chore(deps): bump the gomod-updates group across 1 directory with 20 updates by dependabot[bot] · Pull Request #2043 · xmtp/xmtpd

dependabot · 2026-07-27T05:08:25Z

Bumps the gomod-updates group with 16 updates in the / directory:

Package	From	To
connectrpc.com/connect	`1.19.1`	`1.20.0`
connectrpc.com/grpchealth	`1.4.0`	`1.5.0`
github.com/DataDog/datadog-agent/pkg/trace/log	`0.78.0`	`0.81.2`
github.com/Masterminds/semver/v3	`3.4.0`	`3.5.0`
github.com/exaring/otelpgx	`0.10.0`	`0.11.1`
github.com/jackc/pgx/v5	`5.9.2`	`5.10.0`
github.com/moby/moby/api	`1.54.1`	`1.55.0`
github.com/pires/go-proxyproto	`0.12.0`	`0.15.0`
github.com/prometheus/client_golang	`1.23.2`	`1.24.1`
github.com/redis/go-redis/v9	`9.18.0`	`9.21.0`
github.com/testcontainers/testcontainers-go	`0.42.0`	`0.43.0`
github.com/testcontainers/testcontainers-go/modules/postgres	`0.42.0`	`0.43.0`
go.opentelemetry.io/otel	`1.43.0`	`1.44.0`
go.opentelemetry.io/otel/exporters/prometheus	`0.65.0`	`0.66.0`
go.uber.org/zap	`1.27.1`	`1.28.0`
google.golang.org/grpc	`1.80.0`	`1.82.1`

Updates connectrpc.com/connect from 1.19.1 to 1.20.0

Release notes

Sourced from connectrpc.com/connect's releases.

v1.20.0

What's Changed

Other changes

Bump minimum supported Go version to 1.25 by @jonbodner-buf in #922

Update Unary-Get query parameter order to match spec recommendation by @oliversun9 in #926

New Contributors

@jonbodner-buf made their first contribution in #922

Full Changelog: connectrpc/connect-go@v1.19.2...v1.20.0

v1.19.2

What's Changed

Governance

Add @timostamm as a maintainer in connectrpc/connect-go#905 🎉

Bugfixes

Use 'deadline_exceeded' instead of 'canceled' on HTTP/2 cancelation when appropriate by @jhump in connectrpc/connect-go#904

Fix nil pointer deref in duplexHTTPCall under concurrent Send + CloseAndReceive by @simonferquel in connectrpc/connect-go#919

Other changes

Refactor memhttptest to work with Go 1.25 synctest by @codefromthecrypt in connectrpc/connect-go#881

Doc clarifications by @emcfarlane (#911, #912) and @stefanvanburen (#906)

New Contributors

@codefromthecrypt made their first contribution in connectrpc/connect-go#881

@simonferquel made their first contribution in connectrpc/connect-go#919

Full Changelog: connectrpc/connect-go@v1.19.1...v1.19.2

Commits

1291a7d Prepare for v1.20.0 (#927)
6df682f Update Unary-Get query parameter order to match spec recommendation (#926)
c4aac92 Chore update buf v1.69.0 and license year (#925)
a5a6c30 Bump Go from v1.24 to v1.25 (#922)
138e270 Back to development (#921)
1c195ae Prepare for v1.19.2 (#920)
96abc6b Upgrade golangci-lint to v2 (#917)
be72fa5 Clarify concurrent use semantics for streaming types (#911)
299d2e7 Fix nil pointer deref in duplexHTTPCall under concurrent Send + CloseAndRecei...
e299aa6 Bump google.golang.org/grpc from 1.76.0 to 1.79.3 in /internal/conformance (#...
Additional commits viewable in compare view

Updates connectrpc.com/grpchealth from 1.4.0 to 1.5.0

Release notes

Sourced from connectrpc.com/grpchealth's releases.

v1.5.0

What's Changed

Governance

Add @timostamm as a maintainer in connectrpc/grpchealth-go#80 🎉

Enhancements

Add Watcher interface and Watch RPC support by @jhump in connectrpc/grpchealth-go#83

Add grpchealth client by @emcfarlane in connectrpc/grpchealth-go#84

Other changes

Fix example in README to use standard net/http h2c support by @pkwarren in connectrpc/grpchealth-go#82

Full Changelog: connectrpc/grpchealth-go@v1.4.0...v1.5.0

Commits

371aeda Add grpchealth client (#84)
b8d27c8 Add Watcher interface and Watch RPC support (#83)
30c391a Fix example in README to use standard net/http h2c support (#82)
180e76f Add Timo Stamm to maintainers (#80)
6f8828f Resign as maintainer (#79)
See full diff in compare view

Updates github.com/DataDog/datadog-agent/pkg/trace/log from 0.78.0 to 0.81.2

Commits

6dbfece [release] Update release.json for 7.81.2 (#53925)
3a51b2f [release] Update release.json for 7.81.2-rc.1 (#53831)
0dcdbdd [Backport 7.81.x] ci(e2e): add qa_agent_linux to needs of new-e2e-otel and n...
8e68c44 [Backport 7.81.x] feat(apm-inject): tmpfs-based ld.so.preload for reboot saf...
ee48b9f [backport 7.81.x] chore: bump Agent Data Plane to 1.2.4 (#53529)
025b1ba [Backport 7.81.x] fix(wlan): don't steal focus when launching Datadog Agent ...
f672aa8 [Backport 7.81.x] feat(agenttelemetry): preserve emitter tag on ADP COAT met...
9d1fd78 [Backport 7.81.x] Default metrics v3 intake to Datadog URLs only (#53542)
acc07f4 Backport #52499 & #52983 to 7.81.x (#53463)
6f87676 [Backport 7.81.x] [PROF-15208] Fail the ci preview job if the preview number...
Additional commits viewable in compare view

Updates github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0

Release notes

Sourced from github.com/Masterminds/semver/v3's releases.

v3.5.0

What's Changed

Adding more prerelease tests by @mattfarina in Masterminds/semver#273

Update constraint error messages by @mattfarina in Masterminds/semver#278

Fix edge cases by @mattfarina in Masterminds/semver#279

Adding some checks in by @mattfarina in Masterminds/semver#280

Updating deps by @mattfarina in Masterminds/semver#281

Bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in Masterminds/semver#282

Bump actions/cache from 4.2.3 to 5.0.5 by @dependabot[bot] in Masterminds/semver#283

Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0 by @dependabot[bot] in Masterminds/semver#284

Updating gitignore for devcontainers by @mattfarina in Masterminds/semver#286

Fixing some quality issues by @mattfarina in Masterminds/semver#287

New Contributors

@dependabot[bot] made their first contribution in Masterminds/semver#282

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

Changelog

Sourced from github.com/Masterminds/semver/v3's changelog.

Changelog

Commits

8b89c86 Merge pull request #287 from mattfarina/fix-da-issues
29d51d0 Fixing some quality issues
87f651d Merge pull request #286 from mattfarina/update-devcontainer
158a685 Updating gitignore for devcontainers
7e83c08 Merge pull request #284 from Masterminds/dependabot/github_actions/golangci/g...
697e27f Merge pull request #283 from Masterminds/dependabot/github_actions/actions/ca...
1591f8e Merge pull request #282 from Masterminds/dependabot/github_actions/github/cod...
3f5ff17 Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0
04baa33 Bump actions/cache from 4.2.3 to 5.0.5
45939fe Bump github/codeql-action from 4.35.1 to 4.35.2
Additional commits viewable in compare view

Updates github.com/exaring/otelpgx from 0.10.0 to 0.11.1

Release notes

Sourced from github.com/exaring/otelpgx's releases.

v0.11.1

What's Changed

fix: Tracer.logConnectionDetails defaults to true by @trygve-baerland in exaring/otelpgx#80

New Contributors

@trygve-baerland made their first contribution in exaring/otelpgx#80

Full Changelog: exaring/otelpgx@v0.11.0...v0.11.1

v0.11.0

What's Changed

chore(deps): upgrade Go version to 1.25 + use latest stable otel semconv by @ValentinLvr in exaring/otelpgx#74

feat: add option to disable the AcquireTracer by @joshua-tianci in exaring/otelpgx#73

fix(stats): allow WithStatsAttributes to override library defaults by @obitech in exaring/otelpgx#78

chore: spring cleaning — Go matrix, pgx, testify, golangci-lint by @obitech in exaring/otelpgx#79

New Contributors

@ValentinLvr made their first contribution in exaring/otelpgx#74

@joshua-tianci made their first contribution in exaring/otelpgx#73

Full Changelog: exaring/otelpgx@v0.10.0...v0.11.0

Commits

626246c Fix lints
168b105 Refactor tests to use testify
795d56d fix logConnectionDetails
76cf7a5 Add tests for asserting trace attributes
25501de fix(ci): test from go1.25+
ca37215 fix: Update .github/workflows/test.yaml
b0d28b5 refactor(test): use typed context key in span name test
45dc290 chore(lint): switch from golint to golangci-lint
ad455b0 refactor: switch to testify
e630def chore: update pgx
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)

Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)

Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)

Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)

pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)

Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)

Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)

Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)

Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)

Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)

Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)

Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)

Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

Fix scanning "char" (OID 18) into *string in binary format (luongs3)

Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)

Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)

Fix data race when context is cancelled during connect

Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)

pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)

pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)

pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check

Add missing error check of rows.Err to load types (Jen Altavilla)

Commits

7293fb1 Update changelog for v5.10.0
1ade285 pgconn: document secure connection configuration
b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
b28e65b pgtype: bound array element count against remaining message bytes
cd1f389 pgtype: bound array binary decode element length against remaining bytes
ff27b5b pgtype: bound hstore binary decode against malicious server input
a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
44f6173 pgconn: cap server-supplied SCRAM iteration count
1a976f7 pgconn: add require_auth to restrict accepted server auth methods
Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.54.1 to 1.55.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.55.0

1.55.0

Changelog

POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651

The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

docs: clarify swarm join required fields. moby/moby#52763

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651

The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

docs: clarify swarm join required fields. moby/moby#52763

api/v1.54.2

Changelog

api/docs: cleanup changelog. moby/moby#52379

api/docs: lower deprecation heading to a h4. moby/moby#52315

api/docs: restore API docs and change-logs for API v1.0 - v1.23. moby/moby#52312

api: align Topology swagger with Segments JSON shape. moby/moby#52358

Full Changelog: moby/moby@api/v1.54.1...api/v1.54.2

Commits

b6c53c2 Merge pull request #52773 from vvoland/c8d-amd64-variants
01115e8 Merge pull request #52906 from vvoland/fix-TestContainerWithConflictingNoneNe...
b36296f Merge pull request #52913 from thaJeztah/windows_does_stats
a81aa78 TestContainerWithConflictingNoneNetwork: Extend Windows timeout
908a35a Merge pull request #52914 from thaJeztah/no_stderr
04d33b5 Merge pull request #52912 from thaJeztah/cleanup_GenerateRandomAlphaOnlyString
3b2f557 Merge pull request #52722 from notandruu/integration/migrate-TestInspectAPIIm...
62b3aae Merge pull request #52901 from vvoland/c8d-imageusage
11d3342 integration-cli: un-skip stats tests on Windows
a47b1b2 Merge pull request #52891 from smerkviladze/attestations-clearer-blob-missing...
Additional commits viewable in compare view

Updates github.com/pires/go-proxyproto from 0.12.0 to 0.15.0

Release notes

Sourced from github.com/pires/go-proxyproto's releases.

v0.15.0

This release aligns the library with PROXY protocol spec 3.4 (2026/04/27). It tightens parsing and trust behavior to match the spec's requirements — which makes some previously accepted inputs and configurations fail loudly — and adds first-class support for the PROXY protocol over UDP.

⚠️ Breaking changes

The PROXY header is now required by default (2cd5f00e2b3010a0fa64f52f077a20fb304b72fa)

A new DefaultPolicy package variable, set to REQUIRE, is applied by NewConn and Listener.Accept when no policy is configured. The spec forbids guessing whether a header is present, so headerless connections now fail their first Read with ErrNoProxyProtocol.

To restore the previous lax behavior: proxyproto.DefaultPolicy = proxyproto.USE.

TrustProxyHeaderFrom is now strict: trusted peers get REQUIRE and untrusted peers are dropped by Accept with an error wrapping ErrInvalidUpstream. Previously, untrusted headerless clients could slip through as raw connections.

Stricter v1/v2 header parsing per spec 3.4 (5914db81c566830347865256ec22808fc39a0787)

v1: the full PROXY token is validated; IPv6 zone IDs are rejected; plain IPv4 addresses in TCP6 lines are rejected (set V1AcceptIPv4InTCP6 for nginx interop); ports are parsed with leading zeros rejected and ranges validated on formatting.

v2: the family/transport whitelist now applies to LOCAL commands too, rejecting undefined bytes per spec 2.2. LOCAL headers with a valid address block decode addresses and TLVs and round-trip; ill-fitting ones are normalized to UNSPEC.

New MaxV2HeaderSize variable bounds the declared v2 length (default 4096) — raise it if you carry large TLVs such as PP2_SUBTYPE_SSL_CLIENT_CERT.

✨ New features

PROXY protocol over UDP (499ef90567292b68d14248845f4050f5d917fa5e, fixes #79)

New ParseUDPDatagram and Header.FormatUDPDatagram implement the spec's per-datagram semantics (header and payload share a single datagram) for use with any net.PacketConn.

The library deliberately ships no net.PacketConn wrapper — reply routing needs an application-policy flow table — but examples/udppacketconn is a runnable sketch of that pattern, alongside examples/udpserver and examples/udpclient for the plain paths.

Reworked trust policies (2cd5f00e2b3010a0fa64f52f077a20fb304b72fa)

New PolicyFromRanges(ranges, matched, unmatched) and MustPolicyFromRanges supersede the whitelist policy family, which is deprecated and now delegates to them. The (REQUIRE, IGNORE) combination covers mixed proxied/direct traffic the old family couldn't express.

New CIDR-capable TrustProxyHeaderFromRanges.

All built-in policies wrap address-classification failures in ErrInvalidUpstream, so a single unclassifiable peer can no longer stop an accept loop.

TLV registry and PP2SSL caught up to spec 3.4 (4e80228ed95019bd7cba1d215fb169a008c146f5)

Registered() now includes PP2_TYPE_GROUP, PP2_SUBTYPE_SSL_SIG_SCHEME, and PP2_SUBTYPE_SSL_CLIENT_CERT.

New PP2SSL accessors: SSLSigAlg, SSLKeyAlg, SSLGroup, SSLSigScheme.

🐛 Fixes

Header.EqualsTo no longer panics on nil addresses (5914db81c566830347865256ec22808fc39a0787).

formatVersion2 folds TLV length into the declared length for Unix families instead of emitting TLVs past it (5914db81c566830347865256ec22808fc39a0787).

🧪 Testing & CI

New fuzz/table suites: exhaustive 256-transport-byte sweeps for both v2 commands, a LOCAL decode matrix, byte-for-byte round-trip stability, and FuzzRead parse–format–reparse invariants (5914db81c566830347865256ec22808fc39a0787).

CI gains a fuzz job that auto-discovers fuzz targets and uploads crashers as artifacts; workflow actions bumped across the board (af4b18ccae4375269802ff0831e5edf8c26c33c6).

Coverage for the http2 serveConn TLS handshake-failure branch (b01bea45dfd89272ed4ee72c7e7f96c94f1c89fc).

📚 Documentation

README rewritten against spec 3.4: new Security section with the spec's trust requirements, a UDP section, an examples table, and warnings about the new REQUIRE default (bd986c0a99dccc91fea506d5a6b8c14c5e0cda7c).

v0.14.0

What's Changed

tls: revisit tests and docs by @pires in pires/go-proxyproto#174

Several improvements by @pires in pires/go-proxyproto#175

... (truncated)

Commits

bd986c0 docs: rewrite README against PROXY protocol spec 3.4
af4b18c ci: add fuzz job, bump workflow actions
b01bea4 test: cover http2 serveConn TLS handshake failure
499ef90 feat: support the PROXY protocol over UDP datagrams
4e80228 feat: catch TLV registry and PP2SSL parsing up to spec 3.4
2cd5f00 feat!: require the PROXY header by default and rework trust policies
5914db8 fix!: align v1/v2 header parsing with PROXY protocol spec 3.4
d72bda7 docs: README Usage section points to relevant examples
4aea955 build(deps): bump golang.org/x/net from 0.39.0 to 0.55.0
6fdb7e0 ci: run the whole module under -race -shuffle=on
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @dependabot[bot] in prometheus/client_golang#1852

Refactor LabelNames to return model.LabelNames type for consistency by @yshngg in prometheus/client_golang#1850

remote: simplified Store interface; renamed Handler to WriteHandler by @bwplotka in prometheus/client_golang#1855

feat(api/prometheus): add format_query endpoint for query formatting by @yshngg in prometheus/client_golang#1846

feat(api): add FormatQuery method to Prometheus v1 API by @yshngg in prometheus/client_golang#1856

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

Commits

d6087ee release: cut v1.24.1 (#2076)
48dd383 Cut v1.24.0 (#2061)
a725305 Cut v1.24.0-rc.0 (#2058)
77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
34e9a7f Merge pull request #2055 from prombot/repo_sync
43749bc Update common Prometheus files
de19217 examples: improve simple main.go example (#1999)
20355eb fix: correct typos in comments and test error messages (#2049)
4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.18.0 to 9.21.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.21.0

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:
GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd
GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @TheRealMal

✨ New Features

Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @ndyakov

XTrimLimitDisabled sent...
Description has been truncated

…updates Bumps the gomod-updates group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `1.19.1` | `1.20.0` | | [connectrpc.com/grpchealth](https://github.com/connectrpc/grpchealth-go) | `1.4.0` | `1.5.0` | | [github.com/DataDog/datadog-agent/pkg/trace/log](https://github.com/DataDog/datadog-agent) | `0.78.0` | `0.81.2` | | [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) | `3.4.0` | `3.5.0` | | [github.com/exaring/otelpgx](https://github.com/exaring/otelpgx) | `0.10.0` | `0.11.1` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.2` | `5.10.0` | | [github.com/moby/moby/api](https://github.com/moby/moby) | `1.54.1` | `1.55.0` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.12.0` | `0.15.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.18.0` | `9.21.0` | | [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.42.0` | `0.43.0` | | [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go) | `0.42.0` | `0.43.0` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) | `0.65.0` | `0.66.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.1` | `1.28.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.80.0` | `1.82.1` | Updates `connectrpc.com/connect` from 1.19.1 to 1.20.0 - [Release notes](https://github.com/connectrpc/connect-go/releases) - [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md) - [Commits](connectrpc/connect-go@v1.19.1...v1.20.0) Updates `connectrpc.com/grpchealth` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/connectrpc/grpchealth-go/releases) - [Commits](connectrpc/grpchealth-go@1.4.0...v1.5.0) Updates `github.com/DataDog/datadog-agent/pkg/trace/log` from 0.78.0 to 0.81.2 - [Release notes](https://github.com/DataDog/datadog-agent/releases) - [Changelog](https://github.com/DataDog/datadog-agent/blob/main/CHANGELOG.rst) - [Commits](DataDog/datadog-agent@pkg/api/v0.78.0...pkg/api/v0.81.2) Updates `github.com/Masterminds/semver/v3` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/Masterminds/semver/releases) - [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md) - [Commits](Masterminds/semver@v3.4.0...v3.5.0) Updates `github.com/exaring/otelpgx` from 0.10.0 to 0.11.1 - [Release notes](https://github.com/exaring/otelpgx/releases) - [Commits](exaring/otelpgx@v0.10.0...v0.11.1) Updates `github.com/jackc/pgx/v5` from 5.9.2 to 5.10.0 - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.9.2...v5.10.0) Updates `github.com/moby/moby/api` from 1.54.1 to 1.55.0 - [Release notes](https://github.com/moby/moby/releases) - [Commits](moby/moby@api/v1.54.1...api/v1.55.0) Updates `github.com/pires/go-proxyproto` from 0.12.0 to 0.15.0 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](pires/go-proxyproto@v0.12.0...v0.15.0) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/redis/go-redis/v9` from 9.18.0 to 9.21.0 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md) - [Commits](redis/go-redis@v9.18.0...v9.21.0) Updates `github.com/testcontainers/testcontainers-go` from 0.42.0 to 0.43.0 - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.42.0...v0.43.0) Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.42.0 to 0.43.0 - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.42.0...v0.43.0) Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.65.0 to 0.66.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@exporters/prometheus/v0.65.0...metric/x/v0.66.0) Updates `go.opentelemetry.io/otel/sdk/metric` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.uber.org/zap` from 1.27.1 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.1...v1.28.0) Updates `golang.org/x/crypto` from 0.50.0 to 0.54.0 - [Commits](golang/crypto@v0.50.0...v0.54.0) Updates `golang.org/x/net` from 0.53.0 to 0.57.0 - [Commits](golang/net@v0.53.0...v0.57.0) Updates `golang.org/x/sync` from 0.20.0 to 0.22.0 - [Commits](golang/sync@v0.20.0...v0.22.0) Updates `google.golang.org/grpc` from 1.80.0 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.80.0...v1.82.1) --- updated-dependencies: - dependency-name: connectrpc.com/connect dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: connectrpc.com/grpchealth dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/DataDog/datadog-agent/pkg/trace/log dependency-version: 0.81.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/Masterminds/semver/v3 dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/exaring/otelpgx dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/moby/moby/api dependency-version: 1.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/testcontainers/testcontainers-go dependency-version: 0.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres dependency-version: 0.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: go.opentelemetry.io/otel dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: go.opentelemetry.io/otel/exporters/prometheus dependency-version: 0.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: go.opentelemetry.io/otel/sdk/metric dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 27, 2026

dependabot Bot requested a review from a team as a code owner July 27, 2026 05:08

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the gomod-updates group across 1 directory with 20 updates - #2043

chore(deps): bump the gomod-updates group across 1 directory with 20 updates#2043
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-updates-44066605dc

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v1.20.0

What's Changed

Other changes

New Contributors

v1.19.2

What's Changed

Governance

Bugfixes

Other changes

New Contributors

v1.5.0

What's Changed

Governance

Enhancements

Other changes

v3.5.0

What's Changed

New Contributors

Changelog

v0.11.1

What's Changed

New Contributors

v0.11.0

What's Changed

New Contributors

5.10.0 (June 3, 2026)

Features

Security Hardening

Fixes

api/v1.55.0

1.55.0

Changelog

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

api/v1.54.2

Changelog

v0.15.0

⚠️ Breaking changes

✨ New features

🐛 Fixes

🧪 Testing & CI

📚 Documentation

v0.14.0

What's Changed

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

1.24.1 / 2026-07-23

1.24.0 / 2026-07-20

9.21.0

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Explicit LIMIT 0 for stream trimming

✨ New Features

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Zero-copy `GetToBuffer` / `SetFromBuffer`

Explicit `LIMIT 0` for stream trimming