Bump direct dependencies

[inancgumus]

What?

As part of the regular release process #4162, we want to bump the direct dependencies.

Report

• easyjson v0.7.7 -> v0.9.0: Bug fixes and bumps the Go version.
• go-colorable v0.1.13 -> v0.1.14: Bug fixes and bumps the Go version. Adds: golang.org/x/sys v0.29.0
• testify v1.9.0 -> v1.10.0: Bug fixes and new updates (see all here). Deprecates CompareType.
• otel v1.31.0 -> v1.34.0: Bug fixes and new features (see all here).
• protobuf v1.36.2 -> v1.36.3: Bug fixes and internal improvements.
• x/crypto 8929309228b4 -> 71d3a4cfdb03: Adds a Payload field.

Skipped

These updates are skipped, as,

These ones require Go 1.23:

• github.com/PuerkitoBio/[email protected]
• github.com/chromedp/[email protected]

And this one already has an active PR (#4151):

• github.com/evanw/[email protected]

❤️ I'm open to suggestions. Thanks.

Related

• Bump Go Dependencies #4177
• Bump github.com/evanw/esbuild from 0.21.2 to 0.24.2 #4151

[mstoykov]

LGTM!

Thanks for the details changelog.

I kind of don't want to update otel this late in the cycle. There were some problems hte previous times IIRC.

cc @codebien and @olegbespalov as I think they might know something relevant.
I do wonder if we should not update otel from here but from the output as that might be the most fragile part currently. 🤔 So maybe I should remove it from dependabot here and move it to there.

[codebien]

I do wonder if we should not update otel from here but from the output as that might be the most fragile part currently

@mstoykov It's fine for me, but we have to enable Dependabot on the OTel repo to not keep it outdated for a long time.

[olegbespalov]

I believe OTEL is currently more important in context of browser, which uses it (cc @ankur22 ), xk6-opentelemetry output versions just aligned with what k6 has

[mstoykov]

I wonder if this doesn't break the otel output though . I doubt any of those updates help anything browser uses either way. So skipping to update them at the end of the cycle seems like the more safe bet.

[ankur22]

So skipping to update them at the end of the cycle seems like the more safe bet.

Agreed, i think it's best to update deps at the beginning of the cycle (in general, actually, i'm not a fan of depandabot, and i'd prefer to update once at the beginning and not half way or at the end of the cycle).

[inancgumus]

@mstoykov @codebien @olegbespalov @ankur22 I've removed the Otel update from this PR.