Bump github.com/llm-measurement/llm-sketchkit from 0.2.4 to 0.3.0 in the go-dependencies group

[dependabot]

Bumps the go-dependencies group with 1 update: github.com/llm-measurement/llm-sketchkit.

Updates github.com/llm-measurement/llm-sketchkit from 0.2.4 to 0.3.0

Release notes

Sourced from github.com/llm-measurement/llm-sketchkit's releases.

llm-sketchkit v0.3.0

llm-sketchkit 0.3.0

0.3.0 corrects text normalization and tightens summary validation. Some identities change when upgrading from 0.2.2, in Go as well as Python.

Go Normalization

Updating golang.org/x/text from 0.41.0 to 0.42.0 fixes a composition-key bug. For example, U+11F41 followed by certain combining marks could incorrectly become Greek text, changing the resulting hash.

The Python alignment adds no Go identity change relative to current main, which already uses 0.42.0. That statement does not apply to published 0.2.2.

Python Text Identities

The text_v1 profile trims exactly Unicode 15 White_Space and applies stream-safe NFC normalization. Python output changes for these inputs:

• U+001C through U+001F at text edges are preserved instead of stripped.
• Runs exceeding 30 non-starters receive U+034F COMBINING GRAPHEME JOINER before the character that exceeds the limit. Counting includes compatibility decompositions and backward-combining characters, so fewer than 31 original characters can reach the limit.
• On Python 3.11, normalization involving Unicode 15 combining marks uses their correct classes: U+10EFD..U+10EFF, U+11F41..U+11F42, U+1E08F, and U+1E4EC..U+1E4EF.

The cross-language guarantee covers Unicode 15.0 assigned scalars, including private-use values. It excludes unassigned values, noncharacters, and later additions. Invalid UTF-8 remains an error.

Retained State

Profile names and wire formats are unchanged, so merge checks cannot identify a mixture of old and corrected identities. Existing hashes or sketches alone cannot be repaired.

Identify affected Go and Python producers, record their versions, and upgrade at a new observation-window boundary. Keep affected old and new windows separate in comparisons and merges. Rebuild only with legitimately available original inputs and the original hash key; otherwise retain a separate historical series. Run identity checks before resuming cross-language comparisons. Go-only deployments using the older dependency also need this assessment. See the migration guide for details.

Estimates And Validation

Python HLL++ bias sums use left-to-right addition. On Python 3.12 and later, estimates may differ in their last bits. Stored registers, sketch bytes, and hash

... (truncated)

Changelog

Sourced from github.com/llm-measurement/llm-sketchkit's changelog.

[0.3.0] - 2026-10-11

Text identity and validation corrections. Some identities change when upgrading from 0.2.x in Go as well as Python. Read the release notes before upgrading retained state.

• Reject zero-length observation intervals containing nonzero counters or nonempty sketch state; accept configured empty sketches, including empty dense HLL++. Order epochs consistently by start, end and epoch identifier. Reject protobuf groups before decoding in both languages; the wire schema contains no group fields. See migration notes.

• Align Python text_v1 identities with the existing Go behavior: trim the exact Unicode White_Space set, use stream-safe NFC with decomposition-aware non-starter counting, and support Unicode 15 combining classes on Python 3.11. Python identities can change for U+001C through U+001F at trimmed edges, long non-starter runs (including decomposing and backward-combining characters), and normalization involving Unicode 15 combining marks on older runtimes. This canonicalizer change leaves Go output unchanged when built with the same normalization dependency. Retained affected Python summaries require an explicit migration; see identity migration.

• Evaluate Python HLL++ bias sums left-to-right to match Go and Python 3.11. Python 3.12+ estimates can change in their last bits; sketch bytes and statistical error properties are unchanged. Add shared estimate vectors for every profile and Unicode identity differential verification for Python 3.11 and 3.14.

• Updated golang.org/x/text to v0.42.0, which raises the minimum Go version to 1.26. CI and source-build documentation now reflect that requirement. Its normalization corrections can change Go identities relative to 0.2.2, including U+11F41 followed by combining accents. Affected Go producers also need the identity migration. Published 0.2.x artifacts are unchanged and continue to support Go 1.25.

[0.2.3] - 2026-10-11

• Bound protobuf allocation before decoding: HLL++ and frequent-items accept up to 64 KiB, MinHash 4 KiB, and Bloom 2.5 MiB. Discarded bodies, repeated metadata and body messages, and aggregate repeated entries are bounded. Summary JSON entry counts are checked before maps are built. Malformed protobuf uses documented error categories.
• Validate and canonicalize each summary input once, with bounded live parsed state, and serialize accumulated sketches once. Go accumulates finalized groups; Python re-decodes selected payloads in merge order. Python frequent-items uses a bounded heap for its minimum.
• Redact untrusted metadata in errors, suppress raw Python summary exception chains, and protect hash secrets across Go formatting and non-UTF-8 environments.
• Resolve release sources to existing version tags, keep SBOM generation separate from distributions, and preserve existing release assets on repeat uploads.

... (truncated)

Commits

• f7c5589 Prepare 0.3.0 identity migration release
• 62eb14e Align Python canonical identities and malformed-input acceptance with Go (#57)
• b7daa0e Redact secrets and harden release artifact handling (#56)
• 835d404 Validate summaries once and bound retained Combine state (#55)
• 094d15c Bound allocations before decoding sketch inputs (#54)
• 4ca69f8 Harden Python installs and add CodeQL scanning
• 6439616 Update Go security toolchain to 1.26.9
• 3107aa8 Add Scorecard reporting and security review ownership (#51)
• 08a688f Document signed and signed-off contributions (#50)
• 12e8efc Require author-matching DCO sign-offs (#49)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kwisatzh]

Closing because the proposed dependency upgrades cross an incompatible identity migration. fleetdiff deliberately retains llm-sketchkit v0.2.4 and golang.org/x/text v0.41.0 to preserve existing canonicalization and sketch identities. The pin-rule PR #64 adds Dependabot ignore rules for both modules and documents this deliberate preservation. No dependency upgrade is applied; an identity migration requires separate compatibility review and an explicit migration plan.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml