com/websockets/ws). These dependencies needed to be updated together. Updates `ws` from 7.5.10 to 7.5.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>7.5.11</h2> <h1>Bug fixes</h1> <ul> <li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"><code>fd36cd8</code></a> [dist] 7.5.11</li> <li><a href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52"><code>e14c458</code></a> [security] Limit retained message parts</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/7.5.10...7.5.11">compare view</a></li> </ul> </details> <br /> Updates `ws` from 8.18.3 to 8.21.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>7.5.11</h2> <h1>Bug fixes</h1> <ul> <li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"><code>fd36cd8</code></a> [dist] 7.5.11</li> <li><a href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52"><code>e14c458</code></a> [security] Limit retained message parts</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/7.5.10...7.5.11">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:13:21 -05:00
dependabot[bot]	186d4868cf	build(deps): bump launch-editor from 2.11.1 to 2.14.1 in /docs (#8790 ) Bumps [launch-editor](https://github.com/vitejs/launch-editor) from 2.11.1 to 2.14.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/launch-editor/commit/3f97c648307a70e7c930ba63f040e6ba8e72bc16"><code>3f97c64</code></a> v2.14.1</li> <li><a href="https://github.com/vitejs/launch-editor/commit/0cc9550e05c35224a1f61914b9731723f78c06a7"><code>0cc9550</code></a> fix: reject UNC paths (<a href="https://redirect.github.com/vitejs/launch-editor/issues/138">#138</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/afd1ab907769adbb0fb76b564551f3cd24822ea6"><code>afd1ab9</code></a> ci: run tests on mac and windows (<a href="https://redirect.github.com/vitejs/launch-editor/issues/136">#136</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/0bfa328e4d2a70d3accd86645efde43a5a8fd931"><code>0bfa328</code></a> test: add some tests for launch-editor package (<a href="https://redirect.github.com/vitejs/launch-editor/issues/135">#135</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/1b006ae00061e83628c884770df4869bac481ed3"><code>1b006ae</code></a> chore: add README (<a href="https://redirect.github.com/vitejs/launch-editor/issues/134">#134</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/383ef26fceaaab75e4f122bf833a8d457e187272"><code>383ef26</code></a> v2.14.0</li> <li><a href="https://github.com/vitejs/launch-editor/commit/6277209316b28bd76b057a97fcdfa42da5adc181"><code>6277209</code></a> ci: harden publish settings</li> <li><a href="https://github.com/vitejs/launch-editor/commit/520b2f787af1bbe3d2333d952547fc90f2c01bb3"><code>520b2f7</code></a> fix(deps): update all non-major dependencies (<a href="https://redirect.github.com/vitejs/launch-editor/issues/129">#129</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/475ac662aeaa40eebe319f76acf7bd7ff2aba5d5"><code>475ac66</code></a> chore(deps): update dependency lint-staged to v17 (<a href="https://redirect.github.com/vitejs/launch-editor/issues/130">#130</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/247bf1dfe2c75efb50f507d33c2c5a3cbf4e20d0"><code>247bf1d</code></a> chore(deps): update dependency yorkie to v2 (<a href="https://redirect.github.com/vitejs/launch-editor/issues/131">#131</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/launch-editor/compare/v2.11.1...v2.14.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for launch-editor since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=launch-editor&package-manager=npm_and_yarn&previous-version=2.11.1&new-version=2.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 15:51:53 -05:00
Sebastian Spaink	d1780dbe65	format: Fix dropped with-clause after comment in object value (#8785 ) resolve: https://github.com/open-policy-agent/opa/issues/8765 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>	2026-06-16 15:51:27 -05:00
Sebastiaan van Stijn	4f3e238cad	chore: tidy go.mod to remove untagged versions (#8791 ) - relates to / introduced in https://github.com/open-policy-agent/opa/pull/7887 The github.com/davecgh/go-spew and github.com/pmezard/go-difflib modules are either archived, or dormant, and won't receive new versions. Commit `4ab2ac0c61` updated them to untagged versions (main / master branch); likely through some indirect dependency. Tidy go.mod to revert those updates and use their latest tagged versions. Changes after their last release do not containe code- changes, only changes in metadata and CI config. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2026-06-16 13:46:37 +02:00
Charlie Egan	e7d0c0e3d1	docs: Add we/our/us check to spell check (#8787 ) Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-16 10:32:55 +00:00
Charlie Egan	7b004efe4a	docs: Update documentation to be more consistent and sound more like reference docs (#8786 ) There are a lot of edits here. I am trying to make the docs more consistent between pages and sections, each commit is one category of change so it might be easier to go through commit by commit to see all similar changes in the same place. The main goal was to make the language sound more like reference docs than product marketing, i.e. a little more formal with fewer filler words in places. Rephrase to avoid informal 'we/our' guidance, formatting updates for things like admonitions. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-16 09:44:47 +00:00
Charlie Egan	88c01e659c	runtime: Restore goautomaxprocs, add automemlimit (#8784 ) This PR reverts the change in #8696 where automaxprocs was removed. This meant the go language default of 2 procs vs 1 was used. In some memory constrained deployments of OPA, this caused OOM issues where the server used more memory than before with 2 processes running. This PR restores the automaxprocs dependency and this behaviour. This PR also follows other data-heavy CNCF projects in pairing this with automemlimit to automate the setting of GOMEMLIMIT based on the cgroup data too. This makes no change for users manually setting these, but hopefully will provide some sensible defaults that work well for most cases, and better than the Go defaults in low resource deployments. <details> <summary>Other projects</summary> * https://github.com/prometheus/prometheus/blob/2ad3a871701531d1485f678acb7523cd0aa31789/go.mod#L11 * https://github.com/istio/istio/blob/4985ae369245dcc91bc107a0c47ea41ded0c1a12/go.mod#L8 * https://github.com/grafana/alloy/blob/e11d0f03e2b2e727161fb2169cade54698e17bd8/go.mod#L19 * https://github.com/thanos-io/thanos/blob/main/go.mod#L9 * https://github.com/kubernetes/kube-state-metrics/blob/main/go.mod#L6 * https://github.com/authzed/spicedb/blob/main/go.mod#L22 </details> --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-15 13:54:43 +00:00
pkuzco	c07265b1cd	website: add ossrisk to ecosystem (#8780 ) ## What Adds [ossrisk](https://github.com/depkeep/ossrisk) to the OPA ecosystem page. ossrisk is a CLI and GitHub Action that scans npm and PyPI dependency trees for supply-chain and long-term viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment signals, typosquatting, license compliance, and maintainer-takeover patterns. Beyond a `--fail-on <severity>` threshold, ossrisk integrates with OPA via the `opa` CLI: the scan result JSON is passed as `input` to `opa eval`, and policies in `package ossrisk` add messages to a `deny` set to gate the build. This enables cross-signal rules a threshold alone cannot express — for example blocking packages with install scripts published by a brand-new maintainer (the event-stream takeover pattern). The JSON output also pipes cleanly into conftest. ## Changes - `docs/src/data/ecosystem/entries/ossrisk.md` — entry with `category: security`, `layer: cicd`, `type: poweredbyopa` - `docs/static/img/ecosystem-entry-logos/ossrisk.svg` — logo --------- Signed-off-by: glimm-no <admin@glimm.no> Signed-off-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: glimm-no <admin@glimm.no> Co-authored-by: Charlie Egan <git@charlieegan3.com>	2026-06-15 14:00:35 +01:00
Charlie Egan	c2864a1af3	Add SDK references for evaluating IR plans Moved Intermediate Representation section earlier in the integration guide and documented Swift-OPA and java-opa-sdk for direct IR plan evaluation in applications. Added cross-links between integration.md and ir.md documentation. Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-15 13:27:04 +02:00
Johan Fylling	3b8e2d595b	ast: Fix PE regression for `future.keywords.not` negation inside `every` (#8781 ) Fixing regression where `future.keywords.not` negated expressions nested inside an `every` body would fail to plug variables for partial evaluation. E.g. ```rego package test import future.keywords.not p if { x = input.foo every y in [1, 2] { not f(x, y) } } ``` would fail to plug `x`: ```rego every __local0__1, __local1__1 in [1, 2] { not data.test.f(x, __local1__) } x1 = input.foo ``` instead of the expected: ```rego every __local0__1, __local1__1 in [1, 2] { not data.test.f(input.foo, __local1__1) } x1 = input.foo ``` Signed-off-by: Johan Fylling <johan.dev@fylling.se>	2026-06-15 08:05:39 +02:00
dependabot[bot]	966990ccbf	build(deps): bump the go-opentelemetry-io group across 1 directory with 11 updates (#8769 ) Bumps the go-opentelemetry-io group with 7 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [go.opentelemetry.io/contrib/bridges/prometheus](https://github.com/open-telemetry/opentelemetry-go-contrib) \| `0.68.0` \| `0.69.0` \| \| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) \| `0.68.0` \| `0.69.0` \| \| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) \| `1.43.0` \| `1.44.0` \| \| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp](https://github.com/open-telemetry/opentelemetry-go) \| `1.43.0` \| `1.44.0` \| \| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) \| `1.43.0` \| `1.44.0` \| \| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) \| `1.43.0` \| `1.44.0` \| \| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) \| `1.43.0` \| `1.44.0` \| Updates `go.opentelemetry.io/contrib/bridges/prometheus` from 0.68.0 to 0.69.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/bridges/prometheus's releases</a>.</em></p> <blockquote> <h2>v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the "error" field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>otelconf: validate encoding configuration for OTLP HTTP exporters by <a href="https://github.com/sonalgaud12"><code>@sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8772">open-telemetry/opentelemetry-go-contrib#8772</a></li> <li>fix(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.99.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8780">open-telemetry/opentelemetry-go-contrib#8780</a></li> <li>chore(deps): update prom/prometheus docker tag to v3.11.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8779">open-telemetry/opentelemetry-go-contrib#8779</a></li> <li>otellogrus: Set error field as <code>record.SetErr</code> by <a href="https://github.com/sonalgaud12"><code>@sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8778">open-telemetry/opentelemetry-go-contrib#8778</a></li> <li>chore(deps): update module golang.org/x/sys to v0.43.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8783">open-telemetry/opentelemetry-go-contrib#8783</a></li> <li>chore(deps): update golang.org/x/telemetry digest to 93c7c8a by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8786">open-telemetry/opentelemetry-go-contrib#8786</a></li> <li>chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8787">open-telemetry/opentelemetry-go-contrib#8787</a></li> <li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8788">open-telemetry/opentelemetry-go-contrib#8788</a></li> <li>chore(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8791">open-telemetry/opentelemetry-go-contrib#8791</a></li> <li>chore(deps): update actions/github-script action to v9 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8795">open-telemetry/opentelemetry-go-contrib#8795</a></li> <li>fix(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8794">open-telemetry/opentelemetry-go-contrib#8794</a></li> <li>otelzap: set error field as record.SetErr by <a href="https://github.com/iblancasa"><code>@iblancasa</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8719">open-telemetry/opentelemetry-go-contrib#8719</a></li> <li>fix(deps): update golang.org/x to 746e56f by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8796">open-telemetry/opentelemetry-go-contrib#8796</a></li> <li>chore(deps): update module golang.org/x/arch to v0.26.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8798">open-telemetry/opentelemetry-go-contrib#8798</a></li> <li>Check if otelgrpc metrics are enabled by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8792">open-telemetry/opentelemetry-go-contrib#8792</a></li> <li>chore(deps): update actions/upload-artifact action to v7.0.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8800">open-telemetry/opentelemetry-go-contrib#8800</a></li> <li>Check instrument enabled in deprecatedruntime by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8793">open-telemetry/opentelemetry-go-contrib#8793</a></li> <li>chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8804">open-telemetry/opentelemetry-go-contrib#8804</a></li> <li>chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8802">open-telemetry/opentelemetry-go-contrib#8802</a></li> <li>chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8803">open-telemetry/opentelemetry-go-contrib#8803</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/bridges/prometheus's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] - 2026-05-28</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the "error" field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/03b2bcdb54b3dde73c9ff91ae216aec262f6c8f5"><code>03b2bcd</code></a> Release v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9033">#9033</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/80c46d4037d5991ce324216a52cf7e8d7f2d81fa"><code>80c46d4</code></a> chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9034">#9034</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/51f292197d33b84a21b3c70ae21cb185a2570d5e"><code>51f2921</code></a> fix(deps): update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9026">#9026</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/db82162f1b642bb6dca7fa5be48045315bb466d6"><code>db82162</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9031">#9031</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5a3e533d8cd4045128e61a966f6dad58964a78ea"><code>5a3e533</code></a> fix(deps): update module github.com/aws/smithy-go to v1.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9032">#9032</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c67843c753a924faef17bc4aa63c138aa9472477"><code>c67843c</code></a> otelhttp: Remove custom wrapper after handling request (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c0a41352283151ab6655e88120e4ff4f0a917a2e"><code>c0a4135</code></a> docs(otelhttptrace): add performance guidance for WithoutSubSpans (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8785">#8785</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/a51a86790e1f4df231a70bb5fecc72b95d3c1bf0"><code>a51a867</code></a> otelconf: implement cardinality_limits support in PeriodicMetricReader (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/dead6e50fc0b5b3dc4aea288df207953dae5afe7"><code>dead6e5</code></a> chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8994">#8994</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/979ce1857524394d0884fd7c491722c5bcb43d50"><code>979ce18</code></a> chore(deps): update module github.com/jgautheron/goconst to v1.10.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9030">#9030</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0">compare view</a></li> </ul> </details> <br /> Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.68.0 to 0.69.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's releases</a>.</em></p> <blockquote> <h2>v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the "error" field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>otelconf: validate encoding configuration for OTLP HTTP exporters by <a href="https://github.com/sonalgaud12"><code>@sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8772">open-telemetry/opentelemetry-go-contrib#8772</a></li> <li>fix(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.99.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8780">open-telemetry/opentelemetry-go-contrib#8780</a></li> <li>chore(deps): update prom/prometheus docker tag to v3.11.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8779">open-telemetry/opentelemetry-go-contrib#8779</a></li> <li>otellogrus: Set error field as <code>record.SetErr</code> by <a href="https://github.com/sonalgaud12"><code>@sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8778">open-telemetry/opentelemetry-go-contrib#8778</a></li> <li>chore(deps): update module golang.org/x/sys to v0.43.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8783">open-telemetry/opentelemetry-go-contrib#8783</a></li> <li>chore(deps): update golang.org/x/telemetry digest to 93c7c8a by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8786">open-telemetry/opentelemetry-go-contrib#8786</a></li> <li>chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8787">open-telemetry/opentelemetry-go-contrib#8787</a></li> <li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8788">open-telemetry/opentelemetry-go-contrib#8788</a></li> <li>chore(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8791">open-telemetry/opentelemetry-go-contrib#8791</a></li> <li>chore(deps): update actions/github-script action to v9 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8795">open-telemetry/opentelemetry-go-contrib#8795</a></li> <li>fix(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8794">open-telemetry/opentelemetry-go-contrib#8794</a></li> <li>otelzap: set error field as record.SetErr by <a href="https://github.com/iblancasa"><code>@iblancasa</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8719">open-telemetry/opentelemetry-go-contrib#8719</a></li> <li>fix(deps): update golang.org/x to 746e56f by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8796">open-telemetry/opentelemetry-go-contrib#8796</a></li> <li>chore(deps): update module golang.org/x/arch to v0.26.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8798">open-telemetry/opentelemetry-go-contrib#8798</a></li> <li>Check if otelgrpc metrics are enabled by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8792">open-telemetry/opentelemetry-go-contrib#8792</a></li> <li>chore(deps): update actions/upload-artifact action to v7.0.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8800">open-telemetry/opentelemetry-go-contrib#8800</a></li> <li>Check instrument enabled in deprecatedruntime by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8793">open-telemetry/opentelemetry-go-contrib#8793</a></li> <li>chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8804">open-telemetry/opentelemetry-go-contrib#8804</a></li> <li>chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8802">open-telemetry/opentelemetry-go-contrib#8802</a></li> <li>chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8803">open-telemetry/opentelemetry-go-contrib#8803</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] - 2026-05-28</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the "error" field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/03b2bcdb54b3dde73c9ff91ae216aec262f6c8f5"><code>03b2bcd</code></a> Release v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9033">#9033</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/80c46d4037d5991ce324216a52cf7e8d7f2d81fa"><code>80c46d4</code></a> chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9034">#9034</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/51f292197d33b84a21b3c70ae21cb185a2570d5e"><code>51f2921</code></a> fix(deps): update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9026">#9026</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/db82162f1b642bb6dca7fa5be48045315bb466d6"><code>db82162</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9031">#9031</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5a3e533d8cd4045128e61a966f6dad58964a78ea"><code>5a3e533</code></a> fix(deps): update module github.com/aws/smithy-go to v1.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9032">#9032</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c67843c753a924faef17bc4aa63c138aa9472477"><code>c67843c</code></a> otelhttp: Remove custom wrapper after handling request (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c0a41352283151ab6655e88120e4ff4f0a917a2e"><code>c0a4135</code></a> docs(otelhttptrace): add performance guidance for WithoutSubSpans (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8785">#8785</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/a51a86790e1f4df231a70bb5fecc72b95d3c1bf0"><code>a51a867</code></a> otelconf: implement cardinality_limits support in PeriodicMetricReader (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/dead6e50fc0b5b3dc4aea288df207953dae5afe7"><code>dead6e5</code></a> chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8994">#8994</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/979ce1857524394d0884fd7c491722c5bcb43d50"><code>979ce18</code></a> chore(deps): update module github.com/jgautheron/goconst to v1.10.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9030">#9030</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0">compare view</a></li> </ul> </details> <br /> Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27</h2> <h3>Added</h3> <ul> <li>Add <code>ByteSlice</code> and <code>ByteSliceValue</code> functions for new <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7948">#7948</a>)</li> <li>Apply attribute value limit to the <code>KindBytes</code> attribute type in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Apply attribute value limit to the <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Add <code>String</code> method for <code>Value</code> type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8142">#8142</a>)</li> <li>Add <code>Slice</code> and <code>SliceValue</code> functions for new <code>SLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8166">#8166</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Apply <code>AttributeValueLengthLimit</code> to <code>attribute.SLICE</code> type attribute values in <code>go.opentelemetry.io/otel/sdk/trace</code>, recursively truncating contained string values. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8217">#8217</a>)</li> <li>Add <code>Error</code> field on <code>Record</code> type in <code>go.opentelemetry.io/otel/log/logtest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8148">#8148</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>Settable</code> to <code>go.opentelemetry.io/otel/metric/x</code> to allow reusing attribute options. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8178">#8178</a>)</li> <li>Add experimental support for splitting metric data across multiple batches in <code>go.opentelemetry.io/otel/sdk/metric</code>. Set <code>OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size></code> to enable for all periodic readers. See <code>go.opentelemetry.io/otel/sdk/metric/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8071">#8071</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8192">#8192</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8194">#8194</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/stdout/stdoutlog/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8263">#8263</a>)</li> <li>Add <code>WithDefaultAttributes</code> to <code>go.opentelemetry.io/otel/metric/x</code> to support setting default attributes on instruments. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8135">#8135</a>)</li> <li>Add <code>go.opentelemetry.io/otel/semconv/v1.41.0</code> package. The package contains semantic conventions from the <code>v1.41.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.41.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.40.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8324">#8324</a>)</li> <li>Add Observable variants of instruments to <code>go.opentelemetry.io/otel/semconv/v1.41.0</code> package. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8350">#8350</a>)</li> <li>Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in <code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8002">#8002</a>)</li> </ul> <h3>Changed</h3> <ul> <li>⚠️ <strong>Breaking Change:</strong> <code>go.opentelemetry.io/otel/sdk/metric</code> now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing <code>attribute.Bool("otel.metric.overflow", true)</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b62d92831b2dd142f5a0cc89c828270274196877"><code>b62d928</code></a> Release 1.44.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8376">#8376</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/94132a0a729e94c5aa6e9e1ce7640c0f802dcfea"><code>94132a0</code></a> chore(deps): update golang.org/x/telemetry digest to 5997936 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8379">#8379</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6fdcf82adfebc3becfb5d357957546d6d7258469"><code>6fdcf82</code></a> feat: add self-observability metrics to otlpmetricgrpc metric exporters (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8192">#8192</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/761bbfc2f4ae002f4a54f8c57c12b8a58135a741"><code>761bbfc</code></a> fix(deps): update golang.org/x (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8377">#8377</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/3a91dc62d3852313bab40ff151bb3e11fae1745e"><code>3a91dc6</code></a> fix(deps): update googleapis to 3dc84a4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8375">#8375</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f593185679130f56e14bed3c337fa7f8f60756b1"><code>f593185</code></a> exporters/otlp: default max request size to 64 MiB (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8365">#8365</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f02feacf8652b69c051851cfa2945d2ed5f0d568"><code>f02feac</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/36c2f1bfd1a6a789dc575f8886399093d7600586"><code>36c2f1b</code></a> semconvkit: add invariant test for histogram-exclusion rule (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8370">#8370</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/d0b6cbdff5346557923fd05bd3f5f34df002aeee"><code>d0b6cbd</code></a> sdk/metric: document unit-sensitivity of DefaultAggregationSelector (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8224">#8224</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9a68034bd45c6f24c481d9f9c87ebbee0a61482f"><code>9a68034</code></a> add self observability for stdout exporter (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8263">#8263</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0">compare view</a></li> </ul> </details> <br /> Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.43.0 to 1.44.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27</h2> <h3>Added</h3> <ul> <li>Add <code>ByteSlice</code> and <code>ByteSliceValue</code> functions for new <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7948">#7948</a>)</li> <li>Apply attribute value limit to the <code>KindBytes</code> attribute type in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Apply attribute value limit to the <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Add <code>String</code> method for <code>Value</code> type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8142">#8142</a>)</li> <li>Add <code>Slice</code> and <code>SliceValue</code> functions for new <code>SLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8166">#8166</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Support <code>SLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8216">#8216</a>)</li> <li>Apply <code>AttributeValueLengthLimit</code> to <code>attribute.SLICE</code> type attribute values in <code>go.opentelemetry.io/otel/sdk/trace</code>, recursively truncating contained string values. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8217">#8217</a>)</li> <li>Add <code>Error</code> field on <code>Record</code> type in <code>go.opentelemetry.io/otel/log/logtest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8148">#8148</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>WithMaxRequestSize</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8157">#8157</a>)</li> <li>Add <code>Settable</code> to <code>go.opentelemetry.io/otel/metric/x</code> to allow reusing attribute options. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8178">#8178</a>)</li> <li>Add experimental support for splitting metric data across multiple batches in <code>go.opentelemetry.io/otel/sdk/metric</code>. Set <code>OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size></code> to enable for all periodic readers. See <code>go.opentelemetry.io/otel/sdk/metric/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8071">#8071</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8192">#8192</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8194">#8194</a>)</li> <li>Add experimental self-observability metrics in <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>. Enable with <code>OTEL_GO_X_SELF_OBSERVABILITY=true</code> environment variable. See <code>go.opentelemetry.io/otel/stdout/stdoutlog/internal/x</code> for feature documentation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8263">#8263</a>)</li> <li>Add <code>WithDefaultAttributes</code> to <code>go.opentelemetry.io/otel/metric/x</code> to support setting default attributes on instruments. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8135">#8135</a>)</li> <li>Add <code>go.opentelemetry.io/otel/semconv/v1.41.0</code> package. The package contains semantic conventions from the <code>v1.41.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.41.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.40.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8324">#8324</a>)</li> <li>Add Observable variants of instruments to <code>go.opentelemetry.io/otel/semconv/v1.41.0</code> package. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8350">#8350</a>)</li> <li>Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in <code>go.opentelemetry.io/otel/semconv/v1.41.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8002">#8002</a>)</li> </ul> <h3>Changed</h3> <ul> <li>⚠️ <strong>Breaking Change:</strong> <code>go.opentelemetry.io/otel/sdk/metric</code> now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing <code>attribute.Bool("otel.metric.overflow", true)</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b62d92831b2dd142f5a0cc89c828270274196877"><code>b62d928</code></a> Release 1.44.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8376">#8376</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/94132a0a729e94c5aa6e9e1ce7640c0f802dcfea"><code>94132a0</code></a> chore(deps): update golang.org/x/telemetry digest to 5997936 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8379">#8379</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6fdcf82adfebc3becfb5d357957546d6d7258469"><code>6fdcf82</code></a> feat: add self-observability metrics to otlpmetricgrpc metric exporters (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8192">#8192</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/761bbfc2f4ae002f4a54f8c57c12b8a58135a741"><code>761bbfc</code></a> fix(deps): update golang.org/x (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8377">#8377</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/3a91dc62d3852313bab40ff151bb3e11fae1745e"><code>3a91dc6</code></a> fix(deps): update googleapis to 3dc84a4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8375">#8375</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f593185679130f56e14bed3c337fa7f8f60756b1"><code>f593185</code></a> exporters/otlp: default max request size to 64 MiB (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8365">#8365</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f02feacf8652b69c051851cfa2945d2ed5f0d568"><code>f02feac</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/36c2f1bfd1a6a789dc575f8886399093d7600586"><code>36c2f1b</code></a> semconvkit: add invariant test for histogram-exclusion rule (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8370">#8370</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/d0b6cbdff5346557923fd05bd3f5f34df002aeee"><code>d0b6cbd</code></a> sdk/metric: document unit-sensitivity of DefaultAggregationSelector (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8224">#8224</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9a68034bd45c6f24c481d9f9c87ebbee0a61482f"><code>9a68034</code></a> add self observability for stdout exporter (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8263">#8263</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0">compare view</a></li> </ul> </details> <br /> Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.43.0 to 1.44.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27</h2> <h3>Added</h3> <ul> <li>Add <code>ByteSlice</code> and <code>ByteSliceValue</code> functions for new <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7948">#7948</a>)</li> <li>Apply attribute value limit to the <code>KindBytes</code> attribute type in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Apply attribute value limit to the <code>BYTESLICE</code> attribute type in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7990">#7990</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8153">#8153</a>)</li> <li>Support <code>BYTESLICE</code> attributes in <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.gith... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-06-12 11:22:59 +02:00
Charlie Egan	34167e2d86	docs: Add notes about use of GOMEMLIMIT (#8771 ) Documents issue in memory constrained environments following the change in typical heap size following the change from 1 to 2 max procs in https://github.com/open-policy-agent/opa/pull/8696 --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-11 14:31:12 +00:00
Charlie Egan	ffd7d46ee4	website: Various updates to node and website deps (#8768 ) Replaces https://github.com/open-policy-agent/opa/pull/8762 Original dependabot updates: Bumps the website group in /docs with 9 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@floating-ui/react](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react) \| `0.27.18` \| `0.27.19` \| \| [@iconify/react](https://github.com/iconify/iconify/tree/HEAD/components/react) \| `6.0.0` \| `6.0.2` \| \| [@mermaid-js/layout-elk](https://github.com/mermaid-js/mermaid) \| `0.1.9` \| `0.2.1` \| \| [eslint](https://github.com/eslint/eslint) \| `9.39.2` \| `10.4.1` \| \| [glob](https://github.com/isaacs/node-glob) \| `11.1.0` \| `13.0.6` \| \| [js-yaml](https://github.com/nodeca/js-yaml) \| `4.1.1` \| `4.2.0` \| \| [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) \| `0.21.0` \| `0.22.1` \| \| [recharts](https://github.com/recharts/recharts) \| `3.7.0` \| `3.8.1` \| \| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) \| `2.10.20` \| `2.10.33` \| I have also made some updates to use node 24. --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-11 13:23:17 +00:00
Charlie Egan	142279338d	cover: Track inline rule head in post trace walk (#8767 ) This correct the case where `foo if false` is 'covered' when ```rego foo if { false } ``` is not, as outlined in https://github.com/open-policy-agent/opa/issues/6531. Fixes https://github.com/open-policy-agent/opa/issues/6531 Caveats: - This will reduce test coverage for inline variant, but it'll be the same as the multiline one. This seems acceptable to me since we hope to address coverage stat reporting in other ways, this is more about addressing inconsistencies. Now a row can appear in covered and not covered, but that is actually the reality in some cases and the direction of travel is to do range based reporting of coverage. - WalkRules has been updated, WalkExprs will need to be updated to address the same issue in `true; true; false; true;` case where expressions also create partial row coverage. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-11 10:23:17 +00:00
Charlie Egan	532cf8c880	website: Fix build from missing dateAdded (#8764 ) https://github.com/open-policy-agent/opa/pull/8685 had not been rebased and so this only failed when on main. I have also updated a regal link to use an abs url to silence a warning. Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-10 14:39:35 +01:00
Charlie Egan	85de0c3046	website: Update homepage AI example to tool calls (#8755 ) This feels more relevant and interesting as an example now. We have RBAC use cases elsewhere. Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-10 14:06:49 +01:00
dependabot[bot]	5344311252	build(deps): bump the dependencies group across 2 directories with 2 updates Bumps the dependencies group with 1 update in the / directory: [oras.land/oras-go/v2](https://github.com/oras-project/oras-go). Bumps the dependencies group with 1 update in the /e2e directory: [modernc.org/sqlite](https://gitlab.com/cznic/sqlite). Updates `oras.land/oras-go/v2` from 2.6.0 to 2.6.1 - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](https://github.com/oras-project/oras-go/compare/v2.6.0...v2.6.1) Updates `modernc.org/sqlite` from 1.50.1 to 1.51.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.50.1...v1.51.0) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-10 11:28:12 +02:00
dependabot[bot]	a440330ea7	build(deps): bump the gha-dependencies group with 3 updates Bumps the gha-dependencies group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action) and [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action). Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10) Updates `github/codeql-action` from 4.36.0 to 4.36.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463) Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/ce360397dd3f832beb865e1373c09c0e9f86d70a...06116385d9baf250c9f4dcb4858b16962ea869c3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-dependencies - dependency-name: github/codeql-action dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-dependencies - dependency-name: docker/setup-qemu-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-10 11:21:39 +02:00
Charlie Egan	85e2477c85	website: Update docusaurus (#8756 ) Also add dependabot for website deps. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-10 10:13:01 +01:00
pkuzco	e161170dd9	Add depkeep to enterprise support (#8685 ) Signed-off-by: glimm-no <admin@glimm.no> Co-authored-by: glimm-no <admin@glimm.no>	2026-06-10 10:08:05 +01:00
Stephan Renatus	7750005131	benchmarks: smaller tweaks The crypto benchmark was allocating Bytes() in the b.Loop(), and there's no need for that. The semver benchmark had some duplicate fixtures. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-06-10 11:01:21 +02:00
Charlie Egan	6f52916ab1	docs: Update to agents.md regarding security dependences 'fixes' (#8754 ) This explains the issue with false positives. Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-10 09:10:28 +01:00
Charlie Egan	e7909e1875	cover: Update report to include ranges (#8752 ) Coverage Range records the source span of each expression instead of just row. Additive API Changes: - cover.Position.Col field - cover.Range.Compare function - ast.Location End() function - ast.Location HasFile() function covered_lines / not_covered_lines count unique rows across ranges, same numbers as before. I have also broken down the cover package a bit to aid future work. Fixes https://github.com/open-policy-agent/opa/issues/8748 --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-09 17:05:19 +01:00
dependabot[bot]	a8f8cea073	build(deps): bump shell-quote from 1.8.3 to 1.8.4 in /docs (#8753 ) Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.3 to 1.8.4. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md">shell-quote's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4">v1.8.4</a> - 2026-05-22</h2> <h3>Commits</h3> <ul> <li>[Fix] <code>quote</code>: validate object-token shapes <a href="https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d"><code>4378a6e</code></a></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>eslint</code>, <code>npmignore</code> <a href="https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6"><code>22ebec0</code></a></li> <li>[Tests] increase coverage <a href="https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d"><code>9f3caa3</code></a></li> <li>[readme] replace runkit CI badge with shields.io check-runs badge <a href="https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0"><code>3344a04</code></a></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code> <a href="https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4"><code>699c511</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/shell-quote/commit/ff166e2b63eb5f932bd131a8886a99e9afdf45ae"><code>ff166e2</code></a> v1.8.4</li> <li><a href="https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d"><code>4378a6e</code></a> [Fix] <code>quote</code>: validate object-token shapes</li> <li><a href="https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6"><code>22ebec0</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>eslint</code>, `npmig...</li> <li><a href="https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d"><code>9f3caa3</code></a> [Tests] increase coverage</li> <li><a href="https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0"><code>3344a04</code></a> [readme] replace runkit CI badge with shields.io check-runs badge</li> <li><a href="https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4"><code>699c511</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code></li> <li>See full diff in <a href="https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=shell-quote&package-manager=npm_and_yarn&previous-version=1.8.3&new-version=1.8.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-09 10:03:56 -05:00
Stephan Renatus	c15c1ca12c	workflows: use `go-version-file` with `actions/setup-go` (#8751 ) Just simplifying things a little. Noticed this when putting together https://github.com/open-policy-agent/opa-envoy-plugin/pull/851 Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-06-09 15:52:07 +01:00
ORYGN	daf5d97991	docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712 ) Updates the OPA MCP ecosystem entry with additional links and an updated tool count. ## Changes - Added `videos`: YouTube demo (author, lint, and test a Rego policy end to end from Claude Desktop) - Added `blogs`: LinkedIn Pulse article explaining the motivation behind OPA MCP - Added npm and Docker Hub to `code` (precedent: `opa-typescript` and `opa-wasm-js` entries both include npmjs.com links) - Added Smithery to `code` (primary MCP-ecosystem install path alongside npm) - Updated tool count from 32 to 50+ (current release is 52 tools across 7 categories) - Added Conftest to the CLI list in the description body Signed-off-by: Daniel Okwor <daniel@orygn.tech> Co-authored-by: Daniel Okwor <daniel@orygn.tech>	2026-06-08 13:36:43 +01:00
Bennett	3f0e0af343	build(deps): bump golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 Both are currently pinned (indirectly) to versions with published advisories: - golang.org/x/crypto v0.51.0 → v0.52.0 (fixes GO-2026-5005/5006/5017/5019/ 5020/5021/5023 and related — several rated critical). - golang.org/x/net v0.53.0 → v0.55.0 (fixes GO-2026-5026 and related). These ship compiled into the released OPA binaries (e.g. the v1.17.0 `-static` image), so container scanners (Grype/Trivy) flag OPA images for them. `main`'s `.go-version` is already 1.26.4, which covers the Go-stdlib advisories; this only bumps the two module deps. Produced with `go get golang.org/x/crypto@latest golang.org/x/net@latest && go mod tidy`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Bennett <35474536+BGebken@users.noreply.github.com>	2026-06-08 13:52:44 +02:00
Charlie Egan	75202c334c	docs: PoC for kapa.ai (#8699 ) https://contribute.cncf.io/blog/2026/04/09/reducing-support-tax-cncf-kapa-ai/ Changes to follow shortly, PR open for domain allow listing. Fixes https://github.com/open-policy-agent/opa/issues/8125 --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-08 12:06:56 +02:00
Manuela Züger	947f2f6a7c	docs/contributing: add formatting (#8740 ) ### Why the changes in this PR are needed? The PR pipeline checks if the formatting of docs changes is correct and instructs developers to fix any discovered formatting issues using the command `dprint fmt`. Contributors might not be aware of this before creating the PR, or forget it, resulting in a failing pipeline (for example [here](https://github.com/open-policy-agent/opa/actions/runs/27003824827/job/79690783007)) and one more roundtrip, which could be avoided. ### What are the changes in this PR? This PR adds an instruction to the contribution guideline to run the `dprint fmt` command to ensure correct formatting. ### Further comments: There is no issue for that as far as I know. I thought this would be helpful (also I forgot this already twice 😅 ). Signed-off-by: Manuela Züger <manuela.zueger@ipt.ch>	2026-06-06 08:47:16 +02:00
Philip Conrad	ba8e650e00	compile,planner: improve determinism of `plan`/`wasm` bundle builds (#8732 ) This commit fixes an issue where `plan` and `wasm` bundle build targets could produce different output bytes across separate invocations of `opa build` for the same inputs. There were two underlying causes, both from Golang random map iteration order leaking through to the order-sensitive planner. Causes: - `compilePlan` (`v1/compile`) and `planQuery` (`v1/rego`) iterated over the compiler's module map without sorting keys first. This caused the planner to have iteration-dependent variations in output. This was fixed by sorting the module names before use. - `planRules` (`internal/planner`) sorted rules by length of the rule name ref, which is not a unique value. Because the sorting of the rules was using an unstable sorting algorithm, and the rule names were coming from iterating over a `map` type in the rule trie, this had edge cases where non-deterministic output ordering could creep in. This was fixed by adding a ref `Compare` call as a tie-breaker to get a stable sorting order, regardless of iteration order in the rule trie. This commit also adds regression tests that assert plan output is independent of module and rule ordering. The two fixes are needed together because both sets of issues hit the planner from different angles, and are mostly independent of each other. Signed-off-by: Philip Conrad <philip_conrad@apple.com>	2026-06-05 13:42:13 -04:00
Stephan Renatus	437cae64f8	topdown: remove `dst.Compare(src)` shortcut `dst.Compare(src)` calls `sortedKeys()` on both objects, and `sortedKeys()` re-sorts `dst`'s keys on every call because each preceding `dst.Insert(...)` resets `sortGuard` (the `sync.Once` that gates the sort). Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>	2026-06-05 10:28:58 +02:00
dependabot[bot]	c35f3171a0	build(deps): bump hono in /e2e/api/compile/prisma Bumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.23. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.18...v4.12.23) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-05 08:05:18 +02:00
Philip Conrad	850f198d09	bundle: improve determinism of `file_rego_versions` patterns with overlap. (#8733 ) This commit makes the behavior of pattern selection for determining `file_rego_versions` from a bundle manifest more deterministic when the pattern have overlap. The docs note that when overlapping patterns occur, the result is undefined. In practice, this meant that the map of patterns was iterated over in randomized order. We now iterate over the `file_rego_version` patterns in lexically-sorted order, which ensures a deterministic result, even when user-authored glob patterns overlap with each other. Signed-off-by: Philip Conrad <philip_conrad@apple.com>	2026-06-04 11:47:07 -04:00
Anders Eknert	511fe48b5b	ast: Clean up code for value comparisons (#8737 ) The `ast.Compare(any, any)` function is a beast better avoided, and the `any` args type mean some AST values (like strings) escape to the heap when boxed. Previous work already ensured it wasn't called too often — this just moves it further along by having all `ast.Value`s do their own comparisons with the help of a new function to easily compare 2 different value types. Also: - topdown: slightly cheaper object.union_n implementation - eval: remove unused expr field on evalNot - eval: rename fmtVarTerm -> fmtVar - term: remove unused termSlice type - builtins: cheaper Builtin.Ref() Signed-off-by: Anders Eknert <anders.eknert@apple.com>	2026-06-04 13:08:57 +00:00
Anders Eknert	eb8166fb1c	perf: avoid allocations in `object.get` (#8729 ) This change removes the 1-2 heap allocations previously made per call to the `object.get` built-in function. Also: - Slightly tweak `builtins.<Type>Operand` functions to have them pass the inlining threshold score of 80 — they would previously all score at 81! Signed-off-by: Anders Eknert <anders.eknert@apple.com>	2026-06-04 14:51:39 +02:00
Charlie Egan	c3a407c5d2	website: Add support page disclaimer and sort by date added (#8736 ) Signed-off-by: Charlie Egan <charlie_egan@apple.com>	2026-06-04 10:00:16 +00:00

1 2 3 4 5 ...

6520 Commits