[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/common	v0.67.5 → v0.73.1

---

Release Notes

prometheus/common (github.com/prometheus/common)

v0.73.1

Compare Source

What's Changed

• build(deps): bump github.com/pandatix/go-abnf from 0.5.1 to 0.5.3 by @​bwplotka in #​1027

Full Changelog: prometheus/common@v0.73.0...v0.73.1

v0.73.0

Compare Source

What's Changed

• expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 by @​KR-Ravindra in #​1008
• expfmt: add FmtOpenMetrics_2_0_0_rc format constant by @​bwplotka in #​1020
• expfmt: add ABNF-based OpenMetrics 1.0 parser by @​bwplotka in #​1015

New Contributors

• @​KR-Ravindra made their first contribution in #​1008

Full Changelog: prometheus/common@v0.72.1...v0.73.0

v0.72.1

Compare Source

Bugfixes

• fix(config): deep copy the header in cloneRequest #​982

Internal

• Fix MAINTAINERS.md link text typo in RELEASE.md #​1009
• Synchronize common files from prometheus/prometheus #​1010
• build(deps): bump the codeql group with 4 updates #​1007

Full Changelog: prometheus/common@v0.72.0...v0.72.1

v0.72.0

Compare Source

Bugfixes

• fix(config): deep copy the header in cloneRequest #​982

Internal

• Fix MAINTAINERS.md link text typo in RELEASE.md #​1009
• Synchronize common files from prometheus/prometheus #​1010
• build(deps): bump the codeql group with 4 updates #​1007

Full Changelog: prometheus/common@v0.72.0...v0.72.1

v0.71.0

Compare Source

Note

• This release bumps go.mod to 1.26 -- mostly due to /x Go packages requiring 1.26 as well.
• This is the first release with the experimental support of OpenMetrics 2 encoding.

What's Changed

• feat: implement histogram and gauge histogram support for OpenMetrics 2.0 #​964
• expfmt: reject nameless samples after metric metadata #​988
• feat: implement summary support for OpenMetrics 2.0 #​983
• docs(expfmt): update OpenMetrics 2.0 supported metric types comments #​989
• optimize sample unmarshaling for json/v2 #​991
• expfmt: simplify format constants and provide default negotiation slices #​992
• expfmt: reject invalid UTF-8 and a trailing CR in OpenMetrics 2.0 metadata #​998
• expfmt: stop a test leaving the shared parser on legacy validation #​996
• Update supported Go versions #​1004

Internal

• chore: Update linting #​1002
• chore: Update gofumpt config and apply new formatting #​987
• Synchronize common files from prometheus/prometheus #​1003
• build(deps): bump the codeql group with 4 updates #​980
• build(deps): bump the golang-org-x group across 1 directory with 2 updates #​1000
• build(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 in the prometheus group across 1 directory #​1001

Full Changelog: prometheus/common@v0.71.0...v0.72.0

v0.70.1

Compare Source

What's Changed

• Update CHANGELOG for v0.70.0 by @​roidelapluie in #​945
• config: clarify sensitive redirect headers match net/http by @​roidelapluie in #​924
• Synchronize common files from prometheus/prometheus by @​prombot in #​946
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​950
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​949
• build(deps): bump the codeql group with 4 updates by @​dependabot[bot] in #​948
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 in the golang-org-x group across 1 directory by @​dependabot[bot] in #​947

Full Changelog: prometheus/common@v0.70.0...v0.70.1

v0.70.0

Compare Source

What's Changed

• fix: use slog.DiscardHandler in promslog.NopLogger #​960
• feat: implement gauge and counter support for OpenMetrics 2.0 #​894
• fix: support exemplars with empty label sets in OpenMetrics 2.0 #​965
• model: sort label names without boxing them into sort.Interface #​963
• expfmt: fix wildcard content negotiation regression for Negotiate and NegotiateIncludingOpenMetrics #​966
• expfmt: precompute parsed goautoneg.Accept for well-known Format constants #​967
• expfmt: format OpenMetrics 2.0 float values and validate units #​969
• fix: drop invalid OpenMetrics 2.0 exemplars instead of failing exposition #​970
• model: add Duration unit constants and conversion methods #​952
• expfmt: prevent st@ leaking to Gauge and Untyped samples in OpenMetrics 2.0 #​971
• expfmt: fix OpenMetrics 2.0 decoder error, format docs, and encoder version dispatch #​968

Internal

• Synchronize common files from prometheus/prometheus #​957 #​958 #​959 #​961
• build(deps): bump the codeql group across 1 directory with 4 updates #​955
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 #​956
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 #​977
• build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 #​976
• build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 in the golang-org-x group across 1 directory #​975
• Update dependabot config #​978
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in /assets #​979

Full Changelog: prometheus/common@v0.70.0...v0.71.0

v0.69.0

Compare Source

Enhancements

• route: add support for the QUERY HTTP method. #​932

Bugfixes

• config: fix TLSVersion.String() printing a pointer address instead of the numeric version for unknown TLS versions. #​929

Internal

• expfmt: add BenchmarkConvertMetricFamily comparing the Prometheus text and OpenMetrics 1.0 encoders. #​943
• Update Go dependencies. #​933 #​934
• Synchronize common files from prometheus/prometheus. #​923 #​927 #​930 #​937
• Update GitHub Actions. #​938 #​939 #​940 #​941 #​942

Full Changelog: prometheus/common@v0.69.0...v0.70.0

v0.68.1

Compare Source

Security / behavior changes

• config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #​901 #​920 #​921
• config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #​925

Bugfixes

• expfmt: fix nil pointer panic when parsing empty braces {}. #​922
• model: fix Time.UnmarshalJSON for larger negative numbers. #​918

Performance

• model: reduce allocations in Time.UnmarshalJSON. #​918

Internal

• Synchronize common files from prometheus/prometheus. #​917
• Modernize Go. #​919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.0

Compare Source

What's Changed

• Synchronize common files from prometheus/prometheus by @​prombot in #​873
• Synchronize common files from prometheus/prometheus by @​prombot in #​874
• build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by @​dependabot[bot] in #​879
• build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @​dependabot[bot] in #​878
• Synchronize common files from prometheus/prometheus by @​prombot in #​875
• Synchronize common files from prometheus/prometheus by @​prombot in #​880
• Remove logic adding unit to metrics name by @​vesari in #​877
• Synchronize common files from prometheus/prometheus by @​prombot in #​881
• Update for Go 1.26 by @​SuperQ in #​883
• build(deps): bump golang.org/x/net from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​882
• version: Add a slog helper by @​SuperQ in #​886
• Remove Arthur from maintainers list by @​ArthurSens in #​885
• Synchronize common files from prometheus/prometheus by @​prombot in #​895
• Synchronize common files from prometheus/prometheus by @​prombot in #​896
• config: change NewOAuth2RoundTripper to accept variadic HTTPClientOption by @​alliasgher in #​898
• config: guard against nil oauth2 credential in RoundTrip by @​alliasgher in #​897
• build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​890
• build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​891
• build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 by @​dependabot[bot] in #​892
• Move interface assertions to a test file by @​msiegen in #​839
• fix(http_config): fix client cert rotation when no CA is configured by @​machine424 in #​908
• Remove CircleCI by @​ArthurSens in #​910
• Fix: apply DialContextFunc to OAuth2 token-fetch transport by @​yuri-tceretian in #​911

New Contributors

• @​alliasgher made their first contribution in #​898
• @​msiegen made their first contribution in #​839
• @​machine424 made their first contribution in #​908
• @​yuri-tceretian made their first contribution in #​911

Full Changelog: prometheus/common@v0.67.5...v0.68.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.12 -> 1.26.0
golang.org/x/crypto	v0.54.0 -> v0.58.0
golang.org/x/oauth2	v0.36.0 -> v0.37.0
golang.org/x/sys	v0.47.0 -> v0.49.0
github.com/prometheus/client_model	v0.6.2 -> v0.6.3
github.com/prometheus/procfs	v0.16.1 -> v0.21.0
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5
golang.org/x/net	v0.57.0 -> v0.61.0
golang.org/x/term	v0.45.0 -> v0.47.0
golang.org/x/text	v0.40.0 -> v0.43.0
google.golang.org/protobuf	v1.36.11 -> v1.36.12

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kanshiori for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dd69ad85-30bc-43fa-bcf4-d1411f395757

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn