chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/open-telemetry/opentelemetry-operator	v0.151.0 → v0.152.0			require	minor
opentelemetry-operator (source)	0.113.1 → 0.114.0				minor

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

open-telemetry/opentelemetry-operator (github.com/open-telemetry/opentelemetry-operator)

v0.152.0

Compare Source

0.152.0

🛑 Breaking changes 🛑

• api: Move config parsing and CRD metrics from apis to internal package (#​4362)
  • Methods on *Config (package apis/v1beta1) converted to standalone functions in internal/otelconfig, now taking *v1beta1.Config as the first parameter:
    • GetEnabledComponents, GetReceiverPorts, GetExporterPorts, GetExtensionPorts, GetReceiverAndExporterPorts, GetAllPorts, GetEnvironmentVariables, GetAllRbacRules, ApplyDefaults, GetLivenessProbe, GetReadinessProbe, GetStartupProbe, Yaml, NullObjects
  • Methods on *Service converted to functions in internal/otelconfig:
    • MetricsEndpoint, GetTelemetry
    • ApplyDefaults → renamed to ServiceApplyDefaults
  • Method on *Telemetry converted to function:
    • ToAnyConfig → renamed to TelemetryToAnyConfig
  • Functions moved from apis/v1beta1 to internal/metrics with renames:
    • BootstrapMetrics → Bootstrap
    • NewMetrics(prv, ctx, cl) → New(ctx, prv, cl) (parameter reorder: ctx now first)
  • Types moved out of apis/v1beta1:
    • MetricsConfig, Telemetry → internal/otelconfig
    • Metrics → internal/metrics

💡 Enhancements 💡

• target allocator: Add support for dropping ServiceMonitor/PodMonitor endpoints that reference arbitrary files (#​5104)

• auto-instrumentation: Allow to run the mutating webhook using static configuration, without the need for CRDs. (#​4201)

  With this change, you can deploy the manager as a mutating webhook without setting up a v1alpha1.Instrumentation custom resource
  or the v1alpha1.Instrumentation CRD.

  Instead, you can now set up instrumentation by configuring the manager via its config file with these settings:

    ignore-missing-collector-crds: true 
    enable-instrumentation-crds: false # Ignore that the CRD is not registered.
    enable-multi-instrumentation: false
    instrumentations: # Static configuration for our instrumentation
      spec:
        exporter:
          endpoint: http://collector.default.svc:4318
        propagators:
          - tracecontext
          - baggage
          - b3
        java:
          image: "java-autoinstrumentation:dev"

• target allocator: Improve the error message when the target allocator is enabled but the Prometheus receiver is not named exactly "prometheus". (#​5017)

  When only named instances such as "prometheus/otelcol" are present, the error now lists them and explains that a receiver named exactly "prometheus" is required.

🧰 Bug fixes 🧰

• collector: Remove unnecessary RBAC permissions from the events receiver. (#​5073)

• collector: Fix when configuring a gRPC port for the jaeger_query extension, the collector-extension Service only generates an HTTP port and is missing the gRPC port. (#​4912)

• collector: Explicitly set without_type_suffix, without_units, and without_scope_info to false on the operator-injected Prometheus telemetry reader. (#​5075)

  Preserves historical metric names. Without this, users upgrading to a collector containing open-telemetry/opentelemetry-collector#15027 would see operator-managed collector metric names silently change shape. Added alpha feature gate operator.collector.usedefaulttelemetryshape (off by default) to opt into collector defaults instead. The gate will be promoted to beta (on by default) in a future release.

• target allocator: Fix scrapeClass tlsConfig fields being silently dropped in target allocator config. (#​5101)

  scrapeClasses with tlsConfig like the following had their TLS fields silently dropped
  when passed to the target allocator:
  scrapeClasses:
  - name: tls-config
  tlsConfig:
  caFile: /scrapeclass-ca.pem
  insecureSkipVerify: true

• collector: Restrict automatic RBAC from users without the necessary permissions (#​5105)

  If the operator has permission to create ClusterRoles and ClusterRoleBindings, it sets up RBAC
  for collectors automatically based on their configuration.
  If a user tries to create an OpenTelemetryCollector whose permissions would be automatically
  generated this way, and the user doesn't have the permissions themselves, it will be rejected.
  If the collector tries to use an existing ServiceAccount, only the permissions missing from
  that ServiceAccount are checked this way.

• collector: Skip provisioning Services, Ingress, NetworkPolicy, and HPA for sidecar mode collectors since the operator does not control the Pod lifecycle in that mode. PodMonitors are still provisioned when metrics are enabled. (#​4934)

Components

• OpenTelemetry Collector - v0.152.0
• OpenTelemetry Contrib - v0.152.0
• Java auto-instrumentation - v2.28.1
• .NET auto-instrumentation - v1.15.0
• Node.JS - v0.76.0
• Python - v0.63b1
• Go - v0.24.0
• ApacheHTTPD - 1.0.4
• Nginx - 1.0.4

open-telemetry/opentelemetry-helm-charts (opentelemetry-operator)

v0.114.0

Compare Source

OpenTelemetry Collector Helm chart for Kubernetes

What's Changed

• [collector] bump default collector version to v0.118.0 by @​JaredTan95 in #​1507

Full Changelog: open-telemetry/opentelemetry-helm-charts@opentelemetry-collector-0.113.1...opentelemetry-collector-0.114.0

v0.113.2

Compare Source

OpenTelemetry Operator Helm chart for Kubernetes

What's Changed

• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2226
• chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @​dependabot[bot] in #​2227
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2228
• [opentelemetry-operator] expose pprof port by @​atoulme in #​2224

Full Changelog: open-telemetry/opentelemetry-helm-charts@opentelemetry-kube-stack-0.15.1...opentelemetry-operator-0.113.2

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/exp	v0.0.0-20260312153236-7ab1446f8b90 -> v0.0.0-20260508232706-74f9aab9d74a