chore(deps): bump the go_modules group across 1 directory with 2 updates

[dependabot]

Bumps the go_modules group with 2 updates in the /control-plane directory: go.opentelemetry.io/otel/sdk and google.golang.org/grpc.

Updates go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/sdk's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

• Support testing of Go 1.27. (#8811)
• Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
• Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

• Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
• Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
• Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

• Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
• Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
• Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
• Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
• Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
• Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
• The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
• Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

• chore(deps): update github/codeql-action action to v4.37.6 by @​renovate[bot] in open-telemetry/opentelemetry-go#8697
• chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.64.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8698
• chore(deps): update golang.org/x/telemetry digest to bdd03c3 by @​renovate[bot] in open-telemetry/opentelemetry-go#8699
• fix(deps): update module go.opentelemetry.io/collector/pdata to v1.64.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8700
• chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8701
• chore(deps): update module github.com/rogpeppe/go-internal to v1.16.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8702
• chore(deps): update module github.com/cloudflare/circl to v1.6.5 by @​renovate[bot] in open-telemetry/opentelemetry-go#8703
• Record processor.{span,log}.processed before invoking the exporter in simple processors by @​cijothomas in open-telemetry/opentelemetry-go#8705
• perf(sdk/metric): reduce benchmark suite execution time (#8683) by @​dashpole in open-telemetry/opentelemetry-go#8688
• chore(deps): update codspeedhq/action action to v5.0.3 by @​renovate[bot] in open-telemetry/opentelemetry-go#8710
• attempt 2: Lazily compute filtered and dropped attributes by @​dashpole in open-telemetry/opentelemetry-go#8598
• fix(deps): update googleapis to c8921c7 by @​renovate[bot] in open-telemetry/opentelemetry-go#8712
• chore(deps): update module github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3 by @​renovate[bot] in open-telemetry/opentelemetry-go#8708
• chore(deps): update github.com/charmbracelet/ultraviolet digest to 402eeaa by @​renovate[bot] in open-telemetry/opentelemetry-go#8716
• chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0 by @​renovate[bot] in open-telemetry/opentelemetry-go#8715
• chore(deps): update mvdan.cc/unparam digest to a64391f by @​renovate[bot] in open-telemetry/opentelemetry-go#8717
• fix(deps): update golang.org/x to a8b543c by @​renovate[bot] in open-telemetry/opentelemetry-go#8720
• fix(deps): update googleapis to ec0a776 by @​renovate[bot] in open-telemetry/opentelemetry-go#8719

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

• Support testing of [Go 1.27]. (#8811)
• Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
• Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

• Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
• Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
• Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

• Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
• Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
• Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
• Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
• Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
• Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
• The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
• Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

• Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
• Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
• Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
• Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
• Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
• Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
• Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
• Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
• Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.

... (truncated)

Commits

• 58db4c8 Release v1.46.0 (#8858)
• 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
• 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
• cfbeab5 attribute: clarify xxhash test purpose (#8753)
• 3599b59 sdk/log: Add interface stability markers (#8855)
• 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
• d720f5a otlplog: export dropped attribute count (#8829)
• 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
• 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
• 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.83.1 to 1.83.2

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.2

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)
  • Special Thanks: @​winklemad

Commits

• 030ee8b Update version to 1.83.2 (#9375)
• 8668b69 cherry-pick #9365 to v1.83.x (#9366)
• a3e952d cherry-pick #9346 to v1.83.x and update x/net dependency (#9369)
• 58f8fd9 Change version to 1.83.2-dev (#9337)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[santoshkumarradha]

The gRPC patch looks low risk, but the OpenTelemetry update currently breaks the control-plane tracing URL contract and the required coverage job. I reproduced the focused failure locally. Please address the inline issue before merging.

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	87.80%	87.40%	↑ +0.40 pp	🟡
sdk-go	93.20%	92.00%	↑ +1.20 pp	🟢
sdk-python	94.72%	93.73%	↑ +0.99 pp	🟢
sdk-typescript	91.76%	90.42%	↑ +1.34 pp	🟢
web-ui	84.76%	84.79%	↓ -0.03 pp	🟡
aggregate	85.88%	85.75%	↑ +0.13 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	6	100.00%	✅
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.

[AbirAbbas]

Approving at 633602f: the otel 1.46 path regression Santosh caught is fixed in the tracer rather than by pinning back, with root / trailing-slash / custom-path cases pinned by tests, and coverage-summary is green at this head (full control-plane surface 87.8%, patch 100%). The gRPC and other bumps came through build/vet/test with no new diagnostics. Only thing left is clearing the earlier changes-requested review.

[AbirAbbas]

Re-approving at 52010cb after merging main (#1055 landed the same grpc/x/* pins, so go.mod/go.sum conflicted): kept the Dependabot side (otel 1.46, testify 1.12.1, protobuf 1.36.12 and their indirects), go mod tidy is a no-op on the result, and the branch differs from main only in go.mod, go.sum and the two tracer files. Full control-plane coverage surface and patch gate pass locally; coverage-summary and license/cla are green at this head. The one local failure, TestDispatchAgentRequestStopsWaitingOnceTheNodeIsDemoted, fails 10/30 on pristine main on my WSL2 box (loopback timeout instead of refusal) and 3/30 here, so it's the known host flake, not this bump.