fix(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/prometheus/client_golang	v1.23.2 → v1.24.1			require	minor
golang (source)	1.25.12-alpine → 1.27.0-alpine			stage	minor

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

prometheus/client_golang (github.com/prometheus/client_golang)

v1.24.1

Compare Source

v1.24.0: - 2026-07-20

Compare Source

Changes

• [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #​1862
• [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #​2051
• [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #​1843
• [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #​1850
• [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #​1855
• [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #​1942
• [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #​1392
• [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #​1902
• [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #​1969
• [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #​1925
• [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #​1846, #​1856
• [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #​1896
• [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #​1895
• [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #​1888, #​1890
• [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #​1860
• [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #​1885
• [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #​1961
• [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #​1991
• [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #​2005
• [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #​2030
• [BUGFIX] api: Respect context cancellation inside httpClient.Do. #​1971
• [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #​1889
• [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #​1917
• [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #​1927

All commits

• build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @​dependabot[bot] in #​1839
• build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @​dependabot[bot] in #​1838
• prometheus/collectors: use godoc link for runtime/metrics supported metrics by @​xieyuschen in #​1844
• Fix doc typo by @​torrca in #​1849
• Merge release-1.23 into main by @​vesari in #​1851
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @​dependabot[bot] in #​1852
• Refactor LabelNames to return model.LabelNames type for consistency by @​yshngg in #​1850
• remote: simplified Store interface; renamed Handler to WriteHandler by @​bwplotka in #​1855
• feat(api/prometheus): add format_query endpoint for query formatting by @​yshngg in #​1846
• feat(api): add FormatQuery method to Prometheus v1 API by @​yshngg in #​1856
• Support matchers in rules API by @​jotak in #​1843
• Use prometheus/common.expfmt.NewTextParser by @​aknuds1 in #​1859
• Merge release-1.23 into main by @​aknuds1 in #​1861
• chore: Drop support for <go1.22 by @​mrueg in #​1862
• collectors/version: Allow custom additional labels by @​mrueg in #​1860
• build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by @​ywwg in #​1865
• Sync release-1.23 into main by @​aknuds1 in #​1868
• Sync main with release-1.23 by @​aknuds1 in #​1871
• chore: clean up golangci-lint configuration by @​mmorel-35 in #​1802
• build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by @​dependabot[bot] in #​1880
• build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 in /exp by @​dependabot[bot] in #​1882
• build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.1 in /exp by @​dependabot[bot] in #​1883
• build(deps): bump the github-actions group with 4 updates by @​dependabot[bot] in #​1881
• Fix typo in remote api err msg by @​SungJin1212 in #​1878
• chore: Update metrics for new Go version by @​github-actions[bot] in #​1864
• Add RetryCallBack to remote_api.go by @​pipiland2612 in #​1888
• bug(remote_write): Fix compression buffer pooling by @​fpetkovski in #​1889
• Change RetryCallBack initialized by @​pipiland2612 in #​1890
• Fix CI bug by @​pipiland2612 in #​1892
• Use cloned http.DefaultTransport. issue-1857 by @​karthikkondapally in #​1885
• Public backoff config to allow usage of WithAPIBackoff by @​pipiland2612 in #​1895
• Clarify exp library stability by @​pipiland2612 in #​1894
• feat: add support for /status/tsdb/blocks endpoint by @​tjhop in #​1896
• minor refactor of replaceInvalidRune() in bridge.go by @​karthikkondapally in #​1897
• build(deps): bump github.com/prometheus/procfs from 0.17.0 to 0.19.2 by @​dependabot[bot] in #​1903
• build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 by @​dependabot[bot] in #​1906
• build(deps): bump golang.org/x/sys from 0.35.0 to 0.37.0 by @​dependabot[bot] in #​1904
• build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 by @​dependabot[bot] in #​1907
• build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 in /exp by @​dependabot[bot] in #​1911
• build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 in /exp by @​dependabot[bot] in #​1909
• build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 in /exp by @​dependabot[bot] in #​1910
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​1908
• chore(ci): Add CRLF detection and fix targets to prevent CRLF contamination by @​kakkoyun in #​1898
• chore(ci): Use stable names for CI steps by @​kakkoyun in #​1914
• build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by @​dependabot[bot] in #​1920
• build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 by @​dependabot[bot] in #​1921
• build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by @​dependabot[bot] in #​1922
• build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 in /exp by @​dependabot[bot] in #​1923
• build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 in /exp by @​dependabot[bot] in #​1924
• build(deps): bump the github-actions group with 4 updates by @​dependabot[bot] in #​1919
• feat: expose Desc error through public Err() method by @​duricanikolic in #​1902
• Allow /metrics handler output filtering via name[] query param by @​colega in #​1925
• Prevent OOM from malformed snappy payloads by validating decoded length by @​makasim in #​1917
• Ensure remote write v2 headers cannot be returned on v1 requests by @​kgeckhart in #​1927
• build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 by @​dependabot[bot] in #​1932
• build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 by @​dependabot[bot] in #​1933
• build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /exp by @​dependabot[bot] in #​1935
• build(deps): bump the github-actions group with 5 updates by @​dependabot[bot] in #​1934
• promhttp/zstd: add unit tests for zstd writer registration by @​90ashish in #​1929
• feat(collector): add Go 1.26 new runtime metrics by @​kakkoyun in #​1942
• build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 in /exp by @​dependabot[bot] in #​1948
• build(deps): bump the github-actions group with 4 updates by @​dependabot[bot] in #​1946
• build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by @​dependabot[bot] in #​1944
• build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by @​dependabot[bot] in #​1945
• build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 in /exp by @​dependabot[bot] in #​1947
• chore(test): bump 1.25, tests with synctest and check not panic by @​manute in #​1950
• build(deps): bump github.com/prometheus/procfs from 0.19.2 to 0.20.1 by @​dependabot[bot] in #​1954
• build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @​dependabot[bot] in #​1957
• build(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by @​dependabot[bot] in #​1955
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.34.0 to 1.40.0 in /tutorials/whatsup by @​dependabot[bot] in #​1959
• build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 by @​dependabot[bot] in #​1956
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​1958
• chore(collectors/go): generate the tests after new metric by @​kakkoyun in #​1962
• Remove Arthur from the list of maintainers by @​ArthurSens in #​1964
• build(deps): bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /tutorials/whatsup by @​dependabot[bot] in #​1965
• fix: recover from collector panic and return error in Gather by @​Saflaski in #​1961
• prometheus: clarify MetricVec delete semantics in godoc by @​Retr0-XD in #​1967
• build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 by @​dependabot[bot] in #​1973
• build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @​dependabot[bot] in #​1974
• build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 in /exp by @​dependabot[bot] in #​1976
• Optionally add OM unit by @​vesari in #​1392
• fix: respect context cancellation in httpClient.Do by @​pedrampdd in #​1971
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tutorials/whatsup by @​dependabot[bot] in #​1978
• Synchronize common files from prometheus/prometheus by @​prombot in #​1977
• Synchronize common files from prometheus/prometheus by @​prombot in #​1980
• examples: add native histogram usage example by @​thegdsks in #​1981
• chore(ci): add macOS, Windows and arm64 test runners by @​kakkoyun in #​1968
• prometheus: honor PidFn on windows and darwin by @​Retr0-XD in #​1966
• Synchronize common files from prometheus/prometheus by @​prombot in #​1984
• Synchronize common files from prometheus/prometheus by @​prombot in #​1985
• promhttp: implement WithXFromContext in terms of WithXFromRequest by @​tie in #​1863
• Synchronize common files from prometheus/prometheus by @​prombot in #​1988
• Fix bug unit cpu-seconds not a suffix of metric go_cpu_classes_gc_mark_assist_cpu_seconds by @​vesari in #​1991
• build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 by @​dependabot[bot] in #​1993
• build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @​dependabot[bot] in #​1992
• build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 in /exp by @​dependabot[bot] in #​1995
• exp/api/remote: limit request body size in SnappyDecodeMiddleware by @​roidelapluie in #​1996
• Synchronize common files from prometheus/prometheus by @​prombot in #​2001
• build(deps): bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​1994
• ci(update-go-versions): declare permissions for the monthly chore PR by @​arpitjain099 in #​2003
• docs: fix godoc indentation and typos in timer.go and wrap.go by @​immanuwell in #​2009
• ci: harden actions/checkout with persist-credentials: false by @​roidelapluie in #​2011
• fix(registry): prevent file descriptor leak in WriteToTextfile by @​ProjectMutilation in #​2010
• Synchronize common files from prometheus/prometheus by @​prombot in #​2008
• promhttp: add regression test for concurrent map writes (#​1274) by @​pedrampdd in #​2000
• build(deps): bump github.com/prometheus/common from 0.67.6-0.20260224092343-e4c38a0aea47 to 0.68.0 by @​dependabot[bot] in #​2015
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​2016
• build(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0 by @​dependabot[bot] in #​2014
• build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 in /exp by @​dependabot[bot] in #​2017
• promhttp: fix grammar in exemplar option doc comments by @​s3onghyun in #​2023
• fix: use keyed fields in SamplePair struct literals in api_test.go by @​immanuwell in #​2012
• refactor: replace interface{} with any (Go 1.18+) by @​MD-Mushfiqur123 in #​2021
• Synchronize common files from prometheus/prometheus by @​prombot in #​2013
• build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 by @​dependabot[bot] in #​2025
• build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 in /exp by @​dependabot[bot] in #​2027
• build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @​dependabot[bot] in #​2026
• Synchronize common files from prometheus/prometheus by @​prombot in #​2028
• build(deps): bump github.com/prometheus/procfs from 0.20.1 to 0.21.0 by @​dependabot[bot] in #​2033
• build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by @​dependabot[bot] in #​2036
• build(deps): bump github.com/prometheus/procfs from 0.21.0 to 0.21.1 by @​dependabot[bot] in #​2035
• build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 in /exp by @​dependabot[bot] in #​2038
• Synchronize common files from prometheus/prometheus by @​prombot in #​2041
• fix(api): fall back to GET on forbidden POSTs by @​immanuwell in #​2030
• build(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /tutorials/whatsup by @​dependabot[bot] in #​2042
• build(deps): bump the github-actions group across 1 directory with 5 updates by @​dependabot[bot] in #​2043
• chores: remove example Dockerfile and container_description.yaml by @​bwplotka in #​2044
• Update dependabot config by @​SuperQ in #​2046
• build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 in /exp by @​dependabot[bot] in #​2048
• build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by @​dependabot[bot] in #​2047
• promhttp: don't panic when instrumenting with non-exemplar observers by @​spor3006 in #​2005
• Replace deprecated model.NameValidationScheme with explicit UTF8Validation by @​kakkoyun in #​2051
• test: fix two flaky tests (darwin start_time regex, memstats HeapReleased drift) by @​kakkoyun in #​2050
• fix: correct typos in comments and test error messages by @​maxtaran2010 in #​2049
• examples: improve simple main.go example by @​dhanudhanushree in #​1999
• Synchronize common files from prometheus/prometheus by @​prombot in #​2055
• feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather calls by @​kakkoyun in #​1969
• build(deps): update all Go dependencies in all go.mod files by @​bwplotka in #​2059
• Cut v1.24.0-rc.0 by @​bwplotka in #​2058

New Contributors

• @​xieyuschen made their first contributihttps://github.com/prometheus/client_golang/pull/1844l/1844
• @​torrca made their first contributihttps://github.com/prometheus/client_golang/pull/1849l/1849
• @​yshngg made their first contributihttps://github.com/prometheus/client_golang/pull/1850l/1850
• @​jotak made their first contributihttps://github.com/prometheus/client_golang/pull/1843l/1843
• @​SungJin1212 made their first contributihttps://github.com/prometheus/client_golang/pull/1878l/1878
• @​github-actions[bot] made their first contributihttps://github.com/prometheus/client_golang/pull/1864l/1864
• @​pipiland2612 made their first contributihttps://github.com/prometheus/client_golang/pull/1888l/1888
• @​fpetkovski made their first contributihttps://github.com/prometheus/client_golang/pull/1889l/1889
• @​karthikkondapally made their first contributihttps://github.com/prometheus/client_golang/pull/1885l/1885
• @​tjhop made their first contributihttps://github.com/prometheus/client_golang/pull/1896l/1896
• @​duricanikolic made their first contributihttps://github.com/prometheus/client_golang/pull/1902l/1902
• @​makasim made their first contributihttps://github.com/prometheus/client_golang/pull/1917l/1917
• @​kgeckhart made their first contributihttps://github.com/prometheus/client_golang/pull/1927l/1927
• @​90ashish made their first contributihttps://github.com/prometheus/client_golang/pull/1929l/1929
• @​manute made their first contributihttps://github.com/prometheus/client_golang/pull/1950l/1950
• @​Saflaski made their first contributihttps://github.com/prometheus/client_golang/pull/1961l/1961
• @​Retr0-XD made their first contributihttps://github.com/prometheus/client_golang/pull/1967l/1967
• @​pedrampdd made their first contributihttps://github.com/prometheus/client_golang/pull/1971l/1971
• @​thegdsks made their first contributihttps://github.com/prometheus/client_golang/pull/1981l/1981
• @​tie made their first contributihttps://github.com/prometheus/client_golang/pull/1863l/1863
• @​arpitjain099 made their first contributihttps://github.com/prometheus/client_golang/pull/2003l/2003
• @​immanuwell made their first contributihttps://github.com/prometheus/client_golang/pull/2009l/2009
• @​ProjectMutilation made their first contributihttps://github.com/prometheus/client_golang/pull/2010l/2010
• @​s3onghyun made their first contributihttps://github.com/prometheus/client_golang/pull/2023l/2023
• @​MD-Mushfiqur123 made their first contributihttps://github.com/prometheus/client_golang/pull/2021l/2021
• @​spor3006 made their first contributihttps://github.com/prometheus/client_golang/pull/2005l/2005
• @​maxtaran2010 made their first contributihttps://github.com/prometheus/client_golang/pull/2049l/2049
• @​dhanudhanushree made their first contributihttps://github.com/prometheus/client_golang/pull/1999l/1999

Full Changelog: prometheus/client_golang@v1.23.2...v1.24.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
github.com/prometheus/common	v0.68.1 -> v0.70.1
github.com/prometheus/procfs	v0.20.1 -> v0.21.1
golang.org/x/crypto	v0.53.0 -> v0.54.0
golang.org/x/net	v0.56.0 -> v0.57.0
golang.org/x/sync	v0.21.0 -> v0.22.0
golang.org/x/sys	v0.46.0 -> v0.47.0
golang.org/x/text	v0.39.0 -> v0.40.0