build(deps): bump the go_modules group across 1 directory with 3 updates

[dependabot]

Bumps the go_modules group with 3 updates in the / directory: github.com/traefik/traefik/v3, github.com/containerd/containerd/v2 and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.

Updates github.com/traefik/traefik/v3 from 3.6.25 to 3.7.13

Release notes

Sourced from github.com/traefik/traefik/v3's releases.

v3.7.13

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-qqjf-53cj-pwvv
• Advisory GHSA-f52w-8j3h-j724
• Advisory GHSA-v67p-phpq-fc8x
• Advisory GHSA-w4v4-9rw7-5326
• Advisory GHSA-8fcf-v89g-xpg6

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 to v5.4.1 (#13759 @​ldez)
• [acme] Disable recursive nss propagation by default for DNS challenge (#13830 @​rtribotte)
• [acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge (#13710 @​amazon7737)
• [acme, tls] Ignore negated matchers when parsing rule domains (#13725 @​rtribotte)
• [consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers (#13741 @​rtribotte)
• [http3] Dedicate a transport per HTTP/3 client connection (#13812 @​sdelicata)
• [k8s/ingress-nginx] Fix sticky cookie expiration per request (#13496 @​makaiver)
• [k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect (#13457 @​mmatur)
• [k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute (#13456 @​mmatur)
• [logs, middleware] Set access log entry level and time before formatting the OTLP body (#13767 @​emilevauge)
• [logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning (#13780 @​lazerg)
• [middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme (#13320 @​AnouarMohamed)
• [middleware, authentication] Prevent user enumeration through the basic auth singleflight key (#13816 @​sdelicata)
• [server] Build the configuration copy once per change (#13746 @​jspdown)
• [server] Do not forward h2c upgrade headers to the backend (#13797 @​sdelicata)
• [server] Deny request with an opaque request target (#13796 @​sdelicata)
• [server] Do not forward request trailer values to the backend (#13822 @​rtribotte)
• [server] Bump github.com/quic-go/quic-go to v0.62.0 (#13807 @​Nelwhix)
• [tls] Redact duplicate TLS certificates in provider merge logs (#13548 @​xsergos)
• [webui] Fix displayed number on details pages (#13779 @​gndz07)

Documentation:

• [k8s] Add warning about Ingress API frozen state (#13783 @​jnoordsij)
• [k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector (#13790 @​jnoordsij)
• [k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs (#13811 @​thev1ndu)
• Tell scanning agents to read the security policy and decisions pages (#13753 @​emilevauge)

v3.7.12

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-cjr6-pf59-jq29
• Advisory GHSA-7ghq-v6jf-g56c
• Advisory GHSA-rf44-j88r-hh8c

Bug fixes:

• [fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 (#13769 @​mmatur)
• [file] Include the filename in file provider configuration errors (#13527 @​lazerg)
• [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#13717 @​gndz07)

... (truncated)

Commits

• fc92cc1 Prepare release v3.7.13
• 0c90dbe Do not require recursive nameservers propagation by default for the DNS-01 ch...
• 45a459e Merge branch v2.11 into v3.7
• 839eb7f Prepare release v2.11.57
• 153c8f4 Ignore negated matchers when parsing rule domains
• 591a5e9 Downgrade default TLS resources namespace mismatch log to warning
• 2249bd8 Build a collision-free item key in the Consul Catalog and Nomad providers
• c827fa1 Disable recursive nss propagation by default for DNS challenge
• 46ac3ac Preserve leading dot in sticky session cookie Domain attribute
• 24d4ab0 Redact duplicate TLS certificates in provider merge logs
• Additional commits viewable in compare view

Updates github.com/containerd/containerd/v2 from 2.3.4 to 2.3.5

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.3.5

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes and updates including security patches.

Security Updates

• containerd
  • CVE-2026-53495
  • GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14030)

Runtime

• Avoid hangs and data races when streaming container standard I/O in CRI (#14094)
• Fix missing error messages in OpenTelemetry trace attributes (#14049)
• Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13999)
• Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#13995)
• Avoid containerd startup hangs when loading shims (#13983)
• Add context to error when shim delete times out (#13921)
• Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)

Snapshotters

• Fix unpack failure for EROFS images containing the erofs OS feature (#14062)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Phil Estes
• Samuel Karp
• Derek McGowan
• Sebastiaan van Stijn
• Akhil Mohan
• Maksym Pavlenko
• Wei Fu
• Oleh Konko
• Austin Vazquez
• Jing Chen
• Martín Fernández
• Paco Xu
• XlabAI

... (truncated)

Commits

• 1294c24 Merge pull request #14092 from samuelkarp/prepare-release-2.3.5
• db68d72 Prepare release notes for v2.3.5
• be419b0 Merge commit from fork
• 84ea25b Merge commit from fork
• 5db0399 Merge pull request #14094 from k8s-infra-cherrypick-robot/cherry-pick-14085-t...
• 9f6be86 Fix data races and a deadlock in the byte stream helpers
• 9ec55f0 cri: cancel ExecSync IO drain on context cancellation
• c535779 archive: skip redundant opaque whiteout walks
• 3684f86 Merge pull request #14063 from k8s-infra-cherrypick-robot/cherry-pick-14057-t...
• 7459b1f Merge pull request #14062 from k8s-infra-cherrypick-robot/cherry-pick-14012-t...
• Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc from 0.20.0 to 0.21.0

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

• Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
• Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
• Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
• Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
• Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
• Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
• Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
• Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
• Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
• Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
• Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

• HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
• ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
• Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
• Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
• ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
• ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

• Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

• ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
• ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

• Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
• Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
• Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
• Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
• Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

... (truncated)

Commits

• 93a693e Release v1.45.0 (#8693)
• c65d435 Merge commit from fork
• 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
• 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
• a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
• 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
• cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
• e814a72 Merge commit from fork
• bfd8eb7 chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#8687)
• 48db2c6 chore(deps): update github/codeql-action action to v4.37.5 (#8692)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Preview (prod backend + PR dashboard) → https://1386.ns-preview.trapti.tech/

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 87ce966c-0ebf-46af-a678-b5d41c6d13ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}