fix(deps): update go dependencies (non-major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/usetero/policy-go/backend/teroscan	v1.10.2 → v1.10.3
github.com/usetero/policy-go/policy	v1.12.0 → v1.12.1
github.com/usetero/policy-go/proto	v1.11.0 → v1.11.1
go.opentelemetry.io/collector/pdata	v1.66.0 → v1.68.0
google.golang.org/grpc	v1.83.2 → v1.84.0

---

Release Notes

usetero/policy-go (github.com/usetero/policy-go/backend/teroscan)

v1.10.3: backend/teroscan: v1.10.3

Bug Fixes

• deps: update grpc to v1.83.2 and consolidate dependency updates (#​108) (f5d3f6e)

open-telemetry/opentelemetry-collector (go.opentelemetry.io/collector/pdata)

v1.68.0

🛑 Breaking changes 🛑

• cmd/mdatagen: Generated processor lifecycle tests now assert that the processor propagates the incoming context unchanged to the next consumer by default. (#​15994)
  Disable with skip_context_propagation: true

• processor/queue_batch: Rename queuebatch processor to queue_batch processor. (#​14396)

💡 Enhancements 💡

• extension/memory_limiter: Add otelcol_memorylimiter_refused_requests metric to record network request refusals in extension mode. (#​15561)

• pkg/confighttp: Enable keepalive configuration by default. (#​16026)
  Introduces the feature gate pkg.confighttp.PrioritizeNewKeepalive. When disabled, this flag
  restores the old behaviour of removing the keepalive configuration in favour
  of the deprecated fields IdleConnTimeout, MaxIdleConns, MaxIdleConnsPerHost,
  DisableKeepAlives when the flag is disabled.

• pkg/exporterhelper: Make the partition idle timeout configurable via batch::partition::idle_timeout and raise the default to 90s. (#​15894)

• pkg/exporterhelper: Make the multi-batcher partition LRU cache size configurable and export cache size metrics. (#​14526)
  Adds sending_queue::batch::partition::cache_size (default 10000) to cap the
  number of active partition batchers. The value
  must be positive. Current size and configured capacity are exported as
  otelcol_exporter_queue_batch_partition_cache_size
  and otelcol_exporter_queue_batch_partition_cache_capacity.

• pkg/pprofile: Speed up profiles dictionary merging during exporter-queue batching by replacing the linear-scan dedup in switchDictionary with an indexed lookup, reducing per-merge cost from O(N*L^2) to O(N+L). (#​15544)
  No behavior change: merged dictionary contents and remapped indices are identical to before.

• pkg/receiverhelper: Stop allocating a span link that is always discarded when a long-lived-context receiver starts an operation without a parent span context. (#​15998)
  Receivers created with LongLivedCtx: true no longer build a trace.Link when the
  long-lived context carries no valid span context. The SDK already discarded such a link,
  so behaviour is unchanged. This removes 3 of 7 allocations per receive operation.

• pkg/xpdata: Reduce the time xhash.MapHash takes for maps with many entries. (#​15990)

🧰 Bug fixes 🧰

• exporter/debug: Support known sync error handling on AIX (#​15924)
  Enable the debug exporter to handle known synchronous errors on AIX.

• pkg/exporterhelper: Drop only the oversized item when splitting a batch, instead of discarding every item queued behind it (#​15936)
  Applied to logs only for now

• pkg/exporterhelper: Add exporter and data_type attributes to exporter/enqueue spans. (#​16022)

• receiver/otlp: Error handler preserves the HTTP status code when the request Content-Type is not one a Status can be encoded in (#​15995)
  Extends the fix in #​13414, which handled a missing Content-Type. A Content-Type that was
  present but unsupported, or malformed, still fell through to
  500 {"code": 13, "message": "failed to marshal error message"}, reporting client errors
  such as 401 from a server auth extension or 400 from an unsupported Content-Encoding as
  server faults.

v1.67.0

🛑 Breaking changes 🛑

• pkg/pprofile: Remove deprecated AggregationTemporality, Duration, SetDuration (#​15855)
• pkg/scraperhelper/controller: Remove deprecated AddScraper func (#​15934)
• pkg/service: Remove deprecated ZapOptions (#​15935)
• pkg/xconfmap: Remove deprecated WithForceUnmarshaler func (#​15932)

💡 Enhancements 💡

• pkg/pdata: avoid allocations in WriteInt64 and WriteUint64 (#​15629)

🧰 Bug fixes 🧰

• cmd/schemagen: Accept components written without a configuration body in the generated Collector configuration schema (#​15728)

• pkg/confmap: Fix bug where an escaped URI appearing before a valid URI prevented the subsequent URI from being expanded. (#​15867)
  URI scanning now continues after an escaped URI while preserving the escaped expression as literal text.

• pkg/featuregate: Reject feature gate IDs with an empty dot-separated segment (leading, trailing, or consecutive dots), e.g. .foo, foo., foo..bar. (#​15676)

• pkg/pprofile: Stop erasing inline attribute keys when key_strindex is unset, and clear key_strindex once it is resolved. (#​15793)

• pkg/pprofile: Reference resource and scope attribute strings via the ProfilesDictionary string table when marshaling and unmarshaling OTLP profiles export requests. (#​15792)

• pkg/scraperhelper: Fix shutdown being delayed by extra scrapes when a scrape runs longer than the collection interval (#​15736)
  If a scrape was still running when the next tick fired, the pending tick and the shutdown
  signal could both be ready when it finished and the controller chose between them at random.

grpc/grpc-go (google.golang.org/grpc)

v1.84.0: Release 1.84.0

Compare Source

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#​9215)

New Features

• xds: Add support for contains_match in route header matchers. (#​9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#​9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#​9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#​9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#​9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#​9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#​9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#​9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#​9203)
  • Special Thanks: @​buger
• xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#​9140)
• xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#​9223)
  • Special Thanks: @​nvxbug
• xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#​9223)
  • Special Thanks: @​nvxbug
• xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#​9257)
  • Special Thanks: @​nvxbug
• xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#​9218)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#​9250)
  • Special Thanks: @​nvxbug

Performance Improvements

• transport: Avoid a heap allocation when flushing shared write buffers. (#​9233)
  • Special Thanks: @​zaidoon1
• credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#​9268)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm every weekday,before 6am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: runners/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
go.opentelemetry.io/collector/featuregate	v1.66.0 -> v1.68.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260908043556-f8649ddbbfe6 -> v0.0.0-20260911204522-f61a6ca850bd

File name: server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
google.golang.org/genproto/googleapis/api	v0.0.0-20260908043556-f8649ddbbfe6 -> v0.0.0-20260911204522-f61a6ca850bd