Skip to content

🌱(deps): Bump the all-go-deps group across 1 directory with 4 updates - #477

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-go-deps-098c2caf1a
Closed

🌱(deps): Bump the all-go-deps group across 1 directory with 4 updates#477
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-go-deps-098c2caf1a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-go-deps group with 4 updates in the / directory: cloud.google.com/go/cloudsqlconn, github.com/prometheus/client_golang, golang.org/x/mod and golang.org/x/sync.

Updates cloud.google.com/go/cloudsqlconn from 1.25.3 to 1.25.4

Release notes

Sourced from cloud.google.com/go/cloudsqlconn's releases.

v1.25.4

1.25.4 (2026-10-14)

Bug Fixes

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Changelog

Sourced from cloud.google.com/go/cloudsqlconn's changelog.

1.25.4 (2026-10-14)

Bug Fixes

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Commits

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits
  • 36f2d70 errgroup: modernize the usage of closures in goroutines
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
🌱(deps): Bump the all-go-deps group across 1 directory with 4 updates
1b6ee81 
Bumps the all-go-deps group with 4 updates in the / directory: [cloud.google.com/go/cloudsqlconn](https://github.com/googlecloudplatform/cloud-sql-go-connector), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang), [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/sync](https://github.com/golang/sync).


Updates `cloud.google.com/go/cloudsqlconn` from 1.25.3 to 1.25.4
- [Release notes](https://github.com/googlecloudplatform/cloud-sql-go-connector/releases)
- [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/blob/main/CHANGELOG.md)
- [Commits](GoogleCloudPlatform/cloud-sql-go-connector@v1.25.3...v1.25.4)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/cloudsqlconn
  dependency-version: 1.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/all-go-deps-098c2caf1a branch November 2, 2026 10:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants