Skip to content

chore(deps): bump the go-runtime group with 4 updates - #290

Merged
gnanirahulnutakki merged 1 commit into
devfrom
dependabot/go_modules/dev/go-runtime-6a2614af1e
Jul 21, 2026
Merged

chore(deps): bump the go-runtime group with 4 updates#290
gnanirahulnutakki merged 1 commit into
devfrom
dependabot/go_modules/dev/go-runtime-6a2614af1e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-runtime group with 4 updates: github.com/prometheus/client_golang, github.com/wailsapp/wails/v2, google.golang.org/grpc and sigs.k8s.io/apiserver-network-proxy/konnectivity-client.

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • b0d896b Replace deprecated model.NameValidationScheme with explicit UTF8Validation (#...
  • Additional commits viewable in compare view

Updates github.com/wailsapp/wails/v2 from 2.12.0 to 2.13.0

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.13.0

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.13.0

Changes

Added

Added

Fixed

  • Fixed wake (experimental WAILS_USE_WAKE=true build runner) running precondition sh: strings without template expansion, causing a spurious "garble is required for obfuscated builds" error on every build by @​leaanthony
  • Fixed nil pointer crash in application.Quit when called before Run or after Run returned early #5452 by @​c-tonneslan
Commits
  • 474b677 release: v2.13.0
  • 77fbbfa ci(npm): rebase-and-retry the version-bump push so publishes stop failing (#5...
  • 97f5f46 fix(v3/windows): guard FillRect against nil client rect in WM_ERASEBKGND (#5687)
  • 78254ef fix(v3): return error to frontend as dedicated Error objects instead of strin...
  • fd231e9 [skip ci] Publish @​wailsio/runtime v3.0.0-alpha.96
  • 198c9ce ci: verify the bundled runtime is built from source, not supplied by PRs (#5759)
  • 3c1ca71 fix(v3/windows): web server (server tag) build fails on Windows (#5680) (#5...
  • 0ea5f3a chore: update sponsors.svg and contributors.svg [skip ci]
  • a84a490 ci: skip release/publish/changelog automation on forks (#5756)
  • 1961c27 chore(v3): bump to v3.0.0-alpha2.114 and update changelog [skip ci]
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.79.3 to 1.82.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

  • server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Release 1.82.0

Behavior Changes

  • server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)
  • transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)
  • balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

New Features

  • experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)
  • client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)
  • server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)

Bug Fixes

  • xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)
  • grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)
  • stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)
  • encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)
  • channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)

Release 1.81.1

Security

  • xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#9111)

Bug Fixes

  • otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (#9081)

Release 1.81.0

Behavior Changes

  • balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#8808)

Dependencies

... (truncated)

Commits

Updates sigs.k8s.io/apiserver-network-proxy/konnectivity-client from 0.31.2 to 0.36.0

Changelog

Sourced from sigs.k8s.io/apiserver-network-proxy/konnectivity-client's changelog.

Releasing a new version of apiserver-network-proxy

Please note this guide is only intended for the admins of this repository, and requires write access.

Creating a new release of network proxy involves releasing a new version of the client library (konnectivity-client) and new images for the proxy agent and server. Generally we also want to upgrade kubernetes/kubernetes with the latest version of the images and library, but this is a GCE specific change.

  1. If increasing the minor version (the y in x.y.z), a new release branch must be created. The name of this branch should be release-x.y where x and y correspond to the major and minor release numbers for apiserver-network-proxy. For example, if increasing the apiserver-network-proxy from verision 0.35.1 to 0.36.0 a new branch should be created named release-0.36.

    After making the new tag for the release version, use the following command to create the new branch:

    # assuming a release version of 0.36.0
export RELEASE=release-0.36
git checkout -b "${RELEASE}"
git push upstream "${RELEASE}"

  2. The first step involves creating a new git tag for the release, following semver for go libraries. A tag is required for both the repository and the konnectivity-client library. For example releasing the 0.36.0 version will have two tags v0.36.0 and konnectivity-client/v0.36.0 on the appropriate commit. The minor version number (the y in x.y.z) should match the minor version of the Kubernetes version that is utilized by the apiserver-network-proxy. The patch level version number (the z in x.y.z) should increase by one unless a new minor version is being created, in which case it should be 0.

    In the master branch, choose the appropriate commit, and determine a patch version based on the required Kubernetes version and the current patch level.

    Example commands for HEAD of master branch. (Assumes you have git remote add upstream git@github.com:kubernetes-sigs/apiserver-network-proxy.git.)

    # Assuming v0.35.0 exists
export TAG=v0.36.0
export MESSAGE="Meaningful description of change."

    git fetch upstream
    
git tag -a "${TAG}" -m "${MESSAGE}" upstream/master
    
git tag -a "konnectivity-client/${TAG}" -m "${MESSAGE}" upstream/master
    
git push upstream "${TAG}"
    
git push upstream "konnectivity-client/${TAG}"

    In a release branch, the process is similar but corresponds to earlier minor versions.

    Example commands for HEAD of release-0.36 branch:

    # Assuming v0.35.0 exists, then it is on the release-0.36 branch
export RELEASE=release-0.36
export TAG=v0.36.0
export MESSAGE="Meaningful description of change."

    git fetch upstream
    
git tag -a "${TAG}" -m "${MESSAGE}" upstream/${RELEASE}
    
git tag -a "konnectivity-client/${TAG}" -m "${MESSAGE}" upstream/${RELEASE}
    
git push upstream "${TAG}"
    
git push upstream "konnectivity-client/${TAG}"

... (truncated)

Commits
  • e843261 Merge pull request #857 from kubernetes-sigs/dependabot/go_modules/gomod-depe...
  • 64561d4 Merge pull request #856 from inerplat/fix/backend-dial-timeout-pending-dial
  • 39caa18 chore(deps): bump github.com/prometheus/common
  • 72fc545 Add optional backend dial timeout
  • 9ee6775 Merge pull request #854 from kubernetes-sigs/dependabot/github_actions/golang...
  • 734150d chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
  • ecd8d51 Merge pull request #820 from tesshuflower/add-tls-min-version
  • ad9cad2 Merge pull request #852 from kubernetes-sigs/dependabot/go_modules/gomod-depe...
  • a8faa87 chore(deps): bump the gomod-dependencies group across 1 directory with 10 upd...
  • 8536f7d Merge pull request #853 from cheftako/fix-511043121-1779385126
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-runtime group with 4 updates
3f371d6 
Bumps the go-runtime group with 4 updates: [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang), [github.com/wailsapp/wails/v2](https://github.com/wailsapp/wails), [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [sigs.k8s.io/apiserver-network-proxy/konnectivity-client](https://github.com/kubernetes-sigs/apiserver-network-proxy).


Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.0)

Updates `github.com/wailsapp/wails/v2` from 2.12.0 to 2.13.0
- [Release notes](https://github.com/wailsapp/wails/releases)
- [Commits](wailsapp/wails@v2.12.0...v2.13.0)

Updates `google.golang.org/grpc` from 1.79.3 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.3...v1.82.1)

Updates `sigs.k8s.io/apiserver-network-proxy/konnectivity-client` from 0.31.2 to 0.36.0
- [Release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases)
- [Changelog](https://github.com/kubernetes-sigs/apiserver-network-proxy/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/apiserver-network-proxy@v0.31.2...v0.36.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-runtime
- dependency-name: github.com/wailsapp/wails/v2
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-runtime
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-runtime
- dependency-name: sigs.k8s.io/apiserver-network-proxy/konnectivity-client
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 20, 2026
@gnanirahulnutakki gnanirahulnutakki mentioned this pull request Jul 20, 2026
Open
26 tasks
@gnanirahulnutakki
gnanirahulnutakki merged commit e561613 into dev Jul 21, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/dev/go-runtime-6a2614af1e branch July 21, 2026 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gnanirahulnutakki