build(deps): bump the otel group across 1 directory with 4 updates

[dependabot]

Bumps the otel group with 1 update in the / directory: github.com/jaegertracing/jaeger.

Updates github.com/jaegertracing/jaeger from 1.62.0 to 1.63.0

Changelog

Sourced from github.com/jaegertracing/jaeger's changelog.

v1.63.0 / v2.0.0 (2024-11-10)

Jaeger v2 is here! 🎉 🎉 🎉

Backend Changes

⛔ Breaking Changes

• Remove jaeger-agent from distributions (@​yurishkuro in #6081)

🐞 Bug fixes, Minor Improvements

• Fix possible null pointer deference (@​vaidikcode in #6184)
• Chore: enable all rules of perfsprint linter (@​mmorel-35 in #6164)
• Chore: enable err-error and errorf rules from perfsprint linter (@​mmorel-35 in #6160)
• [query] move trace handler to server level (@​mahadzaryab1 in #6147)
• [fix][query] remove bifurcation for grpc query server (@​mahadzaryab1 in #6145)
• [jaeger-v2] add hotrod integration test for jaeger-v2 (@​Saumya40-codes in #6138)
• [query] use otel's helpers for http server (@​mahadzaryab1 in #6121)
• Use grpc interceptors instead of explicit context wrappers (@​chahatsagarmain in #6133)
• Fix command in v2 example (@​haoqixu in #6134)
• Fix span deduplication via correct ordering of adjusters (@​cdanis in #6116)
• Move all query service http handlers into one function (@​yurishkuro in #6128)
• [fix][grpc] disable tracing in grpc storage writer clients (@​mahadzaryab1 in #6125)
• Feat: automatically publish readme to docker hub (@​inosmeet in #6118)
• Use grpc interceptors for bearer token (@​chahatsagarmain in #6063)
• [fix][query] correct query server legacy condition (@​mahadzaryab1 in #6120)
• [query] use otel's helpers for grpc server (@​mahadzaryab1 in #6055)
• Enable lint rule: import-shadowing (@​inosmeet in #6102)
• [refractor] switch to enums for es mappings (@​Saumya40-codes in #6091)
• Fix rebuild-ui.sh script (@​andreasgerstmayr in #6098)
• Use otel component host instead of no op host for prod code (@​chahatsagarmain in #6085)
• [cassandra] prevent fallback to old schema for operation names table in case of db issues (@​arunvelsriram in #6061)

🚧 Experimental Features

• Add otlp json support for kafka e2e integration tests (@​joeyyy09 in #5935)
• [v2] add es config comments (@​yurishkuro in #6110)
• [chore][docs] add documentation to elasticsearch configuration (@​mahadzaryab1 in #6103)
• [jaeger-v2] refactor elasticsearch/opensearch configurations to have more logical groupings (@​mahadzaryab1 in #6090)
• [jaeger-v2] implement utf-8 sanitizer for otlp (@​mahadzaryab1 in #6078)
• [jaeger-v2] migrate elasticsearch/opensearch to use otel's tls configuration (@​mahadzaryab1 in #6079)
• [jaeger-v2] enable queueing configuration in storage exporter (@​mahadzaryab1 in #6080)
• [jaeger-v2] implement empty service name sanitizer for otlp (@​mahadzaryab1 in #6077)
• [jaeger-v2] refactor elasticsearch/opensearch storage configurations (@​mahadzaryab1 in #6060)

👷 CI Improvements

• [v2] use health check in grpc e2e test (@​yurishkuro in #6113)

... (truncated)

Commits

• 3f752c2 Prepare release 1.63.0/2.0.0 (#6188)
• c88e0f6 Fix possible null pointer deference (#6184)
• 8441654 fix(deps): update module golang.org/x/net to v0.31.0 (#6180)
• 8d1d20a chore(deps): bump golang from 1.23.2-alpine to 1.23.3-alpine in /docker/debug...
• a420fd9 fix(deps): update module google.golang.org/grpc to v1.68.0 (#6176)
• 16c7c55 fix(deps): update module golang.org/x/sys to v0.27.0 (#6177)
• 38a9993 chore: enable all rules of perfsprint linter (#6164)
• 0a24f6d chore: use testify instead of t.Fatal (#6162)
• c65757f chore: enable err-error and errorf rules from perfsprint linter (#6160)
• 74ec19a chore: use Contains or ErrorContains with testify (#6161)
• Additional commits viewable in compare view

Updates github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger from 0.111.0 to 0.112.0

Release notes

Sourced from github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger's releases.

v0.112.0

The OpenTelemetry Collector Contrib contains everything in the opentelemetry-collector release, be sure to check the release notes there as well.

End User Changelog

🛑 Breaking changes 🛑

• elasticsearchexporter: Enable gzip compression by default (#35865) To disable compression, set config compression to none.
• elasticsearchexporter: Set body.* for log body in OTel mode (#35771) Log record body in OTel mapping mode will be stored in body.text, body.structured, body.flattened based on body value type and presence of event.name attribute
• processor/metricsgeneration: Remove "experimental_" prefix from metrics generator processor name. (#35426)

🚩 Deprecations 🚩

• sapmreceiver: Deprecate SAPM receiver (#32125)
• elasticsearchexporter: Deprecate retry::max_requests in favor of retry::max_retries (#32344) retry::max_retries will be exactly retry::max_requests - 1

🚀 New components 🚀

• confmap/aesprovider: Initial aes encryption provider. Allows configurations to decrypt secrets using AES encryption. (#35550)
• systemdreceiver: Introduce the scaffolding of a new component, systemdreceiver (#33532)
• ntpreceiver: Introduce new receiver reporting the offset between the local machine and a NTP server. (#34375)
• tlscheckreceiver: Add TLS Check Receiver component to monitor x.509 certificate expiry (#35423)

💡 Enhancements 💡

• awsfirehosereceiver: Add support for CloudWatch logs (#35077)

• awsfirehosereceiver: added OTLP v1 support to Firehose receiver (#34982)

• awss3receiver: Add support for monitoring the progress of ingesting data from an S3 bucket via OpAMP custom messages. (#30750)

• azureeventshubreceiver: Updates the Azure Event Hub receiver to use the new Resource Logs translator. (#35357)

• cloudflarereceiver: Respond 503 on non-permanent and 400 on permanent errors (#35642)

• elasticsearchexporter: Add hint in error logs for TSDB version_conflict_engine_exception error (#35546)

• pkg/ottl: Add ConvertAttributesToElementsXML Converter (#35328)

• logdedupprocessor: Add a condition field to the Log DeDuplication Processor. (#35440)

• opampextension: Support using auth extensions for authenticating with opamp servers (#35507)

• azureblobreceiver: adds support for using azidentity default auth, enabling the use of Azure Managed Identities, e.g. Workload Identities on AKS (#35636) This change allows to use authentication type "default", which makes the receiver use azidentity default Credentials, which automatically picks up, identities assigned to e.g. a container or a VirtualMachine

• elasticsearchexporter: Introduce an experimental bodymap mapping mode for logs (#35444)

• googlecloudexporter: Google Cloud exporter is marked as mutating. (#35366)

• googlemanagedprometheusexporter: GMP exporter is marked as mutating. (#35366)

• k8sobserver: Emit endpoint per Pod's container (#35491)

• mongodbreceiver: Add support for MongoDB direct connection (#35427)

• exporter/clickhouse: Add the ability to override default table names for all metric types. (#34225) 'metrics_table_name' of the clickhouse exporter config is deprecated and newly introduced parameter 'metrics_tables' should be used instead.

• metricsgenerationprocessor: Introduce functionality to only do metric calculations on data points whose attributes match (#35425)

... (truncated)

Changelog

Sourced from github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger's changelog.

v0.112.0

🛑 Breaking changes 🛑

• pkg/translator/jaeger: Remove error from method signature as it always returns nil (#35560)

🚀 New components 🚀

• pkg/status: Refactors the extension/healthcheckv2extension/internal/status into pkg/status (#34692)

💡 Enhancements 💡

• pkg/translator/prometheusremotewrite: add FromMetricsV2 (#33661) The public function is partially implemented and not ready for use
• receiver/prometheusremotewrite: Add HTTP Server to handler Prometheus Remote Write requests (#35535) Warning - The HTTP Server still doesn't do anything. It's just a placeholder for now.

Commits

• 7090083 [chore] Prepare release 0.112.0 (#35947)
• 12cb45d [chore] more fix on codeowners (#35945)
• 2b69e36 [chore] update broken links (#35943)
• 93bf7a3 [chore] fix codeowners (#35940)
• abd28d8 [chore] Upgrade core to v1.18.0/v0.112.0 (#35938)
• 1d555e9 [receiver/sapm] Deprecate SAPM receiver (#35935)
• 30c18b8 [chore][processor/transform] add configuration example for copying attributes...
• 2eda7e9 [pkg/ottl] Refactor grammar validation to use the AST visitor and combining e...
• ecf9538 [pkg/ottl] Add OTTL context inferrer utility (#35721)
• 61f0fb0 chore(deps): update prom/prometheus docker tag to v2.55.0 (#35929)
• Additional commits viewable in compare view

Updates go.opentelemetry.io/collector/consumer from 0.111.0 to 0.112.0

Release notes

Sourced from go.opentelemetry.io/collector/consumer's releases.

v0.112.0

Images and binaries here: https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.112.0

End User Changelog

v1.18.0/v0.112.0

🛑 Breaking changes 🛑

• consumer/consumererror: Extract consumer/consumererror as a separate go module (#11440)
• exporter/expotertest: Put expotertest into its own module (#11461)
• service: Remove stable gate component.UseLocalHostAsDefaultHost (#11412)

🚩 Deprecations 🚩

• processortest: Deprecated 'NewUnhealthyProcessorCreateSettings'. Use NewNopSettings instead. (#11307)

💡 Enhancements 💡

• mdatagen: Added generated_package_name config field to support custom generated package name. (#11231)
• mdatagen: Generate documentation for components with resource attributes only (#10705)
• confighttp: Adding support for lz4 compression into the project (#9128)
• service: Hide profiles support behind a feature gate while it remains alpha. (#11477)
• exporterhelper: Retry sender will fail fast when the context timeout is shorter than the next retry interval. (#11183)

🧰 Bug fixes 🧰

• cmd/builder: Fix default configuration for builder for httpprovider, httpsprovider, and yamlprovider. (#11357)
• processorhelper: Fix issue where in/out parameters were not recorded when error was returned from consumer. (#11351)

API Changes

v1.18.0/v0.112.0

🛑 Breaking changes 🛑

• service: Change Host to not implement GetExportersWithSignal (#11444) Use Host.GetExporters if still needed.
• componentstatus: Remove deprecated NewInstanceIDWithPipelineIDs, AllPipelineIDsWithPipelineIDs, and WithPipelineIDs. Use NewInstanceID, AllPipelineIDs and WithPipelines instead. (#11363)
• configgrpc: Removed deprecated ClientConfig.ToClientConnWithOptions/ServerConfig.ToServerWithOptions. (#11359, #9480) These methods were renamed to ClientConfig.ToClientConn/ServerConfig.ToServer in v0.111.0.
• connector: Put connectortest in its own module (#11216)
• exporter: Disables setting batch option to batch sender directly. (#10368) Removed WithRequestBatchFuncs(BatcherOption) in favor of WithBatchFuncs(Option), where | BatcherOption is a function that operates on batch sender and Option is one that operates | on BaseExporter
• exporter: Made mergeFunc and mergeSplitFunc required method of exporter.Request (#10368) mergeFunc and mergeSplitFunc used to be part of the configuration pass to the exporter. Now it is changed | to be a method function of request.
• componentprofiles: Move componentprofiles to pipelineprofiles (#11421)
• processor: Put processortest in its own module (#11218)
• receivertest: Removed deprecated NewNopFactoryForTypeWithSignal. Use NewNopFactoryForType instead. (#11362)
• processor: Remove deprecated funcs from processor package (#11368)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/collector/consumer's changelog.

v1.18.0/v0.112.0

🛑 Breaking changes 🛑

• service: Change Host to not implement GetExportersWithSignal (#11444) Use Host.GetExporters if still needed.
• componentstatus: Remove deprecated NewInstanceIDWithPipelineIDs, AllPipelineIDsWithPipelineIDs, and WithPipelineIDs. Use NewInstanceID, AllPipelineIDs and WithPipelines instead. (#11363)
• configgrpc: Removed deprecated ClientConfig.ToClientConnWithOptions/ServerConfig.ToServerWithOptions. (#11359, #9480) These methods were renamed to ClientConfig.ToClientConn/ServerConfig.ToServer in v0.111.0.
• connector: Put connectortest in its own module (#11216)
• exporter: Disables setting batch option to batch sender directly. (#10368) Removed WithRequestBatchFuncs(BatcherOption) in favor of WithBatchFuncs(Option), where | BatcherOption is a function that operates on batch sender and Option is one that operates | on BaseExporter
• exporter: Made mergeFunc and mergeSplitFunc required method of exporter.Request (#10368) mergeFunc and mergeSplitFunc used to be part of the configuration pass to the exporter. Now it is changed | to be a method function of request.
• componentprofiles: Move componentprofiles to pipelineprofiles (#11421)
• processor: Put processortest in its own module (#11218)
• receivertest: Removed deprecated NewNopFactoryForTypeWithSignal. Use NewNopFactoryForType instead. (#11362)
• processor: Remove deprecated funcs from processor package (#11368)
• receiver: Remove deprecated funcs from receiver package (#11367)
• processorhelper: Remove deprecated funcs/types from processorhelper & componenttest (#11302)
• service: Remove deprecated pipelines.ConfigWithPipelineID and Config.PipelinesWithPipelineID. Use pipelines.Config and Config.Pipelines instead. (#11361)

🚩 Deprecations 🚩

• extension: Deprecate funcs that repeat extension in name (#11413) Factory.CreateExtension -> Factory.Create | Factory.ExtensionStability -> Factory.Stability

• exporter: Deprecate funcs that repeate exporter in name (#11370) Factory.Create[Traces|Metrics|Logs|Profiles]Exporter -> Factory.Create[Traces|Metrics|Logs|Profiles] | Factory.[Traces|Metrics|Logs|Profiles]ExporterStability -> Factory.[Traces|Metrics|Logs|Profiles]Stability

🚀 New components 🚀

• consumererrorprofiles: Add new module consumereerrorprofiles for consumer error profiles. (#11131)

💡 Enhancements 💡

• configcompression: Add support for lz4 compression (#9128)
• otlpexporter: Add profiles support to OTLP exporter (#11435)
• otlphttpexporter: Add profiles support to OTLP HTTP exporter (#11450)

Commits

• fee2daa [chore] Prepare release v1.18.0/v0.112.0 (#11515)
• b30b542 Update github/codeql-action action to v3.27.0 (#11514)
• dd573f3 [chore] [exporterhelper] Update batch methods comments (#11513)
• 6e12a02 [chore] Promote Damien Mathieu to triager role (#11508)
• 2b6da0d [chore] Handle nested exportertest dependency references (#11512)
• 02ceda1 [chore] Use psuedo-version number for exportertest (#11511)
• 2a9afd8 Update actions/cache action to v4.1.2 (#11510)
• 11767fe [chore] Update leaf module versions to commits with pseudo version dependenci...
• 403c782 [chore] Remove unnecessary context from Batch.split (#11504)
• 8f20a07 [chore] Small nits in batch processor, use generics to avoid type conversions...
• Additional commits viewable in compare view

Updates go.opentelemetry.io/collector/pdata from 1.17.0 to 1.18.0

Release notes

Sourced from go.opentelemetry.io/collector/pdata's releases.

v1.17.0/v0.111.0

Images and binaries here: https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.111.0

🆕 The binary release adds a new OTLP-only distro. Feel free to leave us feedback on this new distro on the opentelemetry-collector-releases issue tracker.

End User Changelog

🐛 Known bugs 🐛

• The ocb binary has an identified bug caused by the fact that some of the providers have been marked stable and the default providers in the ocb binary still use the unstable version. In order to fix this explicitly add the default providers in your otel builder config, if not already configured:

providers:
  - gomod: go.opentelemetry.io/collector/confmap/provider/envprovider v1.17.0
  - gomod: go.opentelemetry.io/collector/confmap/provider/fileprovider v1.17.0
  - gomod: go.opentelemetry.io/collector/confmap/provider/httpprovider v1.17.0
  - gomod: go.opentelemetry.io/collector/confmap/provider/httpsprovider v1.17.0
  - gomod: go.opentelemetry.io/collector/confmap/provider/yamlprovider v1.17.0

This release removes the logging exporter. See #11337 to migrate to the debug exporter.

🛑 Breaking changes 🛑

• service/telemetry: Change default metrics address to "localhost:8888" instead of ":8888" (#11251) This behavior can be disabled by disabling the feature gate telemetry.UseLocalHostAsDefaultMetricsAddress.
• loggingexporter: Removed the deprecated logging exporter. Use the debug exporter instead. (#11037). You can read issue #11337 for migration instructions.

🚩 Deprecations 🚩

• service/telemetry: Deprecate service::telemetry::metrics::address in favor of service::telemetry::metrics::readers. (#11205)
• processorhelper: Deprecate BuildProcessorMetricName as it's no longer needed since introduction of mdatagen (#11302)

💡 Enhancements 💡

• ocb: create docker images for OCB, per open-telemetry/opentelemetry-collector-releases#671 (#5712) Adds standard Docker images for OCB to Dockerhub and GitHub, see hub.docker.com/r/otel/opentelemetry-collector-builder
• confighttp: Snappy compression to lazy read for memory efficiency (#11177)
• httpsprovider: Mark the httpsprovider as stable. (#11191)
• httpprovider: Mark the httpprovider as stable. (#11191)
• yamlprovider: Mark the yamlprovider as stable. (#11192)
• confmap: Allow using any YAML structure as a string when loading configuration including time.Time formats (#10659) Previously, fields with time.Time formats could not be used as strings in configurations

🧰 Bug fixes 🧰

• processorhelper: Fix data race condition, concurrent writes to the err variable, causes UB (Undefined Behavior) (#11350)
• cmd/builder: re-adds function to properly set and view version number of OpenTelemetry Collector Builder (ocb) binaries (#11208)
• pdata: Unmarshal Span and SpanLink flags from JSON (#11267)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/collector/pdata's changelog.

v1.18.0/v0.112.0

🛑 Breaking changes 🛑

• service: Change Host to not implement GetExportersWithSignal (#11444) Use Host.GetExporters if still needed.
• componentstatus: Remove deprecated NewInstanceIDWithPipelineIDs, AllPipelineIDsWithPipelineIDs, and WithPipelineIDs. Use NewInstanceID, AllPipelineIDs and WithPipelines instead. (#11363)
• configgrpc: Removed deprecated ClientConfig.ToClientConnWithOptions/ServerConfig.ToServerWithOptions. (#11359, #9480) These methods were renamed to ClientConfig.ToClientConn/ServerConfig.ToServer in v0.111.0.
• connector: Put connectortest in its own module (#11216)
• exporter: Disables setting batch option to batch sender directly. (#10368) Removed WithRequestBatchFuncs(BatcherOption) in favor of WithBatchFuncs(Option), where | BatcherOption is a function that operates on batch sender and Option is one that operates | on BaseExporter
• exporter: Made mergeFunc and mergeSplitFunc required method of exporter.Request (#10368) mergeFunc and mergeSplitFunc used to be part of the configuration pass to the exporter. Now it is changed | to be a method function of request.
• componentprofiles: Move componentprofiles to pipelineprofiles (#11421)
• processor: Put processortest in its own module (#11218)
• receivertest: Removed deprecated NewNopFactoryForTypeWithSignal. Use NewNopFactoryForType instead. (#11362)
• processor: Remove deprecated funcs from processor package (#11368)
• receiver: Remove deprecated funcs from receiver package (#11367)
• processorhelper: Remove deprecated funcs/types from processorhelper & componenttest (#11302)
• service: Remove deprecated pipelines.ConfigWithPipelineID and Config.PipelinesWithPipelineID. Use pipelines.Config and Config.Pipelines instead. (#11361)

🚩 Deprecations 🚩

• extension: Deprecate funcs that repeat extension in name (#11413) Factory.CreateExtension -> Factory.Create | Factory.ExtensionStability -> Factory.Stability

• exporter: Deprecate funcs that repeate exporter in name (#11370) Factory.Create[Traces|Metrics|Logs|Profiles]Exporter -> Factory.Create[Traces|Metrics|Logs|Profiles] | Factory.[Traces|Metrics|Logs|Profiles]ExporterStability -> Factory.[Traces|Metrics|Logs|Profiles]Stability

🚀 New components 🚀

• consumererrorprofiles: Add new module consumereerrorprofiles for consumer error profiles. (#11131)

💡 Enhancements 💡

• configcompression: Add support for lz4 compression (#9128)
• otlpexporter: Add profiles support to OTLP exporter (#11435)
• otlphttpexporter: Add profiles support to OTLP HTTP exporter (#11450)

Commits

• fee2daa [chore] Prepare release v1.18.0/v0.112.0 (#11515)
• b30b542 Update github/codeql-action action to v3.27.0 (#11514)
• dd573f3 [chore] [exporterhelper] Update batch methods comments (#11513)
• 6e12a02 [chore] Promote Damien Mathieu to triager role (#11508)
• 2b6da0d [chore] Handle nested exportertest dependency references (#11512)
• 02ceda1 [chore] Use psuedo-version number for exportertest (#11511)
• 2a9afd8 Update actions/cache action to v4.1.2 (#11510)
• 11767fe [chore] Update leaf module versions to commits with pseudo version dependenci...
• 403c782 [chore] Remove unnecessary context from Batch.split (#11504)
• 8f20a07 [chore] Small nits in batch processor, use generics to avoid type conversions...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mergify]

This pull request does not have a backport label. Could you fix it @dependabot[bot]? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-7.17 is the label to automatically backport to the 7.17 branch.
• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit.
• backport-8.x is the label to automatically backport to the 8.x branch.

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label.

[mergify]

This pull request is now in conflicts. Could you fix it @dependabot[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b dependabot/go_modules/otel-881476ebc5 upstream/dependabot/go_modules/otel-881476ebc5
git merge upstream/main
git push upstream dependabot/go_modules/otel-881476ebc5

[kruskall]

@dependabot recreate

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml