Skip to content

chore(deps): update go-dependencies (9.4) - #7676

Merged
ycombinator merged 6 commits into
9.4from
renovate/9.4-golang/go-dependencies
Oct 1, 2026
Merged

chore(deps): update go-dependencies (9.4)#7676
ycombinator merged 6 commits into
9.4from
renovate/9.4-golang/go-dependencies

Conversation

@elastic-renovate-prod

@elastic-renovate-prod elastic-renovate-prod Bot commented Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
github.com/fxamacker/cbor/v2 require patch v2.9.1 → v2.9.4
github.com/go-chi/chi/v5 require patch v5.3.1 → v5.3.2
github.com/gofrs/uuid/v5 require patch v5.5.0 → v5.5.1
github.com/open-telemetry/opamp-go require minor v0.23.0 → v0.24.0
go.opentelemetry.io/otel require minor v1.44.0 → v1.46.0
golang.org/x/net require minor v0.57.0 → v0.59.0
golang.org/x/perf indirect digest 02a15fd → 22c9c6c
golang.org/x/sync require minor v0.22.0 → v0.23.0
golang.org/x/time require minor v0.15.0 → v0.16.0
golang.org/x/tools indirect minor v0.37.0 → v0.50.0
google.golang.org/grpc require minor v1.83.1 → v1.84.0
google.golang.org/protobuf require patch v1.36.11 → v1.36.12

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.4

Compare Source

This release fixes potential panics when decoding a CBOR map whose key decodes to an uncomparable Go value under certain conditions.

Not affected: user apps that don't register tag types and don't use map key types that are either named empty interfaces (e.g. type MyAny any) or contain interfaces.

These potential panics can be encountered when one of these two conditions is met:

  • user application registers a tag type (via TagSet interface) that is an array or struct with uncomparable or interface{} element or field type, or
  • user application specifies a destination Go map whose key type is a named empty interface type or a type containing an interface.

This was identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended to cover this bug.

Upgrading to v2.9.4 is recommended.

What's Changed

Full Changelog: fxamacker/cbor@v2.9.3...v2.9.4

v2.9.3

Compare Source

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

  • Skip data item when decoding to time.Time fails under certain conditions by @​fxamacker in #​803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

v2.9.2

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

  • Reject encoding indefinite-length map with odd item count by @​fxamacker in #​764
  • Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @​fxamacker in #​765
  • Make TagSet.Remove a no-op when contentType is nil by @​fxamacker in #​766
  • Refactor indefinite-length encoding and improve chunk validation during encoding by @​fxamacker in #​767
  • Add more tests, fix a nit in unreachable panic message, update docs & ci by @​fxamacker in #​768
CI / GitHub Actions and Docs
🔎 Details...

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.2

Compare Source

What's Changed

  • feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in #​1151
  • docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in #​1111
  • fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in #​1148
  • Don't duplicate methods in Allow: header for 405 responses by @​flimzy in #​1029
  • fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in #​1156
    • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #​868 and #​1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

gofrs/uuid (github.com/gofrs/uuid/v5)

v5.5.1

Compare Source

What's Changed
New Contributors

Full Changelog: gofrs/uuid@v5.5.0...v5.5.1

open-telemetry/opamp-go (github.com/open-telemetry/opamp-go)

v0.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: open-telemetry/opamp-go@v0.23.0...v0.24.0

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.46.0: /v0.68.0/v0.22.0/v0.0.19

Compare Source

This release is the last to support Go 1.25.
The next release will require at least Go 1.26.

Added
  • Support testing of Go 1.27. (#​8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8273, #​8775, #​8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#​8598)
Changed
  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#​8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#​8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#​8764)
Fixed
  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#​8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#​8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#​8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#​8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#​8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#​8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#​8758)

What's Changed

New Contributors

Full Changelog: open-telemetry/opentelemetry-go@v1.45.0...v1.46.0

v1.45.0: /v0.67.0/v0.21.0/v0.0.18

Compare Source

Overview

Added
  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#​7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#​8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#​8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#​8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#​8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#​8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#​8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package.
    The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#​8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#​8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.
    The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#​8628)
Changed
  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#​8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#​8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#​8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#​8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#​8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#​8538)
Deprecated
  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#​8620)
Removed
  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#​8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#​8556)
Fixed
  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#​8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#​8389)
  • Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in go.opentelemetry.io/otel/attribute. (#​8402)
  • Fix histogram data point reuse in go.opentelemetry.io/otel/sdk/metric aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#​8403)
  • Avoid preallocating scope attributes when they are disabled in go.opentelemetry.io/otel/exporters/prometheus. (#​8404)
  • Support HTTP-date values in the HTTP Retry-After header when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8417)
  • Reduce histogram heap allocations by reusing BucketCounts and Exemplars slices across Collect cycles in the cumulative histogram aggregation in go.opentelemetry.io/otel/sdk/metric. (#​8428)
  • Fix go.opentelemetry.io/otel/exporters/stdout/stdouttrace self-observability to record error.type on the operation-duration histogram when the exportedSpans metric is disabled. (#​8432)
  • Stop including trace exporter endpoint configuration in internal logs from go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. (#​8438)
  • Fix invalid error formatting for out-of-range JSON code values in go.opentelemetry.io/otel/codes. (#​8497)
  • Clarify in go.opentelemetry.io/otel/log that Logger.Enabled should be checked for every log emission because its result may change over time. (#​8565)
  • Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in go.opentelemetry.io/otel/sdk/log. (#​8566)
  • Make WithAttributeCountLimit(0) and OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0 discard all log record attributes in go.opentelemetry.io/otel/sdk/log. (#​8570)
  • Clarify that the Record methods of Float64Histogram and Int64Histogram in go.opentelemetry.io/otel/metric expect non-negative values. (#​8574)
  • Clarify in go.opentelemetry.io/otel/log that LoggerProvider implementations should retain an empty Logger name instead of replacing it with a default. (#​8587)
  • Ensure that the built-in processors in go.opentelemetry.io/otel/sdk/log call exporter ForceFlush during Shutdown. (#​8599)
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem. (GHSA-42cj-99w8-cp2p)
  • Prevent processor operations in go.opentelemetry.io/otel/sdk/log from overlapping with processor shutdown or running after LoggerProvider shutdown. (#​8608)
  • Prevent BatchProcessor in go.opentelemetry.io/otel/sdk/log from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#​8620)
  • Make BatchProcessor in go.opentelemetry.io/otel/sdk/log return errors encountered while draining records during ForceFlush and Shutdown, while continuing to attempt later batches as long as the request context remains valid. (#​8620)
  • Keep the default BatchProcessor maximum export batch size in go.opentelemetry.io/otel/sdk/log at or below the configured maximum queue size. (#​8620)

What's Changed

  • fix(semconv): share metric option pools by @​macayu17 in #​8371
  • chore(deps): update module github.com/alecthomas/chro

Configuration

📅 Schedule: Branch creation - "on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team as a code owner August 21, 2026 08:47
@elastic-renovate-prod elastic-renovate-prod Bot added automation backport-skip Skip notification from the automated backport with mergify dependency labels Aug 21, 2026
@elastic-renovate-prod elastic-renovate-prod Bot added the Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team label Aug 21, 2026
@elastic-renovate-prod

elastic-renovate-prod Bot commented Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: dev-tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated

Details:

Package Change
golang.org/x/mod v0.29.0 -> v0.41.0
golang.org/x/sync v0.17.0 -> v0.23.0
golang.org/x/sys v0.36.0 -> v0.48.0
golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053 -> v0.0.0-20260908163034-4bcc4b2ee518
golang.org/x/text v0.23.0 -> v0.42.0
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
github.com/go-logr/logr v1.4.3 -> v1.4.4
go.opentelemetry.io/otel/metric v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/trace v1.44.0 -> v1.46.0
golang.org/x/crypto v0.54.0 -> v0.57.0
golang.org/x/sys v0.47.0 -> v0.48.0
golang.org/x/text v0.40.0 -> v0.42.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260706201446-f0a921348800
File name: testing/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 11 additional dependencies were updated

Details:

Package Change
github.com/go-logr/logr v1.4.3 -> v1.4.4
go.opentelemetry.io/otel v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/metric v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/trace v1.44.0 -> v1.46.0
golang.org/x/crypto v0.54.0 -> v0.57.0
golang.org/x/net v0.57.0 -> v0.59.0
golang.org/x/sys v0.47.0 -> v0.48.0
golang.org/x/text v0.40.0 -> v0.42.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260706201446-f0a921348800
google.golang.org/grpc v1.83.1 -> v1.84.0
google.golang.org/protobuf v1.36.11 -> v1.36.12

@github-actions

This comment has been minimized.

Sign in to view
@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/go-dependencies branch 5 times, most recently from 4a256b2 to 83ba766 Compare August 24, 2026 13:04
@ycombinator
ycombinator force-pushed the renovate/9.4-golang/go-dependencies branch from 5476c33 to f1144ca Compare September 9, 2026 14:58
ycombinator
ycombinator previously approved these changes Sep 9, 2026
View reviewed changes
@ycombinator
ycombinator enabled auto-merge (squash) September 9, 2026 15:01
@github-actions github-actions Bot mentioned this pull request Sep 9, 2026
Open
@ebeahan

ebeahan commented Sep 9, 2026

Copy link
Copy Markdown
Member

Based on the latest CI runs, these observations still apply: #7676 (comment)

There are some OpenAPI generated files which need updated:

// Package api provides primitives to interact with the openapi HTTP API.
--
  | //
  | -// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.5.0 DO NOT EDIT.
  | +// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.8.0 DO NOT EDIT.
  | package api

@mergify

mergify Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

This pull request is now in conflicts. Could you fix it @elastic-renovate-prod[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-golang/go-dependencies upstream/renovate/9.4-golang/go-dependencies
git merge upstream/9.4
git push upstream renovate/9.4-golang/go-dependencies

@github-actions

This comment has been minimized.

Sign in to view
@swiatekm
swiatekm force-pushed the renovate/9.4-golang/go-dependencies branch from 577e210 to c3a0685 Compare September 18, 2026 14:39
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@ycombinator
ycombinator force-pushed the renovate/9.4-golang/go-dependencies branch from 0b45bb0 to a65836c Compare September 21, 2026 14:52
@github-actions

This comment has been minimized.

Sign in to view
@mergify

mergify Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

This pull request is now in conflicts. Could you fix it @elastic-renovate-prod[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-golang/go-dependencies upstream/renovate/9.4-golang/go-dependencies
git merge upstream/9.4
git push upstream renovate/9.4-golang/go-dependencies

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/go-dependencies branch from a65836c to f9af554 Compare September 22, 2026 16:43
@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/go-dependencies branch from dee0d03 to b6577b9 Compare September 22, 2026 16:46
@elastic-renovate-prod

elastic-renovate-prod Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/go-dependencies branch from 6de4386 to b6a94e3 Compare September 22, 2026 16:47
@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

TL;DR

Two FIPS-targeted unit-test jobs are failing on TestConnectionTLS due a brittle expectation in internal/pkg/es/client_test.go: it assumes behavior based only on crypto/fips140.Enabled(), but with the upgraded Go/dependency stack the TLS handshake outcome also depends on FIPS mode (fips140=on vs fips140=only). Update the test to assert by effective FIPS mode (or error type), then rerun CI.

Remediation

  • Update internal/pkg/es/client_test.go (TestConnectionTLS) to stop using a binary fips140.Enabled() check as the sole oracle. Instead assert on the actual mode/signature, e.g.:
    • fips140=only (or equivalent strict mode): expect handshake failure for the 1024-bit RSA cert.
    • fips140=on: allow handshake success (current Buildkite expectation).
  • Keep the fixture explicit (testdata/fips_invalid.key is RSA-1024) and assert error semantics (TLS/FIPS certificate rejection) rather than only nil/non-nil.
  • Re-run these steps after the test fix: Run unit tests, Run fips140=on unit tests, Run fips140=only unit tests, and Run go benchmark for PR branch.
Investigation details

Root Cause

I reproduced the failing FIPS command locally and got a deterministic failure in TestConnectionTLS at internal/pkg/es/client_test.go:210:

  • Test code currently branches only on fips140.Enabled() (internal/pkg/es/client_test.go:207-210).
  • The server fixture is intentionally non-compliant (internal/pkg/es/client_test.go:217-220, fips_invalid.key = RSA-1024).
  • Under strict FIPS behavior, TLS rejects that cert (tls: certificate uses RSA-1024 public key which is not allowed by FIPS 140-3), but the test sometimes reaches the require.NoError branch.

This mismatch is consistent with mode-dependent semantics (fips140=on vs fips140=only) after dependency/toolchain updates in this PR.

Evidence

  • Build: https://buildkite.com/elastic/fleet-server/builds/17150
  • Failing steps from pre-fetched summary:
    • Run unit tests
    • Run fips140=on unit tests with FIPS provider and microsoft/go
    • Run fips140=only unit tests with FIPS provider and upstream go
    • Run go benchmark for PR branch
  • Local reproduction command:
    • go test -tags=grpcnotrace,requirefips -v -race -coverprofile=/tmp/gh-aw/agent/coverage-fips.out ./...
  • Key log excerpt:
    • internal/pkg/es/client_test.go:210
    • tls: certificate uses RSA-1024 public key which is not allowed by FIPS 140-3 (minimum 2048 bits)

I also confirmed mode sensitivity with:

  • FIPS=true GODEBUG=fips140=on,tlsmlkem=0 go test -tags=grpcnotrace -v -race ./internal/pkg/es -run TestConnectionTLS
    • fails at internal/pkg/es/client_test.go:208 (expected error but got nil), i.e. opposite branch.

Verification

  • ✅ Reproduced failing requirefips unit test command locally with concrete failing test + stack line.
  • ✅ Verified line-level assertion logic in internal/pkg/es/client_test.go.
  • ⚠️ Pre-fetched Buildkite log snippets for Run unit tests and benchmark step are truncated and do not include their first failure line; likely related but not directly provable from provided snippets alone.

Follow-up

  • No existing flaky-test issue was found for TestConnectionTLS (search_issues query: label:flaky-test TestConnectionTLS).

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@swiatekm
fix: adapt to opamp-go and x/sync breaking changes
b566f35 
opamp-go v0.24.0 renamed protobufs.AgentConfigFile to
protobufs.AgentConfigObject.

golang.org/x/sync v0.23.0 makes semaphore.NewWeighted panic on a
negative size. Clamp the API limiter's configured max to zero, which
preserves the previous "reject every request" behaviour for a negative
limit, and fall back to the defaults for the two bulker concurrency
limits so a negative value in the config cannot crash the server on
startup.

Assisted-By: Claude Opus 5 <noreply@anthropic.com>
swiatekm
swiatekm requested changes Sep 23, 2026
View reviewed changes

@swiatekm swiatekm left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocked by #7893

@swiatekm
Merge remote-tracking branch 'origin/9.4' into HEAD
5c3b7e2
@swiatekm
fix: remove semaphore guards superseded by config validation
85feab2 
Config validation now rejects negative values for bulk.flush_max_pending,
output.elasticsearch.max_conn_per_host, and limit.max at startup, making
the defensive clamps in parseBulkOpts and NewLimiter redundant.

Update TestLimiter to use a zero-burst rate limiter instead of negative
config values, which are now rejected before they reach the limiter.

Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@swiatekm
fix: use NewRequestWithContext in TestLimiter
83d7d73 
Fixes noctx lint warning exposed by whole-file linting when the
test file was modified.

Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@ycombinator
ycombinator merged commit a58fd24 into 9.4 Oct 1, 2026
13 checks passed
@ycombinator
ycombinator deleted the renovate/9.4-golang/go-dependencies branch October 1, 2026 10:31
@swiatekm swiatekm mentioned this pull request Oct 1, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@swiatekm swiatekm swiatekm approved these changes
@ycombinator ycombinator ycombinator left review comments
@blakerouse blakerouse Awaiting requested review from blakerouse blakerouse is a code owner automatically assigned from elastic/elastic-agent-control-plane
@macdewee macdewee Awaiting requested review from macdewee macdewee is a code owner automatically assigned from elastic/elastic-agent-control-plane

Assignees

No one assigned

Labels

automation backport-skip Skip notification from the automated backport with mergify dependency skip-changelog Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ebeahan @ycombinator @swiatekm