Skip to content

deps(go): bump the go-minor-patch group across 1 directory with 3 updates - #1226

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-ddcd6abe82
Open

deps(go): bump the go-minor-patch group across 1 directory with 3 updates#1226
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-ddcd6abe82

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 2 updates in the / directory: github.com/mdlayher/netlink and github.com/prometheus/client_golang.

Updates github.com/mdlayher/netlink from 1.9.0 to 1.11.2

Release notes

Sourced from github.com/mdlayher/netlink's releases.

v1.11.2

See https://github.com/mdlayher/netlink/blob/main/CHANGELOG.md#v1112

v1.11.1

See https://github.com/mdlayher/netlink/blob/main/CHANGELOG.md#v1111

v1.11.0

See https://github.com/mdlayher/netlink/blob/main/CHANGELOG.md#v1110

v1.10.0

See https://github.com/mdlayher/netlink/blob/main/CHANGELOG.md#v1100

Changelog

Sourced from github.com/mdlayher/netlink's changelog.

v1.11.2

  • [Bug Fix]: #291 fixed a bug where netlink.Conn.Receive would block concurrent calls to netlink.Conn.Send when blocking in recvmsg.
  • [Improvement]: #289 updated golang.org/x/net and golang.org/x/sys dependencies.

v1.11.1

  • [Bug Fix]: #283 fixed a bug where netlink.Conn.Receive would reject valid netlink messages whose header length is not aligned. This is common with nfqueue, nflog and conntrack events.
  • [Bug Fix]: #284 fixed a bug where netlink.Message.Data could be silently overwritten by subsequent netlink.Conn.Receive calls when netlink.Config.MessageBufferSize is enabled, due to pooled buffer reuse.
  • [Improvement]: #282 improved error handling by usage of errors package.

v1.11.0

This is the first release of package netlink that only supports Go 1.25+.

  • [Bug Fix]: #280 fixed a critical bug where netlink.Conn.Receive and netlink.Conn.ReceiveIter would panic if the received message was unaligned.
  • [Improvement]: #277 added big-endian test fixtures for nlenc and deprecated endian helpers in favor of binary.NativeEndian.
  • [Improvement]: #276 fixed skipping of tests on big-endian hosts.
  • [Improvement]: #273 added golangci-lint to the CI pipeline and fixed all existing lint issues.
  • [Improvement]: #272 updated dependencies and Go version to 1.25.

v1.10.0

Users of this version should upgrade to v1.11.0 as this version contains a critical bug.

  • [New API]: #270 added MessageBufferSize option to netlink.Config for configuring the size of the copy buffer used for receiving messages. This can improve performance in high-throughput applications by reducing the number of syscalls needed to receive messages.
  • [Improvement]: #219 added debug logging inspired by libmnl. This is now the new default when setting NLDEBUG in the environment.

... (truncated)

Commits
  • 847c7b8 CHANGELOG: release v1.11.2 (#292)
  • 2a76054 conn: fix Receive blocking Send (#291)
  • 3881416 build(deps): bump golang.org/x/net in / (#289)
  • 45ff015 CHANGELOG: release v1.11.1 (#285)
  • 8788303 netlink: fix UnmarshalBinary rejecting valid unpadded netlink messages (#283)
  • bf38b16 conn_linux: copy pooled receive buffers before parsing (#284)
  • c24d516 Improve error handling (#282)
  • f1e0776 CHANGELOG: release v1.11.0 (#281)
  • 1ae4967 conn: align receive buffer to nlmsgAlign boundary (#280)
  • a044567 nlenc: add big-endian test fixtures and deprecate endian helpers (#276)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

  • [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • d6087ee release: cut v1.24.1 (#2076)
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • Additional commits viewable in compare view

Updates github.com/prometheus/common from 0.70.0 to 0.70.1

Release notes

Sourced from github.com/prometheus/common's releases.

v0.70.1

What's Changed

Full Changelog: prometheus/common@v0.70.0...v0.70.1

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

Commits
  • b63d8c0 build(deps): bump golang.org/x/net (#947)
  • 4109c3e build(deps): bump the codeql group with 4 updates (#948)
  • 5270b62 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#949)
  • 1167ca3 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#950)
  • d28d382 Update common Prometheus files (#946)
  • f915876 Merge pull request #924 from roidelapluie/roidelapluie/redirect-header-comment
  • dfbebd0 Merge pull request #945 from roidelapluie/roidelapluie/changelog-0.70.0
  • c8a0019 Update CHANGELOG for v0.70.0
  • See full diff in compare view

@dependabot
dependabot Bot requested a review from itcmsgr as a code owner August 13, 2026 20:35
@dependabot @github

dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, go, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
gomod/github.com/mdlayher/netlink 1.11.2 🟢 5.1
Details
CheckScoreReason
Maintained🟢 1020 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 6Found 9/14 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/mdlayher/socket 0.6.0 🟢 7
Details
CheckScoreReason
Code-Review🟢 7Found 7/9 approved changesets -- score normalized to 7
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/prometheus/client_golang 1.24.1 🟢 7.6
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
Code-Review🟢 9Found 13/14 approved changesets -- score normalized to 9
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool detected but not run on all commits
License🟢 10license file detected
Vulnerabilities🟢 73 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 36 contributing companies or organizations
gomod/github.com/prometheus/common 0.70.1 🟢 9.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1023 out of 23 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 28 contributing companies or organizations
gomod/golang.org/x/net 0.57.0 UnknownUnknown

Scanned Files

  • go.mod

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-ddcd6abe82 branch 6 times, most recently from 6cf7d1f to f16c6ec Compare August 19, 2026 20:54
@dependabot
deps(go): bump the go-minor-patch group across 1 directory with 3 upd…
e725e24 
…ates

Bumps the go-minor-patch group with 2 updates in the / directory: [github.com/mdlayher/netlink](https://github.com/mdlayher/netlink) and [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang).


Updates `github.com/mdlayher/netlink` from 1.9.0 to 1.11.2
- [Release notes](https://github.com/mdlayher/netlink/releases)
- [Changelog](https://github.com/mdlayher/netlink/blob/main/CHANGELOG.md)
- [Commits](mdlayher/netlink@v1.9.0...v1.11.2)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.1)

Updates `github.com/prometheus/common` from 0.70.0 to 0.70.1
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)
- [Commits](prometheus/common@v0.70.0...v0.70.1)

---
updated-dependencies:
- dependency-name: github.com/mdlayher/netlink
  dependency-version: 1.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/prometheus/common
  dependency-version: 0.70.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-ddcd6abe82 branch from f16c6ec to e725e24 Compare August 20, 2026 20:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@itcmsgr itcmsgr Awaiting requested review from itcmsgr itcmsgr is a code owner

Assignees

@itcmsgr itcmsgr

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@itcmsgr