Repository navigation
[gomod] Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 - #51
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.1 to 1.25.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.1...v1.25.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
![ecosquad-autoreview[bot]](https://avatars.githubusercontent.com/in/5135070?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review: bump prometheus/client_golang 1.24.1 → 1.25.0
Verdict: approve — safe dependency bump, no code changes required.
What was checked
- Go version requirement: v1.25.0 raises the minimum Go version to 1.26.
go.mod:3is alreadygo 1.26.0, and both CI (.github/workflows/ci.yaml:6,GO_VERSION: '1.26') and theDockerfile:4(ARG GO_VERSION=1.26) already build with Go 1.26. No action needed. - Breaking API changes: the v1.25.0 breaking changes are confined to
api/prometheus/v1(Query/QueryRange/Series/LabelNames/LabelValues signatures, TSDBBlocks types). The repo only importsgithub.com/prometheus/client_golang/prometheusand.../prometheus/promhttp(ininternal/app/app.go:12-13,internal/notification/metrics.go:7,tests/notifications_metrics_test.go:10-11). No usage of theapipackage, so the breaking changes do not apply. - promhttp usage:
internal/app/app.go:103usespromhttp.HandlerFor(reg, promhttp.HandlerOpts{})with default options, which is fully compatible. Note the upstream enhancement (v1.25.0): negotiated metrics responses now include aVaryheader. Harmless, but if any scrape/monitoring integration does exact-header assertions on/metricsresponses, be aware. - go.mod/go.sum consistency: indirect bumps (
klauspost/compress v1.19.2 → v1.20.1,client_model v0.6.2 → v0.6.3,prometheus/common v0.70.1 → v0.72.0,procfs v0.21.1 → v0.22.0) are consistent with client_golang 1.25.0's own requirements, and the newclient_golang v1.25.0hash entries are present ingo.sum.
Findings
No critical or warning-level issues found.
- Suggestion: I could not verify the full
go.sumdiff (file truncated in the PR payload) — confirm locally withgo mod verify/go mod tidythat no stale entries remain. - Note: CI has not fully run on this head commit —
GitGuardian Security Checksis still in progress, and CodeQL reported it cannot determine PR-introduced alerts (two configurations onmainmissing). Worth re-triggering CI before merging so the build, tests, and security scan actually gate this change. I could not run the build or tests in this environment; the review is static only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/prometheus/client_golang from 1.24.1 to 1.25.0.
Release notes
Sourced from github.com/prometheus/client_golang's releases.
... (truncated)
Changelog
Sourced from github.com/prometheus/client_golang's changelog.
Commits
0d88875Cut v1.25.0 (#2164)e9946eeCut v1.25.0-rc.0 (#2154)de866d6Merge pull request #2152 from prometheus/dependabot/go_modules/api/prometheus...a37302fprometheus: fix modernize lint findings (#2151)a3fa380build(deps): bump google.golang.org/grpc9da3fccfix: updates for tsdb blocks handling (#1928)0ecb5c2api: match complete URL placeholders (#2136)2ad001aexp/api/remote: reset buffer before generic marshal (#2139)0db8d43promhttp: vary negotiated metrics responses (#2142)b1f9c7aMerge pull request #2144 from prometheus/dependabot/go_modules/exp/github.com...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)