build: upgrade vulnerable dependencies

[YangKeao]

What problem does this PR solve?

Issue Number: close #70242

Problem Summary:

What changed and how does it work?

Upgrade the dependencies to the newer version.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

Summary by CodeRabbit

• Bug Fixes

  • Improved detection of missing files in Google Cloud Storage.
  • Updated gRPC tracing integration for more consistent telemetry handling.
  • Simplified cache eviction’s random key generation without changing behavior.

• Maintenance

  • Updated Go, cloud, observability, Kubernetes, and utility dependencies.
  • Refreshed Bazel dependency definitions and build configuration.
  • Removed unused build dependencies.

• Tests

  • Improved PromQL validation in metric schema tests.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR refreshes Go and Bazel dependency versions, updates Bazel repository generation settings, and applies targeted compatibility changes for etcd tracing, PromQL parsing, LFU randomness, and GCS error handling.

Changes

Dependency refresh and compatibility updates

Layer / File(s)	Summary
Go module and toolchain pin refresh go.mod, pkg/parser/go.mod	Go toolchain and direct and indirect module versions are updated across cloud, AWS, Azure, observability, Kubernetes, and utility dependencies.
Bazel dependency declarations and generation DEPS.bzl, cmd/mirror/mirror.go	Bazel repository pins and membership are refreshed, patches are updated, and selected repositories receive clean build-file generation settings.
Compatibility and API updates build/patches/..., pkg/infoschema/..., pkg/statistics/..., br/pkg/storage/gcs.go	etcd tracing uses a gRPC stats handler, metric validation reuses a PromQL parser, LFU uses math/rand/v2, and GCS not-found detection uses goerrors.Is.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• pingcap/tidb#69958: Updates the Go toolchain and overlapping dependency pins.
• pingcap/tidb#70244: Updates Bazel dependency pins and clean build-file generation settings.
• pingcap/tidb#69461: Refreshes Go and Bazel dependency resolution.

Suggested reviewers: djshow832, cfzjywxk, ti-chi-bot

Poem

I’m a rabbit with pins in a row,
Fresh modules now neatly grow.
Bazel builds clean,
New APIs are seen,
And patched tracing hops with the flow.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is present, but several template sections are blank or overly vague, including problem summary, side effects, documentation, and release note details.	Fill in the problem summary, describe the dependency changes in more detail, and complete the side effects, documentation, and release note sections.
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects the main change: upgrading dependencies to address vulnerabilities.
Linked Issues check	✅ Passed	The changes align with the dependency-upgrade issue by bumping the Go toolchain, x/text, and related dependency pins and compatibility patches.
Out of Scope Changes check	✅ Passed	The extra test, build, and compatibility edits appear tied to the dependency refresh and are not clearly unrelated to the issue scope.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-8.5@dc0024f). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-8.5     #70243   +/-   ##
================================================
  Coverage               ?   55.7588%           
================================================
  Files                  ?       1852           
  Lines                  ?     667014           
  Branches               ?          0           
================================================
  Hits                   ?     371919           
  Misses                 ?     267476           
  Partials               ?      27619           

Flag	Coverage Δ
integration	39.2284% <100.0000%> (?)
unit	65.2307% <100.0000%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	55.3108% <0.0000%> (?)
parser	∅ <0.0000%> (?)
br	63.1150% <0.0000%> (?)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

DEPS.bzl (1)

5580-5655: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Fix the server upgrade patch so it applies and update the stale etcd modules.

DEPS.bzl and go.mod are aligned, but build/patches/io_etcd_go_etcd_server v3.patch does not apply to go.etcd.io/etcd/server/v3@v3.5.15: with patch_args = ["-p1"], the -a/etcdserver/api/v3rpc/grpc.go hunk fails to find the source file. Since Bazel can ignore a failed patch, this can silently leave OpenTelemetry instrumentation enabled by default. Also drop the remaining etcd/etcdutl/v3 and go.etcd.io/gofail pins from DEPS.bzl/go.mod if they are no longer used, because go.etcd.io/etcd/tests/v3 remains only in go.mod.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@DEPS.bzl` around lines 5580 - 5655, Update the etcd server upgrade patch so
its grpc.go hunk matches the v3.5.15 source and applies successfully with the
existing -p1 configuration, preserving the intended default-disabled
OpenTelemetry instrumentation. Remove the unused io_etcd_go_etcd_etcdutl_v3 and
io_etcd_go_gofail dependency pins from DEPS.bzl and go.mod, while retaining the
etcd tests module entry in go.mod.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@DEPS.bzl`:
- Around line 5580-5655: Update the etcd server upgrade patch so its grpc.go
hunk matches the v3.5.15 source and applies successfully with the existing -p1
configuration, preserving the intended default-disabled OpenTelemetry
instrumentation. Remove the unused io_etcd_go_etcd_etcdutl_v3 and
io_etcd_go_gofail dependency pins from DEPS.bzl and go.mod, while retaining the
etcd tests module entry in go.mod.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c8b555e9-0b02-4205-af9d-baa1dc549319

📥 Commits

Reviewing files that changed from the base of the PR and between f019221 and 0085ea6.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• DEPS.bzl
• build/patches/io_etcd_go_etcd_server_v3.patch
• go.mod

[YangKeao]

/retest

[YangKeao]

/retest

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-07-31 07:37:26.141323315 +0000 UTC m=+2168032.177418381: ☑️ agreed by djshow832.
• 2026-08-03 10:44:36.089892319 +0000 UTC m=+2438462.125987375: ☑️ agreed by D3Hunter.

[YangKeao]

/retest

[YangKeao]

/retest

[YangKeao]

/retest

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AilinKid, D3Hunter, djshow832

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [AilinKid,D3Hunter,djshow832]
• br/pkg/storage/OWNERS [D3Hunter]
• pkg/infoschema/OWNERS [D3Hunter]
• pkg/parser/OWNERS [D3Hunter]
• pkg/statistics/OWNERS [AilinKid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[YangKeao]

/retest

[ti-chi-bot]

@YangKeao: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-unit-test-ddlv1	f019221	link	true	/test pull-unit-test-ddlv1

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[YangKeao]

/retest