[EricAndrechek]

Summary

Unblocks the weekly Go dependency group (held red since early September) together with the nats-server test fix in its own PR.

• OpenTelemetry 1.47. The otel modules move to 1.47 (otel/log and sdk/log 1.47.0, otlploggrpc 0.23.0, Prometheus exporter 0.69.0), and every use of the deprecated otel/log/global (in internal/observability and the integration test) moves to otel.Get/SetLoggerProvider, which only exists from 1.47. That clears the SA1019 findings. gRPC stays at 1.83.2, and proto/otlp and grpc-gateway/v2 stay at the versions that don't need gRPC 1.84.
• gRPC hold. Dependabot ignores google.golang.org/grpc >= 1.84.0, < 1.85.0 (GO-2026-6443; no 1.84.x patch exists, and the fix is only in a 1.85 pre-release), plus go.opentelemetry.io/proto/otlp >= 1.11.1 and grpc-gateway/v2 >= 2.31.0, whose releases require gRPC 1.84.0 and would otherwise pull it in transitively. All three holds go together once gRPC 1.85.0 is tagged; deps: grpc 1.84.0 fails vulncheck (GO-2026-6443) and holds the whole go-deps group red #643 stays open to track that.
• npm cooldown. Dependabot's npm updates get a 7-day cooldown matching pnpm's minimumReleaseAge, with the same @wave-rf/* and @wavehouse/* excludes. It covers the bumped package only, not packages re-resolved transitively.
• Docs made true against the pinned SDKs.
  • The "logs ignore the TLS env vars" gap was stale: otlploggrpc has applied the CA and client-certificate variables since v0.21.0, already in v0.1.0. TestOTel_TLSPath_AllSignals now pins it for all three signals.
  • A malformed OTEL_EXPORTER_OTLP_HEADERS entry makes the logs exporter drop the whole variable, while traces and metrics skip only that entry.
  • Each signal misreads a scheme-less endpoint differently, so always write the scheme.
  • Turning otel.logs.enabled off strips trace_id/span_id, component, source and the build fields from stdout.
  • The local-dashboard steps now enable OTel for make dev and compose.
  • The Alloy pattern keeps OTLP logs on, for the stdout trace IDs.
  • make vulncheck is a package-level scan.
  • go get -u needs the gRPC re-pin before go mod tidy.

After this and the nats-server fix land, Dependabot's next go-deps run should go green. The npm cooldown syntax is validated against the published Dependabot schema but only runs on Dependabot's next schedule.

Test plan

• make ci green locally on the final tree.
• go list -m google.golang.org/grpc → v1.83.2; go mod tidy -diff clean; make vulncheck and make lint-go clean (no SA1019).
• go test -tags integration -run TestOTel ./tests/integration/ passes, including logs over a private CA.
• The documented go get -u ./... → go get google.golang.org/grpc@v1.83 → go mod tidy sequence verified in a scratch copy (gRPC, proto/otlp and grpc-gateway step back down; make tidy clean).
• Pre-push review: the code reviewer returned ship_it on the code (later commits change only docs, comments and a Makefile help string, so its skip is logged). The docs reviewer returned ship_it on the final commit; its marker was recorded by hand because hand-back reports don't write one yet (fix(agents): review-marker hook writes no marker when a reviewer's report arrives by hand-back #659).

Related Issues

Closes #732. Refs #643 (stays open until the holds are dropped), refs #441 (cooldown covers the bumped package only). Part of #740.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 013355b4-da2a-4003-8055-13458f44130c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Docs preview is live → https://f8113f76-wavehouse-docs.wave-rf.workers.dev

• Commit — f369cc1: docs(otel): keep OTLP logs on in the Alloy pattern; say what turning them off costs stdout
• Author — @EricAndrechek, Claude Opus 5.5
• Committed — 2026-10-07 08:42 (UTC-04:00)
• Deployed — 2026-10-07 09:58 EDT

[github-code-quality]

Code Coverage Overview

Languages: Go

Go

The overall line coverage in commit f369cc1 in the deps/go-deps-unblock branch remains at 93%, unchanged from commit bf88dba in the main branch.

Show a line coverage summary of the most impacted files.

File	main bf88dba	deps/go-deps-unblock f369cc1	+/-
internal/mq/nats_topology.go	92%	91%	-1%
internal/mq/external.go	85%	84%	-1%
internal/ingest/worker.go	97%	97%	0%
internal/observ...ity/provider.go	83%	83%	0%

---

_{Updated October 07, 2026 14:03 UTC}