Skip to content

Bump the go_modules group across 2 directories with 10 updates#217

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/go_modules-378b3068e6
Open

Bump the go_modules group across 2 directories with 10 updates#217
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/go_modules-378b3068e6

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 18, 2026

Bumps the go_modules group with 6 updates in the / directory:

Package From To
github.com/golang/glog 0.0.0-20160126235308-23def4e6c14b 1.2.4
github.com/prometheus/client_golang 1.11.0 1.11.1
golang.org/x/crypto 0.0.0-20220507011949-2cf3adece122 0.45.0
golang.org/x/oauth2 0.0.0-20210819190943-2bc19b11175f 0.27.0
google.golang.org/grpc 1.45.0 1.79.3
github.com/cyphar/filepath-securejoin 0.2.3 0.2.4

Bumps the go_modules group with 2 updates in the /examples/are-you-alive directory: github.com/prometheus/client_golang and github.com/sirupsen/logrus.

Updates github.com/golang/glog from 0.0.0-20160126235308-23def4e6c14b to 1.2.4

Release notes

Sourced from github.com/golang/glog's releases.

v1.2.4

What's Changed

  • Fail if log file already exists by @​chressie in golang/glog#74:
    • glog: Don't try to create/rotate a given syncBuffer twice in the same second
    • glog: introduce createInDir function as in internal version
    • glog: have createInDir fail if the file already exists

Full Changelog: golang/glog@v1.2.3...v1.2.4

v1.2.3

What's Changed

Full Changelog: golang/glog@v1.2.2...v1.2.3

v1.2.2

What's Changed

Full Changelog: golang/glog@v1.2.1...v1.2.2

v1.2.1

What's Changed

Full Changelog: golang/glog@v1.2.0...v1.2.1

v1.2.0

What's Changed

Full Changelog: golang/glog@v1.1.2...v1.2.0

v1.1.2

Bugfix release.

What's Changed

Full Changelog: golang/glog@v1.1.1...v1.1.2

v1.1.1

Bugfixes since the larger v1.1.0, which have been addressed.

v1.1.0

... (truncated)

Commits

Updates github.com/prometheus/client_golang from 1.11.0 to 1.11.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

1.11.1 / 2022-02-15

What's Changed

Full Changelog: prometheus/client_golang@v1.11.0...v1.11.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

Unreleased

  • [FEATURE] HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

Unreleased exp module

  • [BUGFIX] exp/api: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917.

1.23.2 / 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

1.23.1 / 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

1.23.0 / 2025-07-30

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766
  • [FEATURE] Add exemplars for native histograms #1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #1729

1.22.0 / 2025-04-07

⚠️ This release contains potential breaking change if you use experimental zstd support introduce in #1496 ⚠️

Experimental support for zstd on scrape was added, controlled by the request Accept-Encoding header. It was enabled by default since version 1.20, but now you need to add a blank import to enable it. The decision to make it opt-in by default was originally made because the Go standard library was expected to have default zstd support added soon, golang/go#62513 however, the work took longer than anticipated and it will be postponed to upcoming major Go versions.

e.g.:

import (
  _ "github.com/prometheus/client_golang/prometheus/promhttp/zstd"
)
  • [FEATURE] prometheus: Add new CollectorFunc utility #1724
  • [CHANGE] Minimum required Go version is now 1.22 (we also test client_golang against latest go version - 1.24) #1738
  • [FEATURE] api: WithLookbackDelta and WithStats options have been added to API client. #1743
  • [CHANGE] ⚠️ promhttp: Isolate zstd support and klauspost/compress library use to promhttp/zstd package. #1765

1.21.1 / 2025-03-04

... (truncated)

Commits

Updates golang.org/x/crypto from 0.0.0-20220507011949-2cf3adece122 to 0.45.0

Commits

Updates golang.org/x/net from 0.7.0 to 0.47.0

Commits
  • 9a29643 go.mod: update golang.org/x dependencies
  • 07cefd8 context: deprecate
  • 5ac9dac publicsuffix: don't treat ip addresses as domain names
  • d1f64cc quic: use testing/synctest
  • fff0469 http2: document that RFC 7540 prioritization does not work with small payloads
  • f35e3a4 http2: fix weight overflow in RFC 7540 write scheduler
  • 89adc90 http2: fix typo referring to RFC 9218 as RFC 9128 instead
  • 8d76a2c quic: don't defer MAX_STREAMS frames indefinitely
  • 027f8b7 quic: fix expected ACK Delay in client's ACK after HANDSHAKE_DONE
  • dec9fe7 dns/dnsmessage: update SVCB packing to prohibit name compression
  • Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.0.0-20210819190943-2bc19b11175f to 0.27.0

Commits

Updates google.golang.org/grpc from 1.45.0 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

Updates google.golang.org/protobuf from 1.28.0 to 1.36.10

Updates github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.2.4

This release fixes a potential security issue in filepath-securejoin when used on Windows (GHSA-6xv5-86q9-7xr8, which could be used to generate paths outside of the provided rootfs in certain cases), as well as improving the overall behaviour of filepath-securejoin when dealing with Windows paths that contain volume names. Thanks to Paulo Gomes for discovering and fixing these issues.

In addition, we've switched (at long last) to GitHub Actions and have continuous integration testing on Linux, MacOS, and Windows.

Thanks to the following contributors for making this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.2.4] - 2023-09-06

Security

  • This release fixes a potential security issue in filepath-securejoin when used on Windows (GHSA-6xv5-86q9-7xr8, which could be used to generate paths outside of the provided rootfs in certain cases), as well as improving the overall behaviour of filepath-securejoin when dealing with Windows paths that contain volume names. Thanks to Paulo Gomes for discovering and fixing these issues.

Fixed

  • Switch to GitHub Actions for CI so we can test on Windows as well as Linux and MacOS.
Commits

Updates gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.1

Updates github.com/prometheus/client_golang from 1.6.0 to 1.11.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

1.11.1 / 2022-02-15

What's Changed

Full Changelog: prometheus/client_golang@v1.11.0...v1.11.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

Unreleased

  • [FEATURE] HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

Unreleased exp module

  • [BUGFIX] exp/api: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917.

1.23.2 / 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

1.23.1 / 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

1.23.0 / 2025-07-30

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766
  • [FEATURE] Add exemplars for native histograms #1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #1729

1.22.0 / 2025-04-07

⚠️ This release contains potential breaking change if you use experimental zstd support introduce in #1496 ⚠️

Experimental support for zstd on scrape was added, controlled by the request Accept-Encoding header. It was enabled by default since version 1.20, but now you need to add a blank import to enable it. The decision to make it opt-in by default was originally made because the Go standard library was expected to have default zstd support added soon, golang/go#62513 however, the work took longer than anticipated and it will be postponed to upcoming major Go versions.

e.g.:

import (
  _ "github.com/prometheus/client_golang/prometheus/promhttp/zstd"
)
  • [FEATURE] prometheus: Add new CollectorFunc utility #1724
  • [CHANGE] Minimum required Go version is now 1.22 (we also test client_golang against latest go version - 1.24) #1738
  • [FEATURE] api: WithLookbackDelta and WithStats options have been added to API client. #1743
  • [CHANGE] ⚠️ promhttp: Isolate zstd support and klauspost/compress library use to promhttp/zstd package. #1765

1.21.1 / 2025-03-04

... (truncated)

Commits

Updates github.com/sirupsen/logrus from 1.6.0 to 1.8.3

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.8.3

What's Changed

New Contributors

Full Changelog: sirupsen/logrus@v1.8.2...v1.8.3

v1.8.2

What's Changed

New Contributors

Full Changelog: sirupsen/logrus@v1.8.1...v1.8.2

v1.8.1

No release notes provided.

v1.8.0

Correct versioning number replacing v1.7.1

v1.7.1

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.8.3

Fixes:

  • Fix potential denial of service in logrus.Writer() when logging >64KB single-line payloads without newlines (#1376)

1.8.2

Features:

  • Add support for the logger private buffer pool (#1253)

Fixes:

  • Fix race condition for SetFormatter and SetReportCaller
  • Fix data race in hooks test package

1.8.1

Code quality:

  • move magefile in its own subdir/submodule to remove magefile dependency on logrus consumer
  • improve timestamp format documentation

Fixes:

  • fix race condition on logger hooks

1.8.0

Correct versioning number replacing v1.7.1.

1.7.1

Beware this release has introduced a new public API and its semver is therefore incorrect.

Code quality:

  • use go 1.15 in travis
  • use magefile as task runner

Fixes:

  • small fixes about new go 1.13 error formatting system
  • Fix for long time race condiction with mutating data hooks

Features:

  • build support for zos

1.7.0

Fixes:

  • the dependency toward a windows terminal library has been removed

Features:

  • a new buffer pool management API has been added
  • a set of <LogLevel>Fn() functions have been added
Commits
  • b30aa27 Merge pull request #1339 from xieyuschen/patch-1
  • 6acd903 Merge pull request #1376 from ozfive/master
  • 105e63f Merge pull request #1 from ashmckenzie/ashmckenzie/fix-writer-scanner
  • c052ba6 Scan text in 64KB chunks
  • e59b167 Merge pull request #1372 from tommyblue/syslog_different_loglevels
  • 766cfec This commit fixes a potential denial of service vulnerability in logrus.Write...
  • 70234da Add instructions to use different log levels for local and syslog
  • a448f82 Merge pull request #1362 from FrancoisWagner/fix-data-race-in-hooks-test-pkg
  • ff07b25 Fix data race in hooks.test package
  • f8bf765 Merge pull request #1343 from sirupsen/dbd-upd-dep
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the go_modules group across 2 directories with 10 updates
22f9a28 
Bumps the go_modules group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/golang/glog](https://github.com/golang/glog) | `0.0.0-20160126235308-23def4e6c14b` | `1.2.4` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.11.0` | `1.11.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.0.0-20220507011949-2cf3adece122` | `0.45.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.0.0-20210819190943-2bc19b11175f` | `0.27.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.45.0` | `1.79.3` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.2.3` | `0.2.4` |

Bumps the go_modules group with 2 updates in the /examples/are-you-alive directory: [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) and [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus).


Updates `github.com/golang/glog` from 0.0.0-20160126235308-23def4e6c14b to 1.2.4
- [Release notes](https://github.com/golang/glog/releases)
- [Commits](https://github.com/golang/glog/commits/v1.2.4)

Updates `github.com/prometheus/client_golang` from 1.11.0 to 1.11.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.11.0...v1.11.1)

Updates `golang.org/x/crypto` from 0.0.0-20220507011949-2cf3adece122 to 0.45.0
- [Commits](https://github.com/golang/crypto/commits/v0.45.0)

Updates `golang.org/x/net` from 0.7.0 to 0.47.0
- [Commits](golang/net@v0.7.0...v0.47.0)

Updates `golang.org/x/oauth2` from 0.0.0-20210819190943-2bc19b11175f to 0.27.0
- [Commits](https://github.com/golang/oauth2/commits/v0.27.0)

Updates `google.golang.org/grpc` from 1.45.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.45.0...v1.79.3)

Updates `google.golang.org/protobuf` from 1.28.0 to 1.36.10

Updates `github.com/cyphar/filepath-securejoin` from 0.2.3 to 0.2.4
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.2.3...v0.2.4)

Updates `gopkg.in/yaml.v3` from 3.0.0-20210107192922-496545a6307b to 3.0.1

Updates `github.com/prometheus/client_golang` from 1.6.0 to 1.11.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.11.0...v1.11.1)

Updates `github.com/sirupsen/logrus` from 1.6.0 to 1.8.3
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.6.0...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/golang/glog
  dependency-version: 1.2.4
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.11.1
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.47.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.27.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.10
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.2.4
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: gopkg.in/yaml.v3
  dependency-version: 3.0.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.11.1
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.8.3
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants