1913 Commits
Author SHA1 Message Date
Zettat123andsilverwind b65fd0f8f8 ci: run the Windows tests on a runner with KVM (#1369)
Run the Windows tests on `ubuntu-latest-kvm` as a PR job, with the installed Windows cached, minutes instead of ~1h40m. Aligned with https://gitea.com/gitea/gitea-mcp/pulls/321 and https://gitea.com/gitea/cli/pulls/79.

Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1369
Reviewed-by: silverwind <[email protected]>
Co-authored-by: Zettat123 <[email protected]>
2026-11-04 02:08:38 +00:00
silverwind f2fbd67962 enhance: support Docker on FreeBSD and restructure the README (#1367)
1. Restructures the README into installation, quickstart, deployment, configuration, jobs and operation, and shortens it to user-facing prose. Option details are left to `config.example.yaml` and `docs/`, existing heading anchors are kept where possible.
2. FreeBSD builds used the Docker stub, so `docker://` labels, services and Docker actions failed there. The Docker code works on FreeBSD against a remote daemon, so it is enabled, and host jobs report `runner.os` as `FreeBSD`.
3. `make build` on Windows now writes `gitea-runner.exe`, taking the suffix from `go env GOEXE`.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1367
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-11-03 02:42:25 +00:00
silverwind d6f5b68a0d enhance: test on Windows and fix what it found (#1348)
Adds a weekly and on-demand workflow that runs the cross-compiled tests on Windows Server 2025 Core in a [dockur/windows](https://github.com/dockur/windows) QEMU VM, and fixes the Windows bugs it found in host and UNC paths, env handling, shell quoting, post-task scripts, health checks, checkout, action symlinks, step summaries, Git client certificates and docker mode from a Windows host.

Host-mode steps now emit UTF-8, `bash` falls back to Git's bash instead of the WSL launcher, the runner can run as a native Windows service, steps can keep background helpers with `RUNNER_TRACKING_ID`, and Windows arm64 binaries are released.

Fixes: https://gitea.com/gitea/runner/issues/1339
Fixes: https://gitea.com/gitea/runner/issues/637
Fixes: https://gitea.com/gitea/runner/issues/1172
Fixes: https://gitea.com/gitea/runner/issues/347
Reviewed-on: https://gitea.com/gitea/runner/pulls/1348
Reviewed-by: bircni <[email protected]>
2026-11-03 01:26:10 +00:00
Renovate Bot 6e42621b4a chore(deps): update dependencies (#1365)
Co-authored-by: Renovate Bot <[email protected]>
v5.3.0
2026-11-02 08:16:42 +00:00
adamaruandsilverwind 228effab64 fix(dind): double-fork in s6-notifyoncheck to eliminate zombie processes (#1364)
In `scripts/s6/docker/run`, `s6-notifyoncheck` runs without the `-d` flag:

```bash
exec s6-notifyoncheck -n 0 dockerd-entrypoint.sh
```

Without `-d`, `s6-notifyoncheck` performs a single fork to execute the background checking process. The parent immediately replaces itself via `exec` with `dockerd-entrypoint.sh` (which calls `exec rootlesskit` on `dind-rootless`).

Because only a single fork occurred, the background checking child remains parented to `rootlesskit`. When the check passes and the process terminates:
1. `rootlesskit` did not spawn this process and never reaps it via `waitpid()`.
2. Under standard Linux process semantics, `s6-svscan` (PID 1) cannot adopt or reap the child because its parent (`rootlesskit`) is still running.
3. The terminated process remains as a permanent zombie (`[s6-notifyoncheck] <defunct>`) for the container's entire lifespan.

Adding `-d` instructs `s6-notifyoncheck` to double-fork, detaching the background check so it is immediately adopted by `s6-svscan` (PID 1) and cleanly reaped upon exit.

---------

Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1364
Reviewed-by: silverwind <[email protected]>
Co-authored-by: adamaru <[email protected]>
2026-11-01 07:20:20 +00:00
silverwindandbircni a46d3f3eda test(e2e): speed up and cover exec and Kubernetes modes (#1363)
Follow-up to https://gitea.com/gitea/runner/pulls/1362, whose crash e2e missed because it only drove the daemon on Docker.

- `dispatch`, `failure_paths` and `reusable_workflow` run through the daemon and `exec`, each on Docker and one shared k3s cluster.
- Fixed sleeps become gates the test releases, the job timeout uses a 15s runner deadline, k3s boots alongside Gitea, Gitea's data is on tmpfs.
- Outside a container, `make test-e2e` runs `go test` in a Linux container on its own network like CI, so local runs take the same paths.

Local wall time:

| | Before | After |
|---|---|---|
| Suite | 84s | 27–35s |
| `job_timeout` | 64s | 17s |
| `reconnect` | 22s | 4.5s |
| `capacity/serial` | 20s | 2s |
| `cli_shutdown_drains` | 14s | 2.3s |
| `kubernetes` | 31s | 21–23s |

_Written by Claude (Opus 5.5)._

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1363
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-31 10:47:35 +00:00
2e72cf902a enhance(kubernetes): fetch job pod copies from the runner over the pod network (#1354)
The Kubernetes backend copies actions and workspaces into job containers with `tar` over `pods/exec`, so every byte goes through the API server. On managed clusters that often sits in other zones than the nodes, so each byte can cross zones twice, and the copies load the API server.

With `kubernetes.transfer.mode: auto` or `direct`, an init container copies `gitea-runner` into the job pod, and the job container fetches directories and copies of 64 KiB or more gzipped from the runner over the pod network. `auto` falls back to the API server for a job pod that cannot reach the runner, `direct` fails the job.

Copies can hold secrets, so each is served once, over TLS 1.3 pinned to a certificate the runner generates, only to the job pod's IPs.

Copying setup-go@v5, cache@v4, setup-java@v4 and build-push-action@v6 sends 11.6 MB through the API server on main and 532 B with this PR.

Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1354
Reviewed-by: silverwind <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
2026-10-31 08:00:36 +00:00
silverwind f4741df90d fix(exec): load local reusable workflows from disk with --no-skip-checkout (#1362)
`gitea-runner exec --no-skip-checkout` panics with a nil pointer dereference on any job that calls a local reusable workflow (`uses: ./.gitea/workflows/x.yml`).

Fetching a local reusable workflow from the instance was gated on `NoSkipCheckout`, but it reads the repository and SHA from the task's preset context, which only the daemon has. `exec` always has the workflow on disk, so the fetch is now gated on the preset instead, and `--no-skip-checkout` only governs checkout again. Daemon behavior is unchanged.

The `exec` e2e test now also runs the existing reusable caller/callee pair with `--no-skip-checkout`.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1362
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-31 05:24:36 +00:00
261ab374ce enhance(cache): scope cache entries by ref like GitHub (#1361)
Cache entries were only scoped by repository, so an entry a pull request saved could be restored on the default branch, for example through a `restore-keys` prefix.

Entries now carry the ref of the job that saved them. As on GitHub ([Restrictions for accessing a cache](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#restrictions-for-accessing-a-cache)), a job restores entries of its own ref first, then of its pull request's base branch, then of the default branch. Pull request events are scoped by their pull request number.

Entries saved before this change are no longer restored and expire through `cache.retention`, so caches start cold once after the upgrade. Runners sharing a cache, and an external `cache-server`, should be upgraded together.

Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1361
Reviewed-by: silverwind <[email protected]>
Co-authored-by: JorgeDLMV <[email protected]>
2026-10-30 22:34:45 +00:00
KenanZhuandsilverwind ca8e9c3c64 enhance: add GITEA_* aliases for built-in workflow environment variables (#1358)
Closes https://gitea.com/gitea/runner/issues/1317, which makes https://github.com/go-gitea/gitea/issues/39813 redundant as the runner sets these variables.

Every built-in `GITHUB_*` environment variable the runner sets is now also available as `GITEA_*` with the same value, so Gitea-native workflows don't have to rely on GitHub naming. The `GITEA_*` names mirror the `GITHUB_*` ones after their last write, so they stay equal and are unset together.

Workflow, job and runner `envs` values for these `GITEA_*` names are now overwritten, the same as for `GITHUB_*`.

---------

Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1358
Reviewed-by: silverwind <[email protected]>
Co-authored-by: KenanZhu <[email protected]>
2026-10-30 21:21:02 +00:00
silverwindandbircni d8d4a4657d fix: scope the action identity to the step executing an action (#1359)
`github.action_repository`/`github.action_ref` and their env vars now belong to the step executing an action, like on GitHub: set for remote actions, empty for `run`, `docker://` and local steps. Before, a local action nested in a remote composite resolved `$/` against the remote action instead of the workflow's repository.

Updates actionslib to v1.5.1, which accepts `$/` as the repository root action.

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1359
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-29 17:41:27 +00:00
silverwind 5fd2f82735 test: fix race in TestTreeKillCancelBeforeCaptureKillsTree (#1360)
`TestTreeKillCancelBeforeCaptureKillsTree` fails intermittently on CI, e.g. https://gitea.com/gitea/runner/actions/runs/1155856.

Dash, the Ubuntu `/bin/sh`, points a background job's stdin at `/dev/null` before applying its redirections, so `cat <&0 &` read EOF and exited at once and the liveness check raced it. The pipe is now handed over on fd 3, which dash leaves alone.

Introduced in https://gitea.com/gitea/runner/pulls/1338

Reviewed-on: https://gitea.com/gitea/runner/pulls/1360
Reviewed-by: Zettat123 <[email protected]>
2026-10-29 16:46:53 +00:00
silverwind c6567296a0 fix: stop the docker proxy probe from leaking its container (#1357)
When the probe's deadline expired during `ContainerCreate`, dockerd still created the container but the probe never got its ID, leaving it in `Created` with its image's anonymous volumes. A slow daemon leaked one per job.

The probe now runs detached with its own timeout, so the create is never cancelled and the container is always removed. Callers still fall back after their own deadline, and the runner waits for pending probes before exiting.

Fixes: https://gitea.com/gitea/runner/issues/1353
Reviewed-on: https://gitea.com/gitea/runner/pulls/1357
Reviewed-by: Zettat123 <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-29 15:53:32 +00:00
Renovate Bot e3607b576e fix(deps): update module golang.org/x/net to v0.62.0 [security] (#1356)
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.61.0` → `v0.62.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.61.0...refs/tags/v0.62.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.62.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.61.0/v0.62.0?slim=true) |

---

### Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
[CVE-2026-78661](https://nvd.nist.gov/vuln/detail/CVE-2026-78661) / [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860)

<details>
<summary>More information</summary>

#### Details
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

#### Severity
Unknown

#### References
- [https://go.dev/cl/849365](https://go.dev/cl/849365)
- [https://go.dev/issue/82224](https://go.dev/issue/82224)
- [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6860) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
[CVE-2026-97045](https://nvd.nist.gov/vuln/detail/CVE-2026-97045) / [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866)

<details>
<summary>More information</summary>

#### Details
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

#### Severity
Unknown

#### References
- [https://go.dev/cl/855121](https://go.dev/cl/855121)
- [https://go.dev/issue/82622](https://go.dev/issue/82622)
- [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6866) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: https://gitea.com/gitea/runner/pulls/1356
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: Renovate Bot <[email protected]>
2026-10-28 06:33:58 +00:00
Lunny XiaoandZettat123 ffd80101a3 enhance(kubernetes): gzip copies into job containers over exec (#1355)
The Kubernetes backend copies actions and other files into the job container with `tar` over `pods/exec`, so the data goes through the API server, which on managed clusters often sits in other zones than the nodes (each copied byte then crosses zones twice). Actions are megabytes of JavaScript bundles that gzip about fivefold:

| Action | tar | gzip |
|---|---|---|
| actions/setup-go@v5 | 8.0 MB | 1.5 MB |
| actions/cache@v4 | 11.6 MB | 2.0 MB |
| actions/setup-java@v4 | 15.3 MB | 2.5 MB |
| docker/build-push-action@v6 | 12.9 MB | 3.0 MB |

The startup probe now also reports whether the job container has `gzip`. If it does, `CopyDir` and copies of 64 KiB or more are gzipped at `BestSpeed` and extracted with `gzip -dc | tar -xf -`. Smaller copies (run scripts, file command files) stay uncompressed, where gzip would save next to nothing and cost a process in the pod. Images without `gzip` keep the plain tar stream, so the image requirements do not change.

This is independent of #1354 and gets most of its traffic saving with no new moving parts.

---
*Written by Codet (AI coding agent) on behalf of @lunny.*

---------

Co-authored-by: Zettat123 <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1355
Reviewed-by: Zettat123 <[email protected]>
v5.2.4
2026-10-28 06:00:51 +00:00
b712c91c2d test(e2e): cover host mode, reusable workflows, scheduling, reconnect and CLI flags (#1347)
Extends the e2e suite with scenarios for host labels, local `workflow_call`, label routing, `runner.capacity`, a dropped and restored connection to Gitea, and the daemon's `--once`, `--labels` and `shutdown_timeout` behaviour.

Stacked on https://gitea.com/gitea/runner/pulls/1346, so its commit shows here until that merges. The new scenarios pass locally against gitea/gitea:latest and main-nightly.

Assisted-by: Codet:codet
Co-authored-by: Zettat123 <[email protected]>
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1347
Reviewed-by: Zettat123 <[email protected]>
2026-10-28 04:32:50 +00:00
d77e216674 fix(exec): serve the v4 artifact API so upload-artifact v4 and later work (#1341)
`exec` forwarded the toolkit's ArtifactService calls to an instance it never registered, and its random runtime token held no backend IDs, so `actions/upload-artifact` and `actions/download-artifact` v4 and later failed.

The local artifact server now serves the v4 API, including the single Put Blob uploads docker/build-push-action uses. `exec` gives each workflow its own unsigned JWT runtime token and artifact run, so artifact names conflict and carry over between runs as on GitHub. Artifacts default to a temporary directory instead of the workspace that jobs copy.

Co-authored-by: silverwind <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1341
Reviewed-by: Lunny Xiao <[email protected]>
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>
2026-10-28 03:52:53 +00:00
Lunny Xiao a76ccd7020 test(e2e): cover the register/daemon CLI and failing jobs (#1346)
The e2e suite started the runner in-process and never exercised failing jobs. This adds a scenario that builds the binary and drives `register` then `daemon` against the Gitea fixture, and one for failed, skipped, continue-on-error and timed-out jobs.

Verified locally against gitea/gitea:main-nightly.

Assisted-by: Codet:codet
Reviewed-on: https://gitea.com/gitea/runner/pulls/1346
Reviewed-by: Zettat123 <[email protected]>
2026-10-27 21:23:59 +00:00
3dbed63f55 fix: close the action header group before the action runs (#1345)
`uses:` steps and job hooks kept their "Run …" group open until they finished. Gitea doesn't nest groups, so the action's own first `::group::` closed the header and everything before it stayed hidden there, e.g. all of goreleaser's output in https://gitea.com/gitea/cli/actions/runs/1121069/jobs/1519275. The header group now closes right after its details, as in actions/runner.

The action header also matches actions/runner's otherwise now: it is titled by the `uses:` reference, lists the resolved inputs including `action.yml` defaults without empty ones, is shown for pre stages too, and post stages start with `Post job cleanup.`.

---------

Co-authored-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1345
Reviewed-by: silverwind <[email protected]>
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: bircni <[email protected]>
v5.2.3
2026-10-26 17:42:16 +00:00
silverwindandbircni dafe8d8d0c fix: keep dry runs off the docker daemon and speed up the tests (#1349)
Without a docker daemon six `act/runner` tests failed instead of passing. A dry run still created and removed job networks, the job teardown dropped the dry-run flag along with every other context value, and the container mocks asked the daemon for the runner arch.

This also speeds up the tests and CI without dropping assertions. Most of the time went to git and docker round trips, which are now pinned, batched or coalesced, and the dind and e2e steps cache or overlap more of their setup. On CI, `act/runner` went from 77s to 55s and `test-dind` from 108s to 55s. Locally, `act/runner` without docker went from 53s to 7s.

Split out of https://gitea.com/gitea/runner/pulls/1348, which adds Windows CI on top. The go cache changes moved to https://gitea.com/gitea/runner/pulls/1350.

Written by Claude Code.

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1349
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-26 17:25:17 +00:00
Zettat123 8ae48ae033 fix: keep the shared action cache as extracted, re-fetch damaged trees (#1352)
The toolkit patch rewrote bundles in place in the shared action cache. Since https://gitea.com/gitea/runner/pulls/1316 trees are never refreshed, so a bundle left truncated failed every later job using it.

Patched bundles now only overwrite the job container's copy, so the runner no longer writes to an extracted tree.

Extraction records each file's size beside the tree, and a tree that no longer matches is fetched again, offline mode included, as a missing one always was. This also catches damage from outside the runner, such as storage losing a write, for a stat per file, a fraction of the copy each stage already makes. Trees from older runners have no record and download once more, except in offline mode, which keeps using them as before.

Generated with Claude Code.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1352
Reviewed-by: Lunny Xiao <[email protected]>
Reviewed-by: bircni <[email protected]>
Co-authored-by: Zettat123 <[email protected]>
2026-10-26 17:20:53 +00:00
Renovate Bot 8dd3776014 chore(deps): update dependencies (#1351)
Co-authored-by: Renovate Bot <[email protected]>
2026-10-26 07:06:33 +00:00
silverwind c6ca020281 ci: implement gitea's cache-seeder (#1350)
Like Gitea's CI, only a `cache-seeder` workflow on main saves the go caches, all other jobs only restore them. Caches are scoped per repository, so until now any pull request, forks included, could write a cache that other runs restore. The seeder compiles the tests without running them, so no test result is ever cached.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1350
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-24 17:04:51 +00:00
silverwind fe2a66dc25 fix: align runner behaviours (#1338)
Contains a number of small bug fixes where jobs behaved differently from GitHub or failed silently.

1. Hooks fail on a refused `::set-env::` or `::add-path::` and no longer inherit the last step's identity
1. Docker build, exec and wait errors are returned instead of swallowed, token-only registry credentials work, logs of `--tty` services decode
1. Env files split lines like GitHub on each OS, so a carriage return is kept on Linux and CRLF ends a line on Windows, empty heredoc names or delimiters are rejected
1. Post steps run after their pre step even when main was skipped, composites see undeclared inputs, `runs.args` wins without `with.args` being parsed
1. Docker actions skip evaluating defaults of inputs given in `with` and read `entryPoint` and `args` in any case, a lowercase `dockerfile` is found, undeclared inputs get GitHub's warning
1. A user-set `CI` is kept, `GITHUB_REPOSITORY_ID` and the other missing `GITHUB_*` variables are exported
1. `timeout-minutes` can read the step's own `env`, a step-level `ACTIONS_ALLOW_UNSECURE_COMMANDS: false` beats a job-level `true` while the runner's own opt-in still wins, `pwsh` quotes the script path
1. A step `env:` given as one expression such as `${{ fromJSON(matrix.env) }}` is applied, `hashFiles` fails with GitHub's messages on script errors and after 120 seconds, a job image without node still gets an empty hash
1. A step whose command files cannot be reset fails instead of importing stale ones, a timeout between steps fails the job instead of reporting success
1. One named volume can be mounted at several paths, host-mode PTY steps keep their last output when they fail, host scratch directories are removed when job setup fails
1. Cancelling a step right after it starts kills its whole process tree
1. Cache prefix restores pick the newest entry created within the same second, also on S3, cache commits with a wrong size are rejected
1. Artifact chunks are written at their offset, download URLs are escaped, listing a run without artifacts no longer crashes
1. Poll backoff reaches `fetch_interval_max`, proxy passwords are masked in more forms, secrets are also masked in step names and in their quoted form in the runner log, a failed final report is logged
1. On Windows hosts a differently cased unsecure-commands opt-in or proxy variable counts, and an early cancel no longer leaks a job object handle
1. Interactive `register` prompts for a missing token and stops on SIGTERM, `exec --list --detect-event` no longer panics without events, `config set` works on `cache.s3` keys

Reviewed-on: https://gitea.com/gitea/runner/pulls/1338
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-23 09:18:24 +00:00
Zettat123 c719a88f36 fix(k8s): retry the startup exec until the kubelet accepts it (#1337)
A new node can run pods before its kubelet has a serving certificate, so the first exec into the job container fails with `error dialing backend: remote error: tls: internal error` and the job fails during setup.

That exec only reads the arch and PATH, so it now retries for up to a minute unless the API server rejects it (4xx) or the command ran.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1337
Reviewed-by: bircni <[email protected]>
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: Zettat123 <[email protected]>
v5.2.2
2026-10-22 20:59:48 +00:00
silverwind d882311ec6 refactor: remove dead code and consolidate tests (#1335)
Removes dead code and redundant logic and consolidates tests, so there is less to read and maintain. No behavior change.

1. **act/runner**: inline single-use wrappers, compile regexes once instead of per call, embed the trampoline as a string, drop the unused legacy result of `parseActionCommand`
2. **act/container**: `sanitizeConfig` and `mergeContainerConfigs` stop returning the configs they already mutate in place, drop never-set option fields and the unused `user` parameter of `ExecWithCmdLine`
3. **act/common and cache server**: drop the unused `Trace`/`Tracef` loggers and the short SHA of `FindGitRevision`, `RegisterJob` releases through `RevokeJob`
4. **daemon, poller and reporter**: one shutdown wait for both poll modes, drop an unreachable fetch timeout branch, guard the reporter's last report time with its existing lock instead of an atomic
5. **build**: drop unused Makefile and release workflow variables, collapse the goreleaser ignore list to the same build targets
6. **tests**: fold near-duplicate tests into tables with shared setup

Throughout, hand-rolled logic gives way to `cmp.Or`, `strings.Cut`, `slices` and `min`/`max`.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1335
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
v5.2.1
2026-10-22 19:41:10 +00:00
silverwind 923a0bfb59 refactor: remove bolthold and gofakes3 deps (#1336)
1. Replace bolthold with direct bbolt access in the cache server. bolthold has not changed since March 2024 and kept `encoding/gob` in the binary although the store was already JSON. The on-disk layout stays the same, so existing caches keep working, and the index buckets bolthold left behind are dropped on the first sweep. Queries now run against an in-memory copy of the entries that is only re-read after another process wrote to the store, so lookups and sweeps no longer decode the whole store.

2. Replace gofakes3 with a small in-memory S3 fake in the one test that used it, which removes aws-sdk-go-v2, afero, mgo and x/tools from the module graph.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1336
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-22 16:28:49 +00:00
silverwind 6f0d4f1b48 refactor: migrate to connect-go v2 (#1325)
Migrates the runner to `connectrpc.com/connect/v2` by pinning actionslib v1.5.0, which carries https://gitea.com/gitea/actionslib/pulls/28. The wire behaviour towards Gitea is unchanged and works against Gitea servers on connect v1 and v2. The client keeps v1's unlimited response size, and the error codes and messages the runner checks stay the same.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1325
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-21 16:10:58 +00:00
silverwindandbircni 430f7bb2cf fix: handle workflow commands like GitHub's runner (#1333)
Commands the runner applies itself, like the `::set-output::` older actions still print, showed up raw in the job log. The reporter also re-parsed every line with one job-wide stop-commands and echo state, while act keeps one command handler per step, stage, composite child and hook, as GitHub does. A `::stop-commands::` left active in one of them kept the reporter suppressed for the others, so their `::add-mask::` values were never registered, and post steps logged command lines twice.

- act's command handler decides what reaches the log, as GitHub's runner does: applied commands only under `ACTIONS_STEP_DEBUG` or `::echo::on`, `::stop-commands::` and its resume line shown with long tokens masked
- Masks go straight to the reporter, which no longer parses command lines
- One parser follows GitHub's rules: leading whitespace, `##[...]` anywhere in a line, registered commands only
- Service logs honour only `::add-mask::`

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1333
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-21 16:03:40 +00:00
silverwind befb1b4bb9 fix: improve the actions toolkit patching (#1328)
Patch the scripts beside each node action entrypoint too, so code-split bundles like rust-cache v2.9.2, setup-java v6 and setup-deno v2 reach the v2 cache API. Entrypoints may point anywhere in the action's repository, as `gradle/actions/setup-gradle` does with `../dist`.

The `.LOCALHOST` match is now anchored on the `.GHE.COM` test before it, so another library's uppercase localhost check is never rewritten.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1328
Reviewed-by: Lunny Xiao <[email protected]>
2026-10-21 05:26:32 +00:00
silverwind 1a7f09224f perf: speed up job setup, action preparation and the cache server (#1327)
- Look up containers by name instead of listing all of them
- On Linux, cache the docker proxy discovery instead of starting a probe container per job
- Download a job's actions concurrently and share identical fetches between concurrent jobs
- Cache `runner.arch` per run and poll service health every 250ms
- Cache server: queue on an in-process lock instead of polling the database file lock, upload S3 objects up to 64MiB in one request and larger ones in 4 concurrent parts

| `exec`, median of 5 | Before | After |
|---|---:|---:|
| 1 step | 1.70s | 0.87s |
| 10 steps | 2.84s | 1.97s |
| Service + step | 3.78s | 2.18s |
| checkout + Node action | 3.64s | 2.52s |

Reviewed-on: https://gitea.com/gitea/runner/pulls/1327
Reviewed-by: Zettat123 <[email protected]>
2026-10-21 05:12:54 +00:00
bircni af2b3f6df5 fix(deps): update go toolchain directive to v1.27.3 (#1332)
Go 1.27.3 includes a crypto/x509 security fix that distrusts a set of intermediate certificates (https://github.com/golang/go/issues/82345), so release builds need the new toolchain.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1332
Reviewed-by: TheFox0x7 <[email protected]>
v5.2.0
2026-10-20 19:31:44 +00:00
silverwindandbircni 785313cc21 build: drop the xgo release targets (#1329)
Releases are built by goreleaser with `CGO_ENABLED=0`, so the xgo `release*` Makefile targets and their gxz compression are unused. Gitea dropped xgo the same way in https://github.com/go-gitea/gitea/pull/37828.

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1329
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-20 16:21:47 +00:00
silverwind 41f1e08bec chore(deps): bump the pins Renovate does not update (#1330)
Renovate gets no release timestamps for Docker Hub images with more than 1000 tags (https://github.com/renovatebot/renovate/issues/46925) or for quay.io, so the 5-day minimum release age holds them back forever. The e2e workflows, the Kubernetes examples and the toolkit test pins are outside its managers, so these are bumped by hand.

The builder follows the current Alpine instead of the frozen 3.23.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1330
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-20 16:14:16 +00:00
silverwindandbircni 4158e05dae refactor: drop logrus and other direct dependencies (#1319)
After https://gitea.com/gitea/runner/pulls/1304, logrus stayed only to forward logs from docker/cli and moby/go-archive. The runner used a small part of those: volume parsing, the build context tar, the `ssh://` connection and registry credentials. Own code that matches them replaces them, so logrus leaves the module graph. docker/cli stays for its logrus-free `opts` and `connhelper/ssh` packages.

Other dependencies that the standard library or existing ones cover go too: mergo, httprouter (replaced by `http.ServeMux`), retry-go, go-isatty, go-selinux, container-device-interface, gotest.tools and go-cmp (replaced by testify). The binary shrinks by 5%.

Behaviour differences:

1. An unreadable file in a build context is skipped with a warning, where go-archive left a truncated tar.
2. Build contexts no longer carry `security.capability` xattrs.
3. The cache and artifact servers answer HEAD on GET routes, and no longer redirect trailing slashes or answer OPTIONS.

*Written by Claude.*

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1319
Reviewed-by: bircni <[email protected]>
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-18 18:57:08 +00:00
silverwind e356c2ed85 chore(config): update stale go-yaml wrapping comment (#1324)
https://github.com/yaml/go-yaml/pull/441 fixed the wrapping bug this comment waited for, so reword it. `WithLineWidth(-1)` stays, `config edit` re-encodes the whole file and wrapping would reflow every long value.

Gitea: https://github.com/go-gitea/gitea/pull/39844

This PR was written with Claude.
Reviewed-on: https://gitea.com/gitea/runner/pulls/1324
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-18 13:15:28 +00:00
silverwindandbircni ed940db4f0 fix: don't fail host steps over a leftover holding their output (#1323)
A successful host step whose background child kept its output open failed with `exec: WaitDelay expired before I/O complete`. Like GitHub's runner (`ProcessExitedHandler` in https://github.com/actions/runner/blob/main/src/Runner.Sdk/ProcessInvoker.cs), the step now succeeds after the drain timeout.

The leftover is killed only on Windows, as GitHub does there. A step whose timeout or cancellation hits during the drain still fails.

Fixes: https://gitea.com/gitea/runner/issues/1290
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1323
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-17 09:03:48 +00:00
Zettat123andsilverwind 755af87095 enhance(k8s): reach Kubernetes services by their id when it is a DNS subdomain (#1320)
On Kubernetes a service is reached by its id made a DNS label, so some service ids might become unreachable. For example, the `devstoreaccount1.azurite.local` service of Gitea's [MSSQL tests](https://github.com/go-gitea/gitea/blob/2fe74d3cdd5184a7e22e32e47772caa78d077489/.github/workflows/pull-db-tests.yml#L229) is only in the pod's hosts as `devstoreaccount1-azurite-local`, while the tests connect to the id as written. Container names must be DNS labels, but `hostAliases` accepts DNS subdomains, so an id that is one is now added there too, and to `no_proxy`, as on Docker where a service is reached by its id.

The warning for a service not reachable by its id now also covers ids that differ only in case, as Kubernetes hostnames are lowercase.

---------

Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1320
Reviewed-by: Lunny Xiao <[email protected]>
Reviewed-by: bircni <[email protected]>
Reviewed-by: silverwind <[email protected]>
Co-authored-by: Zettat123 <[email protected]>
2026-10-17 04:09:17 +00:00
silverwind b9aa47d1a5 fix(deps): bump go-yaml to fix block and folded scalar round-trips (#1321)
Bumps go-yaml to its main branch and drops the workaround it makes obsolete, matching https://github.com/go-gitea/gitea/pull/39787.

- go-yaml main keeps block scalar indentation indicators (https://github.com/yaml/go-yaml/pull/414), so values with a leading newline no longer need quoting
- `config edit` no longer wraps lines, because go-yaml still wraps more-indented lines of folded scalars and turns a space into a newline

Reviewed-on: https://gitea.com/gitea/runner/pulls/1321
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-16 21:34:11 +00:00
silverwind 0d84ec6dab fix: remove the job network even when container removal overruns (#1318)
Job teardown ran every step on one shared minute. When removing the job container took longer, the network removal ran on an expired context and the network stayed behind until the orphan reclaim, which only takes networks older than `workdir_cleanup_age`, 24h by default. All that time it held a subnet of the daemon's address pool.

The job and service containers are now removed in parallel, and the docker proxy sweep, the network and the volumes get a fresh budget after them. The idle reclaim takes unused networks and volumes once they are 10 minutes old, and network removal treats a network that is already gone as removed.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1318
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
v5.1.1
2026-10-15 14:15:41 +00:00
silverwind b769a9765f perf: download actions as archives once per job (#1316)
Each step refreshed its own clone of an action, so a composite using one action repository ten times fetched it ten times per job, and a single network error failed the job.

Like actions/runner, a job now downloads each action repository and ref once, as an archive extracted into a directory per commit. Each action still gets its own copy in the job container. This restores the per-job dedupe of https://gitea.com/gitea/runner/pulls/1178, which only reached a since-deleted branch.

How a download works:

1. The action URL is taken after `insteadOf` rewriting, as git would use it.
2. The archive comes from `<url>/archive/<ref>.tar.gz`, or from codeload.github.com for github.com, as for actions/runner.
3. A cached tag or branch is revalidated with its ETag, which GitHub and Gitea 28+ answer with a 304. A cached commit pin needs no request.
4. Transient failures (5xx, 408, 429 honouring `Retry-After`, dropped transfers) are retried three times with a 10 to 30 second backoff.
5. Git takes over, cloning and exporting the commit into the same directory layout, when the URL is not HTTP(S), the ref is a short commit, the host serves no usable archive, the host cannot be connected to, or the retries run out.

Median of 3 runs, git (shallow clone, then fetch) against archives, on a cold and a warm cache:

| Action | git cold | git warm | archive cold | archive warm |
|---|---|---|---|---|
| github.com actions/checkout@v4 | 937ms | 726ms | 286ms | 171ms |
| github.com actions/cache@v4 | 1006ms | 801ms | 516ms | 161ms |
| github.com actions/setup-node@v4 | 1046ms | 786ms | 463ms | 156ms |
| gitea.com actions/checkout@v4 | 2007ms | 1165ms | 667ms | 222ms |

The action cache layout changes, so existing caches download once more.

*Written by Claude.*

Fixes: https://gitea.com/gitea/runner/issues/1220
Reviewed-on: https://gitea.com/gitea/runner/pulls/1316
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-15 12:49:37 +00:00
9c4c66e70f enhance(report): add runner.log_report_level for the uploaded runner messages (#1310)
The runner's own messages between steps (not step output) were uploaded to the job log at `log.level`, so raising `log.level` for local debugging also changed what workflow authors see in Gitea, and lowering it hid messages from them.

Add `runner.log_report_level` to set that independently. Unset, it still follows `log.level`, so existing setups behave as before. An invalid value is rejected when the config loads.

Assisted-by: Codet
Assisted-by: Claude Code:claude-opus-5-5
Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1310
Co-authored-by: Lunny Xiao <[email protected]>
2026-10-14 14:15:26 +00:00
silverwind 42858c61df fix: stop pruning the cached action ref on refresh (#1312)
The action cache refresh fetched with `--prune` and the unqualified refspec `+<ref>:refs/runner/<hash>`. Git cannot map that ref back to a remote ref, so it deleted it on every other refresh. The first job after a branch or tag moved then failed with `cannot lock ref`, and a moved tag in a full clone could silently run its old commit. `--no-prune` fixes this and also overrides an inherited `fetch.prune`.

Fixes: https://gitea.com/gitea/runner/issues/1311
Reviewed-on: https://gitea.com/gitea/runner/pulls/1312
Reviewed-by: Lunny Xiao <[email protected]>
Reviewed-by: Zettat123 <[email protected]>
2026-10-14 13:15:01 +00:00
470969dc74 chore(deps): update actionslib to v1.4.1 (#1313)
actionslib v1.4.1 no longer logs through logrus, so the workflow model no longer needs the logrus bridge. The bridge stays for docker/cli and moby/go-archive, which still log through logrus's global logger; the comment now says so.

actionslib now logs through slog's global logger, which the runner did not capture. A new slog bridge forwards it to the process-wide logger, so its messages keep the runner's level, format and secret masking.

Assisted-by: Codet
Co-authored-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1313
Reviewed-by: silverwind <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
v5.1.0
2026-10-14 12:09:48 +00:00
silverwind be7ddcd15a fix: give each docker proxy its own job label key (#1314)
A runner nested behind another runner's docker proxy, as in gitea.com CI, had its `com.gitea.runner.job` label overwritten by the outer proxy, so its job cleanup removed nothing. This failed `TestDockerProxyWithDaemon` depending on the CI host, for example on https://gitea.com/gitea/runner/pulls/1312.

Each proxy now sets `com.gitea.runner.job.<job>` and cleans up by that key, so nested proxies keep each other's. This replaces the `com.gitea.runner.job=<job>` label.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1314
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-14 08:00:17 +00:00
Lunny Xiaoandbircni c3c647ef83 test: use t.Context() instead of context.Background() (#1306)
The test context is cancelled when the test ends, so anything still holding it stops instead of leaking into the next test. Uses inside `t.Cleanup`, `defer` and `go func` blocks are left alone, as the context is already cancelled there.

Stacked on https://gitea.com/gitea/runner/pulls/1305.

Assisted-by: Codet
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1306
Reviewed-by: bircni <[email protected]>
2026-10-12 21:11:17 +00:00
bircni 160e18e705 enhance: report the steps of a task as they run (#1293)
Gitea derives the steps of a job from the workflow file, so the `pre` and `post` steps of actions only show up inside "Set up job" and "Complete job", see https://github.com/go-gitea/gitea/issues/24604.

The runner now also reports the steps as it runs them (https://gitea.com/gitea/actions-proto-def/pulls/19): "Set up job", a "Pre" and "Post" step for each action that has one, the workflow steps with their evaluated names, and "Complete job", as actions/runner shows them. The per-step state Gitea reads today is unchanged, and the job log only moves "Complete job name" and "Matrix:" ahead of the pre steps, so older Gitea versions keep showing everything as before. Job hooks and containers stay part of "Set up job" and "Complete job".

The `replace` of `gitea.dev/actionslib` is swapped for the release once the proto change is merged.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1293
Reviewed-by: Zettat123 <[email protected]>
Co-authored-by: bircni <[email protected]>
2026-10-12 20:35:02 +00:00
silverwind 20c8b4abc4 refactor: replace go-git with the git CLI for gitignore filtering (#1309)
Replace go-git in `exec --use-gitignore` filtering with `git ls-files`. The git CLI is already required for action clones since https://gitea.com/gitea/runner/pulls/1277, so this drops `go-git` and 14 other modules, and filtering now follows git's own ignore rules.

Also stop deleting a remote action's `.gitignore` before copying it. Tracked files are never filtered, so the deletion only made copied actions differ from GitHub's action tarballs.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1309
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
2026-10-12 18:13:41 +00:00
Renovate Botandsilverwind ccb9afd7a5 chore(deps): update dependencies (#1308)
This PR contains the following updates:

| Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|---|
| [actions/setup-node](https://github.com/actions/setup-node) ([changelog](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020..949feb2413d6458794dcd2491c4babbbce0c15c1)) | action | digest | `8207627` → `949feb2` |  |  |  |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | require | patch | `v5.19.2` → `v5.19.3` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.19.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.19.2/v5.19.3?slim=true) |
| [github.com/moby/moby/api](https://github.com/moby/moby) | require | patch | `v1.56.0` → `v1.56.1` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmoby%2fmoby%2fapi/v1.56.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmoby%2fmoby%2fapi/v1.56.0/v1.56.1?slim=true) |
| [github.com/moby/moby/client](https://github.com/moby/moby) | require | patch | `v0.6.0` → `v0.6.1` | `v0.6.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmoby%2fmoby%2fclient/v0.6.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmoby%2fmoby%2fclient/v0.6.0/v0.6.1?slim=true) |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel/v1.47.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel/v1.46.0/v1.47.0?slim=true) |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel%2fexporters%2fotlp%2fotlptrace/v1.47.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel%2fexporters%2fotlp%2fotlptrace/v1.46.0/v1.47.0?slim=true) |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel%2fsdk/v1.47.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel%2fsdk/v1.46.0/v1.47.0?slim=true) |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel%2ftrace/v1.47.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel%2ftrace/v1.46.0/v1.47.0?slim=true) |
| [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | require | patch | `v1.11.0` → `v1.11.1` |  | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fproto%2fotlp/v1.11.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fproto%2fotlp/v1.11.0/v1.11.1?slim=true) |
| [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) | require | minor | [`v0.23.0` → `v0.24.0`](https://cs.opensource.google/go/x/sync/+/refs/tags/v0.23.0...refs/tags/v0.24.0) |  | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fsync/v0.24.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fsync/v0.23.0/v0.24.0?slim=true) |
| [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | require | minor | [`v0.48.0` → `v0.49.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.48.0...refs/tags/v0.49.0) |  | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fsys/v0.49.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fsys/v0.48.0/v0.49.0?slim=true) |
| [node](https://github.com/nodejs/node) |  | digest | `0e0ff40` → `d6aa754` |  |  |  |

---

### Release Notes

<details>
<summary>go-git/go-git (github.com/go-git/go-git/v5)</summary>

### [`v5.19.3`](https://github.com/go-git/go-git/releases/tag/v5.19.3)

[Compare Source](https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3)

#### What's Changed

- \[v5] git: repository, Ensure commondir is closed. by [@&#8203;arcaven](https://github.com/arcaven) in [#&#8203;2285](https://github.com/go-git/go-git/pull/2285)
- config: read repositoryformatversion in unmarshalCore by [@&#8203;c-tonneslan](https://github.com/c-tonneslan) in [#&#8203;2167](https://github.com/go-git/go-git/pull/2167)
- build: Update module github.com/go-git/go-git/v5 to v5.19.2 \[SECURITY] (releases/v5.x) by [@&#8203;go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#&#8203;2304](https://github.com/go-git/go-git/pull/2304)
- \[v5] plumbing: revlist, Skip path validation in the object walk by [@&#8203;r0h1tb](https://github.com/r0h1tb) in [#&#8203;2305](https://github.com/go-git/go-git/pull/2305)
- build: Update module golang.org/x/crypto to v0.55.0 \[SECURITY] (releases/v5.x) by [@&#8203;go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#&#8203;2348](https://github.com/go-git/go-git/pull/2348)
- \[v5] plumbing: transport/http, Contain credentials across redirects by [@&#8203;hiddeco](https://github.com/hiddeco) in [#&#8203;2358](https://github.com/go-git/go-git/pull/2358)
- build: Fix workflows for Go 1.27 (v5) by [@&#8203;pjbgf](https://github.com/pjbgf) in [#&#8203;2364](https://github.com/go-git/go-git/pull/2364)
- plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalformedPack in parallel by [@&#8203;akashchamp](https://github.com/akashchamp) in [#&#8203;2421](https://github.com/go-git/go-git/pull/2421)
- build: Update module golang.org/x/crypto to v0.56.0 \[SECURITY] (releases/v5.x) by [@&#8203;go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#&#8203;2357](https://github.com/go-git/go-git/pull/2357)
- plumbing: format/packfile, Break cyclic delta chains instead of recur… by [@&#8203;jgoosens](https://github.com/jgoosens) in [#&#8203;2340](https://github.com/go-git/go-git/pull/2340)
- build: Drop Go 1.25 by [@&#8203;pjbgf](https://github.com/pjbgf) in [#&#8203;2451](https://github.com/go-git/go-git/pull/2451)
- build: Update module github.com/go-git/go-billy/v5 to v5.9.2 (releases/v5.x) by [@&#8203;go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#&#8203;2467](https://github.com/go-git/go-git/pull/2467)
- build: Bump pjbgf/sha1cd to v0.7.0 by [@&#8203;pjbgf](https://github.com/pjbgf) in [#&#8203;2468](https://github.com/go-git/go-git/pull/2468)

#### New Contributors

- [@&#8203;arcaven](https://github.com/arcaven) made their first contribution in [#&#8203;2285](https://github.com/go-git/go-git/pull/2285)
- [@&#8203;c-tonneslan](https://github.com/c-tonneslan) made their first contribution in [#&#8203;2167](https://github.com/go-git/go-git/pull/2167)
- [@&#8203;r0h1tb](https://github.com/r0h1tb) made their first contribution in [#&#8203;2305](https://github.com/go-git/go-git/pull/2305)
- [@&#8203;akashchamp](https://github.com/akashchamp) made their first contribution in [#&#8203;2421](https://github.com/go-git/go-git/pull/2421)
- [@&#8203;jgoosens](https://github.com/jgoosens) made their first contribution in [#&#8203;2340](https://github.com/go-git/go-git/pull/2340)

**Full Changelog**: <https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3>

</details>

<details>
<summary>moby/moby (github.com/moby/moby/client)</summary>

### [`v0.6.1`](https://github.com/moby/moby/compare/v0.6.0...v0.6.1)

[Compare Source](https://github.com/moby/moby/compare/v0.6.0...v0.6.1)

</details>

<details>
<summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary>

### [`v1.47.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.47.0): /v0.69.0/v0.23.0/v0.1.0

[Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.46.0...v1.47.0)

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK.
Our project stability guarantees now apply to the following modules:

- `go.opentelemetry.io/otel/log`
- `go.opentelemetry.io/otel/sdk/log`

See our [versioning policy](https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md) for more information about these stability guarantees.

##### Added

- Add `String` method for `KeyValue` type in `go.opentelemetry.io/otel/attribute`. ([#&#8203;8205](https://github.com/open-telemetry/opentelemetry-go/issues/8205))
- Add `String` method for `Set` type in `go.opentelemetry.io/otel/attribute`. ([#&#8203;8347](https://github.com/open-telemetry/opentelemetry-go/issues/8347))
- Add `WithMaxExportBatchSize` to `go.opentelemetry.io/otel/sdk/metric` to configure the maximum export batch size for `PeriodicReader`. ([#&#8203;8960](https://github.com/open-telemetry/opentelemetry-go/issues/8960))
- Add `WithAttributeValueDepthLimit`, `DefaultAttributeValueDepthLimit`, and `SpanLimits.AttributeValueDepthLimit` in `go.opentelemetry.io/otel/sdk/trace` to configure the maximum depth of span, event, link, and instrumentation scope attribute values. ([#&#8203;8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938))
- Add `WithAttributeValueDepthLimit` in `go.opentelemetry.io/otel/sdk/log` to configure the maximum depth of log record and instrumentation scope attribute values. ([#&#8203;8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938))
- Add `WithMaxResponseSize` to `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`,
  `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and
  `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#&#8203;8941](https://github.com/open-telemetry/opentelemetry-go/issues/8941))
- Add experimental `ProbabilitySampler` in `go.opentelemetry.io/otel/sdk/trace/x` that conforms to the [OpenTelemetry specification's threshold-based sampling algorithm](https://opentelemetry.io/docs/specs/otel/trace/sdk/#probabilitysampler). ([#&#8203;8123](https://github.com/open-telemetry/opentelemetry-go/issues/8123))
- Add experimental `*Binder` extension interfaces in `go.opentelemetry.io/otel/metric/x` for instruments that support binding attributes ahead of time. ([#&#8203;8760](https://github.com/open-telemetry/opentelemetry-go/issues/8760))
- Add the experimental `Finisher` synchronous metric instrument extension interface to `go.opentelemetry.io/otel/metric/x`. ([#&#8203;8906](https://github.com/open-telemetry/opentelemetry-go/issues/8906))

##### Changed

- Use the [OpenTelemetry Attribute Collection representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#attribute-collection-representation-for-non-otlp) for metric data diffs in `go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest`. ([#&#8203;8993](https://github.com/open-telemetry/opentelemetry-go/issues/8993))
- Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in `go.opentelemetry.io/otel/sdk/trace` and `go.opentelemetry.io/otel/sdk/log`. ([#&#8203;8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938))
- Reduce allocations when applying attribute value length limits in `go.opentelemetry.io/otel/sdk/trace` and `go.opentelemetry.io/otel/sdk/log` by rebuilding composite values only when truncation is needed. ([#&#8203;8912](https://github.com/open-telemetry/opentelemetry-go/issues/8912))
- Decode `traceparent` using a hex lookup table in `go.opentelemetry.io/otel/propagation`, which rejects the specification-disallowed upper-case characters without a separate scan of the header. ([#&#8203;8739](https://github.com/open-telemetry/opentelemetry-go/issues/8739))
- Decode all characters at constant indices in `TraceIDFromHex` and `SpanIDFromHex` in `go.opentelemetry.io/otel/trace` to eliminate bounds checks. ([#&#8203;8740](https://github.com/open-telemetry/opentelemetry-go/issues/8740))

##### Fixed

- Count valid U+FFFD replacement characters toward attribute value length limits in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/sdk/trace`, and `go.opentelemetry.io/otel/sdk/log`.
- Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/sdk/trace`, and `go.opentelemetry.io/otel/sdk/log`. ([#&#8203;9054](https://github.com/open-telemetry/opentelemetry-go/issues/9054))
- Fix a data race in `NewPeriodicReader` where `r.inst` was assigned after the background goroutine was launched in `go.opentelemetry.io/otel/sdk/metric`. ([#&#8203;9028](https://github.com/open-telemetry/opentelemetry-go/issues/9028))
- Prevent precision loss for large `int64` values in `Sum`, `Histogram`, and `ExponentialHistogram` aggregations in `go.opentelemetry.io/otel/sdk/metric`. ([#&#8203;8981](https://github.com/open-telemetry/opentelemetry-go/issues/8981))
- Ensure `grpc.DialOption` values passed via `WithDialOption` take precedence over conflicting internally-computed defaults in
  `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`,
  `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`, and
  `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#&#8203;8805](https://github.com/open-telemetry/opentelemetry-go/issues/8805), [#&#8203;8834](https://github.com/open-telemetry/opentelemetry-go/issues/8834), [#&#8203;8836](https://github.com/open-telemetry/opentelemetry-go/issues/8836))
- Treat overflowing `OTEL_METRIC_EXPORT_INTERVAL` and `OTEL_METRIC_EXPORT_TIMEOUT` values as invalid in `go.opentelemetry.io/otel/sdk/metric`. ([#&#8203;8800](https://github.com/open-telemetry/opentelemetry-go/issues/8800))
- Prevent a panic in `NewFixedSizeReservoir` and `FixedSizeReservoirProvider` when given a negative size in `go.opentelemetry.io/otel/sdk/metric/exemplar`; negative sizes are now clamped to zero, consistent with a size of zero. ([#&#8203;8832](https://github.com/open-telemetry/opentelemetry-go/issues/8832))
- Preserve exponential histogram `ZeroThreshold` during OTLP metric export in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#&#8203;8801](https://github.com/open-telemetry/opentelemetry-go/issues/8801))
- Ensure metric helpers in `go.opentelemetry.io/otel/semconv/v1.32.0`, `go.opentelemetry.io/otel/semconv/v1.33.0`, and `go.opentelemetry.io/otel/semconv/v1.34.0` record measurements only once when no attributes are provided. ([#&#8203;8849](https://github.com/open-telemetry/opentelemetry-go/issues/8849))
- Treat empty `OTEL_TRACES_SAMPLER` and `OTEL_TRACES_SAMPLER_ARG` values as unset in `go.opentelemetry.io/otel/sdk/trace`. ([#&#8203;8873](https://github.com/open-telemetry/opentelemetry-go/issues/8873))
- Normalize global `OTEL_EXPORTER_OTLP_ENDPOINT` path joining in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` so trailing-slash base URLs do not produce double-slash log export paths. ([#&#8203;8864](https://github.com/open-telemetry/opentelemetry-go/issues/8864))
- Prevent a deadlock when formatting an error passed to `RecordError` calls back into the span in `go.opentelemetry.io/otel/sdk/trace`. ([#&#8203;8815](https://github.com/open-telemetry/opentelemetry-go/issues/8815))
- Prevent `SimpleSpanProcessor.Shutdown` from panicking when constructed with a nil exporter in `go.opentelemetry.io/otel/sdk/trace`. ([#&#8203;8844](https://github.com/open-telemetry/opentelemetry-go/issues/8844))
- Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in `go.opentelemetry.io/otel/exporters/prometheus`. ([#&#8203;8839](https://github.com/open-telemetry/opentelemetry-go/issues/8839))
- Retain instrument advisory attributes configured with `go.opentelemetry.io/otel/metric/x.WithDefaultAttributes` when a matching View in `go.opentelemetry.io/otel/sdk/metric` does not specify an attribute filter. ([#&#8203;8859](https://github.com/open-telemetry/opentelemetry-go/issues/8859))
- Ignore HTTP URL paths when building OTLP/gRPC metric exporter targets from `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`, while preserving `unix://` and `unix-abstract://` targets; treat `unix-abstract://` endpoints as insecure in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` and `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#&#8203;8862](https://github.com/open-telemetry/opentelemetry-go/issues/8862))
- Ignore HTTP(S) paths when deriving gRPC trace exporter endpoints from `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#&#8203;8852](https://github.com/open-telemetry/opentelemetry-go/issues/8852))
- Bound memory used while parsing dense W3C property metadata by storing it compactly and materializing `Property` values on demand in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`.

##### Removed

- Remove the experimental `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE` environment variable in `go.opentelemetry.io/otel/sdk/metric`.
  Use the `WithMaxExportBatchSize` option instead. ([#&#8203;8960](https://github.com/open-telemetry/opentelemetry-go/issues/8960))

##### What's Changed

- Prevent panic in FixedSizeReservoir for negative sizes by [@&#8203;chiliec](https://github.com/chiliec) in [#&#8203;8832](https://github.com/open-telemetry/opentelemetry-go/pull/8832)
- fix(metric): reject overflowing export durations by [@&#8203;maithilijoshi20](https://github.com/maithilijoshi20) in [#&#8203;8800](https://github.com/open-telemetry/opentelemetry-go/pull/8800)
- chore(deps): update module github.com/gofrs/flock to v0.13.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8885](https://github.com/open-telemetry/opentelemetry-go/pull/8885)
- chore(deps): update module github.com/4meepo/tagalign to v1.4.4 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8900](https://github.com/open-telemetry/opentelemetry-go/pull/8900)
- fix(deps): update googleapis to [`18b4a75`](https://github.com/open-telemetry/opentelemetry-go/commit/18b4a75) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8907](https://github.com/open-telemetry/opentelemetry-go/pull/8907)
- fix(deps): update module github.com/prometheus/client\_model to v0.6.3 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8908](https://github.com/open-telemetry/opentelemetry-go/pull/8908)
- chore(deps): update module github.com/prometheus/procfs to v0.22.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8894](https://github.com/open-telemetry/opentelemetry-go/pull/8894)
- chore(deps): update module github.com/godoc-lint/godoc-lint to v0.11.4 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8897](https://github.com/open-telemetry/opentelemetry-go/pull/8897)
- chore(deps): update github.com/charmbracelet/ultraviolet digest to [`d60c349`](https://github.com/open-telemetry/opentelemetry-go/commit/d60c349) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8909](https://github.com/open-telemetry/opentelemetry-go/pull/8909)
- fix(deps): update module github.com/prometheus/common to v0.71.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8911](https://github.com/open-telemetry/opentelemetry-go/pull/8911)
- chore(deps): update golang.org/x/telemetry digest to [`86cb573`](https://github.com/open-telemetry/opentelemetry-go/commit/86cb573) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8895](https://github.com/open-telemetry/opentelemetry-go/pull/8895)
- fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`7bb06b0`](https://github.com/open-telemetry/opentelemetry-go/commit/7bb06b0) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8902](https://github.com/open-telemetry/opentelemetry-go/pull/8902)
- chore(deps): update module github.com/timonwong/loggercheck to v0.12.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8898](https://github.com/open-telemetry/opentelemetry-go/pull/8898)
- \[otlptracegrpc] Grpc dialoption override bug by [@&#8203;ps-mir](https://github.com/ps-mir) in [#&#8203;8805](https://github.com/open-telemetry/opentelemetry-go/pull/8805)
- otlpmetricgrpc: fix preference for user supplied dialOptions by [@&#8203;ps-mir](https://github.com/ps-mir) in [#&#8203;8834](https://github.com/open-telemetry/opentelemetry-go/pull/8834)
- Do not panic on nil exporter in SimpleSpanProcessor.Shutdown by [@&#8203;ShreeyashPatil2708](https://github.com/ShreeyashPatil2708) in [#&#8203;8844](https://github.com/open-telemetry/opentelemetry-go/pull/8844)
- \[chore] Add doc comments to exported internal symbols (1/N) by [@&#8203;om7057](https://github.com/om7057) in [#&#8203;8752](https://github.com/open-telemetry/opentelemetry-go/pull/8752)
- \[chore] Add doc comments to exported internal symbols (3/N) by [@&#8203;om7057](https://github.com/om7057) in [#&#8203;8869](https://github.com/open-telemetry/opentelemetry-go/pull/8869)
- \[chore] docs: mark Logs as release candidate by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8910](https://github.com/open-telemetry/opentelemetry-go/pull/8910)
- chore(deps): update module github.com/mattn/go-runewidth to v0.0.29 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8917](https://github.com/open-telemetry/opentelemetry-go/pull/8917)
- chore(deps): update github.com/charmbracelet/ultraviolet digest to [`af8eda3`](https://github.com/open-telemetry/opentelemetry-go/commit/af8eda3) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8915](https://github.com/open-telemetry/opentelemetry-go/pull/8915)
- chore(deps): update github.com/golangci/rowserrcheck digest to [`241134d`](https://github.com/open-telemetry/opentelemetry-go/commit/241134d) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8913](https://github.com/open-telemetry/opentelemetry-go/pull/8913)
- fix(deps): update module go.opentelemetry.io/collector/pdata to v1.66.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8918](https://github.com/open-telemetry/opentelemetry-go/pull/8918)
- chore(deps): update otel/weaver docker tag to v0.26.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8922](https://github.com/open-telemetry/opentelemetry-go/pull/8922)
- chore(deps): update open-telemetry/shared-workflows action to v0.13.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8921](https://github.com/open-telemetry/opentelemetry-go/pull/8921)
- chore(deps): update github.com/charmbracelet/ultraviolet digest to [`043ea8a`](https://github.com/open-telemetry/opentelemetry-go/commit/043ea8a) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8919](https://github.com/open-telemetry/opentelemetry-go/pull/8919)
- fix(otlploggrpc): honor custom dial option precedence by [@&#8203;jstar0](https://github.com/jstar0) in [#&#8203;8836](https://github.com/open-telemetry/opentelemetry-go/pull/8836)
- Define bound instrument API in metric/x by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8760](https://github.com/open-telemetry/opentelemetry-go/pull/8760)
- fix(prometheus): report invalid histogram scale errors by [@&#8203;jstar0](https://github.com/jstar0) in [#&#8203;8839](https://github.com/open-telemetry/opentelemetry-go/pull/8839)
- Add experimental metric Finisher interface by [@&#8203;MrAlias](https://github.com/MrAlias) in [#&#8203;8906](https://github.com/open-telemetry/opentelemetry-go/pull/8906)
- chore(deps): update github.com/charmbracelet/ultraviolet digest to [`ae99b73`](https://github.com/open-telemetry/opentelemetry-go/commit/ae99b73) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8923](https://github.com/open-telemetry/opentelemetry-go/pull/8923)
- chore(deps): update golang.org/x by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8920](https://github.com/open-telemetry/opentelemetry-go/pull/8920)
- sdk/trace/x: Add experimental `ProbabilitySampler` by [@&#8203;yuanyuanzhao3](https://github.com/yuanyuanzhao3) in [#&#8203;8123](https://github.com/open-telemetry/opentelemetry-go/pull/8123)
- sdk/trace/x: Adding GoDev badge. by [@&#8203;yuanyuanzhao3](https://github.com/yuanyuanzhao3) in [#&#8203;8927](https://github.com/open-telemetry/opentelemetry-go/pull/8927)
- perf(propagation): use a hex lookup table to decode traceparent by [@&#8203;itssaharsh](https://github.com/itssaharsh) in [#&#8203;8739](https://github.com/open-telemetry/opentelemetry-go/pull/8739)
- chore(deps): update github.com/charmbracelet/ultraviolet digest to [`0277a17`](https://github.com/open-telemetry/opentelemetry-go/commit/0277a17) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8931](https://github.com/open-telemetry/opentelemetry-go/pull/8931)
- fix(deps): update googleapis to [`f8649dd`](https://github.com/open-telemetry/opentelemetry-go/commit/f8649dd) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8929](https://github.com/open-telemetry/opentelemetry-go/pull/8929)
- chore(deps): update module github.com/dlclark/regexp2/v2 to v2.8.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8930](https://github.com/open-telemetry/opentelemetry-go/pull/8930)
- \[chore] Add doc comments to exported internal symbols (5/N) by [@&#8203;om7057](https://github.com/om7057) in [#&#8203;8934](https://github.com/open-telemetry/opentelemetry-go/pull/8934)
- \[chore] Add doc comments to exported internal symbols (4/N) by [@&#8203;om7057](https://github.com/om7057) in [#&#8203;8926](https://github.com/open-telemetry/opentelemetry-go/pull/8926)
- sdk: optimize composite attribute truncation by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8912](https://github.com/open-telemetry/opentelemetry-go/pull/8912)
- chore(deps): update module github.com/go-critic/go-critic to v0.15.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8924](https://github.com/open-telemetry/opentelemetry-go/pull/8924)
- chore(deps): update module go.augendre.info/fatcontext to v0.10.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8939](https://github.com/open-telemetry/opentelemetry-go/pull/8939)
- chore(deps): update module mvdan.cc/gofumpt to v0.12.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8935](https://github.com/open-telemetry/opentelemetry-go/pull/8935)
- chore(deps): update module dev.gaijin.team/go/exhaustruct/v5 to v5.2.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8928](https://github.com/open-telemetry/opentelemetry-go/pull/8928)
- fix(deps): update golang.org/x by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8936](https://github.com/open-telemetry/opentelemetry-go/pull/8936)
- chore(deps): update module github.com/ghostiam/protogetter to v1.0.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8940](https://github.com/open-telemetry/opentelemetry-go/pull/8940)
- fix(trace): avoid reentrant RecordError deadlock by [@&#8203;jstar0](https://github.com/jstar0) in [#&#8203;8815](https://github.com/open-telemetry/opentelemetry-go/pull/8815)
- \[chore] Add doc comments to exported internal symbols (6/6), remove exclusion by [@&#8203;om7057](https://github.com/om7057) in [#&#8203;8937](https://github.com/open-telemetry/opentelemetry-go/pull/8937)
- otlploghttp: normalize global endpoint path joining by [@&#8203;RedZapdos123](https://github.com/RedZapdos123) in [#&#8203;8864](https://github.com/open-telemetry/opentelemetry-go/pull/8864)
- sdk/trace: treat empty sampler env values as unset by [@&#8203;RedZapdos123](https://github.com/RedZapdos123) in [#&#8203;8873](https://github.com/open-telemetry/opentelemetry-go/pull/8873)
- Run full benchmarks weekly by [@&#8203;XSAM](https://github.com/XSAM) in [#&#8203;8932](https://github.com/open-telemetry/opentelemetry-go/pull/8932)
- fix(semconv): avoid duplicate metric recording without attributes by [@&#8203;jstar0](https://github.com/jstar0) in [#&#8203;8849](https://github.com/open-telemetry/opentelemetry-go/pull/8849)
- chore(deps): update module github.com/mattn/go-runewidth to v0.0.30 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8946](https://github.com/open-telemetry/opentelemetry-go/pull/8946)
- chore(deps): update ubuntu:26.04 docker digest to [`e5a4d62`](https://github.com/open-telemetry/opentelemetry-go/commit/e5a4d62) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8945](https://github.com/open-telemetry/opentelemetry-go/pull/8945)
- chore(deps): update github/codeql-action action to v4.38.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8944](https://github.com/open-telemetry/opentelemetry-go/pull/8944)
- chore(deps): update golang.org/x/telemetry digest to [`55ac43c`](https://github.com/open-telemetry/opentelemetry-go/commit/55ac43c) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8943](https://github.com/open-telemetry/opentelemetry-go/pull/8943)
- otlptracegrpc: fix env endpoint URL parsing by [@&#8203;RedZapdos123](https://github.com/RedZapdos123) in [#&#8203;8852](https://github.com/open-telemetry/opentelemetry-go/pull/8852)
- otlpmetricgrpc: preserve gRPC env endpoint targets by [@&#8203;RedZapdos123](https://github.com/RedZapdos123) in [#&#8203;8862](https://github.com/open-telemetry/opentelemetry-go/pull/8862)
- chore(deps): update module github.com/sourcegraph/go-diff to v0.9.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8947](https://github.com/open-telemetry/opentelemetry-go/pull/8947)
- feat(otlphttp): configure maximum response size by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8941](https://github.com/open-telemetry/opentelemetry-go/pull/8941)
- fix(otlpmetric): preserve exponential histogram zero threshold by [@&#8203;maithilijoshi20](https://github.com/maithilijoshi20) in [#&#8203;8801](https://github.com/open-telemetry/opentelemetry-go/pull/8801)
- chore(deps): update golang.org/x/telemetry digest to [`15ceca2`](https://github.com/open-telemetry/opentelemetry-go/commit/15ceca2) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8948](https://github.com/open-telemetry/opentelemetry-go/pull/8948)
- chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6c9e17d`](https://github.com/open-telemetry/opentelemetry-go/commit/6c9e17d) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8950](https://github.com/open-telemetry/opentelemetry-go/pull/8950)
- chore(deps): update module github.com/dave/dst to v0.28.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8949](https://github.com/open-telemetry/opentelemetry-go/pull/8949)
- fix(deps): update googleapis to [`f61a6ca`](https://github.com/open-telemetry/opentelemetry-go/commit/f61a6ca) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8951](https://github.com/open-telemetry/opentelemetry-go/pull/8951)
- chore(deps): update module github.com/nishanths/exhaustive to v0.13.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8953](https://github.com/open-telemetry/opentelemetry-go/pull/8953)
- chore(deps): update module github.com/xo/terminfo to v1.2.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8954](https://github.com/open-telemetry/opentelemetry-go/pull/8954)
- sdk/log: add queue\_full shutdown regression test by [@&#8203;RedZapdos123](https://github.com/RedZapdos123) in [#&#8203;8754](https://github.com/open-telemetry/opentelemetry-go/pull/8754)
- internal/tools/verifyreadmes: skip hidden dot-directories on Windows by [@&#8203;RedZapdos123](https://github.com/RedZapdos123) in [#&#8203;8729](https://github.com/open-telemetry/opentelemetry-go/pull/8729)
- sdk/metric: add internal finish-aware Sum lifecycle by [@&#8203;MrAlias](https://github.com/MrAlias) in [#&#8203;8925](https://github.com/open-telemetry/opentelemetry-go/pull/8925)
- sdk: limit nested attribute value depth by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8938](https://github.com/open-telemetry/opentelemetry-go/pull/8938)
- chore(deps): update codecov/codecov-action action to v7.1.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8966](https://github.com/open-telemetry/opentelemetry-go/pull/8966)
- fix(deps): update module go.opentelemetry.io/collector/pdata to v1.67.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8965](https://github.com/open-telemetry/opentelemetry-go/pull/8965)
- chore(deps): update open-telemetry/shared-workflows action to v0.14.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8961](https://github.com/open-telemetry/opentelemetry-go/pull/8961)
- Fix Alex Kats emeritus mention by [@&#8203;dmathieu](https://github.com/dmathieu) in [#&#8203;8933](https://github.com/open-telemetry/opentelemetry-go/pull/8933)
- sdk/metric: stabilize max batch size in PeriodicReader by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8960](https://github.com/open-telemetry/opentelemetry-go/pull/8960)
- chore(deps): update ubuntu:26.04 docker digest to [`61ebaa5`](https://github.com/open-telemetry/opentelemetry-go/commit/61ebaa5) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8968](https://github.com/open-telemetry/opentelemetry-go/pull/8968)
- sdk/metric: Retain advisory attributes when View has no AttributeFilter by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8859](https://github.com/open-telemetry/opentelemetry-go/pull/8859)
- chore(deps): update module github.com/ldez/tagliatelle to v0.8.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8970](https://github.com/open-telemetry/opentelemetry-go/pull/8970)
- sdk/metric: Document nil AttributeFilter behavior by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8971](https://github.com/open-telemetry/opentelemetry-go/pull/8971)
- chore: fix gofumpt extra-rules warning by [@&#8203;dmathieu](https://github.com/dmathieu) in [#&#8203;8942](https://github.com/open-telemetry/opentelemetry-go/pull/8942)
- chore(deps): update codecov/codecov-action action to v7.1.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8975](https://github.com/open-telemetry/opentelemetry-go/pull/8975)
- chore(deps): update module github.com/ldez/gomoddirectives to v0.10.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8974](https://github.com/open-telemetry/opentelemetry-go/pull/8974)
- sdk/trace/x: deduplicate tracestate combination error report in ProbabilitySampler by [@&#8203;alex131125](https://github.com/alex131125) in [#&#8203;8969](https://github.com/open-telemetry/opentelemetry-go/pull/8969)
- \[chore]: fix article and word typos in doc comments by [@&#8203;simpleqt](https://github.com/simpleqt) in [#&#8203;8972](https://github.com/open-telemetry/opentelemetry-go/pull/8972)
- \[chore]: fix two doc comments that name the wrong method by [@&#8203;simpleqt](https://github.com/simpleqt) in [#&#8203;8973](https://github.com/open-telemetry/opentelemetry-go/pull/8973)
- Update googleapis to [`eeb232e`](https://github.com/open-telemetry/opentelemetry-go/commit/eeb232e) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8983](https://github.com/open-telemetry/opentelemetry-go/pull/8983)
- sdk/metric: extract generic hotColdMap for delta aggregators by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8756](https://github.com/open-telemetry/opentelemetry-go/pull/8756)
- Update github/codeql-action action to v4.38.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8987](https://github.com/open-telemetry/opentelemetry-go/pull/8987)
- Update googleapis to [`cecb647`](https://github.com/open-telemetry/opentelemetry-go/commit/cecb647) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8986](https://github.com/open-telemetry/opentelemetry-go/pull/8986)
- \[chore]: remove CLAUDE.md in favor of AGENTS.md by [@&#8203;jarrensj](https://github.com/jarrensj) in [#&#8203;8988](https://github.com/open-telemetry/opentelemetry-go/pull/8988)
- test(internal/tools/verifyreadmes): add unit tests for verifyReadme by [@&#8203;marcschaeferger](https://github.com/marcschaeferger) in [#&#8203;8066](https://github.com/open-telemetry/opentelemetry-go/pull/8066)
- perf(trace): unroll hex decoders to drop bounds checks by [@&#8203;itssaharsh](https://github.com/itssaharsh) in [#&#8203;8740](https://github.com/open-telemetry/opentelemetry-go/pull/8740)
- sdk/metric: add canonical attribute identity by [@&#8203;MrAlias](https://github.com/MrAlias) in [#&#8203;8963](https://github.com/open-telemetry/opentelemetry-go/pull/8963)
- attribute: add Set.String by [@&#8203;iyiola-dev](https://github.com/iyiola-dev) in [#&#8203;8347](https://github.com/open-telemetry/opentelemetry-go/pull/8347)
- attribute: add String method for KeyValue by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8205](https://github.com/open-telemetry/opentelemetry-go/pull/8205)
- Update open-telemetry/shared-workflows action to v0.15.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8992](https://github.com/open-telemetry/opentelemetry-go/pull/8992)
- Update googleapis to [`b142276`](https://github.com/open-telemetry/opentelemetry-go/commit/b142276) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8991](https://github.com/open-telemetry/opentelemetry-go/pull/8991)
- Update golang.org/x/telemetry digest to [`bdcd072`](https://github.com/open-telemetry/opentelemetry-go/commit/bdcd072) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8990](https://github.com/open-telemetry/opentelemetry-go/pull/8990)
- Update module google.golang.org/grpc to v1.84.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8982](https://github.com/open-telemetry/opentelemetry-go/pull/8982)
- Update open-telemetry/shared-workflows action to v0.16.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8995](https://github.com/open-telemetry/opentelemetry-go/pull/8995)
- Update github.com/opentracing-contrib/go-grpc/test digest to [`c4b3818`](https://github.com/open-telemetry/opentelemetry-go/commit/c4b3818) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8994](https://github.com/open-telemetry/opentelemetry-go/pull/8994)
- Revert "Update module google.golang.org/grpc to v1.84.0 ([#&#8203;8982](https://github.com/open-telemetry/opentelemetry-go/issues/8982))" by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8997](https://github.com/open-telemetry/opentelemetry-go/pull/8997)
- metricdatatest: use attribute collection formatting by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;8993](https://github.com/open-telemetry/opentelemetry-go/pull/8993)
- Update github.com/charmbracelet/ultraviolet digest to [`4e49372`](https://github.com/open-telemetry/opentelemetry-go/commit/4e49372) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;8998](https://github.com/open-telemetry/opentelemetry-go/pull/8998)
- fix(sdk/metric): preserve int64 precision in sum and histogram aggregations by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8981](https://github.com/open-telemetry/opentelemetry-go/pull/8981)
- Update golang.org/x/telemetry digest to [`c6096d2`](https://github.com/open-telemetry/opentelemetry-go/commit/c6096d2) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9000](https://github.com/open-telemetry/opentelemetry-go/pull/9000)
- Fix OSS-Fuzz issues in FuzzHashKVs, FuzzGetBin, and FuzzSpanIDFromHex by [@&#8203;dashpole](https://github.com/dashpole) in [#&#8203;8996](https://github.com/open-telemetry/opentelemetry-go/pull/8996)
- Update github.com/timakin/bodyclose digest to [`98ded9a`](https://github.com/open-telemetry/opentelemetry-go/commit/98ded9a) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9003](https://github.com/open-telemetry/opentelemetry-go/pull/9003)
- Update module github.com/ProtonMail/go-crypto to v1.5.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9004](https://github.com/open-telemetry/opentelemetry-go/pull/9004)
- Update module github.com/ProtonMail/go-crypto to v1.5.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9021](https://github.com/open-telemetry/opentelemetry-go/pull/9021)
- Update golang.org/x/telemetry digest to [`9662f6f`](https://github.com/open-telemetry/opentelemetry-go/commit/9662f6f) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9020](https://github.com/open-telemetry/opentelemetry-go/pull/9020)
- Update module github.com/mgechev/revive to v1.17.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9022](https://github.com/open-telemetry/opentelemetry-go/pull/9022)
- Add ps-mir as an approver by [@&#8203;MrAlias](https://github.com/MrAlias) in [#&#8203;9018](https://github.com/open-telemetry/opentelemetry-go/pull/9018)
- Add Marc Schäfer as a project Triager by [@&#8203;MrAlias](https://github.com/MrAlias) in [#&#8203;9019](https://github.com/open-telemetry/opentelemetry-go/pull/9019)
- Update golang.org/x/telemetry digest to [`ed294f9`](https://github.com/open-telemetry/opentelemetry-go/commit/ed294f9) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9027](https://github.com/open-telemetry/opentelemetry-go/pull/9027)
- Update github/codeql-action action to v4.38.2 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9025](https://github.com/open-telemetry/opentelemetry-go/pull/9025)
- Update module github.com/golangci/golangci-lint/v2 to v2.14.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9026](https://github.com/open-telemetry/opentelemetry-go/pull/9026)
- Update github.com/charmbracelet/ultraviolet digest to [`b78653f`](https://github.com/open-telemetry/opentelemetry-go/commit/b78653f) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9036](https://github.com/open-telemetry/opentelemetry-go/pull/9036)
- Update github.com/charmbracelet/ultraviolet digest to [`bbf040a`](https://github.com/open-telemetry/opentelemetry-go/commit/bbf040a) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9037](https://github.com/open-telemetry/opentelemetry-go/pull/9037)
- Update module github.com/golangci/golines to v0.16.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9043](https://github.com/open-telemetry/opentelemetry-go/pull/9043)
- Update module github.com/prometheus/common to v0.72.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9044](https://github.com/open-telemetry/opentelemetry-go/pull/9044)
- Update module go.opentelemetry.io/collector/pdata to v1.68.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9046](https://github.com/open-telemetry/opentelemetry-go/pull/9046)
- Update module github.com/uudashr/iface to v1.5.2 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9042](https://github.com/open-telemetry/opentelemetry-go/pull/9042)
- Update module github.com/ProtonMail/go-crypto to v1.5.2 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9040](https://github.com/open-telemetry/opentelemetry-go/pull/9040)
- Update open-telemetry/shared-workflows action to v0.17.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9047](https://github.com/open-telemetry/opentelemetry-go/pull/9047)
- Update github.com/golangci/canonicalheader digest to [`e18e5c5`](https://github.com/open-telemetry/opentelemetry-go/commit/e18e5c5) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9039](https://github.com/open-telemetry/opentelemetry-go/pull/9039)
- Update googleapis to [`8a89bd6`](https://github.com/open-telemetry/opentelemetry-go/commit/8a89bd6) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9041](https://github.com/open-telemetry/opentelemetry-go/pull/9041)
- Update github.com/charmbracelet/ultraviolet digest to [`666ce5e`](https://github.com/open-telemetry/opentelemetry-go/commit/666ce5e) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9051](https://github.com/open-telemetry/opentelemetry-go/pull/9051)
- Remove retired Go Report Card badge from README by [@&#8203;kijimad](https://github.com/kijimad) in [#&#8203;9050](https://github.com/open-telemetry/opentelemetry-go/pull/9050)
- fix(sdk/metric): Fix data race with initialization of NewPeriodicReader by [@&#8203;CTrando](https://github.com/CTrando) in [#&#8203;9028](https://github.com/open-telemetry/opentelemetry-go/pull/9028)
- Update module github.com/dlclark/regexp2/v2 to v2.8.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9061](https://github.com/open-telemetry/opentelemetry-go/pull/9061)
- Update github.com/charmbracelet/ultraviolet digest to [`270558f`](https://github.com/open-telemetry/opentelemetry-go/commit/270558f) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9060](https://github.com/open-telemetry/opentelemetry-go/pull/9060)
- chore: Replace deprecated gofumpt extra-rules with extra options by [@&#8203;kijimad](https://github.com/kijimad) in [#&#8203;9062](https://github.com/open-telemetry/opentelemetry-go/pull/9062)
- Update module github.com/pjbgf/sha1cd to v0.7.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9064](https://github.com/open-telemetry/opentelemetry-go/pull/9064)
- Update github.com/golangci/rowserrcheck digest to [`f772fe6`](https://github.com/open-telemetry/opentelemetry-go/commit/f772fe6) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9066](https://github.com/open-telemetry/opentelemetry-go/pull/9066)
- Update github.com/charmbracelet/ultraviolet digest to [`8786532`](https://github.com/open-telemetry/opentelemetry-go/commit/8786532) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9065](https://github.com/open-telemetry/opentelemetry-go/pull/9065)
- Fix zero attribute value length for malformed UTF-8 by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;9054](https://github.com/open-telemetry/opentelemetry-go/pull/9054)
- Update module github.com/uudashr/iface to v1.5.3 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9067](https://github.com/open-telemetry/opentelemetry-go/pull/9067)
- Update ubuntu:26.04 Docker digest to [`88a381d`](https://github.com/open-telemetry/opentelemetry-go/commit/88a381d) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;9069](https://github.com/open-telemetry/opentelemetry-go/pull/9069)
- Release 1.47.0/0.69.0/0.23.0/0.1.0 by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;9024](https://github.com/open-telemetry/opentelemetry-go/pull/9024)

##### New Contributors

- [@&#8203;chiliec](https://github.com/chiliec) made their first contribution in [#&#8203;8832](https://github.com/open-telemetry/opentelemetry-go/pull/8832)
- [@&#8203;maithilijoshi20](https://github.com/maithilijoshi20) made their first contribution in [#&#8203;8800](https://github.com/open-telemetry/opentelemetry-go/pull/8800)
- [@&#8203;ps-mir](https://github.com/ps-mir) made their first contribution in [#&#8203;8805](https://github.com/open-telemetry/opentelemetry-go/pull/8805)
- [@&#8203;ShreeyashPatil2708](https://github.com/ShreeyashPatil2708) made their first contribution in [#&#8203;8844](https://github.com/open-telemetry/opentelemetry-go/pull/8844)
- [@&#8203;alex131125](https://github.com/alex131125) made their first contribution in [#&#8203;8969](https://github.com/open-telemetry/opentelemetry-go/pull/8969)
- [@&#8203;simpleqt](https://github.com/simpleqt) made their first contribution in [#&#8203;8972](https://github.com/open-telemetry/opentelemetry-go/pull/8972)
- [@&#8203;jarrensj](https://github.com/jarrensj) made their first contribution in [#&#8203;8988](https://github.com/open-telemetry/opentelemetry-go/pull/8988)
- [@&#8203;iyiola-dev](https://github.com/iyiola-dev) made their first contribution in [#&#8203;8347](https://github.com/open-telemetry/opentelemetry-go/pull/8347)
- [@&#8203;kijimad](https://github.com/kijimad) made their first contribution in [#&#8203;9050](https://github.com/open-telemetry/opentelemetry-go/pull/9050)
- [@&#8203;CTrando](https://github.com/CTrando) made their first contribution in [#&#8203;9028](https://github.com/open-telemetry/opentelemetry-go/pull/9028)

**Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.47.0-rc.1...v1.47.0>

</details>

<details>
<summary>open-telemetry/opentelemetry-proto-go (go.opentelemetry.io/proto/otlp)</summary>

### [`v1.11.1`](https://github.com/open-telemetry/opentelemetry-proto-go/releases/tag/v1.11.1): /v0.4.1

[Compare Source](https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.11.0...v1.11.1)

Generated Go code for the [`v1.11.1`][otlp] version of the OTLP.

[otlp]: https://github.com/open-telemetry/opentelemetry-proto/releases/tag/v1.11.1

#### What's Changed

- chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;664](https://github.com/open-telemetry/opentelemetry-proto-go/pull/664)
- chore(deps): update ossf/scorecard-action action to v2.4.4 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;663](https://github.com/open-telemetry/opentelemetry-proto-go/pull/663)
- chore(deps): update googleapis to [`3fe39f3`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/3fe39f3) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;662](https://github.com/open-telemetry/opentelemetry-proto-go/pull/662)
- chore(deps): update googleapis to [`b2f2020`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/b2f2020) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;665](https://github.com/open-telemetry/opentelemetry-proto-go/pull/665)
- chore(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;666](https://github.com/open-telemetry/opentelemetry-proto-go/pull/666)
- chore(deps): update googleapis to [`6c54ddd`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/6c54ddd) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;667](https://github.com/open-telemetry/opentelemetry-proto-go/pull/667)
- chore(deps): update google.golang.org/genproto/googleapis/api digest to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8efbd57) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;670](https://github.com/open-telemetry/opentelemetry-proto-go/pull/670)
- chore(deps): update module github.com/go-git/go-git/v5 to v5.19.2 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;669](https://github.com/open-telemetry/opentelemetry-proto-go/pull/669)
- chore(deps): update google.golang.org/genproto/googleapis/rpc digest to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8efbd57) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;671](https://github.com/open-telemetry/opentelemetry-proto-go/pull/671)
- chore(deps): update github/codeql-action action to v4.37.4 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;673](https://github.com/open-telemetry/opentelemetry-proto-go/pull/673)
- fix(deps): update module google.golang.org/grpc to v1.83.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;672](https://github.com/open-telemetry/opentelemetry-proto-go/pull/672)
- chore: Change Renovate configuration to best practices by [@&#8203;thompson-tomo](https://github.com/thompson-tomo) in [#&#8203;674](https://github.com/open-telemetry/opentelemetry-proto-go/pull/674)
- chore(deps): pin dependencies by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;677](https://github.com/open-telemetry/opentelemetry-proto-go/pull/677)
- chore(deps): update github/codeql-action action to v4.37.5 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;676](https://github.com/open-telemetry/opentelemetry-proto-go/pull/676)
- chore(deps): update googleapis to [`6ac0973`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/6ac0973) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;678](https://github.com/open-telemetry/opentelemetry-proto-go/pull/678)
- chore(deps): update github/codeql-action action to v4.37.6 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;679](https://github.com/open-telemetry/opentelemetry-proto-go/pull/679)
- ci: add shared security scanning workflow by [@&#8203;opentelemetrybot](https://github.com/opentelemetrybot) in [#&#8203;675](https://github.com/open-telemetry/opentelemetry-proto-go/pull/675)
- chore(deps): update open-telemetry/shared-workflows action to v0.5.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;682](https://github.com/open-telemetry/opentelemetry-proto-go/pull/682)
- chore(deps): update module github.com/cloudflare/circl to v1.6.5 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;681](https://github.com/open-telemetry/opentelemetry-proto-go/pull/681)
- fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;680](https://github.com/open-telemetry/opentelemetry-proto-go/pull/680)
- chore(deps): update googleapis to [`c8921c7`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/c8921c7) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;684](https://github.com/open-telemetry/opentelemetry-proto-go/pull/684)
- chore(deps): update open-telemetry/shared-workflows action to v0.6.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;683](https://github.com/open-telemetry/opentelemetry-proto-go/pull/683)
- chore(deps): update googleapis to [`ec0a776`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/ec0a776) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;685](https://github.com/open-telemetry/opentelemetry-proto-go/pull/685)
- fix(deps): update module google.golang.org/protobuf to v1.36.12 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;686](https://github.com/open-telemetry/opentelemetry-proto-go/pull/686)
- chore(deps): update module golang.org/x/mod to v0.39.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;687](https://github.com/open-telemetry/opentelemetry-proto-go/pull/687)
- ci: use shared OSSF Scorecard workflow by [@&#8203;opentelemetrybot](https://github.com/opentelemetrybot) in [#&#8203;688](https://github.com/open-telemetry/opentelemetry-proto-go/pull/688)
- chore(deps): update all golang.org/x packages by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;689](https://github.com/open-telemetry/opentelemetry-proto-go/pull/689)
- chore(deps): update otel/build-protobuf docker tag to v0.26.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;668](https://github.com/open-telemetry/opentelemetry-proto-go/pull/668)
- chore(deps): update module golang.org/x/mod to v0.40.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;690](https://github.com/open-telemetry/opentelemetry-proto-go/pull/690)
- chore(deps): update open-telemetry/shared-workflows action to v0.7.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;691](https://github.com/open-telemetry/opentelemetry-proto-go/pull/691)
- chore(deps): update googleapis to [`ac3dfec`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/ac3dfec) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;692](https://github.com/open-telemetry/opentelemetry-proto-go/pull/692)
- chore(deps): update googleapis to [`1b09341`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/1b09341) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;693](https://github.com/open-telemetry/opentelemetry-proto-go/pull/693)
- fix(deps): update module google.golang.org/grpc to v1.83.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;694](https://github.com/open-telemetry/opentelemetry-proto-go/pull/694)
- chore(deps): update googleapis to [`08b0e42`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/08b0e42) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;695](https://github.com/open-telemetry/opentelemetry-proto-go/pull/695)
- chore(deps): update open-telemetry/shared-workflows action to v0.8.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;696](https://github.com/open-telemetry/opentelemetry-proto-go/pull/696)
- chore(deps): update open-telemetry/shared-workflows action to v0.10.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;697](https://github.com/open-telemetry/opentelemetry-proto-go/pull/697)
- chore(deps): update open-telemetry/shared-workflows action to v0.11.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;698](https://github.com/open-telemetry/opentelemetry-proto-go/pull/698)
- chore(deps): update googleapis to [`da73d73`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/da73d73) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;700](https://github.com/open-telemetry/opentelemetry-proto-go/pull/700)
- fix(deps): update module google.golang.org/grpc to v1.83.2 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;699](https://github.com/open-telemetry/opentelemetry-proto-go/pull/699)
- chore(deps): update module github.com/skeema/knownhosts to v1.3.3 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;702](https://github.com/open-telemetry/opentelemetry-proto-go/pull/702)
- chore(deps): update open-telemetry/shared-workflows action to v0.12.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;701](https://github.com/open-telemetry/opentelemetry-proto-go/pull/701)
- chore(deps): update googleapis to [`18b4a75`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/18b4a75) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;703](https://github.com/open-telemetry/opentelemetry-proto-go/pull/703)
- chore(deps): update open-telemetry/shared-workflows action to v0.13.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;704](https://github.com/open-telemetry/opentelemetry-proto-go/pull/704)
- chore(deps): update googleapis to [`f8649dd`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/f8649dd) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;706](https://github.com/open-telemetry/opentelemetry-proto-go/pull/706)
- chore(deps): update googleapis to [`f61a6ca`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/f61a6ca) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;708](https://github.com/open-telemetry/opentelemetry-proto-go/pull/708)
- Make slim OTLP descriptors coexist with canonical OTLP by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;707](https://github.com/open-telemetry/opentelemetry-proto-go/pull/707)
- chore(deps): update open-telemetry/shared-workflows action to v0.14.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;710](https://github.com/open-telemetry/opentelemetry-proto-go/pull/710)
- Drop support for Go 1.25 by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;711](https://github.com/open-telemetry/opentelemetry-proto-go/pull/711)
- chore(deps): update all golang.org/x packages by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;709](https://github.com/open-telemetry/opentelemetry-proto-go/pull/709)
- chore(deps): update googleapis to [`eeb232e`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/eeb232e) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;713](https://github.com/open-telemetry/opentelemetry-proto-go/pull/713)
- fix(deps): update module google.golang.org/grpc to v1.84.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;712](https://github.com/open-telemetry/opentelemetry-proto-go/pull/712)
- chore(deps): update googleapis to [`cecb647`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/cecb647) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;714](https://github.com/open-telemetry/opentelemetry-proto-go/pull/714)
- chore(deps): update googleapis to [`b142276`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/b142276) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;715](https://github.com/open-telemetry/opentelemetry-proto-go/pull/715)
- chore(deps): update open-telemetry/shared-workflows action to v0.15.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;716](https://github.com/open-telemetry/opentelemetry-proto-go/pull/716)
- chore(deps): update open-telemetry/shared-workflows action to v0.16.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;717](https://github.com/open-telemetry/opentelemetry-proto-go/pull/717)
- chore(deps): update module github.com/protonmail/go-crypto to v1.5.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;718](https://github.com/open-telemetry/opentelemetry-proto-go/pull/718)
- chore(deps): update module github.com/protonmail/go-crypto to v1.5.1 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;719](https://github.com/open-telemetry/opentelemetry-proto-go/pull/719)
- fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.31.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;720](https://github.com/open-telemetry/opentelemetry-proto-go/pull/720)
- chore(deps): update googleapis to [`8a89bd6`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8a89bd6) by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;723](https://github.com/open-telemetry/opentelemetry-proto-go/pull/723)
- chore(deps): update open-telemetry/shared-workflows action to v0.17.0 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;722](https://github.com/open-telemetry/opentelemetry-proto-go/pull/722)
- chore(deps): update module github.com/protonmail/go-crypto to v1.5.2 by [@&#8203;renovate](https://github.com/renovate)\[bot] in [#&#8203;721](https://github.com/open-telemetry/opentelemetry-proto-go/pull/721)
- Release v1.11.1 by [@&#8203;pellared](https://github.com/pellared) in [#&#8203;724](https://github.com/open-telemetry/opentelemetry-proto-go/pull/724)

#### New Contributors

- [@&#8203;thompson-tomo](https://github.com/thompson-tomo) made their first contribution in [#&#8203;674](https://github.com/open-telemetry/opentelemetry-proto-go/pull/674)

**Full Changelog**: <https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.11.0...v1.11.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

---------

Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1308
Reviewed-by: silverwind <[email protected]>
Co-authored-by: Renovate Bot <[email protected]>
2026-10-12 15:36:28 +00:00
Lunny Xiaoandbircni 49e34813ae docs: describe the logging package (#1305)
Drop the logrus references from the docs and the config example, and add a Logging section to `DEVELOPMENT.md` on how to log and test logging.

Stacked on https://gitea.com/gitea/runner/pulls/1304.

Assisted-by: Codet
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1305
Reviewed-by: bircni <[email protected]>
2026-10-12 06:52:14 +00:00