Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.33.0 to
0.34.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1ac721dff8"><code>1ac721d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="fb1fac8b36"><code>fb1fac8</code></a>
all: upgrade go directive to at least 1.25.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.33.0...v0.34.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
Fixes:
https://github.com/modelcontextprotocol/registry/actions/runs/22784360696/job/66097670402
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
Fixes two CI issues:
### 1. Deploy workflows broken since PR #1034 (all staging deploys
failing)
The deploy-staging and deploy-production workflows install Go using the
**root** `go.mod`, but then build Pulumi infrastructure code from the
`deploy/` directory which has its own `go.mod`.
This started failing when PR #1034 (`build(deps): bump
github.com/pulumi/pulumi/sdk/v3 from 3.220.0 to 3.225.1 in /deploy`)
bumped `deploy/go.mod` from Go 1.24.11 to **Go 1.25.6** — a version
newer than the root module's Go 1.24.13. Every staging deploy since that
merge (Mar 6) has failed with:
```
go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local)
```
The last successful deploy was commit cb4807a on Mar 1, before the Go
version bump.
**Fix**: point `go-version-file` in both deploy workflows at
`deploy/go.mod` instead of the root `go.mod`.
### 2. `govulncheck` failing due to Go stdlib vulnerabilities
Five new Go stdlib vulnerabilities (GO-2026-4599 through GO-2026-4603)
were published on Mar 5-6 affecting Go 1.24.13, fixed in Go 1.25.8.
These cause `govulncheck` in the CI pipeline to fail.
**Fix**: bump root `go.mod` from Go 1.24.13 to Go 1.25.8.
## Test plan
- [ ] CI pipeline passes (govulncheck, build, lint, tests)
- [ ] Verify the deploy-staging workflow passes on the next push to main
after merge
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Bumps [github.com/docker/cli](https://github.com/docker/cli) from
29.0.3+incompatible to 29.2.0+incompatible.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0b9d1985db"><code>0b9d198</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6764">#6764</a> from
vvoland/update-docker</li>
<li><a
href="9c9ec73588"><code>9c9ec73</code></a>
vendor: github.com/moby/moby/client v0.2.2</li>
<li><a
href="bab3e81e1d"><code>bab3e81</code></a>
vendor: github.com/moby/moby/api v1.53.0</li>
<li><a
href="2e64fc162a"><code>2e64fc1</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6367">#6367</a> from
thaJeztah/template_slicejoin</li>
<li><a
href="1f2ba2ac9d"><code>1f2ba2a</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6760">#6760</a> from
thaJeztah/container_create_fix_error</li>
<li><a
href="e34a3422cc"><code>e34a342</code></a>
templates: make "join" work with non-string slices and map
values</li>
<li><a
href="a86356d42f"><code>a86356d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6763">#6763</a> from
thaJeztah/bump_mapstructure</li>
<li><a
href="771660a17e"><code>771660a</code></a>
vendor: github.com/go-viper/mapstructure/v2 v2.5.0</li>
<li><a
href="9cff36b35a"><code>9cff36b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6762">#6762</a> from
thaJeztah/bump_x_deps</li>
<li><a
href="08ed2bc6e8"><code>08ed2bc</code></a>
cli/command/container: make injecting config.json failures a
warning</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/cli/compare/v29.0.3...v29.2.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.32.0 to
0.33.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="27761a2ad8"><code>27761a2</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.32.0...v0.33.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
The following PR fixes the failing validation checks on our CI.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go)
from 1.24.0 to 1.25.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/releases">cloud.google.com/go/kms's
releases</a>.</em></p>
<blockquote>
<h2>maps 1.25.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/maps/v1.24.0...maps/v1.25.0">1.25.0</a>
(2025-10-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>Add moved_place and moved_place_id to Place (PiperOrigin-RevId:
821809971) (<a
href="f46efe45">f46efe45</a>)</p>
</li>
<li>
<p>add experimental Load Costs feature (PiperOrigin-RevId: 819788002)
(<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
<li>
<p>add OptimizeToursLongRunning method (PiperOrigin-RevId: 819788002)
(<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
<li>
<p>add experimental U-turn Avoidance feature (PiperOrigin-RevId:
819788002) (<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
<li>
<p>add OptimizeToursUri method (PiperOrigin-RevId: 819788002) (<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>
<p>Change comments in some fields in Places API (PiperOrigin-RevId:
821809971) (<a
href="f46efe45">f46efe45</a>)</p>
</li>
<li>
<p>A comment for field <code>place_id</code> in message
<code>.google.maps.routeoptimization.v1.Waypoint</code> is changed
(PiperOrigin-RevId: 819788002) (<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
<li>
<p>A comment for field <code>precedence_rules</code> in message
<code>.google.maps.routeoptimization.v1.ShipmentModel</code> is changed
(PiperOrigin-RevId: 819788002) (<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
<li>
<p>A comment for field <code>duration_distance_matrices</code> in
message <code>.google.maps.routeoptimization.v1.ShipmentModel</code> is
changed (PiperOrigin-RevId: 819788002) (<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
<li>
<p>A comment for enum <code>TravelMode</code> is changed
(PiperOrigin-RevId: 819788002) (<a
href="0241a9ca">0241a9ca</a>)</p>
</li>
</ul>
<h2>cloudbuild 1.25.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/cloudbuild/v1.24.0...cloudbuild/v1.25.0">1.25.0</a>
(2025-12-18)</h2>
<h2>kms 1.25.0</h2>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.24.0...kms/v1.25.0">1.25.0</a>
(2026-01-22)</h2>
<h3>Features</h3>
<ul>
<li>add the SingleTenantHsm functionality including the management API
and resource types (PiperOrigin-RevId: 858582271) (<a
href="8ddeca50">8ddeca50</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>
<p>A comment for field <code>crypto_key_backend</code> in message
<code>.google.cloud.kms.v1.CryptoKey</code> is expanded to include
SingleTenantHsmInstances (PiperOrigin-RevId: 858582271) (<a
href="8ddeca50">8ddeca50</a>)</p>
</li>
<li>
<p>A comment for enum value
<code>MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION</code> in enum
<code>AccessReason</code> is changed (PiperOrigin-RevId: 858582271) (<a
href="8ddeca50">8ddeca50</a>)</p>
</li>
<li>
<p>A comment for enum value
<code>MODIFIED_CUSTOMER_INITIATED_ACCESS</code> in enum
<code>AccessReason</code> is changed (PiperOrigin-RevId: 858582271) (<a
href="8ddeca50">8ddeca50</a>)</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md">cloud.google.com/go/kms's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.24.0...documentai/v1.25.0">1.25.0</a>
(2024-02-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Expose model_type in v1 processor, so
that user can see the model_type after get or list processor version (<a
href="2fcf55ccb2">2fcf55c</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="740e59c6a0"><code>740e59c</code></a>
chore: librarian release pull request: 20250912T134835Z (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12870">#12870</a>)</li>
<li><a
href="d8078f0b64"><code>d8078f0</code></a>
chore: release main (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12869">#12869</a>)</li>
<li><a
href="2d9e87b206"><code>2d9e87b</code></a>
chore: librarian generate pull request: 20250912T133008Z (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12868">#12868</a>)</li>
<li><a
href="1501b23474"><code>1501b23</code></a>
feat(gkehub): add <code>k8s_git_version</code> field (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12863">#12863</a>)</li>
<li><a
href="1f11996023"><code>1f11996</code></a>
chore(main): release spanner 1.85.1 (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12796">#12796</a>)</li>
<li><a
href="baab714b87"><code>baab714</code></a>
fix(spanner): disable afe_connectivity_error_count metric (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12866">#12866</a>)</li>
<li><a
href="a76dedc161"><code>a76dedc</code></a>
chore: release main (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12861">#12861</a>)</li>
<li><a
href="5a65fa044f"><code>5a65fa0</code></a>
chore: remove dlp from release-please and bump postprocessor (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12862">#12862</a>)</li>
<li><a
href="d73f9123be"><code>d73f912</code></a>
chore(apihub): fix Go proto/grpc build target (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12814">#12814</a>)</li>
<li><a
href="45a7d9b4b9"><code>45a7d9b</code></a>
fix(internal/postprocessor): add dlp to skip-module-scan-paths (<a
href="https://redirect.github.com/googleapis/google-cloud-go/issues/12857">#12857</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-cloud-go/compare/dlp/v1.24.0...dlp/v1.25.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.31.0 to
0.32.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4c04067938"><code>4c04067</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.31.0...v0.32.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.6
to 5.8.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.8.0 (December 26, 2025)</h1>
<ul>
<li>Require Go 1.24+</li>
<li>Remove golang.org/x/crypto dependency</li>
<li>Add OptionShouldPing to control ResetSession ping behavior
(ilyam8)</li>
<li>Fix: Avoid overflow when MaxConns is set to MaxInt32</li>
<li>Fix: Close batch pipeline after a query error (Anthonin
Bonnefoy)</li>
<li>Faster shutdown of pgxpool.Pool background goroutines (Blake
Gentry)</li>
<li>Add pgxpool ping timeout (Amirsalar Safaei)</li>
<li>Fix: Rows.FieldDescriptions for empty query</li>
<li>Scan unknown types into *any as string or []byte based on format
code</li>
<li>Optimize pgtype.Numeric (Philip Dubé)</li>
<li>Add AfterNetConnect hook to pgconn.Config</li>
<li>Fix: Handle for preparing statements that fail during the Describe
phase</li>
<li>Fix overflow in numeric scanning (Ilia Demianenko)</li>
<li>Fix: json/jsonb sql.Scanner source type is []byte</li>
<li>Migrate from math/rand to math/rand/v2 (Mathias Bogaert)</li>
<li>Optimize internal iobufpool (Mathias Bogaert)</li>
<li>Optimize stmtcache invalidation (Mathias Bogaert)</li>
<li>Fix: missing error case in interval parsing (Maxime Soulé)</li>
<li>Fix: invalidate statement/description cache in Exec (James
Hartig)</li>
<li>ColumnTypeLength method return the type length for varbit type
(DengChan)</li>
<li>Array and Composite codecs handle typed nils</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe8740aa06"><code>fe8740a</code></a>
Release v5.8.0</li>
<li><a
href="e5dde5a511"><code>e5dde5a</code></a>
Skip test on CockroachDB</li>
<li><a
href="06f2d82cac"><code>06f2d82</code></a>
Remove trailing space</li>
<li><a
href="2cf78dd906"><code>2cf78dd</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2448">#2448</a> from
DengChan/column_type_lenth_varbit</li>
<li><a
href="2d1c4ef1aa"><code>2d1c4ef</code></a>
Skip tests on CockroachDB</li>
<li><a
href="1a5fa7fc7f"><code>1a5fa7f</code></a>
Array and Composite codecs handle typed nils</li>
<li><a
href="5736d0976d"><code>5736d09</code></a>
ColumnTypeLength method return the type length for varbit type.</li>
<li><a
href="4c1308c14b"><code>4c1308c</code></a>
Revert "stdlib matches native pgx scanning support"</li>
<li><a
href="14ce2b7a62"><code>14ce2b7</code></a>
Skip test on CockroachDB</li>
<li><a
href="65b2724ea5"><code>65b2724</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2443">#2443</a> from
jameshartig/x-invalidate-cache-in-exec</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.7.6...v5.8.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps
[go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go)
from 1.38.0 to 1.39.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel's
releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h2>Overview</h2>
<h3>Added</h3>
<ul>
<li>Greatly reduce the cost of recording metrics in
<code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map
keys. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li>Add <code>WithInstrumentationAttributeSet</code> option to
<code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/trace</code> packages. This provides a
concurrent-safe and performant alternative to
<code>WithInstrumentationAttributes</code> by accepting a
pre-constructed <code>attribute.Set</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li>
<li>Add experimental observability for the Prometheus exporter in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>. Check the
<code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code>
package documentation for more information. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li>
<li>Add temporality selector functions
<code>DeltaTemporalitySelector</code>,
<code>CumulativeTemporalitySelector</code>,
<code>LowMemoryTemporalitySelector</code> to
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li>
<li>Add experimental observability metrics for simple log processor in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7486">#7486</a>)</li>
<li>Add experimental observability metrics for simple span processor in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7374">#7374</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7512">#7512</a>)</li>
<li>Add experimental observability metrics for manual reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7524">#7524</a>)</li>
<li>Add experimental observability metrics for periodic reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7571">#7571</a>)</li>
<li>Support <code>OTEL_EXPORTER_OTLP_LOGS_INSECURE</code> and
<code>OTEL_EXPORTER_OTLP_INSECURE</code> environmental variables in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7608">#7608</a>)</li>
<li>Add <code>Enabled</code> method to the <code>Processor</code>
interface in <code>go.opentelemetry.io/otel/sdk/log</code>. All
<code>Processor</code> implementations now include an
<code>Enabled</code> method. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.38.0</code> package.
The package contains semantic conventions from the <code>v1.38.0</code>
version of the OpenTelemetry Semantic Conventions. See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.38.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.37.0.</code>(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7648">#7648</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>Distinct</code> in
<code>go.opentelemetry.io/otel/attribute</code> is no longer guaranteed
to uniquely identify an attribute set. Collisions between
<code>Distinct</code> values for different Sets are possible with
extremely high cardinality (billions of series per instrument), but are
highly unlikely. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/trace</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>TracerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/meter</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>MeterOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/log</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>LoggerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li>Rename the <code>OTEL_GO_X_SELF_OBSERVABILITY</code> environment
variable to <code>OTEL_GO_X_OBSERVABILITY</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/exporters/stdout/stdouttrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7302">#7302</a>)</li>
<li>Improve performance of histogram <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/metric</code> when min and max are
disabled using <code>NoMinMax</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7306">#7306</a>)</li>
<li>Improve error handling for dropped data during translation by using
<code>prometheus.NewInvalidMetric</code> in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>. ⚠️
<strong>Breaking Change:</strong> Previously, these cases were only
logged and scrapes succeeded. Now, when translation would drop data
(e.g., invalid label/value), the exporter emits a
<code>NewInvalidMetric</code>, and Prometheus scrapes <strong>fail with
HTTP 500</strong> by default. To preserve the prior behavior (scrapes
succeed while errors are logged), configure your Prometheus HTTP handler
with: <code>promhttp.HandlerOpts{ ErrorHandling:
promhttp.ContinueOnError }</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7363">#7363</a>)</li>
<li>Replace fnv hash with xxhash in
<code>go.opentelemetry.io/otel/attribute</code> for better performance.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7371">#7371</a>)</li>
<li>The default <code>TranslationStrategy</code> in
<code>go.opentelemetry.io/exporters/prometheus</code> is changed from
<code>otlptranslator.NoUTF8EscapingWithSuffixes</code> to
<code>otlptranslator.UnderscoreEscapingWithSuffixes</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7421">#7421</a>)</li>
<li>Improve performance of concurrent measurements in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7427">#7427</a>)</li>
<li>Include W3C TraceFlags (bits 0–7) in the OTLP
<code>Span.Flags</code> field in
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp</code>
and
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7438">#7438</a>)</li>
<li>The <code>ErrorType</code> function in
<code>go.opentelemetry.io/otel/semconv/v1.37.0</code> now handles custom
error types.
If an error implements an <code>ErrorType() string</code> method, the
return value of that method will be used as the error type. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7442">#7442</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix <code>WithInstrumentationAttributes</code> options in
<code>go.opentelemetry.io/otel/trace</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/log</code> to properly merge attributes
when passed multiple times instead of replacing them. Attributes with
duplicate keys will use the last value passed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7300">#7300</a>)</li>
<li>The equality of <code>attribute.Set</code> when using the
<code>Equal</code> method is not affected by the user overriding the
empty set pointed to by <code>attribute.EmptySet</code> in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7357">#7357</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Fix <code>AddAttributes</code>, <code>SetAttributes</code>,
<code>SetBody</code> on <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to not mutate input. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7403">#7403</a>)</li>
<li>Do not double record measurements of <code>RecordSet</code> methods
in <code>go.opentelemetry.io/otel/semconv/v1.37.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7655">#7655</a>)</li>
<li>Do not double record measurements of <code>RecordSet</code> methods
in <code>go.opentelemetry.io/otel/semconv/v1.36.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7656">#7656</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05</h2>
<h3>Added</h3>
<ul>
<li>Greatly reduce the cost of recording metrics in
<code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map
keys. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li>Add <code>WithInstrumentationAttributeSet</code> option to
<code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/trace</code> packages.
This provides a concurrent-safe and performant alternative to
<code>WithInstrumentationAttributes</code> by accepting a
pre-constructed <code>attribute.Set</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li>
<li>Add experimental observability for the Prometheus exporter in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>.
Check the
<code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code>
package documentation for more information. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li>
<li>Add temporality selector functions
<code>DeltaTemporalitySelector</code>,
<code>CumulativeTemporalitySelector</code>,
<code>LowMemoryTemporalitySelector</code> to
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li>
<li>Add experimental observability metrics for simple log processor in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7486">#7486</a>)</li>
<li>Add experimental observability metrics for simple span processor in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7374">#7374</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7512">#7512</a>)</li>
<li>Add experimental observability metrics for manual reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7524">#7524</a>)</li>
<li>Add experimental observability metrics for periodic reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7571">#7571</a>)</li>
<li>Support <code>OTEL_EXPORTER_OTLP_LOGS_INSECURE</code> and
<code>OTEL_EXPORTER_OTLP_INSECURE</code> environmental variables in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7608">#7608</a>)</li>
<li>Add <code>Enabled</code> method to the <code>Processor</code>
interface in <code>go.opentelemetry.io/otel/sdk/log</code>.
All <code>Processor</code> implementations now include an
<code>Enabled</code> method. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.38.0</code> package.
The package contains semantic conventions from the <code>v1.38.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.38.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.37.0.</code>(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7648">#7648</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>Distinct</code> in
<code>go.opentelemetry.io/otel/attribute</code> is no longer guaranteed
to uniquely identify an attribute set.
Collisions between <code>Distinct</code> values for different Sets are
possible with extremely high cardinality (billions of series per
instrument), but are highly unlikely. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/trace</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>TracerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/meter</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>MeterOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/log</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>LoggerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li>Rename the <code>OTEL_GO_X_SELF_OBSERVABILITY</code> environment
variable to <code>OTEL_GO_X_OBSERVABILITY</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/exporters/stdout/stdouttrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7302">#7302</a>)</li>
<li>Improve performance of histogram <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/metric</code> when min and max are
disabled using <code>NoMinMax</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7306">#7306</a>)</li>
<li>Improve error handling for dropped data during translation by using
<code>prometheus.NewInvalidMetric</code> in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>.
⚠️ <strong>Breaking Change:</strong> Previously, these cases were only
logged and scrapes succeeded.
Now, when translation would drop data (e.g., invalid label/value), the
exporter emits a <code>NewInvalidMetric</code>, and Prometheus scrapes
<strong>fail with HTTP 500</strong> by default.
To preserve the prior behavior (scrapes succeed while errors are
logged), configure your Prometheus HTTP handler with:
<code>promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError
}</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7363">#7363</a>)</li>
<li>Replace fnv hash with xxhash in
<code>go.opentelemetry.io/otel/attribute</code> for better performance.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7371">#7371</a>)</li>
<li>The default <code>TranslationStrategy</code> in
<code>go.opentelemetry.io/exporters/prometheus</code> is changed from
<code>otlptranslator.NoUTF8EscapingWithSuffixes</code> to
<code>otlptranslator.UnderscoreEscapingWithSuffixes</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7421">#7421</a>)</li>
<li>Improve performance of concurrent measurements in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7427">#7427</a>)</li>
<li>Include W3C TraceFlags (bits 0–7) in the OTLP
<code>Span.Flags</code> field in
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp</code>
and
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7438">#7438</a>)</li>
<li>The <code>ErrorType</code> function in
<code>go.opentelemetry.io/otel/semconv/v1.37.0</code> now handles custom
error types.
If an error implements an <code>ErrorType() string</code> method, the
return value of that method will be used as the error type. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7442">#7442</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix <code>WithInstrumentationAttributes</code> options in
<code>go.opentelemetry.io/otel/trace</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/log</code> to properly merge attributes
when passed multiple times instead of replacing them.
Attributes with duplicate keys will use the last value passed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7300">#7300</a>)</li>
<li>The equality of <code>attribute.Set</code> when using the
<code>Equal</code> method is not affected by the user overriding the
empty set pointed to by <code>attribute.EmptySet</code> in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7357">#7357</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6ce14298b9"><code>6ce1429</code></a>
Release v1.39.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7676">#7676</a>)</li>
<li><a
href="12e421a706"><code>12e421a</code></a>
sdk/log: move Enabled method from FilterProcessor to Processor (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li>
<li><a
href="5982f16d24"><code>5982f16</code></a>
fix(deps): update module golang.org/x/sys to v0.39.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7684">#7684</a>)</li>
<li><a
href="928837830d"><code>9288378</code></a>
chore(deps): update module golang.org/x/sync to v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7683">#7683</a>)</li>
<li><a
href="ee3dfef45d"><code>ee3dfef</code></a>
chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7682">#7682</a>)</li>
<li><a
href="9345d1f64d"><code>9345d1f</code></a>
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7680">#7680</a>)</li>
<li><a
href="d03b03395d"><code>d03b033</code></a>
Check context prior to delaying retry in OTLP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7678">#7678</a>)</li>
<li><a
href="61765e78a6"><code>61765e7</code></a>
Fix flaky <code>TestClientInstrumentation</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7677">#7677</a>)</li>
<li><a
href="a54721cc80"><code>a54721c</code></a>
chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7679">#7679</a>)</li>
<li><a
href="746d0860d7"><code>746d086</code></a>
chore(deps): update github/codeql-action action to v4.31.7 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7675">#7675</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.38.0...v1.39.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.30.0 to
0.31.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d271cf332f"><code>d271cf3</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="269c237cf3"><code>269c237</code></a>
sumdb/note: delete chop</li>
<li><a
href="3f03020ad5"><code>3f03020</code></a>
x/mod: apply go fix and go vet</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Prepared by Claude Code, reviewd by me.
## Summary
- Upgrade Go from 1.24.9 to 1.24.11 in the main `go.mod` to fix
govulncheck CI failure
- Upgrade Go from 1.24.7 to 1.24.11 in `deploy/go.mod` for the same
vulnerability fix
## Details
This PR addresses the failing `govulncheck` check in CI caused by
vulnerability **GO-2025-4155**:
- **Vulnerability**: Excessive resource consumption when printing error
string for host certificate validation in `crypto/x509`
- **Found in**: `crypto/x509@go1.24.9` (and earlier versions like
go1.24.7)
- **Fixed in**: `crypto/x509@go1.24.11`
- **More info**: https://pkg.go.dev/vuln/GO-2025-4155
Both Go module files in the repository are updated to 1.24.11 to ensure
consistent vulnerability remediation.
## Test plan
- [x] CI passes govulncheck after the Go version upgrade
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Bumps the go_modules group with 1 update in the / directory:
[golang.org/x/crypto](https://github.com/golang/crypto).
Updates `golang.org/x/crypto` from 0.42.0 to 0.45.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e0068c009"><code>4e0068c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="e79546e28b"><code>e79546e</code></a>
ssh: curb GSSAPI DoS risk by limiting number of specified OIDs</li>
<li><a
href="f91f7a7c31"><code>f91f7a7</code></a>
ssh/agent: prevent panic on malformed constraint</li>
<li><a
href="2df4153a03"><code>2df4153</code></a>
acme/autocert: let automatic renewal work with short lifetime certs</li>
<li><a
href="bcf6a849ef"><code>bcf6a84</code></a>
acme: pass context to request</li>
<li><a
href="b4f2b62076"><code>b4f2b62</code></a>
ssh: fix error message on unsupported cipher</li>
<li><a
href="79ec3a51fc"><code>79ec3a5</code></a>
ssh: allow to bind to a hostname in remote forwarding</li>
<li><a
href="122a78f140"><code>122a78f</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="c0531f9c34"><code>c0531f9</code></a>
all: eliminate vet diagnostics</li>
<li><a
href="0997000b45"><code>0997000</code></a>
all: fix some comments</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.42.0...v0.45.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.16.0 to 3.17.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.17.0</h2>
<h2>What's Changed</h2>
<ul>
<li>oidc: improve error message for mismatched issuer URLs by <a
href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/469">coreos/go-oidc#469</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.16.0...v3.17.0">https://github.com/coreos/go-oidc/compare/v3.16.0...v3.17.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="35b8e031bc"><code>35b8e03</code></a>
oidc: improve error message for mismatched issuer URLs</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.16.0...v3.17.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go)
from 1.13.0 to 1.13.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases">github.com/Azure/azure-sdk-for-go/sdk/azidentity's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azidentity/v1.13.1</h2>
<h2>1.13.1 (2025-11-10)</h2>
<h3>Bugs Fixed</h3>
<ul>
<li><code>AzureCLICredential</code> quoted arguments incorrectly on
Windows</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6bb9b03b23"><code>6bb9b03</code></a>
azidentity v1.13.1 (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25574">#25574</a>)</li>
<li><a
href="e18dbd7e4d"><code>e18dbd7</code></a>
Increment package version after release of azidentity (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25367">#25367</a>)</li>
<li><a
href="4f0facc097"><code>4f0facc</code></a>
Prepare azidentity v1.13.0 for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25352">#25352</a>)</li>
<li><a
href="2d8c98bd54"><code>2d8c98b</code></a>
Selecting ManagedIdentityCredential disables DefaultAzureCredential's
IMDS pr...</li>
<li><a
href="67dd4fcabd"><code>67dd4fc</code></a>
Increment package version after release of azidentity (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25263">#25263</a>)</li>
<li><a
href="1a74bc8ed7"><code>1a74bc8</code></a>
Prepare azidentity v1.12.0 for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25231">#25231</a>)</li>
<li><a
href="839a355f6e"><code>839a355</code></a>
Test IMDS managed identity with a remote VM (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25237">#25237</a>)</li>
<li><a
href="c352be349a"><code>c352be3</code></a>
Sync eng/common directory with azure-sdk-tools for PR 11931 (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25243">#25243</a>)</li>
<li><a
href="c994eca550"><code>c994eca</code></a>
gofmt (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25234">#25234</a>)</li>
<li><a
href="9c95d95a66"><code>9c95d95</code></a>
[Release] sdk/resourcemanager/computefleet/armcomputefleet/2.0.0-beta.1
gener...</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.13.0...sdk/azidentity/v1.13.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.29.0 to
0.30.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7416265ac6"><code>7416265</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="5517a715a6"><code>5517a71</code></a>
all: fix some comments</li>
<li><a
href="b6cdd1a97c"><code>b6cdd1a</code></a>
modfile: use reflect.TypeFor instead of reflect.TypeOf</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.29.0...v0.30.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go)
from 1.12.0 to 1.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases">github.com/Azure/azure-sdk-for-go/sdk/azidentity's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azidentity/v1.13.0</h2>
<h2>1.13.0 (2025-10-07)</h2>
<h3>Features Added</h3>
<ul>
<li>Added <code>AzurePowerShellCredential</code>, which authenticates as
the identity logged in to Azure PowerShell
(thanks <a href="https://github.com/ArmaanMcleod">ArmaanMcleod</a>)</li>
<li>When <code>AZURE_TOKEN_CREDENTIALS</code> is set to
<code>ManagedIdentityCredential</code>,
<code>DefaultAzureCredential</code> behaves the same as
does <code>ManagedIdentityCredential</code> when used directly. It
doesn't apply special retry configuration or attempt to
determine whether IMDS is available. (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25265">#25265</a>)</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Removed the <code>WorkloadIdentityCredential</code> support for
identity binding mode added in v1.13.0-beta.1.
It will return in v1.14.0-beta.1</li>
</ul>
<h2>sdk/azidentity/v1.13.0-beta.1</h2>
<h2>1.13.0-beta.1 (2025-09-17)</h2>
<h3>Features Added</h3>
<ul>
<li>Added <code>AzurePowerShellCredential</code>, which authenticates as
the identity logged in to Azure PowerShell
(thanks <a href="https://github.com/ArmaanMcleod">ArmaanMcleod</a>)</li>
<li><code>WorkloadIdentityCredential</code> supports identity binding
mode (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/25056">#25056</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="94c22e63e8"><code>94c22e6</code></a>
[azcore] prepping for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23192">#23192</a>)</li>
<li><a
href="c5213b1289"><code>c5213b1</code></a>
Redesign persistent token cache API (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23114">#23114</a>)</li>
<li><a
href="5df73f947f"><code>5df73f9</code></a>
[azopenai]: Update custom_client.go to enable insecure credential with
HTTP (...</li>
<li><a
href="b4b4721223"><code>b4b4721</code></a>
[azcore] Adding in a function create a policy.Request using an existing
*http...</li>
<li><a
href="80dbc7d99d"><code>80dbc7d</code></a>
Update CODEOWNERS_baseline_errors.txt (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23191">#23191</a>)</li>
<li><a
href="d254d11b07"><code>d254d11</code></a>
Increment package version after release of internal (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23190">#23190</a>)</li>
<li><a
href="62f7a3d0e9"><code>62f7a3d</code></a>
Test credential factory supports Pipelines federated auth (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23184">#23184</a>)</li>
<li><a
href="5aaedf4bf9"><code>5aaedf4</code></a>
[Release]
sdk/resourcemanager/informaticadatamgmt/arminformaticadatamgmt/1.0....</li>
<li><a
href="ce39ed9696"><code>ce39ed9</code></a>
Sync eng/common directory with azure-sdk-tools for PR 8598 (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23175">#23175</a>)</li>
<li><a
href="75d30bbd4b"><code>75d30bb</code></a>
Enable use of pipeline credential. Fixes <a
href="https://github.com/microsoft/azure-p">https://github.com/microsoft/azure-p</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.12.0...sdk/azcore/v1.13.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Motivated by vulnerabilities found in 1.24.6 -
https://github.com/modelcontextprotocol/registry/actions/runs/18924936129/job/54058441000?pr=729
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
This allows the private key used for DNS or HTTP based authentication to
be stored securely in a cloud key management system. These services
often provide HSM storage which makes it very hard to leak the private
key.
The full context is described in my design document here:
https://github.com/modelcontextprotocol/registry/issues/482#issuecomment-3437117171
## How Has This Been Tested?
I have tested it against PROD using an Ed25519 key stored in Google KMS.
I have added unit tests. I have tested both ECDSA P-384 and Ed25519 with
Az KV and Google KMS against a locally running server.
## Breaking Changes
None intended.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Co-authored-by: adam jones <domdomegg+git@gmail.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR:
* Deprecates the existing OCI reference parser
* Deprecates the existing OCI way of authenticating and accessing the
image manifest
* Replaces the above by leveraging go-containerregistry
* Introduces support for Google Artifact Registry
* Enables us to easily add support for other OCI-compliant registries in
the future
* Introduces better error handling
* Introduces custom context timeouts for validation
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Related to #427
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Fixes#710
This PR adds CORS middleware to enable browser-based clients and web
applications to access the registry API.
## Changes
- Add CORSMiddleware in internal/api/cors.go to handle preflight OPTIONS
requests and inject CORS headers
- Integrate CORS middleware into the server middleware stack
- Add CORS configuration options (CORS_ENABLED and CORS_ALLOWED_ORIGIN)
## Testing
- All existing tests pass
- Manual testing confirms CORS headers are present in responses
- OPTIONS preflight requests now return 204 with proper headers
## Configuration
New environment variables:
- MCP_REGISTRY_CORS_ENABLED (default: true)
- MCP_REGISTRY_CORS_ALLOWED_ORIGIN (default: *)
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
There was feedback that other projects wanting to use the registry
package have to upgrade to 1.25 (because of how Go works). In the
registry itself we are not relying on 1.25 features so this PR reverts
us back to 1.24 until 1.25 becomes better adopted and we can safely move
to it.
Also realised we were not keeping our dependencies for our deploy/infra
code up to date with Dependabot so this fixes that too.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR addresses the feedback from #634 around:
* Use a proper library - https://github.com/distribution/reference,
instead of the implementing the OCI parsing ourselves (note: left the
tests so we can ensure we are not breaking any existing behavior)
* Updating one of the error messages to now assume MCPB.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.28.0 to
0.29.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bba3e065a6"><code>bba3e06</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.28.0...v0.29.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.15.0 to 3.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<h2>What's Changed</h2>
<ul>
<li>refactor: Remove unused time injection from RemoteKeySet by <a
href="https://github.com/ponimas"><code>@ponimas</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/466">coreos/go-oidc#466</a></li>
<li>bump go to 1.24, remove 1.23 support, bump go-jose dependency,
remove x/net dependency by <a
href="https://github.com/wardviaene"><code>@wardviaene</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/wardviaene"><code>@wardviaene</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e9584733f8"><code>e958473</code></a>
bump go to 1.24, remove 1.23 support, bump go-jose dependency, remove
x/net d...</li>
<li><a
href="69b167061f"><code>69b1670</code></a>
refactor: Remove unused time injection from RemoteKeySet</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
This PR adds two important improvements to ensure data integrity:
1. **Adds server name format validation at the API layer** to match the
database constraint from migration 008
2. **Includes migration 008 to clean up invalid data** before applying
strict constraints in migration 009
## Changes
### Server Name Validation
- Enforces validation at the API layer matching the database constraint
- **Namespace pattern**: `[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]`
- Must start and end with alphanumeric characters
- Can contain dots and hyphens in the middle
- **Name pattern**: `[a-zA-Z0-9][a-zA-Z0-9._-]*[a-zA-Z0-9]`
- Must start and end with alphanumeric characters
- Can contain dots, underscores, and hyphens in the middle
- Provides clear, user-friendly error messages indicating which part is
invalid
- Uses DRY approach with composed regex patterns
### Migration 008: Data Cleanup
- Removes servers with invalid names or empty versions (5 servers
affected in production)
- Fixes invalid status values by setting them to 'active' (1 server
affected)
- Removes duplicate name+version combinations
- Includes comprehensive safety checks to prevent accidental data loss
- Must run before migration 009 which adds strict constraints
## Testing
- All validator tests pass
- Migration includes safety checks that match production data
- CI verification included
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The follow PR removes the in-memory database option from the registry.
We had a chat about this with @domdomegg and although it is supposed to
be convenient, it isn't that useful in reality. We want to test and
develop the registry in a setup that is closer to the environment it is
supposed to be run. One of the main reasons are:
* We don't use it anywhere else besides unit testing and potentially
local development. Instead we should use postgresql for reliable results
(in-memory was actually giving false positive results)
* We have to keep maintaining it and make sure it mimics the behaviour
we have for postgresql which is not yielding a lot of value
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Yes, I've updated the test unit make target to run in the postgresql
environment and now we can see the race condition issue happening.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from
0.30.0 to 0.31.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="014cf778b4"><code>014cf77</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li><a
href="3c76ce5d23"><code>3c76ce5</code></a>
endpoints: correct Naver OAuth2 endpoint URLs</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.0 to 1.23.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.2 - 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement). There are no functional changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common@v0.66.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1869">prometheus/client_golang#1869</a></li>
<li>[release-1.23] Cut v1.23.2 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1870">prometheus/client_golang#1870</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2">https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2</a></p>
<h2>v1.23.1 - 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change in prometheus/common v0.66.0. There are no functional
changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common v0.66 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1866">prometheus/client_golang#1866</a></li>
<li>[release-1.23] Cut v1.23.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1867">prometheus/client_golang#1867</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1">https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.23.2 / 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement).
There are no functional changes.</p>
<h2>1.23.1 / 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change
in prometheus/common v0.66.0. There are no functional changes.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8179a56081"><code>8179a56</code></a>
Cut v1.23.2 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1870">#1870</a>)</li>
<li><a
href="4142b5908b"><code>4142b59</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/1869">#1869</a>
from prometheus/arve/upgrade-common</li>
<li><a
href="4ff40f0d91"><code>4ff40f0</code></a>
Cut v1.23.1 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1867">#1867</a>)</li>
<li><a
href="989b029894"><code>989b029</code></a>
Upgrade to prometheus/common v0.66 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1866">#1866</a>)</li>
<li>See full diff in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot[bot]
Radoslav Dimitrov
Tadas Antanavicius
Joel Verhagen
Terry Nederveld