[dependabot]

Bumps the dependencies group with 4 updates in the /systemtest directory: go.opentelemetry.io/collector/pdata, go.yaml.in/yaml/v3, golang.org/x/net and google.golang.org/grpc.

Updates go.opentelemetry.io/collector/pdata from 1.69.0 to 1.70.0

Changelog

Sourced from go.opentelemetry.io/collector/pdata's changelog.

v1.70.0/v0.164.0

💡 Enhancements 💡

• pkg/xpdata: Add xhash.WithUint64 to hash a uint64 value without converting it to int64. (#16176) It produces the same hash as xhash.WithValue(pcommon.NewValueInt(int64(v))).

🧰 Bug fixes 🧰

• pkg/exporterhelper: Expose PartitionConfig and NewDefaultPartitionConfig so that users can modify it. (#16197)

Commits

• f532e15 [chore] Prepare release v1.70.0/v0.164.0 (#16234)
• 8214855 Downgrade github.com/dkorunic/betteralign to v0.14.4 (#16225)
• d39211b [chore] Fix comments indentation in pdata generated code (#16224)
• 42ee5d3 Update module github.com/golangci/golangci-lint/v2 to v2.15.0 (#16206)
• 6d99d81 [otlphttpexporter]report the resolved URL in HTTP status errors (#16215)
• 4130c3c [cmd/mdatagen] Add supported_platforms metadata (#16097)
• 5d7b6a5 [cmd/mdatagen][pdata/xpdata] Add xhash.WithUint64 to avoid gosec G115 in gene...
• 3913c26 [chore] Fix misleading refconsumer Consume* doc comments (#16217)
• fb0374f [pkg/configoptional] set flavor to none (#16210)
• 3123b61 [chore] remove comment about stabilized gate (#16208)
• Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.5 to 3.0.6

Commits

• 5a62aba resolve: hint-class literal merge-key string "<<" so it's quoted on encode
• See full diff in compare view

Updates golang.org/x/net from 0.60.0 to 0.62.0

Commits

• 3de643d html: check all ancestor namespace transitions when rendering raw text
• 05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
• dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
• 9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
• 9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
• 4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
• afcf8cd ipv4: fix several missing bounds checks
• 4af4fce html: avoid quadratic complexity when coalescing text nodes
• 7e56200 quic: per-path connection ids
• c1d31df go.mod: update golang.org/x dependencies
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label. Could you fix it @dependabot[bot]? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8.19 is the label to automatically backport to the 8.19 branch.
• backport-9./d is the label to automatically backport to the 9./d branch. /d is the digit.
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[Copilot]

🟢 Approval recommended

There are no active review issues for the system-test dependency refresh.

No open issues 🎉

What changed in this PR

This PR refreshes dependencies used by APM Server’s system tests, without changing application or test source code.

Changes:

• Updates Collector pdata to 1.70.0, YAML to 3.0.6, x/net to 0.62.0, and gRPC to 1.85.0.
• Updates related indirect dependencies and module checksums.

File	Description
systemtest/​go.sum	Refreshes checksums for updated direct and transitive dependencies.
systemtest/​go.mod	Bumps four direct dependencies and related indirect requirements.

_{Review effort: Balanced}

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 8017d83

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR updates 4 Go dependencies in systemtest/go.mod; overall risk is low-to-moderate (no breaking usage found, but partial upstream release-note detail for 3 modules).

go.opentelemetry.io/collector/pdata v1.69.0 → v1.70.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in repository usage
Testable in PR	✅ Yes (.github/workflows/ci.yml runs on pull_request; includes system-test and system-test-fips using systemtest/go.mod)

Changelog highlights (v1.69.0 → v1.70.0)

• GitHub Releases did not provide an exact pdata/v1.70.0 release body.
• Tag metadata confirms module tag moved to pdata/v1.70.0 with message "Module set stable, Version v1.70.0".
• No explicit CVE/GHSA entries were available from upstream release notes in MCP responses.

Usage in this repository

• systemtest/otlp_test.go uses OTLP pdata APIs: pcommon, plog, plogotlp, pmetric, pmetricotlp.

Compatibility assessment

• Minor bump (1.69.0 → 1.70.0) with no import-path major-version change.
• Current usage is OTLP data model/test construction; no removed APIs identified from available metadata.
• Risk impact: likely neutral to positive; no evidence of increased attack surface.

go.yaml.in/yaml/v3 v3.0.5 → v3.0.6

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in repository usage
Testable in PR	✅ Yes (ci.yml pull_request trigger)

Changelog highlights (v3.0.5 → v3.0.6)

• No GitHub release body for v3.0.6; tag exists with message "Release v3.0.6".
• No explicit CVE/GHSA entries were available from upstream release notes in MCP responses.

Usage in this repository

• systemtest/cmd/runapm/main.go and systemtest/kibana.go import go.yaml.in/yaml/v3 for YAML config parsing/serialization.

Compatibility assessment

• Patch bump within major v3; no import path change.
• Usage is standard marshal/unmarshal-style config handling; no incompatible interface change identified from available metadata.
• Risk impact: low.

golang.org/x/net v0.60.0 → v0.62.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in repository usage
Testable in PR	✅ Yes (ci.yml pull_request trigger)

Changelog highlights (v0.60.0 → v0.62.0)

• No GitHub release entries for golang/net; tags for both versions are present.
• No explicit CVE/GHSA entries were available from upstream release notes in MCP responses.

Usage in this repository

• systemtest/http2_test.go imports golang.org/x/net/http2 and http2/hpack.

Compatibility assessment

• Minor bump in pre-1.0 module; usage is focused test-side HTTP/2 behavior.
• No evidence of removed APIs used by this repo.
• Risk impact: low-to-moderate due limited upstream notes, but blast radius is constrained to system tests.

google.golang.org/grpc v1.84.0 → v1.85.0

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in repository usage
Testable in PR	✅ Yes (ci.yml pull_request trigger)

Changelog highlights (v1.84.0 → v1.85.0)

• Upstream release notes include new metadata/stats APIs and multiple transport/server fixes.
• Security-relevant hardening includes protocol/stream-handling fixes (e.g., stream-ID handling and malformed/truncated frame handling).
• No CVE/GHSA identifiers were listed in the release notes.

Usage in this repository

• systemtest/benchtest/clients.go, systemtest/logging_test.go, systemtest/otlp_test.go use grpc client, credentials, metadata, status/codes APIs.

Compatibility assessment

• Minor bump with stable import path; consumed APIs remain standard and unchanged in this update.
• Release changes appear backward-compatible for this usage and mostly robustness/security hardening.
• Risk impact: low.

Validation

• Ran: cd systemtest && go test ./...
• Result: partially passed; package tests ran, but full systemtest target failed in this sandbox because Docker daemon is unavailable (`Cannot connect to the Docker daemon at (redacted)

Labels Applied

• oblt-aw/ai/merge-ready — applied (low-to-moderate overall risk, no breaking usage found, ecosystem checks pass, PR-context CI coverage present).

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• 169.254.169.254
• metadata.google.internal

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "169.254.169.254"
    - "metadata.google.internal"

See Network Configuration for more information.

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

Automerge skipped

Automerge skipped this pull request because the go-dependencies collection is not enabled for this repository.

To allow automerge for this kind of update, enable the matching collection under Automerge on the Control Plane Dashboard (the oblt-aw/dashboard issue). See Automerge dependency collections for what each collection covers.

See Opt in or opt out for how to enable or disable Automerge collections on the Control Plane Dashboard.

Collections currently enabled for automerge: github-actions, pre-commit

Changed files considered:

• systemtest/go.mod
• systemtest/go.sum