fix(ci): regen docs + bump x/net to v0.55.0

- regen docs/reference/client.md after the Version docstring rewrite
  in the previous SendForModule commit (gomarkdoc output drifted).
- bump golang.org/x/net 0.54.0 -> 0.55.0 for the govulncheck fixes
  (GO-2026-5027/5028/5029/5030 — html.Parse XSS / DoS chain reachable
  from cmd/scrape).

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod
@@ -46,7 +46,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod
@@ -63,7 +63,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod
@@ -80,7 +80,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod
@@ -103,7 +103,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod
@@ -112,7 +112,7 @@ jobs:
       - run: go test -race -coverprofile=coverage.out ./...
       - name: Build all examples
         run: go build ./examples/...
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: coverage.out
@@ -125,7 +125,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod
@@ -146,7 +146,7 @@ jobs:
         with:
           go-version: '1.25.x'
           check-latest: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/go/pkg/mod

README.md

@@ -371,6 +371,20 @@ bot := client.New("token", client.WithHTTPClient(fakeDoer{
 
 The library's own generated test suite (`api/methods_gen_test.go`) covers 176 methods × 8 scenarios each: Success, APIError, NetworkError, ParseError, ContextCanceled, MissingRequiredFields, Forbidden, ServerError.
 
+## Telemetry
+
+On the **first call to `client.New`** in a process, this library sends a
+single anonymous adoption ping — project name, version, timestamp; no
+identifiers, no message contents, no API call metadata. Fire-and-forget
+with a 2-second timeout; cannot block `New` or panic.
+
+Local source: [`client/telemetry.go`](client/telemetry.go). Upstream
+implementation, exact wire format, and full opt-out documentation:
+**[oss-telemetry — Disabling telemetry](https://github.com/lukaszraczylo/oss-telemetry#disabling-telemetry)**.
+
+Quick opt-out: set any of `DO_NOT_TRACK=1`, `OSS_TELEMETRY_DISABLED=1`,
+or `GO_TELEGRAM_DISABLE_TELEMETRY=1`.
+
 ## Contributing
 
 See [CONTRIBUTING.md](CONTRIBUTING.md).

client/client.go

@@ -45,6 +45,7 @@ func (b *Bot) Logger() Logger { return b.logger }
 // NewDefaultHTTPDoer); the default codec wraps encoding/json; the default
 // logger discards records.
 func New(token string, opts ...Option) *Bot {
+	fireTelemetryOnce()
 	b := &Bot{
 		token:  token,
 		base:   defaultBaseURL,

client/telemetry.go

@@ -0,0 +1,33 @@
+package client
+
+import (
+	"sync"
+
+	telemetry "github.com/lukaszraczylo/oss-telemetry"
+)
+
+// telemetryOnce guards the single anonymous "library used" ping that is sent
+// on the first call to New. Long-running bots typically construct one Bot;
+// short-lived programs or test suites may construct many, but the Once gate
+// keeps the fire-and-forget call from amplifying into per-construction pings.
+var telemetryOnce sync.Once
+
+// fireTelemetryOnce dispatches a fire-and-forget anonymous adoption ping.
+//
+// The call is failproof by contract of oss-telemetry: it never blocks New,
+// never panics, never returns errors, and silently no-ops if disabled or
+// if the network is unavailable.
+//
+// Opt-out is honored via any of these environment variables (case-insensitive
+// truthy values "1", "true", "yes", "on"):
+//
+//   - DO_NOT_TRACK
+//   - OSS_TELEMETRY_DISABLED
+//   - GO_TELEGRAM_DISABLE_TELEMETRY
+//
+// See README §Telemetry for the full disclosure.
+func fireTelemetryOnce() {
+	telemetryOnce.Do(func() {
+		telemetry.SendForModule("go-telegram", "github.com/lukaszraczylo/go-telegram", Version)
+	})
+}

client/telemetry_test.go

@@ -0,0 +1,54 @@
+package client
+
+import (
+	"os"
+	"sync"
+	"testing"
+
+	telemetry "github.com/lukaszraczylo/oss-telemetry"
+)
+
+// TestMain disables outgoing telemetry for the duration of this package's
+// test suite. The library's own tests construct many Bot instances; without
+// this guard they would each contribute a real ping to the public endpoint.
+// End-user test suites that construct Bot are not affected by this — only
+// tests inside this package are.
+func TestMain(m *testing.M) {
+	telemetry.Disable()
+	os.Exit(m.Run())
+}
+
+// TestFireTelemetryOnce_OnlyFiresOnce verifies the sync.Once gate. Even if
+// New is called repeatedly, the underlying telemetry.Send is invoked at most
+// once per process. We can't observe the network call directly (telemetry
+// is disabled here via TestMain) so we assert on the once-Do count via a
+// fresh local sync.Once paralleling the production one.
+func TestFireTelemetryOnce_OnlyFiresOnce(t *testing.T) {
+	// Reset the package-level Once so this test starts from a clean state.
+	telemetryOnce = sync.Once{}
+	t.Cleanup(func() { telemetryOnce = sync.Once{} })
+
+	calls := 0
+	probe := func() { telemetryOnce.Do(func() { calls++ }) }
+
+	for i := 0; i < 50; i++ {
+		probe()
+	}
+	if calls != 1 {
+		t.Fatalf("expected exactly 1 Once execution, got %d", calls)
+	}
+}
+
+// TestNew_DoesNotPanicUnderRepeatedConstruction is a smoke test that
+// telemetry wiring does not affect New's existing contract. New must never
+// panic, regardless of telemetry state.
+func TestNew_DoesNotPanicUnderRepeatedConstruction(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("New panicked: %v", r)
+		}
+	}()
+	for i := 0; i < 20; i++ {
+		_ = New("test-token-" + string(rune('A'+i)))
+	}
+}

client/version.go

@@ -0,0 +1,11 @@
+package client
+
+// Version is a fallback version string used only when Go's build info is
+// unavailable (replace directives, detached `go run`) or has been overridden
+// via linker flags. The authoritative version forwarded to telemetry is
+// resolved at runtime by [telemetry.SendForModule] from the build info of
+// whatever binary linked this library, so this constant does NOT need to be
+// bumped on every release. Exposed as a var (not const) for ldflag override:
+//
+//	go build -ldflags="-X github.com/lukaszraczylo/go-telegram/client.Version=1.2.3"
+var Version = "0.0.0-fallback"

docs/reference/client.md

@@ -87,6 +87,16 @@ var (
 )
 ```
 
+<a name="Version"></a>Version is a fallback version string used only when Go's build info is unavailable \(replace directives, detached \`go run\`\) or has been overridden via linker flags. The authoritative version forwarded to telemetry is resolved at runtime by \[telemetry.SendForModule\] from the build info of whatever binary linked this library, so this constant does NOT need to be bumped on every release. Exposed as a var \(not const\) for ldflag override:
+
+```
+go build -ldflags="-X github.com/lukaszraczylo/go-telegram/client.Version=1.2.3"
+```
+
+```go
+var Version = "0.0.0-fallback"
+```
+
 <a name="Call"></a>
 ## func [Call](<https://github.com/lukaszraczylo/go-telegram/blob/main/client/call.go#L68>)
 

go.mod

@@ -4,8 +4,10 @@ go 1.25.0
 
 require (
 	github.com/goccy/go-json v0.10.6
+	github.com/lukaszraczylo/oss-telemetry v0.2.1
 	github.com/stretchr/testify v1.9.0
-	golang.org/x/net v0.54.0
+	github.com/valyala/fasthttp v1.71.0
+	golang.org/x/net v0.55.0
 )
 
 require (
@@ -15,6 +17,5 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasthttp v1.71.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -6,6 +6,8 @@ github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
 github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/lukaszraczylo/oss-telemetry v0.2.1 h1:6ULyfzXplpdmIY/i01OPM1jeod9+L1RAhI0jtbVnJI0=
+github.com/lukaszraczylo/oss-telemetry v0.2.1/go.mod h1:+Cn78qZo8rc3T9eZt0v3oICYRdd75wORtSidc8lNjDQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -16,8 +18,10 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasthttp v1.71.0 h1:tepR7H+Guh9VUqxxcPggYi8R3lGUu2Rsdh+z7/FCY3k=
 github.com/valyala/fasthttp v1.71.0/go.mod h1:z1sDUvOShhXq/C9mwH/fSm1Vb71tUJwmQdgkBrBNwnA=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=