fix(deps): update all updates

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
aya	workspace.dependencies	digest	c29cd71 → 0cf81a3
opentelemetry (source)	dependencies	minor	0.32.0 → 0.33.0
opentelemetry-otlp (source)	dependencies	minor	0.32.0 → 0.33.0
opentelemetry_sdk (source)	dependencies	minor	0.32.1 → 0.33.0
rand (source)	dependencies	patch	0.10.2 → 0.10.3
registry.access.redhat.com/ubi9/ubi	final	digest	c5cc9c2 → a4b9ec0
registry.access.redhat.com/ubi9/ubi	stage	digest	c5cc9c2 → a4b9ec0
thiserror	dependencies	patch	2.0.20 → 2.0.21

---

Release Notes

open-telemetry/opentelemetry-rust (opentelemetry)

v0.33.0

Compare Source

Released 2026-Sep-18

• Fix TraceState accepting more than the 32 list-members the W3C trace-context
  specification allows. from_str, from_key_value and insert now keep at most
  32, dropping members from the end of the list as the specification prescribes, so
  neither a parsed nor a locally built tracestate can exceed the limit.
• Added experimental support for a global context event observer. A
  ContextObserver can be registered via GlobalContextObserver::set to be
  notified of context transitions through the on_context_enter and
  on_context_exit callbacks. This feature is primarily intended to publish a
  different view of the current context (the ObserverContextView) through
  alternative channels that let external readers (e.g. an eBPF profiler) track
  the current context. See the associated
  OTEP.
  Gated behind the experimental_context_observer feature flag.
• otel_info!, otel_warn!, otel_debug!, and otel_error! macros now accept quoted-key fields
  (e.g. "otel.component.type" = "value") for dotted attribute names.
• Added BoundGauge<T> and BoundUpDownCounter<T> types (and the
  corresponding Gauge::bind() / UpDownCounter::bind() methods), completing
  the experimental bound-instrument API across all sync instruments
  (Counter, UpDownCounter, Histogram, Gauge). Gated behind the
  experimental_metrics_bound_instruments feature flag.
• Fix a panic when a value stored with Context::with_value() calls
  Context::current() from its Drop implementation.

open-telemetry/opentelemetry-rust (opentelemetry-otlp)

v0.33.0

Compare Source

Released 2026-Sep-18

• Exporter builder usage and environment configuration are unchanged.
  Breaking for callers parsing compression strings: Compression::from_str
  (including .parse::<Compression>()) now returns the opaque ParseConfigError
  instead of ExporterBuildError. Update explicit result types and error handling
  that expects ExporterBuildError::UnsupportedCompressionAlgorithm. The new error
  implements Display and std::error::Error; its message is for diagnostics.
  Accepted strings and parsing behavior are unchanged.

  // Before:
  let result: Result<Compression, ExporterBuildError> = value.parse();
  
  // After:
  let result: Result<Compression, ParseConfigError> = value.parse();
  if let Err(error) = result {
      eprintln!("invalid compression configuration: {error}");
  }

• Interpret protocol, compression, and metrics temporality environment values
  case-insensitively. Treat empty values as unset, and warn and ignore invalid,
  non-Unicode, or feature-unavailable enum values so resolution can continue
  to the next environment variable or default. Compression none explicitly
  disables compression, including when a generic compression value is set.
  Programmatic configuration remains strict.

Retry

• Retries are now enabled by default for OTLP/HTTP and OTLP/gRPC. The default
  policy uses exponential backoff and jitter with up to 3 retries (4 attempts
  total). Use .with_retry_policy(RetryPolicy::disabled()) to disable retries,
  or provide a custom RetryPolicy to change the behavior.
• Migration for users of the experimental retry features: If your
  Cargo.toml enables experimental-grpc-retry or
  experimental-http-retry, remove those feature flags. No migration action is
  required for users who did not enable them.
  #​3621
• Breaking Make the retry and retry_classification modules crate-private,
  removing their retry engine, error type, and protocol classifiers from the
  public API. RetryPolicy remains available from the crate root with private
  fields and fluent configuration methods. Replace imports from
  opentelemetry_otlp::retry with opentelemetry_otlp::RetryPolicy, and replace
  struct literals with its with_* methods.
  #​3672

Retry fixes

The following fixes apply to retry behavior that was experimental before this
release:

• Retry only HTTP status codes 429, 502, 503, and 504, as required by the OTLP
  specification. The exporter now also honors Retry-After on 503 responses.
• Honor positive gRPC RetryInfo delays returned with Unavailable responses.
• Continue exponential backoff from server-provided RetryInfo and
  Retry-After delays when subsequent export attempts fail.

Other changes

• Exporter compression configuration and behavior are unchanged; users of
  .with_compression(...) need no changes. Breaking only for direct conversion
  callers: removed TryFrom<Compression> for
  tonic::codec::CompressionEncoding. Code explicitly converting between these
  enums must map the variants itself.

• Return an exporter build error when construction of a built-in reqwest HTTP
  client fails instead of silently falling back to a client without the
  exporter-configured timeout. Failure to spawn the blocking client's setup
  thread, or a panic in that thread, is also returned instead of panicking.

• Breaking Removed Default from the TonicExporterBuilderSet and
  HttpExporterBuilderSet typestate markers. This also removes Default from
  the transport-selected exporter builders (e.g.
  SpanExporterBuilder<TonicExporterBuilderSet>). Use the intended builder
  flow instead:

  // Before (no longer compiles):
  let exporter = SpanExporterBuilder::<TonicExporterBuilderSet>::default().build()?;
  
  // After (use the builder entry point):
  let exporter = SpanExporter::builder().with_tonic().build()?;

  Also removed the unused #[doc(hidden)] NoExporterConfig type.

• Breaking Mark Protocol and Compression as non-exhaustive so new OTLP
  protocols, encodings, and compression algorithms can be added without
  breaking downstream users. External exhaustive matches must add a wildcard
  arm. Constructing existing variants and passing them to exporter builders is
  unchanged.

  let protocol_name = match protocol {
      Protocol::Grpc => "grpc",
      Protocol::HttpBinary => "http/protobuf",
      Protocol::HttpJson => "http/json",
      _ => "unknown", // Required because Protocol is non-exhaustive.
  };

• Breaking Make Protocol::from_env() crate-private. Exporter builders
  already resolve OTEL_EXPORTER_OTLP_PROTOCOL when built; applications that
  need to inspect the raw environment setting should read the variable
  directly.

• Breaking Remove OTEL_EXPORTER_OTLP_ENDPOINT_DEFAULT, which always held
  the HTTP default (http://localhost:4318) despite gRPC using
  http://localhost:4317. Omit .with_endpoint(...) to let the selected
  transport use its correct default, or provide the appropriate URL explicitly.
  #​3690

• Breaking Restrict MetricExporterBuilder::with_http() and with_tonic()
  to builders where no transport has been selected, matching the span and log
  exporter builders. Select a transport once; with_temporality() remains
  available before or after transport selection.

• Breaking Remove the public HttpExporterBuilder and
  TonicExporterBuilder transport-first APIs. Configure transports through the
  signal builders instead:

  • Replace HttpExporterBuilder::default() with the corresponding signal
    exporter builder followed by .with_http(), then replace
    .build_span_exporter() or .build_log_exporter() with .build().
  • Replace .build_metrics_exporter(temporality) with
    .with_temporality(temporality).build().
  • Replace TonicExporterBuilder::default() with the corresponding signal
    exporter builder followed by .with_tonic().
    Transport-specific configuration methods remain available after
    .with_http() or .with_tonic().

• Breaking Removed the deprecated tls feature alias. Replace tls with
  tls-ring, or select tls-aws-lc or tls-provider-agnostic explicitly.

• Exporter builder usage is unchanged. Breaking for code matching or constructing
  removed error variants: Simplified ExporterBuildError to the exhaustive
  InvalidConfiguration(String) and InternalFailure(String) variants.
  The enum is no longer marked #[non_exhaustive].
  Configuration errors such as invalid endpoints, missing HTTP clients,
  transport/protocol mismatches, and missing compression features now use
  InvalidConfiguration. Replace implementation-specific, non-exhaustive
  matches such as:

  match error {
      ExporterBuildError::InvalidUri(_, _)
      | ExporterBuildError::InvalidConfig { .. }
      | ExporterBuildError::NoHttpClient => {
          eprintln!("fix the exporter configuration");
      }
      ExporterBuildError::InternalFailure(message) => {
          eprintln!("exporter initialization failed: {message}");
      }
      _ => {}
  }

  with an exhaustive match over the two stable categories:

  match error {
      ExporterBuildError::InvalidConfiguration(message) => {
          eprintln!("fix the exporter configuration: {message}");
      }
      ExporterBuildError::InternalFailure(message) => {
          eprintln!("exporter initialization failed: {message}");
      }
  }

  Code that propagates build errors with ? without inspecting their variants
  needs no changes.
  Tonic endpoint errors identify the originating environment variable when
  validating the URI or reporting endpoint-related TLS setup failures.
  #​3691

• Return an exporter build error for invalid OTLP/HTTP endpoint environment
  variables instead of silently falling back to another endpoint or localhost.
  Empty endpoint environment variables are now treated as unset.

• Return an exporter build error for invalid OTLP/gRPC endpoint environment
  variables instead of silently falling back to another endpoint or localhost.
  Empty endpoint environment variables are now treated as unset.

• Add WithHttpConfig::with_max_request_body_size to configure the HTTP request
  body limit. OTLP/HTTP request bodies are now limited to 64 MiB by default, before and
  after compression; oversized requests are discarded without being sent or
  retried.

• Breaking Seal WithExportConfig, WithHttpConfig, and
  WithTonicConfig. These traits remain public for calling configuration
  methods on OTLP builders, but can no longer be implemented for external
  types.

• Add support for INSECURE environment variables for gRPC (env-var-only, no builder method, per spec):
  OTEL_EXPORTER_OTLP_INSECURE (generic), OTEL_EXPORTER_OTLP_TRACES_INSECURE,
  OTEL_EXPORTER_OTLP_METRICS_INSECURE, OTEL_EXPORTER_OTLP_LOGS_INSECURE.
  Per the spec, these only apply to gRPC connections. When an endpoint has no explicit scheme,
  INSECURE=true uses http://, INSECURE=false (default) uses https:// with auto-TLS.
  Breaking: Schemeless endpoints (e.g., collector.example.com:4317) now default to https://
  instead of being passed as-is. Set OTEL_EXPORTER_OTLP_INSECURE=true for plaintext connections.
  Endpoints with an explicit scheme (e.g., http://, https://, unix://) are unaffected.
  #​774
  #​984

• Breaking Removed the serialize feature flag and its implicit serde
  dependency. This feature gated Serialize/Deserialize derives on
  Protocol and Compression, but the derived representations were incorrect
  (Rust variant names instead of spec values) and the feature only covered
  these two enums. The equivalent feature was removed from the core
  opentelemetry crate in 2022.
  Migration: Remove serialize (and serde, if listed) from your feature
  list. If these values are part of serialisable app config, define a local
  config enum or wrapper and convert it to Protocol or Compression when
  building the exporter.
  #​3711

• Breaking Removed reqwest-rustls-webpki-roots feature. The webpki-roots cargo feature was
  removed from reqwest in v0.13.0, making this feature broken for anyone resolving reqwest >= 0.13.0.
  Migration: Use reqwest-rustls instead (now correctly uses reqwest/rustls with platform native
  trust roots). If you specifically need Mozilla's embedded CA bundle, construct a custom client:

  let root_store = rustls::RootCertStore::from_iter(
      webpki_roots::TLS_SERVER_ROOTS.iter().cloned(),
  );
  let tls_config = rustls::ClientConfig::builder()
      .with_root_certificates(root_store)
      .with_no_client_auth();
  let client = reqwest::Client::builder()
      .tls_backend_preconfigured(tls_config)
      .build()?;
  exporter_builder.with_http_client(client)

• Allow to provide http client wrapped in Arc when configuring HTTP exporter. 3468

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

v0.33.0

Released 2026-Sep-18

• Publicly export the OTEL_*/OTEL_*_DEFAULT environment variable name and
  default value constants for BatchSpanProcessor (opentelemetry_sdk::trace),
  BatchLogProcessor (opentelemetry_sdk::logs), and PeriodicReader
  (opentelemetry_sdk::metrics), so downstream configuration systems can read
  the SDK's spec-defined defaults programmatically instead of duplicating
  them. As part of this, PeriodicReader's previously-private
  DEFAULT_INTERVAL/METRIC_EXPORT_INTERVAL_NAME constants were renamed
  to OTEL_METRIC_EXPORT_INTERVAL_DEFAULT/OTEL_METRIC_EXPORT_INTERVAL to
  match the naming convention already used elsewhere.
  (#​3623)
• Added SDK self-observability metrics, feature-gated behind
  experimental_metrics_bound_instruments: otel.sdk.log.created counts log
  records submitted to the SDK; otel.sdk.processor.log.processed and
  otel.sdk.processor.span.processed count records and spans submitted to an
  exporter by batch and simple processors, with error.type reporting items
  dropped before submission; and otel.sdk.processor.log.queue.capacity
  reports the configured BatchLogProcessor queue capacity.
  (#​3514,
  #​3608,
  #​3609,
  #​3611)
• Made futures-channel, futures-executor, futures-util, and thiserror
  optional, enabling a minimal SDK build. With default-features = false, the
  SDK's only dependency is the opentelemetry API crate.
  (#​3593)
• Bound instruments are now available for Gauge and UpDownCounter via the
  new BoundGauge<T> and BoundUpDownCounter<T> types exposed by the
  opentelemetry crate. Requires the experimental_metrics_bound_instruments
  feature.
• Fixed a race in BatchSpanProcessor and BatchLogProcessor where a
  span/log enqueued just before force_flush() or shutdown() could be
  missed by the flush and dropped at shutdown: the pending-item counter is
  now incremented before enqueueing (and reverted if the queue is full), so
  the worker's counter snapshot can no longer under-count items already in
  the queue (#​3453).
• Default SDK Resource construction now falls back to unknown_service under
  Miri instead of calling std::env::current_exe(), avoiding an abort in Miri
  isolation mode while preserving the normal
  unknown_service:<process.executable.name> fallback outside Miri.
• Fixed asynchronous counters (ObservableCounter, ObservableUpDownCounter)
  using delta temporality reporting incorrect deltas when observed attributes
  were recorded in an unsorted key order.

rust-random/rand (rand)

v0.10.3

Compare Source

Fixes

• Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#​1808)
• Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#​1821)
• Fix possible panic due to sampling a deserialized Uniform<char> (#​1831)

Changes

• Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#​1838)

dtolnay/thiserror (thiserror)

v2.0.21

Compare Source

• Fix parsing of generic unit variants in display expressions (#​459)

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: stackrox/fact/.coderabbit.yml

Review profile: CHILL

Plan: Advanced

Run ID: 73c76cb5-2f7a-4e2f-b9b2-0235b72e2f10

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace
    Updating crates.io index
    Updating git repository `https://github.com/aya-rs/aya.git`
error: failed to get `aya` as a dependency of package `fact v0.5.0-dev (/tmp/renovate/repos/github/stackrox/fact/fact)`

Caused by:
  failed to load source for dependency `aya`

Caused by:
  unable to update https://github.com/aya-rs/aya.git?rev=0cf81a36670dfbca8e442eb8aba7dd6081e72281

Caused by:
  failed to create directory `/home/renovate/.cargo/git/db/aya-c5ab473414e1dedb`

Caused by:
  Permission denied (os error 13)

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path fact/Cargo.toml --package rand@0.10.2 --precise 0.10.3
    Updating crates.io index
    Updating git repository `https://github.com/aya-rs/aya.git`
error: failed to get `aya` as a dependency of package `fact v0.5.0-dev (/tmp/renovate/repos/github/stackrox/fact/fact)`

Caused by:
  failed to load source for dependency `aya`

Caused by:
  unable to update https://github.com/aya-rs/aya.git?rev=0cf81a36670dfbca8e442eb8aba7dd6081e72281

Caused by:
  failed to create directory `/home/renovate/.cargo/git/db/aya-c5ab473414e1dedb`

Caused by:
  Permission denied (os error 13)

[rhacs-bot]

Auto-approved by automation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 33.47%. Comparing base (9bae9a6) to head (1a43513).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1820   +/-   ##
=======================================
  Coverage   33.47%   33.47%           
=======================================
  Files          22       22           
  Lines        3621     3621           
  Branches     3621     3621           
=======================================
  Hits         1212     1212           
  Misses       2400     2400           
  Partials        9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Molter73]

/konflux-retest fact-on-push

[Molter73]

/konflux-retest fact-on-push

[Molter73]

/konflux-retest fact-on-push

[Molter73]

/konflux-retest fact-on-push

[github-actions]

/konflux-retest fact-on-push

[github-actions]

/konflux-retest fact-on-push

[github-actions]

/konflux-retest fact-on-push