[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the all-dependencies group with 1 update in the / directory: distroless/static.

Updates distroless/static from 6a5e9a4 to 63b4c00

Bumps the all-dependencies group with 6 updates in the / directory:

Package	From	To
github.com/prometheus/common	0.72.1	0.73.1
k8s.io/api	0.37.1	0.37.2
k8s.io/apiextensions-apiserver	0.37.1	0.37.2
k8s.io/apimachinery	0.37.1	0.37.2
k8s.io/apiserver	0.37.1	0.37.2
k8s.io/client-go	0.37.1	0.37.2

Bumps the all-dependencies group with 2 updates in the /hack/sops-build directory: golang.org/x/net and google.golang.org/grpc.

Updates github.com/prometheus/common from 0.72.1 to 0.73.1

Release notes

Sourced from github.com/prometheus/common's releases.

v0.73.1

What's Changed

• build(deps): bump github.com/pandatix/go-abnf from 0.5.1 to 0.5.3 by @​bwplotka in prometheus/common#1027

Full Changelog: prometheus/common@v0.73.0...v0.73.1

v0.73.0

What's Changed

• expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 by @​KR-Ravindra in prometheus/common#1008
• expfmt: add FmtOpenMetrics_2_0_0_rc format constant by @​bwplotka in prometheus/common#1020
• expfmt: add ABNF-based OpenMetrics 1.0 parser by @​bwplotka in prometheus/common#1015

New Contributors

• @​KR-Ravindra made their first contribution in prometheus/common#1008

Full Changelog: prometheus/common@v0.72.1...v0.73.0

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

Commits

• d92d839 build(deps): bump github.com/pandatix/go-abnf from 0.5.1 to 0.5.3 (#1027)
• 983d509 expfmt: add ABNF-based OpenMetrics 1.0 parser (#1015)
• 220c51a expfmt: add FmtOpenMetrics_2_0_0_rc format constant (#1020)
• 25bdf5c expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 (#1008)
• See full diff in compare view

Updates k8s.io/api from 0.37.1 to 0.37.2

Commits

• 1bc0c52 Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.37.1 to 0.37.2

Commits

• c5e6c4c Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.37.1 to 0.37.2

Commits

• 97adf14 Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates k8s.io/apiserver from 0.37.1 to 0.37.2

Commits

• e204ba1 Update dependencies to v0.37.2 tag
• 2beb045 Merge pull request #142770cwedgwood/automated-cherry-pick-of-#142607
• e1b83ce apiserver: accept large identity header sets with Go 1.27
• See full diff in compare view

Updates k8s.io/client-go from 0.37.1 to 0.37.2

Commits

• 72c52dd Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates golang.org/x/net from 0.61.0 to 0.62.0

Commits

• 3de643d html: check all ancestor namespace transitions when rendering raw text
• 05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
• dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
• 9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
• 9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
• 4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
• afcf8cd ipv4: fix several missing bounds checks
• 4af4fce html: avoid quadratic complexity when coalescing text nodes
• 7e56200 quic: per-path connection ids
• See full diff in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fce39157-6b9f-451d-9bdf-290ea2c44fd3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn