chore(deps): bump the go-dependencies group across 1 directory with 16 updates

[dependabot]

Bumps the go-dependencies group with 16 updates in the / directory:

Package	From	To
github.com/anthropics/anthropic-sdk-go	1.71.0	1.79.1
github.com/modelcontextprotocol/go-sdk	1.7.0	1.8.0
github.com/ollama/ollama	0.34.0	0.40.1
github.com/openai/openai-go/v3	3.59.0	3.74.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	0.71.0	0.72.0
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	1.46.0	1.47.0
go.opentelemetry.io/otel/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/trace	1.46.0	1.47.0
go.opentelemetry.io/proto/otlp	1.11.0	1.11.1
google.golang.org/genai	1.71.0	1.73.0
google.golang.org/grpc	1.83.2	1.84.0
modernc.org/sqlite	1.58.0	1.60.1

Updates github.com/anthropics/anthropic-sdk-go from 1.71.0 to 1.79.1

Release notes

Sourced from github.com/anthropics/anthropic-sdk-go's releases.

v1.79.1

Chores

• ci: check that pull requests update the changelog
• docs: note that listing Claude Console spend limits is in early access

v1.79.0

1.79.0 (2026-10-07)

Full Changelog: v1.78.0...v1.79.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1930a5e)
• api: add disabled to thinking types in model capabilities (3b88a46)
• api: add display_name to RBAC roles and deprecate name (e568369)
• api: add include_default parameter to list workspaces (a2acfc6)
• api: add lifecycle stage fields and filter to /v1/models (2b3ea06)
• api: add line to model objects (24b1d56)
• api: add url_sources to the Managed Agents web_fetch tool config (3b88a46)
• api: add web search and code execution support to model capabilities (3b88a46)
• client: add All() iterators to SSE streams and auto-pagers (b0d7423)

Bug Fixes

• api: send the beta header by default when listing spend limits (b8bcfc7)
• auth: require https or loopback at every token endpoint (#431) (3b88a46)
• client: percent-encode path params and reject dot-segment values (3b88a46)
• client: return the field error when a param union variant fails to decode (a59fef2)
• client: send array header params as a single comma-separated header (dace66e)
• client: send default and caller-provided array header values in a single header (1ca109c)
• environments: keep a local edit made after a memory upload whose response was lost (#441) (3b88a46)
• return unmodeled content blocks and citations from ToParam instead of panicking (#436) (3b88a46)

Chores

• api: keep the MessageParam name and drop generated constructors (3b88a46)
• api: mark the Text Completions API as deprecated (3b88a46)
• docs: correct example groups in rate limit list description (a489eb3)
• docs: correct when usage and cost report data becomes final (3b88a46)
• docs: describe a federation rule's target by its type (3b88a46)
• docs: fix example IDs in sessions, agents and vault credentials (3b88a46)
• docs: update Managed Agents multiagent and thread descriptions (3b88a46)
• docs: update the activity summaries endpoint description (86f2da1)
• docs: update the description of the Model line field (ad2ed3e)
• internal: add REVIEW.md with review instructions (3b88a46)
• internal: make mock server spec updates smaller in git history (3b88a46)
• internal: move the custom unmarshaler test into the param decode tests (#444) (3b88a46)

... (truncated)

Changelog

Sourced from github.com/anthropics/anthropic-sdk-go's changelog.

1.79.1 (2026-10-08)

Chores

• ci: check that pull requests update the changelog
• docs: note that listing Claude Console spend limits is in early access

1.79.0 (2026-10-07)

Full Changelog: v1.78.0...v1.79.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1930a5e)
• api: add disabled to thinking types in model capabilities (3b88a46)
• api: add display_name to RBAC roles and deprecate name (e568369)
• api: add include_default parameter to list workspaces (a2acfc6)
• api: add lifecycle stage fields and filter to /v1/models (2b3ea06)
• api: add line to model objects (24b1d56)
• api: add url_sources to the Managed Agents web_fetch tool config (3b88a46)
• api: add web search and code execution support to model capabilities (3b88a46)
• client: add All() iterators to SSE streams and auto-pagers (b0d7423)

Bug Fixes

• api: send the beta header by default when listing spend limits (b8bcfc7)
• auth: require https or loopback at every token endpoint (#431) (3b88a46)
• client: percent-encode path params and reject dot-segment values (3b88a46)
• client: return the field error when a param union variant fails to decode (a59fef2)
• client: send array header params as a single comma-separated header (dace66e)
• client: send default and caller-provided array header values in a single header (1ca109c)
• environments: keep a local edit made after a memory upload whose response was lost (#441) (3b88a46)
• return unmodeled content blocks and citations from ToParam instead of panicking (#436) (3b88a46)

Chores

• api: keep the MessageParam name and drop generated constructors (3b88a46)
• api: mark the Text Completions API as deprecated (3b88a46)
• docs: correct example groups in rate limit list description (a489eb3)
• docs: correct when usage and cost report data becomes final (3b88a46)
• docs: describe a federation rule's target by its type (3b88a46)
• docs: fix example IDs in sessions, agents and vault credentials (3b88a46)
• docs: update Managed Agents multiagent and thread descriptions (3b88a46)
• docs: update the activity summaries endpoint description (86f2da1)
• docs: update the description of the Model line field (ad2ed3e)
• internal: add REVIEW.md with review instructions (3b88a46)
• internal: make mock server spec updates smaller in git history (3b88a46)
• internal: move the custom unmarshaler test into the param decode tests (#444) (3b88a46)

... (truncated)

Commits

• 70a91c6 release: 1.79.1
• 713657e Merge pull request #456 from anthropics/synced/published
• 6180188 chore(internal): update changelog (#455)
• 76d6546 chore(ci): check that pull requests update the changelog
• d5435a7 Merge branch 'main' into next
• a45273b Merge pull request #476 from anthropics/release-please--branches--main--chang...
• 0a98c69 chore(docs): note that listing Claude Console spend limits is in early access
• e41c58e release: 1.79.0
• a59fef2 fix(client): return the field error when a param union variant fails to decode
• 2b3ea06 feat(api): add lifecycle stage fields and filter to /v1/models
• Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

• internal/json: json nesting depth check by @​yarolegovich (#1200)
• mcp: add an sse event size cap by @​yarolegovich (#1205)
• mcp: add a max request body size of the old transport by @​yarolegovich (#1224)
• oauthex: bound dcr read to 1mb by @​yarolegovich (#1206)
• oauthex: oauth discovery checks by @​yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

• mcp: allow restricting the protocol versions a server supports by @​guglielmo-san (#1199)
• mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @​guglielmo-san (#1143)
• mcp: limit SSE discover supportedVersions to SSE-defined revisions by @​arimu1 (#1121)
• mcp: prefer the negotiated protocol version over the request context by @​gwyszynski-sa (#1163)
• mcp: export ClientSessionOptions.ProtocolVersion by @​arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

• mcp: allow per request Cacheable customization by @​guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

• plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
• blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

• seterroroverwrite
• enableoriginverification
• disablecontenttypecheck

... (truncated)

Commits

• 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
• 830f0b7 mcp: update conformance tests (#1231)
• 12cbafe oauthex: oauth discovery checks (#1220)
• 3632967 mcp: add an sse event size cap (#1205)
• 0d3036f mcp: allow per request Cacheable customization (#1203)
• cb0de64 mcp: add a max request body size of the old transport (#1224)
• 2fdabde mcp: do not check metatada on notifications (#1215)
• 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
• a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
• 8227246 fix: only subscribe when server advertises capability (#1221)
• Additional commits viewable in compare view

Updates github.com/ollama/ollama from 0.34.0 to 0.40.1

Release notes

Sourced from github.com/ollama/ollama's releases.

v0.40.1

What's Changed

• server: proxy cloud usage and balance APIs by @​drifkin in ollama/ollama#18829
• llama: fix clef head reads past 2GiB on windows by @​Gigrise in ollama/ollama#18777
• cmd: remove account step from CLI onboarding by @​hoyyeva in ollama/ollama#18826
• manifest: avoid symlinks on Windows by @​dhiltgen in ollama/ollama#18852
• docs: fix 6 dead links in README community integrations list by @​aniketkrs in ollama/ollama#18814
• docs: fix broken download links in app README by @​chenlichao in ollama/ollama#18233
• mlx: drop carried metal residency patch now that it is upstream by @​dhiltgen in ollama/ollama#18854

New Contributors

• @​Gigrise made their first contribution in ollama/ollama#18777
• @​aniketkrs made their first contribution in ollama/ollama#18814
• @​chenlichao made their first contribution in ollama/ollama#18233

Full Changelog: ollama/ollama@v0.40.0...v0.40.1-rc0

v0.40.0

What's Changed

Models run on MLX on Apple Silicon by default

In this release, on Apple Silicon devices, model architectures supported by the MLX runtime will automatically run on MLX.

ollama pull qwen3.8
ollama run qwen3.8

Additional models include gemma4, qwen3.6 and qwen3.5

Decision models are now available on MLX as well: Nimble tev1 clef clef-flash

MLX now has support for an embedding model: embeddinggemma-2

We will continue testing and enabling additional models.

Full Changelog: ollama/ollama@v0.35.1...v0.40.0

v0.35.1

Clef decision models

Ollama now supports Clef and Clef Flash, Cloudflare's new open-source decision models, through /v1/systemone.

Clef (27B) and Clef Flash (9B) are multimodal: requests can now include images alongside the text state, shared by all questions and scored jointly with it.

curl http://localhost:11434/v1/systemone -d '{
  "model": "clef-flash",
</tr></table> 

... (truncated)

Commits

• cf2a313 mlx: drop carried metal residency patch now that it is upstream (#18854)
• f9f4af6 Merge pull request #18233 from chenlichao/fix/app-readme-download-links
• a742c06 Merge pull request #18814 from aniketkrs/docs/readme-dead-links
• a896fdf manifest: avoid symlinks on Windows (#18852)
• 468e7e5 cmd: remove account step from CLI onboarding (#18826)
• d3c846f llama: fix clef head reads past 2GiB on windows (#18777)
• f864601 server: proxy cloud usage and balance APIs (#18829)
• 0d0720e routes: fix embed 413 vs 400 routing (#18822)
• efe43c5 model: add multimodal embeddings (#18820)
• 03ed9ce docs: fix 6 dead links in README community integrations list
• Additional commits viewable in compare view

Updates github.com/openai/openai-go/v3 from 3.59.0 to 3.74.0

Release notes

Sourced from github.com/openai/openai-go/v3's releases.

v3.74.0

3.74.0 (2026-10-08)

Features

• agents: handle local tools during session creation streams (#1030) (7e4e1b1)

Bug Fixes

• api: correct custom voice creation parameters (#1040) (6dbe457)

v3.73.0

3.73.0 (2026-10-06)

Features

• api: add standalone Decisions support (#1036) (e57ff4a)

v3.72.0

3.72.0 (2026-10-06)

Features

• agents: observe local tool failures (#1028) (25cd67f)
• api: add agent turn items and usage source grouping (#1035) (473e093)

v3.71.2

3.71.2 (2026-10-05)

Bug Fixes

• bound aggregate sparse tool-call growth per chunk (#1014) (8b04b3c)
• escape multipart scalar field names consistently (#1029) (a3d6415)

v3.71.1

3.71.1 (2026-10-02)

Bug Fixes

• client: close unowned successful response bodies (#1019) (122396e)
• client: restore configured HTTP endpoint compatibility (#1022) (facbcce)

v3.71.0

3.71.0 (2026-10-02)

... (truncated)

Changelog

Sourced from github.com/openai/openai-go/v3's changelog.

3.74.0 (2026-10-08)

Features

• agents: handle local tools during session creation streams (#1030) (7e4e1b1)

Bug Fixes

• api: correct custom voice creation parameters (#1040) (6dbe457)

3.73.0 (2026-10-06)

Features

• api: add standalone Decisions support (#1036) (e57ff4a)

3.72.0 (2026-10-06)

Features

• agents: observe local tool failures (#1028) (25cd67f)
• api: add agent turn items and usage source grouping (#1035) (473e093)

3.71.2 (2026-10-05)

Bug Fixes

• bound aggregate sparse tool-call growth per chunk (#1014) (8b04b3c)
• escape multipart scalar field names consistently (#1029) (a3d6415)

3.71.1 (2026-10-02)

Bug Fixes

• client: close unowned successful response bodies (#1019) (122396e)
• client: restore configured HTTP endpoint compatibility (#1022) (facbcce)

3.71.0 (2026-10-02)

Features

• api: add custom voices and agent session webhook events (#1016) (0d0331b)
• api: use safe API error diagnostics by default (#1013) (ef62324)

... (truncated)

Commits

• 51e09a6 release: 3.74.0 (#1038)
• 6dbe457 fix(api): correct custom voice creation parameters (#1040)
• 7e4e1b1 feat(agents): handle local tools during session creation streams (#1030)
• 764e0b6 release: 3.73.0 (#1037)
• e57ff4a feat(api): add standalone Decisions support (#1036)
• 1a552c3 release: 3.72.0 (#1032)
• 473e093 feat(api): add agent turn items and usage source grouping (#1035)
• ea1f7a2 test(tools): cover tool search (defer_loading=true) across Responses and Agen...
• a104f5a ci: avoid duplicate CI runs on feature branch pushes (#1031)
• 25cd67f feat(agents): observe local tool failures (#1028)
• Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.71.0 to 0.72.0

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog.

[1.47.0/2.6.0/0.72.0/0.38.0/0.27.0/0.21.0/0.17.0/0.19.0] - 2026-10-03

Added

• Add NewResourceDetectorWithOptions and the WithAWSLogger option to go.opentelemetry.io/contrib/detectors/aws/ec2/v2, allowing a custom AWS SDK logging.Logger to be supplied to the EC2 resource detector. (#9132)
• Add go.opentelemetry.io/contrib/detectors/openshift, a new resource detector for OpenShift 4 clusters, ported from processor/resourcedetectionprocessor/internal/openshift in opentelemetry-collector-contrib. Detects k8s.cluster.name, and cloud.provider, cloud.platform and cloud.region for clusters running on AWS, Google Cloud and IBM Cloud; Azure clusters report cloud.provider and cloud.platform only. (#9499)
• Add go.opentelemetry.io/contrib/detectors/kubeadm, a new resource detector for kubeadm-provisioned Kubernetes clusters, ported from processor/resourcedetectionprocessor/internal/kubeadm in opentelemetry-collector-contrib. Detects k8s.cluster.name from the ClusterConfiguration document in the kube-system/kubeadm-config ConfigMap and k8s.cluster.uid from the kube-system namespace UID. (#9500)

Changed

• Client metrics in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp no longer include attributes from the server-side Labeler, preventing attributes such as http.route from leaking into outbound requests. This is a breaking change for applications that use ContextWithLabeler to add custom client metric attributes: use ContextWithClientLabeler / ClientLabelerFromContext or the WithMetricAttributesFn option instead. Server-side use of ContextWithLabeler / LabelerFromContext is unchanged. (#8924)
• Stop emitting the legacy http.read_bytes and http.wrote_bytes attributes on the per-operation span events enabled by WithMessageEvents in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. The read and write events remain, while total body sizes continue to be recorded on the server span as http.request.body.size and http.response.body.size according to HTTP semantic conventions. (#9624)

Deprecated

• Deprecate go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws. (#9707)
• Deprecate go.opentelemetry.io/contrib/propagators/aws. (#9706)
• Deprecate go.opentelemetry.io/contrib/samplers/probability/consistent. (#9633)
• Deprecate ReadBytesKey, ReadErrorKey, WroteBytesKey, and WriteErrorKey in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. The identifiers remain available and their values are unchanged, but WithMessageEvents no longer emits http.read_bytes or http.wrote_bytes. There is no semantic-convention replacement for per-read or per-write byte counts or the human-readable error fields. Use HTTPRequestBodySizeKey and HTTPResponseBodySizeKey from go.opentelemetry.io/otel/semconv/v1.43.0 to record total body sizes on the span. If an error causes the HTTP request to fail, set the span status to Error and record ErrorType(err) from go.opentelemetry.io/otel/semconv/v1.43.0 on the span. (#9624)

Fixed

• Treat empty Prometheus exporter environment variable values as unset in go.opentelemetry.io/contrib/exporters/autoexport, restoring the documented defaults. (#9636)
• Bound converter-owned recursive map, slice, array, and pointer traversal in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. A field requiring more than 100 such levels is replaced with <max-depth-exceeded> and the record continues to be emitted. Existing fmt and user-method behavior remains unchanged. (#9691)
• Format span attributes in go.opentelemetry.io/contrib/zpages using attribute.Value.String instead of the deprecated attribute.Value.Emit, following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#9453)
• Set error.type on the span and on the request-duration, request-body-size, and response-body-size metrics when a client disconnects mid-request in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin, using the request context's cancellation error as the classification source when the handler has not already recorded an error via c.Error. Previously a disconnect was recorded with span status Error and no error.type, indistinguishable from a genuine server fault. (#9394)
• Report Prometheus metrics HTTP server errors in go.opentelemetry.io/contrib/otelconf when using the v0.2.0 configuration schema. The error check was inverted, so a clean shutdown (http.ErrServerClosed) was reported as unexpected while real Serve errors were ignored. (#9653)
• Fix temporary file cleanup for multipart requests in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp by copying the parsed multipart form back to the original request during deferred cleanup, preserving net/http cleanup during panic unwinding for HTTP/2 panic handling and outer recovery middleware paths. Unrecovered HTTP/1 handler panics remain uncleaned because net/http skips finishRequest in that path. (#9685)
• Fix http.client.request.body.size recording for streaming request bodies in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8684)
• Bound Kubernetes ConfigMap requests in go.opentelemetry.io/contrib/detectors/aws/eks with a 10-second timeout so Detect cannot hang indefinitely when the caller-provided context has no deadline. (#9419)

Removed

• Drop support for [Go 1.25]. (#9584)
• Remove go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho. Use github.com/labstack/echo-opentelemetry instead. (#9613)

Commits

• 0c76f61 Release v1.47.0/v2.6.0/v0.72.0/v0.38.0/v0.27.0/v0.21.0/v0.17.0/v0.19.0 (#9802)
• 318f5f9 Add timeout on Kubernetes API calls for EKS detector (#9419)
• f848a15 test(detector/ecs): increase unit test coverage (#9774)
• c0d84de Restore gofumpt clothe-returns and balance-calls (#9793)
• 6215054 fix(deps): update aws-sdk-go-v2 monorepo (#9785)
• 9a2e8ea fix(deps): update kubernetes monorepo to v0.37.1
• 3d8e338 chore(deps): update sigs.k8s.io/json digest to 11ed52e
• be5b688 chore(deps): update go-openapi packages
• e382b4d chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.4
• 97f9e88 fix(deps): update module github.com/moby/moby/client to v0.6.1
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.46.0 to 1.47.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.47.0/v0.69.0/v0.23.0/v0.1.0

This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules:

• go.opentelemetry.io/otel/log
• go.opentelemetry.io/otel/sdk/log

See our versioning policy for more information about these stability guarantees.

Added

• Add String method for KeyValue type in go.opentelemetry.io/otel/attribute. (#8205)
• Add String method for Set type in go.opentelemetry.io/otel/attribute. (#8347)
• Add WithMaxExportBatchSize to go.opentelemetry.io/otel/sdk/metric to configure the maximum export batch size for PeriodicReader. (#8960)
• Add WithAttributeValueDepthLimit, DefaultAttributeValueDepthLimit, and SpanLimits.AttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/trace to configure the maximum depth of span, event, link, and instrumentation scope attribute values. (#8938)
• Add WithAttributeValueDepthLimit in go.opentelemetry.io/otel/sdk/log to configure the maximum depth of log record and instrumentation scope attribute values. (#8938)
• Add WithMaxResponseSize to go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8941)
• Add experimental ProbabilitySampler in go.opentelemetry.io/otel/sdk/trace/x that conforms to the OpenTelemetry specification's threshold-based sampling algorithm. (#8123)
• Add experimental *Binder extension interfaces in go.opentelemetry.io/otel/metric/x for instruments that support binding attributes ahead of time. (#8760)
• Add the experimental Finisher synchronous metric instrument extension interface to go.opentelemetry.io/otel/metric/x. (#8906)

Changed

• Use the OpenTelemetry Attribute Collection representation for non-OTLP protocols for metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8993)
• Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8938)
• Reduce allocations when applying attribute value length limits in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log by rebuilding composite values only when truncation is needed. (#8912)
• Decode traceparent using a hex lookup table in go.opentelemetry.io/otel/propagation, which rejects the specification-disallowed upper-case characters without a separate scan of the header. (#8739)
• Decode all characters at constant indices in TraceIDFromHex and SpanIDFromHex in go.opentelemetry.io/otel/trace to eliminate bounds checks. (#8740)

Fixed

• Count valid U+FFFD replacement characters toward attribute value length limits in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log.
• Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/sdk/trace, and go.opentelemetry.io/otel/sdk/log. (#9054)
• Fix a data race in NewPeriodicReader where r.inst was assigned after the background goroutine was launched in go.opentelemetry.io/otel/sdk/metric. (#9028)
• Prevent precision loss for large int64 values in Sum, Histogram, and ExponentialHistogram aggregations in go.opentelemetry.io/otel/sdk/metric. (#8981)
• Ensure grpc.DialOption values passed via WithDialOption take precedence over conflicting internally-computed defaults in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc, and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8805, #8834, #8836)
• Treat overflowing OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT values as invalid in go.opentelemetry.io/otel/sdk/metric. (#8800)
• Prevent a panic in NewFixedSizeReservoir and FixedSizeReservoirProvider when given a negative size in go.opentelemetry.io/otel/sdk/metric/exemplar; negative sizes are now clamped to zero, consistent with a size of zero. (#8832)
• Preserve exponential histogram ZeroThreshold during OTLP metric export in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (