--- a/go.mod
+++ b/go.mod
@@ -96,7 +96,7 @@
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
 	go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
@@ -117,3 +117,11 @@
 	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
+
+replace go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
+
+replace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
+
+replace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
+
+replace golang.org/x/net => golang.org/x/net v0.60.0
--- a/go.sum
+++ b/go.sum
@@ -218,12 +218,12 @@
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 h1:QBajQ2SrwQijzHyZbQlPsuIzpl/ll8DY6wPWsajeGcI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0/go.mod h1:08ZQLjrPLQ6R4kAXvuOvODEer5Yh4CoFvll5qB2BCI8=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 h1:2lpf4hnrasYIsUyEXwnTZq5lsxrMm4T2Bwb06IctAZQ=
@@ -259,8 +259,8 @@
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go	2026-10-09 17:01:33.372510964 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go	2026-10-09 17:01:33.372510964 +0000
@@ -7,4 +7,4 @@
   - [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc],
   - [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp].
 */
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go	2026-10-09 17:01:33.372510964 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
 
 import (
 	"context"
@@ -97,9 +97,9 @@
 func (e *Exporter) MarshalLog() any {
 	return struct {
 		Type   string
-		Client Client
+		Client string
 	}{
 		Type:   "otlptrace",
-		Client: e.client,
+		Client: fmt.Sprintf("%T", e.client),
 	}
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go	2026-10-09 17:01:33.372510964 +0000
@@ -3,7 +3,7 @@
 
 // Package tracetransform provides conversion functionality for the otlptrace
 // exporters.
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
@@ -87,6 +87,22 @@
 		av.Value = &commonpb.AnyValue_StringValue{
 			StringValue: v.AsString(),
 		}
+	case attribute.BYTESLICE:
+		av.Value = &commonpb.AnyValue_BytesValue{
+			BytesValue: v.AsByteSlice(),
+		}
+	case attribute.SLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: values(v.AsSlice()),
+			},
+		}
+	case attribute.MAP:
+		av.Value = &commonpb.AnyValue_KvlistValue{
+			KvlistValue: &commonpb.KeyValueList{
+				Values: KeyValues(v.AsMap()),
+			},
+		}
 	case attribute.STRINGSLICE:
 		av.Value = &commonpb.AnyValue_ArrayValue{
 			ArrayValue: &commonpb.ArrayValue{
@@ -149,3 +165,11 @@
 	}
 	return converted
 }
+
+func values(vals []attribute.Value) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = Value(v)
+	}
+	return converted
+}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go	2026-10-09 17:01:33.372510964 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go	2026-10-09 17:01:33.372510964 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	resourcepb "go.opentelemetry.io/proto/otlp/resource/v1"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go	2026-10-09 17:01:33.372510964 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	"math"
@@ -37,21 +37,22 @@
 		}
 
 		rKey := sd.Resource().Equivalent()
+		scope := sd.InstrumentationScope()
 		k := key{
 			r:  rKey,
-			is: sd.InstrumentationScope(),
+			is: scope,
 		}
 		scopeSpan, iOk := ssm[k]
 		if !iOk {
 			// Either the resource or instrumentation scope were unknown.
 			scopeSpan = &tracepb.ScopeSpans{
-				Scope:     InstrumentationScope(sd.InstrumentationScope()),
+				Scope:     InstrumentationScope(scope),
 				Spans:     []*tracepb.Span{},
-				SchemaUrl: sd.InstrumentationScope().SchemaURL,
+				SchemaUrl: scope.SchemaURL,
 			}
+			ssm[k] = scopeSpan
 		}
 		scopeSpan.Spans = append(scopeSpan.Spans, span(sd))
-		ssm[k] = scopeSpan
 
 		rs, rOk := rsm[rKey]
 		if !rOk {
@@ -90,14 +91,16 @@
 		return nil
 	}
 
-	tid := sd.SpanContext().TraceID()
-	sid := sd.SpanContext().SpanID()
+	spanContext := sd.SpanContext()
+	tid := spanContext.TraceID()
+	sid := spanContext.SpanID()
 
+	sdStatus := sd.Status()
 	s := &tracepb.Span{
 		TraceId:                tid[:],
 		SpanId:                 sid[:],
-		TraceState:             sd.SpanContext().TraceState().String(),
-		Status:                 status(sd.Status().Code, sd.Status().Description),
+		TraceState:             spanContext.TraceState().String(),
+		Status:                 status(sdStatus.Code, sdStatus.Description),
 		StartTimeUnixNano:      uint64(max(0, sd.StartTime().UnixNano())), // nolint:gosec // Overflow checked.
 		EndTimeUnixNano:        uint64(max(0, sd.EndTime().UnixNano())),   // nolint:gosec // Overflow checked.
 		Links:                  links(sd.Links()),
@@ -110,10 +113,11 @@
 		DroppedLinksCount:      clampUint32(sd.DroppedLinks()),
 	}
 
-	if psid := sd.Parent().SpanID(); psid.IsValid() {
+	sdParent := sd.Parent()
+	if psid := sdParent.SpanID(); psid.IsValid() {
 		s.ParentSpanId = psid[:]
 	}
-	s.Flags = buildSpanFlagsWith(sd.SpanContext().TraceFlags(), sd.Parent())
+	s.Flags = buildSpanFlagsWith(spanContext.TraceFlags(), sdParent)
 
 	return s
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go	2026-10-09 17:01:33.428510622 +0000
@@ -1,11 +1,12 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
 
 import (
 	"context"
 	"errors"
+	"fmt"
 	"sync"
 	"time"
 
@@ -16,6 +17,7 @@
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
@@ -26,11 +28,12 @@
 )
 
 type client struct {
-	endpoint      string
-	dialOpts      []grpc.DialOption
-	metadata      metadata.MD
-	exportTimeout time.Duration
-	requestFunc   retry.RequestFunc
+	endpoint       string
+	dialOpts       []grpc.DialOption
+	metadata       metadata.MD
+	exportTimeout  time.Duration
+	maxRequestSize int
+	requestFunc    retry.RequestFunc
 
 	// stopCtx is used as a parent context for all exports. Therefore, when it
 	// is canceled with the stopFunc all exports are canceled.
@@ -65,14 +68,15 @@
 	ctx, cancel := context.WithCancel(context.Background()) //nolint:gosec  // cancel called in client shutdown.
 
 	c := &client{
-		endpoint:      cfg.Traces.Endpoint,
-		exportTimeout: cfg.Traces.Timeout,
-		requestFunc:   cfg.RetryConfig.RequestFunc(retryable),
-		dialOpts:      cfg.DialOptions,
-		stopCtx:       ctx,
-		stopFunc:      cancel,
-		conn:          cfg.GRPCConn,
-		instID:        counter.NextExporterID(),
+		endpoint:       cfg.Traces.Endpoint,
+		exportTimeout:  cfg.Traces.Timeout,
+		maxRequestSize: cfg.Traces.MaxRequestSize,
+		requestFunc:    cfg.RetryConfig.RequestFunc(retryable),
+		dialOpts:       cfg.DialOptions,
+		stopCtx:        ctx,
+		stopFunc:       cancel,
+		conn:           cfg.GRPCConn,
+		instID:         counter.NextExporterID(),
 	}
 
 	if len(cfg.Traces.Headers) > 0 {
@@ -205,16 +209,28 @@
 	ctx, cancel := c.exportContext(ctx)
 	defer cancel()
 
-	var code codes.Code
+	pbRequest := &coltracepb.ExportTraceServiceRequest{
+		ResourceSpans: protoSpans,
+	}
+
+	code := codes.Unknown
 	if c.inst != nil {
-		op := c.inst.ExportSpans(ctx, len(protoSpans))
+		var spanCount int
+		for _, rs := range protoSpans {
+			for _, ss := range rs.ScopeSpans {
+				spanCount += len(ss.Spans)
+			}
+		}
+		op := c.inst.ExportSpans(ctx, spanCount)
 		defer func() { op.End(uploadErr, code) }()
 	}
 
+	if maxSize := c.maxRequestSize; maxSize > 0 && proto.Size(pbRequest) > maxSize {
+		return fmt.Errorf("request message too large: exceeded %d bytes", maxSize)
+	}
+
 	return c.requestFunc(ctx, func(iCtx context.Context) error {
-		resp, err := c.tsc.Export(iCtx, &coltracepb.ExportTraceServiceRequest{
-			ResourceSpans: protoSpans,
-		})
+		resp, err := c.tsc.Export(iCtx, pbRequest)
 		if resp != nil && resp.PartialSuccess != nil {
 			msg := resp.PartialSuccess.GetErrorMessage()
 			n := resp.PartialSuccess.GetRejectedSpans()
@@ -312,12 +328,10 @@
 }
 
 // MarshalLog is the marshaling function used by the logging system to represent this Client.
-func (c *client) MarshalLog() any {
+func (*client) MarshalLog() any {
 	return struct {
-		Type     string
-		Endpoint string
+		Type string
 	}{
-		Type:     "otlptracegrpc",
-		Endpoint: c.endpoint,
+		Type: "otlptracegrpc",
 	}
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go	2026-10-09 17:01:33.428510622 +0000
@@ -62,4 +62,4 @@
 
 [W3C Baggage HTTP Header Content Format]: https://www.w3.org/TR/baggage/#header-content
 */
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go	2026-10-09 17:01:33.428510622 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go	2026-10-09 17:01:33.428510622 +0000
@@ -1,14 +1,14 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/counter/counter.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/counter/counter.go.tmpl
+
 // Package counter provides a simple counter for generating unique IDs.
 //
 // This package is used to generate unique IDs while allowing testing packages
 // to reset the counter.
-package counter // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter"
+package counter
 
 import "sync/atomic"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,12 +1,12 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
+
 // Package envconfig provides functionality to parse configuration from
 // environment variables.
-package envconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig"
+package envconfig
 
 import (
 	"crypto/tls"
@@ -60,7 +60,7 @@
 func WithBool(n string, fn func(bool)) ConfigFn {
 	return func(e *EnvOptionsReader) {
 		if v, ok := e.GetEnvValue(n); ok {
-			b := strings.ToLower(v) == "true"
+			b := strings.EqualFold(v, "true")
 			fn(b)
 		}
 	}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go	2026-10-09 17:01:33.428510622 +0000
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package internal provides internal functionally for the otlptracegrpc package.
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
+package internal
 
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess.go.tmpl "--data={}" --out=partialsuccess.go
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess_test.go.tmpl "--data={}" --out=partialsuccess_test.go
@@ -27,8 +27,8 @@
 //go:generate gotmpl --body=../../../../../internal/shared/x/x.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc\" }" --out=x/x.go
 //go:generate gotmpl --body=../../../../../internal/shared/x/x_test.go.tmpl "--data={}" --out=x/x_test.go
 
-//go:generate gotmpl --body=../../../../../internal/shared/otlp/observ/target.go.tmpl "--data={ \"pkg\": \"observ\", \"pkg_path\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ\" }" --out=observ/target.go
+//go:generate gotmpl --body=../../../../../internal/shared/otlp/observ/target.go.tmpl "--data={ \"pkg\": \"observ\" }" --out=observ/target.go
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/observ/target_test.go.tmpl "--data={ \"pkg\": \"observ\" }" --out=observ/target_test.go
 
-//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter\" }" --out=counter/counter.go
+//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={}" --out=counter/counter.go
 //go:generate gotmpl --body=../../../../../internal/shared/counter/counter_test.go.tmpl "--data={}" --out=counter/counter_test.go
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go	2026-10-09 17:01:33.432510598 +0000
@@ -3,4 +3,4 @@
 
 // Package observ provides experimental observability instrumentation for the
 // otlptracegrpc exporter.
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ"
+package observ
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ"
+package observ
 
 import (
 	"context"
@@ -18,8 +18,8 @@
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x"
 	"go.opentelemetry.io/otel/internal/global"
 	"go.opentelemetry.io/otel/metric"
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
-	"go.opentelemetry.io/otel/semconv/v1.40.0/otelconv"
+	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
+	"go.opentelemetry.io/otel/semconv/v1.43.0/otelconv"
 )
 
 const (
@@ -72,6 +72,7 @@
 func get[T any](p *sync.Pool) *[]T { return p.Get().(*[]T) }
 
 func put[T any](p *sync.Pool, s *[]T) {
+	clear(*s)     // erase elements to allow GC to collect what they refer to.
 	*s = (*s)[:0] // Reset.
 	p.Put(s)
 }
@@ -339,7 +340,10 @@
 // the provided non-nil err.
 func rejected(n int64, err error) int64 {
 	ps := errPartialPool.Get().(*internal.PartialSuccess)
-	defer errPartialPool.Put(ps)
+	defer func() {
+		*ps = internal.PartialSuccess{} // erase fields to allow GC to collect them.
+		errPartialPool.Put(ps)
+	}()
 	// Check for partial success.
 	if errors.As(err, ps) {
 		// Bound RejectedItems to [0, n]. This should not be needed,
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/observ/target.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/observ/target.go.tmpl
+
+package observ
 
 import (
 	"errors"
@@ -41,11 +41,10 @@
 	const sep = "://"
 
 	// Find scheme. Do not allocate the string by using url.Parse.
-	idx := strings.Index(target, sep)
-	if idx == -1 {
+	scheme, endpoint, found := strings.Cut(target, sep)
+	if !found {
 		return "", -1, fmt.Errorf("invalid target %q: missing scheme", target)
 	}
-	scheme, endpoint := target[:idx], target[idx+len(sep):]
 
 	// Check for unix schemes.
 	if scheme == schemeUnix || scheme == schemeUnixAbstract {
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -49,31 +49,37 @@
 	tlsConf := &tls.Config{}
 	DefaultEnvOptionsReader.Apply(
 		envconfig.WithURL("ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For OTLP/HTTP endpoint URLs without a per-signal
-				// configuration, the passed endpoint is used as a base URL
-				// and the signals are sent to these paths relative to that.
-				cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For OTLP/HTTP endpoint URLs without a per-signal
+					// configuration, the passed endpoint is used as a base URL
+					// and the signals are sent to these paths relative to that.
+					cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithURL("TRACES_ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For endpoint URLs for OTLP/HTTP per-signal variables, the
-				// URL MUST be used as-is without any modification. The only
-				// exception is that if an URL contains no path part, the root
-				// path / MUST be used.
-				path := u.Path
-				if path == "" {
-					path = "/"
-				}
-				cfg.Traces.URLPath = path
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For endpoint URLs for OTLP/HTTP per-signal variables, the
+					// URL MUST be used as-is without any modification. The only
+					// exception is that if an URL contains no path part, the root
+					// path / MUST be used.
+					path := u.Path
+					if path == "" {
+						path = "/"
+					}
+					cfg.Traces.URLPath = path
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithCertPool("CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
 		envconfig.WithCertPool("TRACES_CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
@@ -142,7 +148,7 @@
 }
 
 func withTLSConfig(c *tls.Config, fn func(*tls.Config)) func(e *envconfig.EnvOptionsReader) {
-	return func(e *envconfig.EnvOptionsReader) {
+	return func(*envconfig.EnvOptionsReader) {
 		if c.RootCAs != nil || len(c.Certificates) > 0 {
 			fn(c)
 		}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
+
 // Package otlpconfig provides configuration for the otlptrace exporters.
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -31,6 +31,9 @@
 	// DefaultTracesPath is a default URL path for endpoint that
 	// receives spans.
 	DefaultTracesPath string = "/v1/traces"
+	// DefaultMaxRequestSize is the default maximum size of a serialized export
+	// request, before compression.
+	DefaultMaxRequestSize int = 64 * 1024 * 1024
 	// DefaultTimeout is a default max waiting time for the backend to process
 	// each span batch.
 	DefaultTimeout time.Duration = 10 * time.Second
@@ -42,13 +45,14 @@
 	HTTPTransportProxyFunc func(*http.Request) (*url.URL, error)
 
 	SignalConfig struct {
-		Endpoint    string
-		Insecure    bool
-		TLSCfg      *tls.Config
-		Headers     map[string]string
-		Compression Compression
-		Timeout     time.Duration
-		URLPath     string
+		Endpoint       string
+		Insecure       bool
+		TLSCfg         *tls.Config
+		Headers        map[string]string
+		Compression    Compression
+		MaxRequestSize int
+		Timeout        time.Duration
+		URLPath        string
 
 		// gRPC configurations
 		GRPCCredentials credentials.TransportCredentials
@@ -77,10 +81,11 @@
 func NewHTTPConfig(opts ...HTTPOption) Config {
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 	}
@@ -94,7 +99,7 @@
 
 // cleanPath returns a path with all spaces trimmed. If urlPath is empty,
 // defaultPath is returned instead.
-func cleanPath(urlPath string, defaultPath string) string {
+func cleanPath(urlPath, defaultPath string) string {
 	tmp := strings.TrimSpace(urlPath)
 	if tmp == "" || tmp == "." {
 		return defaultPath
@@ -111,10 +116,11 @@
 	userAgent := "OTel OTLP Exporter Go/" + otlptrace.Version()
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 		DialOptions: []grpc.DialOption{grpc.WithUserAgent(userAgent)},
@@ -128,7 +134,7 @@
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
 	}
 	// Prioritize GRPCCredentials over Insecure (passing both is an error).
-	if cfg.Traces.GRPCCredentials != nil {
+	if cfg.Traces.GRPCCredentials != nil { //nolint:gocritic // if-else is clearer than switch
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Traces.GRPCCredentials))
 	} else if cfg.Traces.Insecure {
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(insecure.NewCredentials()))
@@ -222,7 +228,7 @@
 
 func (splitOption) private() {}
 
-func newSplitOption(httpFn func(cfg Config) Config, grpcFn func(cfg Config) Config) GenericOption {
+func newSplitOption(httpFn, grpcFn func(cfg Config) Config) GenericOption {
 	return &splitOption{httpFn: httpFn, grpcFn: grpcFn}
 }
 
@@ -280,6 +286,11 @@
 
 		cfg.Traces.Endpoint = u.Host
 		cfg.Traces.URLPath = u.Path
+		if cfg.Traces.URLPath == "" {
+			// For HTTP exporters, a URL without a path targets the root path. Set it explicitly so the default signal
+			// path is not appended by cleanPath. (URLPath is ignored by gRPC exporters.)
+			cfg.Traces.URLPath = "/"
+		}
 		cfg.Traces.Insecure = u.Scheme != "https"
 
 		return cfg
@@ -344,6 +355,13 @@
 		return cfg
 	})
 }
+
+func WithMaxRequestSize(size int) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.MaxRequestSize = size
+		return cfg
+	})
+}
 
 func WithProxy(pf HTTPTransportProxyFunc) GenericOption {
 	return newGenericOption(func(cfg Config) Config {
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
+
+package otlpconfig
 
 const (
 	// DefaultCollectorGRPCPort is the default gRPC port of the collector.
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go	2026-10-09 17:01:33.428510622 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/partialsuccess.go
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/partialsuccess.go
+
+package internal
 
 import "fmt"
 
@@ -41,7 +41,7 @@
 }
 
 // Is supports the errors.Is() interface.
-func (ps PartialSuccess) Is(err error) bool {
+func (PartialSuccess) Is(err error) bool {
 	_, ok := err.(PartialSuccess)
 	return ok
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,13 +1,13 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/retry/retry.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/retry/retry.go.tmpl
+
 // Package retry provides request retry functionality that can perform
 // configurable exponential backoff for transient errors and honor any
 // explicit throttle responses received.
-package retry // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry"
+package retry
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go	2026-10-09 17:01:33.428510622 +0000
@@ -1,8 +1,8 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
+package internal
 
 // Version is the current release version of the OpenTelemetry OTLP gRPC trace
 // exporter in use.
-const Version = "1.42.0"
+const Version = "1.45.0"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x"
+package x
 
 import "strings"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go	2026-10-09 17:01:33.432510598 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/x/x.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/x/x.go.tmpl
+
 // Package x documents experimental features for [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc].
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x"
+package x
 
 import (
 	"os"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go	2026-10-09 17:01:33.428510622 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
 
 import (
 	"fmt"
@@ -192,6 +192,16 @@
 	return wrappedOption{otlpconfig.WithTimeout(duration)}
 }
 
+// WithMaxRequestSize sets the maximum size, in bytes, of a serialized export
+// request, before compression, that the exporter will send.
+//
+// If size is less than or equal to zero, no request-size limit is applied.
+// Disabling the limit is not recommended because it can lead to excessive
+// resource consumption or abuse.
+func WithMaxRequestSize(size int) Option {
+	return wrappedOption{otlpconfig.WithMaxRequestSize(size)}
+}
+
 // WithRetry sets the retry policy for transient retryable errors that may be
 // returned by the target endpoint when exporting a batch of spans.
 //
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go	2026-10-09 17:01:33.488510255 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
 
 import (
 	"bytes"
@@ -143,9 +143,9 @@
 }
 
 // Stop shuts down the client and interrupt any in-flight request.
-func (d *client) Stop(ctx context.Context) error {
-	d.stopOnce.Do(func() {
-		close(d.stopCh)
+func (c *client) Stop(ctx context.Context) error {
+	c.stopOnce.Do(func() {
+		close(c.stopCh)
 	})
 	select {
 	case <-ctx.Done():
@@ -156,7 +156,7 @@
 }
 
 // UploadTraces sends a batch of spans to the collector.
-func (d *client) UploadTraces(ctx context.Context, protoSpans []*tracepb.ResourceSpans) (uploadErr error) {
+func (c *client) UploadTraces(ctx context.Context, protoSpans []*tracepb.ResourceSpans) (uploadErr error) {
 	pbRequest := &coltracepb.ExportTraceServiceRequest{
 		ResourceSpans: protoSpans,
 	}
@@ -165,30 +165,41 @@
 		return err
 	}
 
-	ctx, cancel := d.contextWithStop(ctx)
+	ctx, cancel := c.contextWithStop(ctx)
 	defer cancel()
 
-	request, err := d.newRequest(rawRequest)
+	if maxSize := c.cfg.MaxRequestSize; maxSize > 0 && len(rawRequest) > maxSize {
+		return fmt.Errorf("request body too large: exceeded %d bytes", maxSize)
+	}
+
+	request, err := c.newRequest(rawRequest)
 	if err != nil {
 		return err
 	}
 
 	var statusCode int
-	if d.inst != nil {
-		op := d.inst.ExportSpans(ctx, len(protoSpans))
+	if c.inst != nil {
+		var spanCount int
+		for _, rs := range protoSpans {
+			for _, ss := range rs.ScopeSpans {
+				spanCount += len(ss.Spans)
+			}
+		}
+		op := c.inst.ExportSpans(ctx, spanCount)
 		defer func() { op.End(uploadErr, statusCode) }()
 	}
 
-	return errors.Join(uploadErr, d.requestFunc(ctx, func(ctx context.Context) error {
+	return errors.Join(uploadErr, c.requestFunc(ctx, func(ctx context.Context) error {
 		select {
 		case <-ctx.Done():
 			return ctx.Err()
 		default:
 		}
 
+		statusCode = 0
 		request.reset(ctx)
 		// nolint:gosec // URL is constructed from validated OTLP endpoint configuration
-		resp, err := d.client.Do(request.Request)
+		resp, err := c.client.Do(request.Request)
 		var urlErr *url.Error
 		if errors.As(err, &urlErr) && urlErr.Temporary() {
 			return newResponseError(http.Header{}, err)
@@ -272,8 +283,8 @@
 	}))
 }
 
-func (d *client) newRequest(body []byte) (request, error) {
-	u := url.URL{Scheme: d.getScheme(), Host: d.cfg.Endpoint, Path: d.cfg.URLPath}
+func (c *client) newRequest(body []byte) (request, error) {
+	u := url.URL{Scheme: c.getScheme(), Host: c.cfg.Endpoint, Path: c.cfg.URLPath}
 	r, err := http.NewRequestWithContext(context.Background(), http.MethodPost, u.String(), http.NoBody)
 	if err != nil {
 		return request{Request: r}, err
@@ -282,13 +293,13 @@
 	userAgent := "OTel OTLP Exporter Go/" + otlptrace.Version()
 	r.Header.Set("User-Agent", userAgent)
 
-	for k, v := range d.cfg.Headers {
+	for k, v := range c.cfg.Headers {
 		r.Header.Set(k, v)
 	}
 	r.Header.Set("Content-Type", contentTypeProto)
 
 	req := request{Request: r}
-	switch Compression(d.cfg.Compression) {
+	switch Compression(c.cfg.Compression) {
 	case NoCompression:
 		r.ContentLength = int64(len(body))
 		req.bodyReader = bodyReader(body)
@@ -299,7 +310,10 @@
 		r.Header.Set("Content-Encoding", "gzip")
 
 		gz := gzPool.Get().(*gzip.Writer)
-		defer gzPool.Put(gz)
+		defer func() {
+			gz.Reset(io.Discard)
+			gzPool.Put(gz)
+		}()
 
 		var b bytes.Buffer
 		gz.Reset(&b)
@@ -320,15 +334,11 @@
 }
 
 // MarshalLog is the marshaling function used by the logging system to represent this Client.
-func (d *client) MarshalLog() any {
+func (*client) MarshalLog() any {
 	return struct {
-		Type     string
-		Endpoint string
-		Insecure bool
+		Type string
 	}{
-		Type:     "otlptracehttp",
-		Endpoint: d.cfg.Endpoint,
-		Insecure: d.cfg.Insecure,
+		Type: "otlptracehttp",
 	}
 }
 
@@ -362,7 +372,7 @@
 
 // retryableError represents a request failure that can be retried.
 type retryableError struct {
-	throttle int64
+	throttle time.Duration
 	err      error
 }
 
@@ -371,16 +381,30 @@
 // if it is not nil.
 func newResponseError(header http.Header, wrapped error) error {
 	var rErr retryableError
-	if s, ok := header["Retry-After"]; ok {
-		if t, err := strconv.ParseInt(s[0], 10, 64); err == nil {
-			rErr.throttle = t
-		}
+	if v := header.Get("Retry-After"); v != "" {
+		rErr.throttle = retryAfterDuration(v)
 	}
 
 	rErr.err = wrapped
 	return rErr
 }
 
+func retryAfterDuration(v string) time.Duration {
+	if t, err := strconv.ParseInt(v, 10, 64); err == nil && t >= 0 {
+		const maxRetryAfterSeconds = int64(1<<63-1) / int64(time.Second)
+		if t > maxRetryAfterSeconds {
+			return time.Duration(1<<63 - 1)
+		}
+		return time.Duration(t) * time.Second
+	}
+
+	if date, err := http.ParseTime(v); err == nil {
+		return max(time.Until(date), 0)
+	}
+
+	return 0
+}
+
 func (e retryableError) Error() string {
 	if e.err != nil {
 		return "retry-able request failure: " + e.err.Error()
@@ -422,17 +446,17 @@
 		return false, 0
 	}
 
-	return true, time.Duration(rErr.throttle)
+	return true, rErr.throttle
 }
 
-func (d *client) getScheme() string {
-	if d.cfg.Insecure {
+func (c *client) getScheme() string {
+	if c.cfg.Insecure {
 		return "http"
 	}
 	return "https"
 }
 
-func (d *client) contextWithStop(ctx context.Context) (context.Context, context.CancelFunc) {
+func (c *client) contextWithStop(ctx context.Context) (context.Context, context.CancelFunc) {
 	// Unify the parent context Done signal with the client's stop
 	// channel.
 	ctx, cancel := context.WithCancel(ctx)
@@ -441,7 +465,7 @@
 		case <-ctx.Done():
 			// Nothing to do, either cancelled or deadline
 			// happened.
-		case <-d.stopCh:
+		case <-c.stopCh:
 			cancel()
 		}
 	}(ctx, cancel)
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go	2026-10-09 17:01:33.488510255 +0000
@@ -65,4 +65,4 @@
 
 [W3C Baggage HTTP Header Content Format]: https://www.w3.org/TR/baggage/#header-content
 */
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go	2026-10-09 17:01:33.488510255 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,14 +1,14 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/counter/counter.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/counter/counter.go.tmpl
+
 // Package counter provides a simple counter for generating unique IDs.
 //
 // This package is used to generate unique IDs while allowing testing packages
 // to reset the counter.
-package counter // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter"
+package counter
 
 import "sync/atomic"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,12 +1,12 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
+
 // Package envconfig provides functionality to parse configuration from
 // environment variables.
-package envconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig"
+package envconfig
 
 import (
 	"crypto/tls"
@@ -60,7 +60,7 @@
 func WithBool(n string, fn func(bool)) ConfigFn {
 	return func(e *EnvOptionsReader) {
 		if v, ok := e.GetEnvValue(n); ok {
-			b := strings.ToLower(v) == "true"
+			b := strings.EqualFold(v, "true")
 			fn(b)
 		}
 	}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go	2026-10-09 17:00:47.140799704 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go	2026-10-09 17:01:33.492510230 +0000
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package internal provides internal functionally for the otlptracehttp package.
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal"
+package internal
 
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess.go.tmpl "--data={}" --out=partialsuccess.go
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess_test.go.tmpl "--data={}" --out=partialsuccess_test.go
@@ -26,6 +26,6 @@
 
 //go:generate gotmpl --body=../../../../../internal/shared/x/x.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\" }" --out=x/x.go
 
-//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter\" }" --out=counter/counter.go
+//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={}" --out=counter/counter.go
 //go:generate gotmpl --body=../../../../../internal/shared/counter/counter_test.go.tmpl "--data={}" --out=counter/counter_test.go
 //go:generate gotmpl --body=../../../../../internal/shared/x/x_test.go.tmpl "--data={}" --out=x/x_test.go
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go	2026-10-09 17:01:33.492510230 +0000
@@ -3,7 +3,7 @@
 
 // Package observ provides experimental observability instrumentation for the
 // otlptracehttp exporter.
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ"
+package observ
 
 import (
 	"context"
@@ -23,8 +23,8 @@
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x"
 	"go.opentelemetry.io/otel/internal/global"
 	"go.opentelemetry.io/otel/metric"
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
-	"go.opentelemetry.io/otel/semconv/v1.40.0/otelconv"
+	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
+	"go.opentelemetry.io/otel/semconv/v1.43.0/otelconv"
 )
 
 const (
@@ -77,6 +77,7 @@
 func get[T any](p *sync.Pool) *[]T { return p.Get().(*[]T) }
 
 func put[T any](p *sync.Pool, s *[]T) {
+	clear(*s)     // erase elements to allow GC to collect what they refer to.
 	*s = (*s)[:0] // Reset.
 	p.Put(s)
 }
@@ -167,7 +168,7 @@
 // to set the "component.name" attribute.
 //
 // The endpoint is the HTTP endpoint the exporter is exporting to. It should be
-// in the format "host:port" or a full URL.
+// in the format "host[:port]".
 func BaseAttrs(id int64, endpoint string) []attribute.KeyValue {
 	host, port, err := parseEndpoint(endpoint)
 	if err != nil || (host == "" && port < 0) {
@@ -345,7 +346,7 @@
 //
 // Otherwise, a new RecordOption is returned with the base attributes of the
 // Instrumentation plus the http.response.status_code attribute set to the
-// provided status, and if err is not nil, the error.type attribute set
+// provided status (if non-zero), and if err is not nil, the error.type attribute set
 // to the type of the error.
 func (i *Instrumentation) recordOption(err error, status int) metric.RecordOption {
 	if err == nil && status == http.StatusOK {
@@ -356,7 +357,9 @@
 	defer put(measureAttrsPool, attrs)
 	*attrs = append(*attrs, i.attrs...)
 
-	*attrs = append(*attrs, semconv.HTTPResponseStatusCode(status))
+	if status != 0 {
+		*attrs = append(*attrs, semconv.HTTPResponseStatusCode(status))
+	}
 	if err != nil {
 		*attrs = append(*attrs, semconv.ErrorType(err))
 	}
@@ -394,7 +397,10 @@
 // the provided non-nil err.
 func rejected(n int64, err error) int64 {
 	ps := errPartialPool.Get().(*internal.PartialSuccess)
-	defer errPartialPool.Put(ps)
+	defer func() {
+		*ps = internal.PartialSuccess{} // erase fields to allow GC to collect them.
+		errPartialPool.Put(ps)
+	}()
 	// Check for partial success.
 	if errors.As(err, ps) {
 		// Bound RejectedItems to [0, n]. This should not be needed,
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -49,31 +49,37 @@
 	tlsConf := &tls.Config{}
 	DefaultEnvOptionsReader.Apply(
 		envconfig.WithURL("ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For OTLP/HTTP endpoint URLs without a per-signal
-				// configuration, the passed endpoint is used as a base URL
-				// and the signals are sent to these paths relative to that.
-				cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For OTLP/HTTP endpoint URLs without a per-signal
+					// configuration, the passed endpoint is used as a base URL
+					// and the signals are sent to these paths relative to that.
+					cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithURL("TRACES_ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For endpoint URLs for OTLP/HTTP per-signal variables, the
-				// URL MUST be used as-is without any modification. The only
-				// exception is that if an URL contains no path part, the root
-				// path / MUST be used.
-				path := u.Path
-				if path == "" {
-					path = "/"
-				}
-				cfg.Traces.URLPath = path
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For endpoint URLs for OTLP/HTTP per-signal variables, the
+					// URL MUST be used as-is without any modification. The only
+					// exception is that if an URL contains no path part, the root
+					// path / MUST be used.
+					path := u.Path
+					if path == "" {
+						path = "/"
+					}
+					cfg.Traces.URLPath = path
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithCertPool("CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
 		envconfig.WithCertPool("TRACES_CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
@@ -142,7 +148,7 @@
 }
 
 func withTLSConfig(c *tls.Config, fn func(*tls.Config)) func(e *envconfig.EnvOptionsReader) {
-	return func(e *envconfig.EnvOptionsReader) {
+	return func(*envconfig.EnvOptionsReader) {
 		if c.RootCAs != nil || len(c.Certificates) > 0 {
 			fn(c)
 		}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
+
 // Package otlpconfig provides configuration for the otlptrace exporters.
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -31,6 +31,9 @@
 	// DefaultTracesPath is a default URL path for endpoint that
 	// receives spans.
 	DefaultTracesPath string = "/v1/traces"
+	// DefaultMaxRequestSize is the default maximum size of a serialized export
+	// request, before compression.
+	DefaultMaxRequestSize int = 64 * 1024 * 1024
 	// DefaultTimeout is a default max waiting time for the backend to process
 	// each span batch.
 	DefaultTimeout time.Duration = 10 * time.Second
@@ -42,13 +45,14 @@
 	HTTPTransportProxyFunc func(*http.Request) (*url.URL, error)
 
 	SignalConfig struct {
-		Endpoint    string
-		Insecure    bool
-		TLSCfg      *tls.Config
-		Headers     map[string]string
-		Compression Compression
-		Timeout     time.Duration
-		URLPath     string
+		Endpoint       string
+		Insecure       bool
+		TLSCfg         *tls.Config
+		Headers        map[string]string
+		Compression    Compression
+		MaxRequestSize int
+		Timeout        time.Duration
+		URLPath        string
 
 		// gRPC configurations
 		GRPCCredentials credentials.TransportCredentials
@@ -77,10 +81,11 @@
 func NewHTTPConfig(opts ...HTTPOption) Config {
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 	}
@@ -94,7 +99,7 @@
 
 // cleanPath returns a path with all spaces trimmed. If urlPath is empty,
 // defaultPath is returned instead.
-func cleanPath(urlPath string, defaultPath string) string {
+func cleanPath(urlPath, defaultPath string) string {
 	tmp := strings.TrimSpace(urlPath)
 	if tmp == "" || tmp == "." {
 		return defaultPath
@@ -111,10 +116,11 @@
 	userAgent := "OTel OTLP Exporter Go/" + otlptrace.Version()
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 		DialOptions: []grpc.DialOption{grpc.WithUserAgent(userAgent)},
@@ -128,7 +134,7 @@
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
 	}
 	// Prioritize GRPCCredentials over Insecure (passing both is an error).
-	if cfg.Traces.GRPCCredentials != nil {
+	if cfg.Traces.GRPCCredentials != nil { //nolint:gocritic // if-else is clearer than switch
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Traces.GRPCCredentials))
 	} else if cfg.Traces.Insecure {
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(insecure.NewCredentials()))
@@ -222,7 +228,7 @@
 
 func (splitOption) private() {}
 
-func newSplitOption(httpFn func(cfg Config) Config, grpcFn func(cfg Config) Config) GenericOption {
+func newSplitOption(httpFn, grpcFn func(cfg Config) Config) GenericOption {
 	return &splitOption{httpFn: httpFn, grpcFn: grpcFn}
 }
 
@@ -280,6 +286,11 @@
 
 		cfg.Traces.Endpoint = u.Host
 		cfg.Traces.URLPath = u.Path
+		if cfg.Traces.URLPath == "" {
+			// For HTTP exporters, a URL without a path targets the root path. Set it explicitly so the default signal
+			// path is not appended by cleanPath. (URLPath is ignored by gRPC exporters.)
+			cfg.Traces.URLPath = "/"
+		}
 		cfg.Traces.Insecure = u.Scheme != "https"
 
 		return cfg
@@ -344,6 +355,13 @@
 		return cfg
 	})
 }
+
+func WithMaxRequestSize(size int) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.MaxRequestSize = size
+		return cfg
+	})
+}
 
 func WithProxy(pf HTTPTransportProxyFunc) GenericOption {
 	return newGenericOption(func(cfg Config) Config {
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
+
+package otlpconfig
 
 const (
 	// DefaultCollectorGRPCPort is the default gRPC port of the collector.
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/partialsuccess.go
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/partialsuccess.go
+
+package internal
 
 import "fmt"
 
@@ -41,7 +41,7 @@
 }
 
 // Is supports the errors.Is() interface.
-func (ps PartialSuccess) Is(err error) bool {
+func (PartialSuccess) Is(err error) bool {
 	_, ok := err.(PartialSuccess)
 	return ok
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,13 +1,13 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/retry/retry.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/retry/retry.go.tmpl
+
 // Package retry provides request retry functionality that can perform
 // configurable exponential backoff for transient errors and honor any
 // explicit throttle responses received.
-package retry // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry"
+package retry
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,8 +1,8 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal"
+package internal
 
 // Version is the current release version of the OpenTelemetry OTLP HTTP trace
 // exporter in use.
-const Version = "1.43.0"
+const Version = "1.45.0"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x"
+package x
 
 import "strings"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go	2026-10-09 17:01:33.492510230 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/x/x.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/x/x.go.tmpl
+
 // Package x documents experimental features for [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp].
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x"
+package x
 
 import (
 	"os"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go	2026-10-09 17:01:33.488510255 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
 
 import (
 	"crypto/tls"
@@ -93,6 +93,11 @@
 //
 // If an invalid URL is provided, the default value will be kept.
 //
+// The path of the provided URL is used as-is; with one exception: if the URL has
+// no path, it is normalized to the root path ("/"). The default traces path
+// ("/v1/traces") is not appended automatically. Use WithEndpoint if you want
+// that behavior, or pass a URL that includes that path.
+//
 // By default, if an environment variable is not set, and this option is not
 // passed, "localhost:4318" will be used.
 //
@@ -138,6 +143,16 @@
 	return wrappedOption{otlpconfig.WithTimeout(duration)}
 }
 
+// WithMaxRequestSize sets the maximum size, in bytes, of a serialized export
+// request, before compression, that the exporter will send.
+//
+// If size is less than or equal to zero, no request-size limit is applied.
+// Disabling the limit is not recommended because it can lead to excessive
+// resource consumption or abuse.
+func WithMaxRequestSize(size int) Option {
+	return wrappedOption{otlpconfig.WithMaxRequestSize(size)}
+}
+
 // WithRetry configures the retry policy for transient errors that may occurs
 // when exporting traces. An exponential back-off algorithm is used to ensure
 // endpoints are not overwhelmed with retries. If unset, the default retry
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go	2026-10-09 17:00:47.144799680 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go	2026-10-09 17:01:33.372510964 +0000
@@ -1,9 +1,9 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
 
 // Version is the current release version of the OpenTelemetry OTLP trace exporter in use.
 func Version() string {
-	return "1.43.0"
+	return "1.45.0"
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/flow.go /work/src/docker-registry/vendor/golang.org/x/net/http2/flow.go
--- a/vendor/golang.org/x/net/http2/flow.go	2026-10-09 17:00:47.180799462 +0000
+++ b/vendor/golang.org/x/net/http2/flow.go	2026-10-09 17:01:34.600503459 +0000
@@ -10,6 +10,9 @@
 // flow control window update.
 const inflowMinRefresh = 4 << 10
 
+// maxFlowWindow is the maximum size of a flow control window.
+const maxFlowWindow = (1 << 31) - 1
+
 // inflow accounts for an inbound flow control window.
 // It tracks both the latest window sent to the peer (used for enforcement)
 // and the accumulated unsent window.
@@ -74,47 +77,99 @@
 	return true
 }
 
-// outflow is the outbound flow control window's size.
+// connOutflow is connection-level outbound flow control.
+type connOutflow struct {
+	initial int32 // SETTINGS_INITIAL_WINDOW_SIZE, changes with settings updates
+	n       int32 // connection-level flow control window
+	flowErr bool  // set when a flow control error is encountered
+}
+
+func (f *connOutflow) init() {
+	f.initial = initialWindowSize // initial stream window size
+	f.n = initialWindowSize       // current connection window size
+}
+
+func (f *connOutflow) changeInitialWindowSize(size int64) bool {
+	if size > maxFlowWindow {
+		f.flowErr = true
+		return false
+	}
+	f.initial = int32(size)
+	return true
+}
+
+func (f *connOutflow) add(n int32) bool {
+	sum := int64(f.n) + int64(n)
+	if sum > maxFlowWindow {
+		f.flowErr = true
+		return false
+	}
+	f.n += n
+	return true
+}
+
+// outflow is the stream-level outbound flow control window's size.
 type outflow struct {
 	_ incomparable
 
-	// n is the number of DATA bytes we're allowed to send.
-	// An outflow is kept both on a conn and a per-stream.
-	n int32
+	// delta is the difference between the stream's flow control window and
+	// the connection's initial window size (conn.initial).
+	//
+	// Another view is that delta is the number of flow control bytes provided to this
+	// stream in WINDOW_UPDATE frames, less the number of bytes sent on the stream.
+	delta int32
 
 	// conn points to the shared connection-level outflow that is
-	// shared by all streams on that conn. It is nil for the outflow
-	// that's on the conn directly.
-	conn *outflow
+	// shared by all streams on that conn.
+	conn *connOutflow
 }
 
-func (f *outflow) setConnFlow(cf *outflow) { f.conn = cf }
-
-func (f *outflow) available() int32 {
-	n := f.n
-	if f.conn != nil && f.conn.n < n {
-		n = f.conn.n
+func (f *outflow) available() (int32, bool) {
+	if f.conn == nil {
+		return maxFlowWindow, true // only happens in tests
 	}
-	return n
+	if f.conn.flowErr {
+		// Block all sending once any stream observes a flow control error.
+		return 0, false
+	}
+	n := int64(f.conn.initial) + int64(f.delta)
+	if n > maxFlowWindow {
+		f.conn.flowErr = true
+		return 0, false
+	}
+	return min(int32(n), f.conn.n), true
 }
 
 func (f *outflow) take(n int32) {
-	if n > f.available() {
-		panic("internal error: took too much")
+	if f.conn == nil {
+		return // only happens in tests
 	}
-	f.n -= n
-	if f.conn != nil {
-		f.conn.n -= n
+	avail, _ := f.available()
+	if n > avail {
+		panic("internal error: took too much")
 	}
+	f.delta -= n
+	f.conn.n -= n
 }
 
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
 func (f *outflow) add(n int32) bool {
-	sum := f.n + n
-	if (sum > n) == (f.n > 0) {
-		f.n = sum
-		return true
+	if f.conn == nil {
+		return true // only happens in tests
+	}
+	avail := int64(f.conn.initial) + int64(f.delta)
+	if avail > maxFlowWindow {
+		// An earlier change to the initial window pushed this stream over the limit.
+		// This is a connection-level flow control error.
+		f.conn.flowErr = true
+		return false
 	}
-	return false
+	if avail+int64(n) > maxFlowWindow {
+		// This update would push the stream over the limit.
+		// This is a stream-level flow control error.
+		return false
+	}
+	f.delta += n
+	return true
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/frame.go /work/src/docker-registry/vendor/golang.org/x/net/http2/frame.go
--- a/vendor/golang.org/x/net/http2/frame.go	2026-10-09 17:00:47.180799462 +0000
+++ b/vendor/golang.org/x/net/http2/frame.go	2026-10-09 17:01:34.600503459 +0000
@@ -1711,7 +1711,8 @@
 	mh := &MetaHeadersFrame{
 		HeadersFrame: hf,
 	}
-	var remainSize = fr.maxHeaderListSize()
+	var headersRemainSize = fr.maxHeaderListSize()
+	var trailersRemainSize = fr.maxHeaderListSize()
 	var sawRegular bool
 
 	var invalid error // pseudo header field errors
@@ -1743,14 +1744,29 @@
 			return
 		}
 
-		size := hf.Size()
-		if size > remainSize {
+		var remainSize *uint32
+		var size uint32
+		if hf.Name == "trailer" {
+			remainSize = &trailersRemainSize
+			fieldCount := strings.Count(hf.Value, ",") + 1
+			// Rather than actually constructing hpack.HeaderField for each
+			// trailer field and cumulatively adding its Size, just do the math
+			// manually to avoid unnecessary work. This does make it so
+			// whitespaces after comma are counted against the budget, but that
+			// should be innocuous.
+			size = uint32(len(hf.Value)-fieldCount+1) + uint32(fieldCount)*hpack.HeaderField{}.Size()
+		} else {
+			remainSize = &headersRemainSize
+			size = hf.Size()
+		}
+		if size > *remainSize {
 			hdec.SetEmitEnabled(false)
 			mh.Truncated = true
-			remainSize = 0
+			headersRemainSize = 0
+			trailersRemainSize = 0
 			return
 		}
-		remainSize -= size
+		*remainSize -= size
 
 		mh.Fields = append(mh.Fields, hf)
 	})
@@ -1766,10 +1782,10 @@
 		// skip parsing the fragment and close the connection.
 		//
 		// "Too much" is either any CONTINUATION frame after we've already
-		// exceeded the max header list size (in which case remainSize is 0),
-		// or a frame whose encoded size is more than twice the remaining
-		// header list bytes we're willing to accept.
-		if int64(len(frag)) > int64(2*remainSize) {
+		// exceeded the max header list size (if so, both budgets are 0), or a
+		// frame whose encoded size is more than twice the remaining header
+		// list bytes we're willing to accept.
+		if int64(len(frag)) > 2*int64(headersRemainSize+trailersRemainSize) {
 			if VerboseLogs {
 				log.Printf("http2: header list too large")
 			}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/server.go /work/src/docker-registry/vendor/golang.org/x/net/http2/server.go
--- a/vendor/golang.org/x/net/http2/server.go	2026-10-09 17:00:47.184799438 +0000
+++ b/vendor/golang.org/x/net/http2/server.go	2026-10-09 17:01:34.600503459 +0000
@@ -280,7 +280,6 @@
 		doneServing:                 make(chan struct{}),
 		clientMaxStreams:            math.MaxUint32, // Section 6.5.2: "Initially, there is no limit to this value"
 		advMaxStreams:               conf.MaxConcurrentStreams,
-		initialStreamSendWindowSize: initialWindowSize,
 		initialStreamRecvWindowSize: conf.MaxUploadBufferPerStream,
 		maxFrameSize:                initialMaxFrameSize,
 		pingTimeout:                 conf.PingTimeout,
@@ -320,7 +319,7 @@
 	// These start at the RFC-specified defaults. If there is a higher
 	// configured value for inflow, that will be updated when we send a
 	// WINDOW_UPDATE shortly after sending SETTINGS.
-	sc.flow.add(initialWindowSize)
+	sc.flow.init()
 	sc.inflow.init(initialWindowSize)
 	sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf)
 	sc.hpackEncoder.SetMaxDynamicTableSizeLimit(conf.MaxEncoderHeaderTableSize)
@@ -427,7 +426,7 @@
 	wroteFrameCh     chan frameWriteResult  // from writeFrameAsync -> serve, tickles more frame writes
 	bodyReadCh       chan bodyReadMsg       // from handlers -> serve
 	serveMsgCh       chan interface{}       // misc messages & code to send to / run on the serve loop
-	flow             outflow                // conn-wide (not stream-specific) outbound flow control
+	flow             connOutflow            // conn-wide (not stream-specific) outbound flow control
 	inflow           inflow                 // conn-wide inbound flow control
 	tlsState         *tls.ConnectionState   // shared by all handlers, like net/http
 	remoteAddrStr    string
@@ -441,6 +440,9 @@
 	sawFirstSettings            bool // got the initial SETTINGS frame after the preface
 	needToSendSettingsAck       bool
 	unackedSettings             int    // how many SETTINGS have we sent without ACKs?
+	pendingEncoderTableSize     bool   // peer changed SETTINGS_HEADER_TABLE_SIZE; apply to hpackEncoder before the next frame write
+	encoderTableSizeMin         uint32 // smallest SETTINGS_HEADER_TABLE_SIZE since the last apply
+	encoderTableSize            uint32 // latest SETTINGS_HEADER_TABLE_SIZE
 	queuedControlFrames         int    // control frames in the writeSched queue
 	clientMaxStreams            uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit)
 	advMaxStreams               uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
@@ -451,7 +453,6 @@
 	maxPushPromiseID            uint32 // ID of the last push promise (even), or 0 if there have been no pushes
 	streams                     map[uint32]*stream
 	unstartedHandlers           []unstartedHandler
-	initialStreamSendWindowSize int32
 	initialStreamRecvWindowSize int32
 	maxFrameSize                int32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
@@ -521,7 +522,8 @@
 	// immutable:
 	sc        *serverConn
 	id        uint32
-	body      *pipe       // non-nil if expecting DATA frames
+	body      *pipe // non-nil if expecting DATA frames
+	reqBody   *requestBody
 	cw        closeWaiter // closed wait stream transitions to closed state
 	ctx       context.Context
 	cancelCtx func()
@@ -1172,6 +1174,16 @@
 
 	sc.writingFrame = true
 	sc.needsFrameFlush = true
+	if sc.pendingEncoderTableSize {
+		// hpackEncoder may be in use by writeFrameAsync, so SETTINGS
+		// changes to it are deferred until no frame is being written.
+		// Replaying the smallest size before the latest one keeps the
+		// encoder's view identical to having applied every change
+		// (RFC 7541, Section 4.2).
+		sc.pendingEncoderTableSize = false
+		sc.hpackEncoder.SetMaxDynamicTableSize(sc.encoderTableSizeMin)
+		sc.hpackEncoder.SetMaxDynamicTableSize(sc.encoderTableSize)
+	}
 	if wr.write.staysWithinBuffer(sc.bw.Available()) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
@@ -1271,6 +1283,11 @@
 	}
 	sc.inFrameScheduleLoop = true
 	for !sc.writingFrameAsync {
+		if sc.flow.flowErr && (!sc.inGoAway || sc.goAwayCode == ErrCodeNo) {
+			sc.inGoAway = true
+			sc.needToSendGoAway = true
+			sc.goAwayCode = ErrCodeFlowControl
+		}
 		if sc.needToSendGoAway {
 			sc.needToSendGoAway = false
 			sc.startFrameWrite(FrameWriteRequest{
@@ -1294,6 +1311,9 @@
 				sc.startFrameWrite(wr)
 				continue
 			}
+			if sc.flow.flowErr {
+				continue
+			}
 		}
 		if sc.needsFrameFlush {
 			sc.startFrameWrite(FrameWriteRequest{write: flushFrameWriter{}})
@@ -1526,6 +1546,10 @@
 			return nil
 		}
 		if !st.flow.add(int32(f.Increment)) {
+			if st.flow.conn.flowErr {
+				// This is a lazily-detected connection-level flow control error.
+				return sc.countError("bad_flow", ConnectionError(ErrCodeFlowControl))
+			}
 			return sc.countError("bad_flow", streamError(f.StreamID, ErrCodeFlowControl))
 		}
 	default: // connection-level flow control
@@ -1584,10 +1608,6 @@
 		}
 	}
 	if p := st.body; p != nil {
-		// Return any buffered unread bytes worth of conn-level flow control.
-		// See golang.org/issue/16481
-		sc.sendWindowUpdate(nil, p.Len())
-
 		p.CloseWithError(err)
 	}
 	if e, ok := err.(StreamError); ok {
@@ -1641,7 +1661,12 @@
 	}
 	switch s.ID {
 	case SettingHeaderTableSize:
-		sc.hpackEncoder.SetMaxDynamicTableSize(s.Val)
+		// Applied by startFrameWrite; see comment there.
+		if !sc.pendingEncoderTableSize || s.Val < sc.encoderTableSizeMin {
+			sc.encoderTableSizeMin = s.Val
+		}
+		sc.encoderTableSize = s.Val
+		sc.pendingEncoderTableSize = true
 	case SettingEnablePush:
 		sc.pushEnabled = s.Val != 0
 	case SettingMaxConcurrentStreams:
@@ -1672,28 +1697,14 @@
 
 func (sc *serverConn) processSettingInitialWindowSize(val uint32) error {
 	sc.serveG.check()
-	// Note: val already validated to be within range by
-	// processSetting's Valid call.
-
-	// "A SETTINGS frame can alter the initial flow control window
-	// size for all current streams. When the value of
-	// SETTINGS_INITIAL_WINDOW_SIZE changes, a receiver MUST
-	// adjust the size of all stream flow control windows that it
-	// maintains by the difference between the new value and the
-	// old value."
-	old := sc.initialStreamSendWindowSize
-	sc.initialStreamSendWindowSize = int32(val)
-	growth := int32(val) - old // may be negative
-	for _, st := range sc.streams {
-		if !st.flow.add(growth) {
-			// 6.9.2 Initial Flow Control Window Size
-			// "An endpoint MUST treat a change to
-			// SETTINGS_INITIAL_WINDOW_SIZE that causes any flow
-			// control window to exceed the maximum size as a
-			// connection error (Section 5.4.1) of type
-			// FLOW_CONTROL_ERROR."
-			return sc.countError("setting_win_size", ConnectionError(ErrCodeFlowControl))
-		}
+	if !sc.flow.changeInitialWindowSize(int64(val)) {
+		// 6.9.2 Initial Flow Control Window Size
+		// "An endpoint MUST treat a change to
+		// SETTINGS_INITIAL_WINDOW_SIZE that causes any flow
+		// control window to exceed the maximum size as a
+		// connection error (Section 5.4.1) of type
+		// FLOW_CONTROL_ERROR."
+		return sc.countError("setting_win_size", ConnectionError(ErrCodeFlowControl))
 	}
 	return nil
 }
@@ -1966,7 +1977,7 @@
 	if st.reqTrailer != nil {
 		st.trailer = make(http.Header)
 	}
-	st.body = req.Body.(*requestBody).pipe // may be nil
+	st.body = st.reqBody.pipe // may be nil
 	st.declBodyBytes = req.ContentLength
 
 	handler := sc.handler.ServeHTTP
@@ -1989,7 +2000,7 @@
 		st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
 	}
 
-	return sc.scheduleHandler(id, rw, req, handler)
+	return sc.scheduleHandler(st, rw, req, handler)
 }
 
 func (sc *serverConn) upgradeRequest(req *http.Request) {
@@ -2102,7 +2113,6 @@
 	}
 	st.cw.Init()
 	st.flow.conn = &sc.flow // link to conn-level counter
-	st.flow.add(sc.initialStreamSendWindowSize)
 	st.inflow.init(sc.initialStreamRecvWindowSize)
 	if sc.hs.WriteTimeout > 0 {
 		st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout)
@@ -2184,7 +2194,7 @@
 		} else {
 			req.ContentLength = -1
 		}
-		req.Body.(*requestBody).pipe = &pipe{
+		st.reqBody.pipe = &pipe{
 			b: &dataBuffer{expected: req.ContentLength},
 		}
 	}
@@ -2204,7 +2214,7 @@
 		return nil, nil, sc.countError(res.InvalidReason, streamError(st.id, ErrCodeProtocol))
 	}
 
-	body := &requestBody{
+	st.reqBody = &requestBody{
 		conn:          sc,
 		stream:        st,
 		needsContinue: res.NeedsContinue,
@@ -2220,7 +2230,7 @@
 		ProtoMinor: 0,
 		TLS:        tlsState,
 		Host:       rp.Authority,
-		Body:       body,
+		Body:       st.reqBody,
 		Trailer:    res.Trailer,
 	}).WithContext(st.ctx)
 	rw := sc.newResponseWriter(st, req)
@@ -2244,11 +2254,12 @@
 	rw       *responseWriter
 	req      *http.Request
 	handler  func(http.ResponseWriter, *http.Request)
+	body     *pipe
 }
 
 // scheduleHandler starts a handler goroutine,
 // or schedules one to start as soon as an existing handler finishes.
-func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
+func (sc *serverConn) scheduleHandler(st *stream, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
 	sc.serveG.check()
 	maxHandlers := sc.advMaxStreams
 	if sc.curHandlers < maxHandlers {
@@ -2260,10 +2271,11 @@
 		return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm))
 	}
 	sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{
-		streamID: streamID,
+		streamID: st.id,
 		rw:       rw,
 		req:      req,
 		handler:  handler,
+		body:     st.body,
 	})
 	return nil
 }
@@ -2277,6 +2289,10 @@
 		u := sc.unstartedHandlers[i]
 		if sc.streams[u.streamID] == nil {
 			// This stream was reset before its goroutine had a chance to start.
+			if u.body != nil {
+				u.body.BreakWithError(errClosedBody)
+				sc.sendWindowUpdate(nil, u.body.Len())
+			}
 			continue
 		}
 		if sc.curHandlers >= maxHandlers {
@@ -2298,6 +2314,12 @@
 	didPanic := true
 	defer func() {
 		rw.rws.stream.cancelCtx()
+		if b := rw.rws.stream.reqBody; b != nil {
+			// Closing the body refunds flow control credit for any unconsumed data.
+			// (reqBody is nil for Upgrade: h2c requests, but those do not use flow
+			// control for the request body.)
+			b.Close()
+		}
 		if req.MultipartForm != nil {
 			req.MultipartForm.RemoveAll()
 		}
@@ -2396,7 +2418,7 @@
 func (sc *serverConn) noteBodyRead(st *stream, n int) {
 	sc.serveG.check()
 	sc.sendWindowUpdate(nil, n) // conn-level
-	if st.state != stateHalfClosedRemote && st.state != stateClosed {
+	if st != nil && st.state != stateHalfClosedRemote && st.state != stateClosed {
 		// Don't send this WINDOW_UPDATE if the stream is closed
 		// remotely.
 		sc.sendWindowUpdate(st, n)
@@ -2444,6 +2466,9 @@
 	b.closeOnce.Do(func() {
 		if b.pipe != nil {
 			b.pipe.BreakWithError(errClosedBody)
+			if unread := b.pipe.Len(); unread > 0 {
+				b.conn.noteBodyReadFromHandler(nil, unread, errClosedBody)
+			}
 		}
 	})
 	return nil
@@ -2461,9 +2486,6 @@
 	if err == io.EOF {
 		b.sawEOF = true
 	}
-	if b.conn == nil {
-		return
-	}
 	b.conn.noteBodyReadFromHandler(b.stream, n, err)
 	return
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/transport.go /work/src/docker-registry/vendor/golang.org/x/net/http2/transport.go
--- a/vendor/golang.org/x/net/http2/transport.go	2026-10-09 17:00:47.184799438 +0000
+++ b/vendor/golang.org/x/net/http2/transport.go	2026-10-09 17:01:34.600503459 +0000
@@ -27,6 +27,7 @@
 	"net/http"
 	"net/http/httptrace"
 	"net/textproto"
+	"slices"
 	"strconv"
 	"sync"
 	"sync/atomic"
@@ -203,7 +204,7 @@
 
 	mu               sync.Mutex // guards following
 	cond             *sync.Cond // hold mu; broadcast on flow/closed changes
-	flow             outflow    // our conn-level flow control quota (cs.outflow is per stream)
+	flow             connOutflow // our conn-level flow control quota (cs.outflow is per stream)
 	inflow           inflow     // peer's conn-level flow control
 	doNotReuse       bool       // whether conn is marked to not be reused for any future requests
 	closing          bool
@@ -227,7 +228,6 @@
 	maxConcurrentStreams        uint32
 	peerMaxHeaderListSize       uint64
 	peerMaxHeaderTableSize      uint32
-	initialWindowSize           uint32
 	initialStreamRecvWindowSize int32
 	readIdleTimeout             time.Duration
 	pingTimeout                 time.Duration
@@ -472,7 +472,6 @@
 		readerDone:                  make(chan struct{}),
 		nextStreamID:                1,
 		maxFrameSize:                16 << 10, // spec default
-		initialWindowSize:           65535,    // spec default
 		initialStreamRecvWindowSize: conf.MaxUploadBufferPerStream,
 		maxConcurrentStreams:        initialMaxConcurrentStreams, // "infinite", per spec. Use a smaller value until we have received server settings.
 		strictMaxConcurrentStreams:  conf.StrictMaxConcurrentRequests,
@@ -497,7 +496,7 @@
 	}
 
 	cc.cond = sync.NewCond(&cc.mu)
-	cc.flow.add(int32(initialWindowSize))
+	cc.flow.init()
 
 	// TODO: adjust this writer size to account for frame size +
 	// MTU + crypto/tls record padding.
@@ -876,6 +875,33 @@
 	return nil
 }
 
+func (cc *ClientConn) goAwayAndClose(code ErrCode) {
+	cc.mu.Lock()
+	closed := cc.closed
+	cc.closing = true
+	cc.closed = true
+	cc.mu.Unlock()
+	if closed {
+		return
+	}
+	if f := cc.fr.countError; f != nil {
+		f(fmt.Sprintf("conn_close_error_%s", code.stringToken()))
+	}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		cc.wmu.Lock()
+		cc.fr.WriteGoAway(0, code, nil)
+		cc.bw.Flush()
+		cc.wmu.Unlock()
+	}()
+	select {
+	case <-done:
+	case <-time.After(250 * time.Millisecond):
+	}
+	cc.closeForError(fmt.Errorf("http2: closing connection with %v", code))
+}
+
 // closes the client connection immediately. In-flight requests are interrupted.
 // err is sent to streams.
 func (cc *ClientConn) closeForError(err error) {
@@ -1319,7 +1345,9 @@
 	}
 	if err != nil {
 		cs.abortStream(err) // possibly redundant, but harmless
-		if cs.sentHeaders {
+		if ce, ok := err.(ConnectionError); ok {
+			cc.goAwayAndClose(ErrCode(ce))
+		} else if cs.sentHeaders {
 			if se, ok := err.(StreamError); ok {
 				if se.Cause != errFromPeer {
 					cc.writeStreamReset(cs.ID, se.Code, false, err)
@@ -1648,8 +1676,12 @@
 			return 0, errRequestCanceled
 		default:
 		}
-		if a := cs.flow.available(); a > 0 {
-			take := a
+		avail, ok := cs.flow.available()
+		if !ok {
+			return 0, ConnectionError(ErrCodeFlowControl)
+		}
+		if avail > 0 {
+			take := avail
 			if int(take) > maxBytes {
 
 				take = int32(maxBytes) // can't truncate int; take is int32
@@ -1710,8 +1742,7 @@
 
 // requires cc.mu be held.
 func (cc *ClientConn) addStreamLocked(cs *clientStream) {
-	cs.flow.add(int32(cc.initialWindowSize))
-	cs.flow.setConnFlow(&cc.flow)
+	cs.flow.conn = &cc.flow
 	cs.inflow.init(cc.initialStreamRecvWindowSize)
 	cs.ID = cc.nextStreamID
 	cc.nextStreamID += 2
@@ -2095,18 +2126,42 @@
 		return nil, nil
 	}
 
+	// Delete various headers that might mess up framing for HTTP/1. This is
+	// not a problem for HTTP/2, but someone might use HTTP/2 transport as a
+	// reverse proxy which forwards the response to an HTTP/1 client. Our
+	// HTTP/1 client transport will properly reject improper headers such as
+	// multiple conflicting Content-Length headers, but other implementations
+	// might not.
+	// TODO: just reject such responses? We deleted them for compatibility
+	// since this was done in a security fix (go.dev/issue/81115). However,
+	// rejecting them seems entirely reasonable and relatively safe.
+
+	// Connection-specific header fields must not appear in an HTTP/2 message,
+	// and any message containing them is malformed. RFC 9113, Section 8.2.2.
+	for _, k := range connHeaders {
+		delete(res.Header, k)
+	}
 	res.ContentLength = -1
-	if clens := res.Header["Content-Length"]; len(clens) == 1 {
-		if cl, err := strconv.ParseUint(clens[0], 10, 63); err == nil {
-			res.ContentLength = int64(cl)
+	if clens, ok := res.Header["Content-Length"]; ok {
+		// Repeated Content-Length values may be collapsed into one only if
+		// they are identical per RFC 9110 Section 8.6.
+		// No need to trim whitespace, HTTP/2 header values must not have
+		// extraneous whitespace per RFC 9113 Section 8.2.1.
+		// Non-canonical headers are already rejected by our framer at this
+		// point.
+		conflicting := slices.ContainsFunc(clens[1:], func(clen string) bool {
+			return clen != clens[0]
+		})
+		cl, err := strconv.ParseUint(clens[0], 10, 63)
+		if conflicting || err != nil {
+			delete(res.Header, "Content-Length")
 		} else {
-			// TODO: care? unlike http/1, it won't mess up our framing, so it's
-			// more safe smuggling-wise to ignore.
+			res.Header["Content-Length"] = clens[:1]
+			res.ContentLength = int64(cl)
 		}
-	} else if len(clens) > 1 {
-		// TODO: care? unlike http/1, it won't mess up our framing, so it's
-		// more safe smuggling-wise to ignore.
-	} else if f.StreamEnded() && !cs.isHead {
+	}
+
+	if res.ContentLength < 0 && f.StreamEnded() && !cs.isHead {
 		res.ContentLength = 0
 	}
 
@@ -2417,6 +2472,10 @@
 func (rl *clientConnReadLoop) streamByID(id uint32, headerOrData bool) *clientStream {
 	rl.cc.mu.Lock()
 	defer rl.cc.mu.Unlock()
+	return rl.streamByIDLocked(id, headerOrData)
+}
+
+func (rl *clientConnReadLoop) streamByIDLocked(id uint32, headerOrData bool) *clientStream {
 	if headerOrData {
 		// Work around an unfortunate gRPC behavior.
 		// See comment on ClientConn.rstStreamPingsBlocked for details.
@@ -2499,24 +2558,10 @@
 		case SettingMaxHeaderListSize:
 			cc.peerMaxHeaderListSize = uint64(s.Val)
 		case SettingInitialWindowSize:
-			// Values above the maximum flow-control
-			// window size of 2^31-1 MUST be treated as a
-			// connection error (Section 5.4.1) of type
-			// FLOW_CONTROL_ERROR.
-			if s.Val > math.MaxInt32 {
+			if !cc.flow.changeInitialWindowSize(int64(s.Val)) {
 				return ConnectionError(ErrCodeFlowControl)
 			}
-
-			// Adjust flow control of currently-open
-			// frames by the difference of the old initial
-			// window size and this one.
-			delta := int32(s.Val) - int32(cc.initialWindowSize)
-			for _, cs := range cc.streams {
-				cs.flow.add(delta)
-			}
 			cc.cond.Broadcast()
-
-			cc.initialWindowSize = s.Val
 		case SettingHeaderTableSize:
 			cc.henc.SetMaxDynamicTableSize(s.Val)
 			cc.peerMaxHeaderTableSize = s.Val
@@ -2558,29 +2603,30 @@
 
 func (rl *clientConnReadLoop) processWindowUpdate(f *WindowUpdateFrame) error {
 	cc := rl.cc
-	cs := rl.streamByID(f.StreamID, notHeaderOrDataFrame)
-	if f.StreamID != 0 && cs == nil {
-		return nil
-	}
-
 	cc.mu.Lock()
 	defer cc.mu.Unlock()
-
-	fl := &cc.flow
-	if cs != nil {
-		fl = &cs.flow
-	}
-	if !fl.add(int32(f.Increment)) {
-		// For stream, the sender sends RST_STREAM with an error code of FLOW_CONTROL_ERROR
-		if cs != nil {
+	if f.StreamID == 0 {
+		if !cc.flow.add(int32(f.Increment)) {
+			return ConnectionError(ErrCodeFlowControl)
+		}
+	} else {
+		cs := rl.streamByIDLocked(f.StreamID, notHeaderOrDataFrame)
+		if cs == nil {
+			return nil
+		}
+		if !cs.flow.add(int32(f.Increment)) {
+			if cs.flow.conn.flowErr {
+				// This is a lazily-detected connection-level flow control error.
+				return ConnectionError(ErrCodeFlowControl)
+			}
+			// For stream, the sender sends RST_STREAM with
+			// an error code of FLOW_CONTROL_ERROR.
 			rl.endStreamErrorLocked(cs, StreamError{
 				StreamID: f.StreamID,
 				Code:     ErrCodeFlowControl,
 			})
 			return nil
 		}
-
-		return ConnectionError(ErrCodeFlowControl)
 	}
 	cc.cond.Broadcast()
 	return nil
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/transport_wrap.go /work/src/docker-registry/vendor/golang.org/x/net/http2/transport_wrap.go
--- a/vendor/golang.org/x/net/http2/transport_wrap.go	2026-10-09 17:00:47.184799438 +0000
+++ b/vendor/golang.org/x/net/http2/transport_wrap.go	2026-10-09 17:01:34.600503459 +0000
@@ -119,33 +119,27 @@
 
 // DialFromContext dials a new connection using the http2.Transport's DialTLS/DialTLSContext.
 func (t transportConfig) DialFromContext(ctx context.Context, network, address string) (net.Conn, error) {
-	if ctx.Value(http2TransportContextKey{}) == nil {
+	dial, _ := ctx.Value(http2TransportContextKey{}).(*transportRoundTripState)
+	if dial == nil {
 		// We're being called from a RoundTrip that did not start with an http2.Transport.
 		// Use the http.Transport's dialer.
 		return nil, errors.ErrUnsupported
 	}
-
-	tlsConf := t.t.TLSClientConfig
-	if tlsConf == nil {
-		tlsConf = &tls.Config{}
-	} else {
-		tlsConf = tlsConf.Clone()
-	}
-	if !slices.Contains(tlsConf.NextProtos, "h2") {
-		tlsConf.NextProtos = append([]string{"h2"}, tlsConf.NextProtos...)
-	}
-	if tlsConf.ServerName == "" {
-		host, _, err := net.SplitHostPort(address)
-		if err == nil {
-			tlsConf.ServerName = host
-		}
-	}
-	return t.t.dialTLS(ctx, network, address, tlsConf)
+	return t.t.dialForRoundTrip(ctx, dial, network, address)
 }
 
 type transportInternal struct {
 	initOnce sync.Once
 	lazyt1   *http.Transport
+
+	dialMu sync.Mutex
+	dials  map[string]*transportDialState
+}
+
+type transportDialState struct {
+	dialc   chan struct{} // close when dial returns
+	dialErr error         // dial result, set before dialc is closed
+	rtdonec chan struct{} // closed when RoundTrip initiating the dial returns
 }
 
 func (t *Transport) init() *http.Transport {
@@ -167,6 +161,52 @@
 	}
 }
 
+// transportRoundTripState is the state of the dial for an http2.Transport.RoundTrip.
+type transportRoundTripState struct {
+	mu       sync.Mutex
+	rtdone   bool          // set when RoundTrip returns
+	rtdonec  chan struct{} // closed when RoundTrip returns
+	gotconnc chan struct{} // closed when GotConn hook is called
+}
+
+// startDial is called when a dial starts.
+//
+// It returns done=true if the RoundTrip has already returned,
+// in which case we should skip dialing.
+func (dial *transportRoundTripState) startDial() (gotconnc chan struct{}, done bool) {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	if dial.rtdone {
+		return nil, true
+	}
+	if dial.rtdonec == nil {
+		dial.rtdonec = make(chan struct{})
+	}
+	dial.gotconnc = make(chan struct{})
+	return dial.gotconnc, false
+}
+
+// gotConn is called when RoundTrip gets a connection.
+// This may happen multiple times per RoundTrip, if a request is retried.
+func (dial *transportRoundTripState) gotConn() {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	if dial.gotconnc != nil {
+		close(dial.gotconnc)
+		dial.gotconnc = nil
+	}
+}
+
+// roundTripDone is called when RoundTrip returns.
+func (dial *transportRoundTripState) roundTripDone() {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	dial.rtdone = true
+	if dial.rtdonec != nil {
+		close(dial.rtdonec)
+	}
+}
+
 func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
 	t1 := t.init()
 
@@ -186,12 +226,146 @@
 	// Both http.Transport and http2.Transport allow the user to provide a custom
 	// dial function, and historically you only get the dial function from the
 	// Transport you're calling RoundTrip on.
-	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, t)
+	//
+	// In addition, http2.Transport coalesces dials, which http.Transport historically
+	// has not.
+	dial := &transportRoundTripState{}
+	defer dial.roundTripDone()
+	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, dial)
+	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+		GotConn: func(httptrace.GotConnInfo) {
+			// Tell dialForRoundTrip that we have received a connection.
+			dial.gotConn()
+		},
+	})
 	req = req.WithContext(ctx)
-
 	return t1.RoundTrip(req)
 }
 
+var errCoalescedDialAbandoned = errors.New("http2: abandoned coalesced dial")
+
+const coalescedDialRetryTimeout = 50 * time.Millisecond
+
+// dialForRoundTrip is called (indirectly) by net/http when dialing a new connection
+// for a request call which originated as an http2.Transport.RoundTrip call.
+//
+// It uses the http2.Transport's Dial hooks and coalesces dials.
+func (t *Transport) dialForRoundTrip(ctx context.Context, dial *transportRoundTripState, network, address string) (net.Conn, error) {
+	gotconnc, rtdone := dial.startDial()
+	if rtdone {
+		// RoundTrip returned, no need for this dial to proceed.
+		return nil, errCoalescedDialAbandoned
+	}
+
+	var state *transportDialState
+	for {
+		// The first dial to an address registers itself with t.dials.
+		// When the dial finishes, it records the outcome and removes itself from t.dials
+		// so future dials will start a new round of coalescing.
+		//
+		// Subsequent dials observe that a dial is in progress, and skip dialing.
+		t.dialMu.Lock()
+		if t.dials == nil {
+			t.dials = make(map[string]*transportDialState)
+		}
+		leader := t.dials[address]
+		if leader == nil {
+			// No entry in t.dials to coalesce with. Add ourselves as leader.
+			state = &transportDialState{
+				dialc:   make(chan struct{}),
+				rtdonec: dial.rtdonec,
+			}
+			t.dials[address] = state
+		}
+		t.dialMu.Unlock()
+		if leader == nil {
+			// We are the leader, so we should dial for real.
+			break
+		}
+
+		// Coalesce with a previous dial.
+		var (
+			done          = false
+			leaderdialc   = leader.dialc
+			leaderrtdonec = leader.rtdonec
+			timerc        <-chan time.Time
+		)
+		for !done {
+			if leaderdialc == nil && leaderrtdonec == nil && timerc == nil {
+				// The leader finished dialing, and its RoundTrip finished.
+				//
+				// There are several possibilities, which reduce to:
+				//   - The RoundTrip we are dialing for is about to receive
+				//     a connection (possibly the one the leader just dialed),
+				//     but we haven't observed it yet.
+				//   - There's something wrong with the leader's connection,
+				//     such as a TLS handshake failure.
+				//
+				// We have no good way to distinguish between these cases.
+				//
+				// Wait a short time for the leader's connection (or some
+				// other usable connection) to be delivered to our RoundTrip.
+				// If it is not, start a dial of our own.
+				timerc = time.After(coalescedDialRetryTimeout)
+			}
+			select {
+			case <-leaderdialc:
+				// The leader's dial completed.
+				if leader.dialErr != nil {
+					return nil, leader.dialErr
+				}
+				leaderdialc = nil
+			case <-leaderrtdonec:
+				// The leader's RoundTrip completed.
+				leaderrtdonec = nil
+			case <-timerc:
+				// The leader's dial and RoundTrip completed, and some time
+				// has passed. Assume we're not getting a connection and
+				// restart the dial process.
+				done = true
+			case <-dial.rtdonec:
+				// Our RoundTrip returned.
+				return nil, errCoalescedDialAbandoned
+			case <-gotconnc:
+				// Our RoundTrip got a connection.
+				return nil, errCoalescedDialAbandoned
+			case <-ctx.Done():
+				// net/http abandoned the dial.
+				return nil, ctx.Err()
+			}
+		}
+	}
+
+	// Dial for real.
+	tlsConf := t.TLSClientConfig
+	if tlsConf == nil {
+		tlsConf = &tls.Config{}
+	} else {
+		tlsConf = tlsConf.Clone()
+	}
+	if !slices.Contains(tlsConf.NextProtos, "h2") {
+		tlsConf.NextProtos = append([]string{"h2"}, tlsConf.NextProtos...)
+	}
+	if tlsConf.ServerName == "" {
+		host, _, err := net.SplitHostPort(address)
+		if err == nil {
+			tlsConf.ServerName = host
+		}
+	}
+	nc, err := t.dialTLS(ctx, network, address, tlsConf)
+
+	// Remove this dial from t.dials, so future dial attempts will not coalesce with it.
+	t.dialMu.Lock()
+	delete(t.dials, address)
+	t.dialMu.Unlock()
+
+	// Notify any dial coalesced with this one that we are done.
+	state.dialErr = err
+	close(state.dialc)
+
+	return nc, err
+}
+
 func (t *Transport) closeIdleConnections() {
 	t1 := t.init()
 	t1.CloseIdleConnections()
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/writesched.go /work/src/docker-registry/vendor/golang.org/x/net/http2/writesched.go
--- a/vendor/golang.org/x/net/http2/writesched.go	2026-10-09 17:00:47.184799438 +0000
+++ b/vendor/golang.org/x/net/http2/writesched.go	2026-10-09 17:01:34.600503459 +0000
@@ -79,10 +79,11 @@
 	}
 
 	// Might need to split after applying limits.
-	allowed := wr.stream.flow.available()
-	if n < allowed {
-		allowed = n
+	avail, ok := wr.stream.flow.available()
+	if !ok {
+		return empty, empty, 0
 	}
+	allowed := min(n, avail)
 	if wr.stream.sc.maxFrameSize < allowed {
 		allowed = wr.stream.sc.maxFrameSize
 	}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/internal/httpcommon/gzip.go /work/src/docker-registry/vendor/golang.org/x/net/internal/httpcommon/gzip.go
--- a/vendor/golang.org/x/net/internal/httpcommon/gzip.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/net/internal/httpcommon/gzip.go	2026-10-09 17:01:34.604503435 +0000
@@ -0,0 +1,132 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package httpcommon
+
+import (
+	"compress/flate"
+	"compress/gzip"
+	"errors"
+	"io"
+	"io/fs"
+	"sync"
+)
+
+var errConcurrentRead = errors.New("http: concurrent read on response body")
+
+// incomparable is a zero-width, non-comparable type. Adding it to a struct
+// makes that struct also non-comparable, and generally doesn't add
+// any size (as long as it's first).
+type incomparable [0]func()
+
+// GzipReader wraps a response body so it can lazily
+// get gzip.Reader from the pool on the first call to Read.
+// After Close is called it puts gzip.Reader to the pool immediately
+// if there is no Read in progress or later when Read completes.
+type GzipReader struct {
+	_    incomparable
+	Body io.ReadCloser // underlying Response.Body
+	mu   sync.Mutex    // guards zr and zerr
+	zr   *gzip.Reader  // stores gzip reader from the pool between reads
+	zerr error         // sticky gzip reader init error or sentinel value to detect concurrent read and read after close
+}
+
+type eofReader struct{}
+
+func (eofReader) Read([]byte) (int, error) { return 0, io.EOF }
+func (eofReader) ReadByte() (byte, error)  { return 0, io.EOF }
+
+var gzipPool = sync.Pool{New: func() any { return new(gzip.Reader) }}
+
+// gzipPoolGet gets a gzip.Reader from the pool and resets it to read from r.
+func gzipPoolGet(r io.Reader) (*gzip.Reader, error) {
+	zr := gzipPool.Get().(*gzip.Reader)
+	if err := zr.Reset(r); err != nil {
+		gzipPoolPut(zr)
+		return nil, err
+	}
+	return zr, nil
+}
+
+// gzipPoolPut puts a gzip.Reader back into the pool.
+func gzipPoolPut(zr *gzip.Reader) {
+	// Reset will allocate bufio.Reader if we pass it anything
+	// other than a flate.Reader, so ensure that it's getting one.
+	var r flate.Reader = eofReader{}
+	zr.Reset(r)
+	gzipPool.Put(zr)
+}
+
+// acquire returns a gzip.Reader for reading response body.
+// The reader must be released after use.
+func (gz *GzipReader) acquire() (*gzip.Reader, error) {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr != nil {
+		return nil, gz.zerr
+	}
+	if gz.zr == nil {
+		// gzipPoolGet might block indefinitely since it reads the gzip header.
+		// Therefore, drop mu temporarily when using gzipPoolGet.
+		// We set zerr to errConcurrentRead to prevent concurrent read
+		// even when mu is temporarily dropped.
+		gz.zerr = errConcurrentRead
+		gz.mu.Unlock()
+		zr, err := gzipPoolGet(gz.Body)
+		gz.mu.Lock()
+		// Guard against Close being called while gzipPoolGet is running.
+		if gz.zerr != errConcurrentRead {
+			if zr != nil {
+				gzipPoolPut(zr)
+			}
+			return nil, gz.zerr
+		}
+		gz.zr, gz.zerr = zr, err
+		if gz.zerr != nil {
+			return nil, gz.zerr
+		}
+	}
+	ret := gz.zr
+	gz.zr, gz.zerr = nil, errConcurrentRead
+	return ret, nil
+}
+
+// release returns the gzip.Reader to the pool if Close was called during Read.
+func (gz *GzipReader) release(zr *gzip.Reader) {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr == errConcurrentRead {
+		gz.zr, gz.zerr = zr, nil
+	} else { // fs.ErrClosed
+		gzipPoolPut(zr)
+	}
+}
+
+// close returns the gzip.Reader to the pool immediately or
+// signals release to do so after Read completes.
+func (gz *GzipReader) close() {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr == nil && gz.zr != nil {
+		gzipPoolPut(gz.zr)
+		gz.zr = nil
+	}
+	gz.zerr = fs.ErrClosed
+}
+
+func (gz *GzipReader) Read(p []byte) (n int, err error) {
+	zr, err := gz.acquire()
+	if err != nil {
+		return 0, err
+	}
+	defer gz.release(zr)
+
+	return zr.Read(p)
+}
+
+func (gz *GzipReader) Close() error {
+	gz.close()
+
+	return gz.Body.Close()
+}
diff -Nur /work/src-orig/docker-registry/vendor/modules.txt /work/src/docker-registry/vendor/modules.txt
--- a/vendor/modules.txt	2026-10-09 17:00:47.436797909 +0000
+++ b/vendor/modules.txt	2026-10-09 17:01:35.424498423 +0000
@@ -566,11 +566,11 @@
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/oconf
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/retry
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/transform
-# go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlptrace
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform
-# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal
@@ -580,7 +580,7 @@
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x
-# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal
@@ -694,7 +694,7 @@
 golang.org/x/crypto/internal/poly1305
 golang.org/x/crypto/pkcs12
 golang.org/x/crypto/pkcs12/internal/rc2
-# golang.org/x/net v0.59.0
+# golang.org/x/net v0.59.0 => golang.org/x/net v0.60.0
 ## explicit; go 1.26.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
@@ -978,3 +978,7 @@
 google.golang.org/protobuf/types/known/structpb
 google.golang.org/protobuf/types/known/timestamppb
 google.golang.org/protobuf/types/known/wrapperspb
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
+# golang.org/x/net => golang.org/x/net v0.60.0
