Update go.mod: bump OpenTelemetry and testify dependencies

[robindiddams]

Summary by CodeRabbit

• Chores
  • Upgraded telemetry, logging, and related platform libraries across the project to newer releases for improved stability, performance, and compatibility.
  • Updated system/tooling dependencies for better reliability and security.
• Tests
  • Upgraded testing libraries to improve test robustness.
• Documentation
  • No user-facing documentation changes.
• Refactor
  • No functional refactors; internal dependency surface streamlined.
• Bug Fixes
  • No direct user-facing fixes included.

[coderabbitai]

Walkthrough

Updates only to go.mod: multiple direct OpenTelemetry-related modules (core, sdk, metric, trace, log/exporters) and testify were bumped; several indirect dependencies (golang.org/x/, google.golang.org/, grpc, genproto, etc.) were also advanced. No source code or public API changes.

Changes

Cohort / File(s)	Summary
Direct dependency bumps go.mod	Upgraded direct modules: github.com/stretchr/testify v1.10.0 → v1.11.1; go.opentelemetry.io/otel core/sdk/trace/metric v1.34.0 → v1.38.0; OTLP exporters/log packages v0.10.0 → v0.14.0 / v1.38.0; go.opentelemetry.io/otel/sdk/log v0.10.0 → v0.14.0.
Indirect/upstream bumps go.mod	Advanced indirect deps: golang.org/x/sync v0.12.0 → v0.16.0; golang.org/x/term v0.30.0 → v0.34.0; golang.org/x/net/sys/text and related OTLP/genproto/grpc packages updated (e.g., google.golang.org/grpc v1.71.0 → v1.75.0, google.golang.org/genproto revisions).
Expanded OTEL surface (indirect) go.mod	Indirect upgrades for OpenTelemetry components and related transitive modules: go.opentelemetry.io/otel/exporters/otlp/..., go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/proto/otlp, and supporting golang.org/x/* packages.
No code or API changes (repo-wide)	No source files or exported/public declarations were modified; changes are limited to dependency version updates in go.mod (and transitive resolution).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

I hop through modules, twitch my nose,
Bumping otel where the green grass grows.
Testify leaps, transitive trails run,
go.mod polishes under moon and sun.
Thump! — a rabbit's patchwork of versions, done.

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 47d4768 and de8a853.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod (3 hunks)

🔇 Additional comments (4)

go.mod (4)

21-27: OTel stack is version-aligned.

Core, SDK, trace, and log (including HTTP exporters) are consistently pinned (v1.38.0 / v0.14.0). Good job avoiding skew.

---

28-29: stdlib x/ bumps look fine.*

No obvious compatibility risks with the rest of the graph post-OTel bump.

---

70-72: Indirect OTel modules match direct deps.

otlptrace and metric at v1.38.0 and proto/otlp at v1.7.1 are consistent with the exporters/core.

---

76-79: Verify gRPC/genproto/protobuf compatibility after the bump.

Large jumps here can surface subtle wire/ABI/API breaks in gateway/proto-generated code. Please run a quick build/test sweep and check for duplicate versions in the graph.

You can run locally:

#!/bin/bash
set -euo pipefail
# Ensure module graph is tidy
go mod tidy

# Check for duplicate major versions of key deps
go mod graph | rg -nP 'google\.golang\.org/(grpc|protobuf)|genproto/googleapis/(api|rpc)'

# Build and test all packages
go build ./...
go test ./...

Pre-merge checks (2 passed, 1 inconclusive)

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description Check	❓ Inconclusive	No pull request description was provided in the context, so it is not possible to determine whether it appropriately describes the changes made.	Please add a concise description summarizing the dependency updates and their purpose to clarify the intent of this pull request.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The current title “Bump otel @coderabbitai” directly references the primary change of updating OpenTelemetry dependencies, making it related to the changeset, though the inclusion of a user handle and the generic term “otel” reduces clarity.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch bump-otel

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

go.mod (1)

3-4: Invalid go directive: use major.minor only (optionally add toolchain).

"go 1.25.0" is invalid; the go directive must be "go 1.25". Optionally add a separate toolchain line if you need the exact patch.

Apply:

-go 1.25.0
+go 1.25
+toolchain go1.25.0

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d4e687e and 47d4768.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod (3 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: build

🔇 Additional comments (5)

go.mod (5)

18-18: Testify bump looks good.

No breaking changes expected for common assert/require usage.

---

21-21: Core OTel to v1.38.0 looks good.

Sets a clear baseline for aligning submodules.

---

49-49: logr patch bump OK.

Safe, no action needed.

---

75-75: x/sys bump OK.

Reasonable with newer OTel. Ensure CI toolchain matches the go/toolchain directive.

---

71-72: No direct imports of go.opentelemetry.io/otel/metric found; keep it as an indirect dependency.