opentelemetry-proto Weekly: Tooling Dependency Bumps Only

opentelemetry-proto defines the OTLP protocol that most OpenTelemetry SDKs and collectors speak. This week was quiet: three commits, all dependency bumps from renovate, and no changes to the .proto files. If you generate code from these definitions, nothing changes for you.

Buf CLI moved to 1.75.0

The biggest bump is the update of the bufbuild/buf docker tag to 1.75.0. Buf validates and lints the proto definitions in CI. A newer Buf means the repo’s schema checks run against the current release, and when Buf ships new lint rules, the maintainers catch them here first rather than in a downstream SDK.

The version lives in the dependencies.Dockerfile, which pins each tool by tag plus a sha256 digest. That digest pinning is the interesting part for anyone copying this pattern. Renovate bumps both the tag and the digest in one commit, so builds stay reproducible even when a tag is pushed again.

FROM bufbuild/buf:1.75.0@sha256:adf82c7170be6629ec81dc907921ac1699407cd11c4f7fd7521b13c74152f849 AS bufbuild

Lint and security action bumps

Two smaller changes shipped alongside the Buf update:

• markdownlint-cli2 updated to v0.24.0 in the same dependencies.Dockerfile. This keeps the docs and changelog linting in step with the current release. The diff shows the full commit: one line changed, one image swapped, digest updated.
• codeql-action bumped to v4.39.1 in the .github/workflows/codeql.yml workflow. CodeQL scans the generated code and the repo scripts, and a routine action bump keeps the analysis config aligned with what GitHub expects.

That is the whole week: 3 files changed, 4 insertions, 4 deletions. I value this kind of low signal week in a protocol repository. Steady maintenance is what you want to see here, and any churn in the actual .proto files would be far more visible.

If you mirror this setup

If you copy the proto into your own build, two things are worth checking. First, regenerate your client code with Buf 1.75.0 if you use the same version, so your generated stubs match what the SDKs will ship. Second, look at how this repo pins docker images by digest. It costs nothing and removes a whole class of tag drift problems.

What to watch

• No deprecations or default flips this week. All changes are tooling only.
• The OTel Election work and any OTLP stability changes will show up as real commits when they land. They were not part of this window.
• If you track the proto for compatibility, the file to watch is still the opentelemetry/proto tree; it was untouched in these three commits.