Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 1, 2025

Bumps the stable-updates group with 10 updates in the / directory:

Package From To
github.com/go-chi/chi/v5 5.0.12 5.2.3
github.com/minio/minio-go/v7 7.0.67 7.0.95
github.com/prometheus/client_golang 1.19.0 1.23.0
github.com/rs/cors 1.10.1 1.11.1
github.com/spf13/afero 1.11.0 1.14.0
github.com/spf13/cobra 1.8.0 1.9.1
go.opentelemetry.io/otel 1.24.0 1.38.0
k8s.io/apimachinery 0.29.2 0.34.0
k8s.io/client-go 0.29.2 0.34.0
k8s.io/code-generator 0.29.2 0.34.0

Updates github.com/go-chi/chi/v5 from 5.0.12 to 5.2.3

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.2.3

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.2.2...v5.2.3

v5.2.2

What's Changed

Security fix

  • Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
    • a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
    • reported by Anuraag Baishya, @​anuraagbaishya. Thank you!

New Contributors

Full Changelog: go-chi/chi@v5.2.1...v5.2.2

v5.2.1

⚠️ Chi supports Go 1.20+

... (truncated)

Changelog

Sourced from github.com/go-chi/chi/v5's changelog.

Changelog

Commits
  • 9b9fb55 Replace methodTypString func with reverseMethodMap (#1018)
  • 0265fcd refactor: iterative wildcard collapsing and add test for consecutive wildcard...
  • cf537d4 Optimize throttle middleware by avoiding unnecessary timer creation (#1011)
  • 9040e95 fix/608 - Fix flaky Throttle middleware test by synchronizing token usage (#1...
  • d12cc49 feat(mux): support http.Request.Pattern in Go 1.23 (#986)
  • 1c2d011 Avoid potential nil dereference (#1008)
  • 7859137 Allow multiple whitespace between method & pattern (#1013)
  • 80d8da2 Add pathvalue example to README and implement PathValue handler. (#985)
  • 23c395f Correct documentation (#992)
  • 5516d14 docs: change install code to code block (#1001)
  • Additional commits viewable in compare view

Updates github.com/minio/minio-go/v7 from 7.0.67 to 7.0.95

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

Bugfix Release

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.0.94...v7.0.95

Bugfix Release

What's Changed

Full Changelog: minio/minio-go@v7.0.93...v7.0.94

Bugfix Release

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.0.92...v7.0.93

Bugfix Release and new APIs

What's Changed

... (truncated)

Commits
  • bd91926 make sure to avoid closing the input reader (#2137)
  • 94f7e5e fix: DurationSeconds is a QueryValues not a Form data (#2128) (#2129)
  • 456f9b2 fix: explicitly use UTC for expiration field when marshaling PostPolicy (#2135)
  • beae4df setting multiple keys to trailer is not allowed
  • 6358be6 extend more missing headers for PartUploads (#2132)
  • bab3180 fix: missing append() API behavior (#2131)
  • 8a07725 set checksum headers requested properly (#2130)
  • 9b18e49 update all deps (#2125)
  • 68615a3 fix: prefix should use stringLike when new a bucketPolicy (2) (#2124)
  • 8eacd80 test: add test for PresignedPostPolicy with empty fileName (#2119)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.19.0 to 1.23.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.23.0 - 2025-07-30

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766
  • [FEATURE] Add exemplars for native histograms #1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #1729

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.23.0 / 2025-07-30

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766
  • [FEATURE] Add exemplars for native histograms #1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #1729

1.22.0 / 2025-04-07

⚠️ This release contains potential breaking change if you use experimental zstd support introduce in #1496 ⚠️

Experimental support for zstd on scrape was added, controlled by the request Accept-Encoding header. It was enabled by default since version 1.20, but now you need to add a blank import to enable it. The decision to make it opt-in by default was originally made because the Go standard library was expected to have default zstd support added soon, golang/go#62513 however, the work took longer than anticipated and it will be postponed to upcoming major Go versions.

e.g.:

import (
  _ "github.com/prometheus/client_golang/prometheus/promhttp/zstd"
)
  • [FEATURE] prometheus: Add new CollectorFunc utility #1724
  • [CHANGE] Minimum required Go version is now 1.22 (we also test client_golang against latest go version - 1.24) #1738
  • [FEATURE] api: WithLookbackDelta and WithStats options have been added to API client. #1743
  • [CHANGE] ⚠️ promhttp: Isolate zstd support and klauspost/compress library use to promhttp/zstd package. #1765

1.21.1 / 2025-03-04

  • [BUGFIX] prometheus: Revert of Inc, Add and Observe cumulative metric CAS optimizations (#1661), causing regressions on low contention cases.
  • [BUGFIX] prometheus: Fix GOOS=ios build, broken due to process_collector_* wrong build tags.

1.21.0 / 2025-02-17

⚠️ This release contains potential breaking change if you upgrade github.com/prometheus/common to 0.62+ together with client_golang. ⚠️

New common version changes model.NameValidationScheme global variable, which relaxes the validation of label names and metric name, allowing all UTF-8 characters. Typically, this should not break any user, unless your test or usage expects strict certain names to panic/fail on client_golang metric registration, gathering or scrape. In case of problems change model.NameValidationScheme to old model.LegacyValidation value in your project init function.

  • [BUGFIX] gocollector: Fix help message for runtime/metric metrics. #1583
  • [BUGFIX] prometheus: Fix Desc.String() method for no labels case. #1687
  • [ENHANCEMENT] prometheus: Optimize popular prometheus.BuildFQName function; now up to 30% faster. #1665
  • [ENHANCEMENT] prometheus: Optimize Inc, Add and Observe cumulative metrics; now up to 50% faster under high concurrent contention. #1661
  • [CHANGE] Upgrade prometheus/common to 0.62.0 which changes model.NameValidationScheme global variable. #1712
  • [CHANGE] Add support for Go 1.23. #1602
  • [FEATURE] process_collector: Add support for Darwin systems. #1600 #1616 #1625 #1675 #1715
  • [FEATURE] api: Add ability to invoke CloseIdleConnections on api.Client using api.Client.(CloseIdler).CloseIdleConnections() casting. #1513

... (truncated)

Commits

Updates github.com/rs/cors from 1.10.1 to 1.11.1

Commits
  • a814d79 Re-add support for multiple Access-Control-Request-Headers field (fixes #184)...
  • 1562b17 Removed redundant log nil checks (#178)
  • 3d336ea Update all dependencies to latest in examples (#175)
  • 85fc0ca Make Gin wrapper's status configurable and use 204 as default (fixes #145) (#...
  • 4c32059 Normalize allowed request headers and store them in a sorted set (fixes #170)...
  • 8d33ca4 Complete documentation; deprecate AllowOriginRequestFunc in favour of AllowOr...
  • af821ae Merge branch 'jub0bs-master'
  • 0bcf73f Update benchmark
  • eacc8e8 Fix skewed middleware benchmarks (#165)
  • 9297f15 Respect the documented precedence of options (#163)
  • Additional commits viewable in compare view

Updates github.com/spf13/afero from 1.11.0 to 1.14.0

Release notes

Sourced from github.com/spf13/afero's releases.

v1.14.0

What's Changed

Full Changelog: spf13/afero@v1.13.0...v1.14.0

v1.13.0

What's Changed

New Contributors

Full Changelog: spf13/afero@v1.12.0...v1.13.0

v1.12.0

What's Changed

New Contributors

Full Changelog: spf13/afero@v1.11.0...v1.12.0

Commits
  • ea38482 Merge pull request #462 from spf13/dependencies
  • a9aaabc docs: add release instructions
  • d3a70b6 ci: run tests for submodules
  • 2af1925 feat: split gcsfs and sftpfs into separate modules
  • dbd6f61 Merge pull request #477 from spf13/update-dependencies
  • 83b8a55 update readme
  • bf3bd73 update dependencies
  • 464bc98 Merge pull request #473 from spf13/dependabot/github_actions/golangci/golangc...
  • da239a4 Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1
  • 523f621 Merge pull request #461 from spf13/go124
  • Additional commits viewable in compare view

Updates github.com/spf13/cobra from 1.8.0 to 1.9.1

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.9.1

🐛 Fixes

Full Changelog: spf13/cobra@v1.9.0...v1.9.1

v1.9.0

✨ Features

🐛 Fixes

🤖 Completions

🧪 Testing

✍🏼 Documentation

🔧 Dependency upgrades

... (truncated)

Commits

Updates github.com/stretchr/testify from 1.8.4 to 1.10.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.10.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

... (truncated)

Commits
  • 89cbdd9 Merge pull request #1626 from arjun-1/fix-functional-options-diff-indirect-calls
  • 07bac60 Merge pull request #1667 from sikehish/flaky
  • 716de8d Increase timeouts in Test_Mock_Called_blocks to reduce flakiness in CI
  • 118fb83 NotSame should fail if args are not pointers #1661 (#1664)
  • 7d99b2b attempt 2
  • 05f87c0 more similar
  • ea7129e better fmt
  • a1b9c9e Merge pull request #1663 from ybrustin/master
  • 8302de9 Merge branch 'master' into master
  • 89352f7 Merge pull request #1518 from hendrywiranto/adjust-readme-remove-v2
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.24.0 to 1.38.0

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.38.0/0.60.0/0.14.0/0.0.13] 2025-08-29

This release is the last to support [Go 1.23]. The next release will require at least [Go 1.24].

Added

  • Add native histogram exemplar support in go.opentelemetry.io/otel/exporters/prometheus. (#6772)
  • Add template attribute functions to the go.opentelmetry.io/otel/semconv/v1.34.0 package. (#6939)
    • ContainerLabel
    • DBOperationParameter
    • DBSystemParameter
    • HTTPRequestHeader
    • HTTPResponseHeader
    • K8SCronJobAnnotation
    • K8SCronJobLabel
    • K8SDaemonSetAnnotation
    • K8SDaemonSetLabel
    • K8SDeploymentAnnotation
    • K8SDeploymentLabel
    • K8SJobAnnotation
    • K8SJobLabel
    • K8SNamespaceAnnotation
    • K8SNamespaceLabel
    • K8SNodeAnnotation
    • K8SNodeLabel
    • K8SPodAnnotation
    • K8SPodLabel
    • K8SReplicaSetAnnotation
    • K8SReplicaSetLabel
    • K8SStatefulSetAnnotation
    • K8SStatefulSetLabel
    • ProcessEnvironmentVariable
    • RPCConnectRPCRequestMetadata
    • RPCConnectRPCResponseMetadata
    • RPCGRPCRequestMetadata
    • RPCGRPCResponseMetadata
  • Add ErrorType attribute helper function to the go.opentelmetry.io/otel/semconv/v1.34.0 package. (#6962)
  • Add WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log which can be used to disable deduplication for log records. (#6968)
  • Add WithCardinalityLimit option to configure the cardinality limit in go.opentelemetry.io/otel/sdk/metric. (#6996, #7065, #7081, #7164, #7165, #7179)
  • Add Clone method to Record in go.opentelemetry.io/otel/log that returns a copy of the record with no shared state. (#7001)
  • Add experimental self-observability span and batch span processor metrics in go.opentelemetry.io/otel/sdk/trace. Check the go.opentelemetry.io/otel/sdk/trace/internal/x package documentation for more information. (#7027, #6393, #7209)
  • The go.opentelemetry.io/otel/semconv/v1.36.0 package. The package contains semantic conventions from the v1.36.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for in...

    Description has been truncated

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 1, 2025
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 2, 2025

Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request.

3 similar comments
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 3, 2025

Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 3, 2025

Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 4, 2025

Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 16, 2025

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.

@dependabot dependabot bot force-pushed the dependabot/go_modules/stable-updates-9851b2a859 branch from af30452 to 91b9904 Compare September 18, 2025 01:06
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 30, 2025

Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request.

@dependabot dependabot bot force-pushed the dependabot/go_modules/stable-updates-9851b2a859 branch from 91b9904 to 482d125 Compare October 8, 2025 01:08
Bumps the stable-updates group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.0.12` | `5.2.3` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.67` | `7.0.95` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.19.0` | `1.23.0` |
| [github.com/rs/cors](https://github.com/rs/cors) | `1.10.1` | `1.11.1` |
| [github.com/spf13/afero](https://github.com/spf13/afero) | `1.11.0` | `1.14.0` |
| [github.com/spf13/cobra](https://github.com/spf13/cobra) | `1.8.0` | `1.9.1` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.38.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.29.2` | `0.34.0` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.29.2` | `0.34.0` |
| [k8s.io/code-generator](https://github.com/kubernetes/code-generator) | `0.29.2` | `0.34.0` |



Updates `github.com/go-chi/chi/v5` from 5.0.12 to 5.2.3
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.0.12...v5.2.3)

Updates `github.com/minio/minio-go/v7` from 7.0.67 to 7.0.95
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.0.67...v7.0.95)

Updates `github.com/prometheus/client_golang` from 1.19.0 to 1.23.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.19.0...v1.23.0)

Updates `github.com/rs/cors` from 1.10.1 to 1.11.1
- [Commits](rs/cors@v1.10.1...v1.11.1)

Updates `github.com/spf13/afero` from 1.11.0 to 1.14.0
- [Release notes](https://github.com/spf13/afero/releases)
- [Commits](spf13/afero@v1.11.0...v1.14.0)

Updates `github.com/spf13/cobra` from 1.8.0 to 1.9.1
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.8.0...v1.9.1)

Updates `github.com/stretchr/testify` from 1.8.4 to 1.10.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.8.4...v1.10.0)

Updates `go.opentelemetry.io/otel` from 1.24.0 to 1.38.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.24.0...v1.38.0)

Updates `go.opentelemetry.io/otel/metric` from 1.24.0 to 1.38.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.24.0...v1.38.0)

Updates `k8s.io/apimachinery` from 0.29.2 to 0.34.0
- [Commits](kubernetes/apimachinery@v0.29.2...v0.34.0)

Updates `k8s.io/client-go` from 0.29.2 to 0.34.0
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.29.2...v0.34.0)

Updates `k8s.io/code-generator` from 0.29.2 to 0.34.0
- [Commits](kubernetes/code-generator@v0.29.2...v0.34.0)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.0.95
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: stable-updates
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: github.com/rs/cors
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: github.com/spf13/afero
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: k8s.io/client-go
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
- dependency-name: k8s.io/code-generator
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stable-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/stable-updates-9851b2a859 branch from 482d125 to 4481859 Compare October 17, 2025 01:07
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 28, 2025

Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 20, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Nov 20, 2025
@dependabot dependabot bot deleted the dependabot/go_modules/stable-updates-9851b2a859 branch November 20, 2025 01:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant