Skip to content

Conversation

@red-hat-konflux
Copy link

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/cyphar/filepath-securejoin v0.4.1 -> v0.6.0 age confidence indirect minor
github.com/emicklei/go-restful/v3 v3.12.2 -> v3.13.0 age confidence indirect minor
github.com/go-logr/logr v1.4.2 -> v1.4.3 age confidence indirect patch
github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.1 age confidence indirect minor
github.com/go-openapi/jsonreference v0.20.2 -> v0.21.2 age confidence indirect minor
github.com/go-openapi/swag v0.23.0 -> v0.25.1 age confidence indirect minor
github.com/google/pprof d1b30fe -> 5df77e3 age confidence indirect digest
github.com/mailru/easyjson v0.7.7 -> v0.9.1 age confidence indirect minor
github.com/prometheus/client_golang v1.22.0 -> v1.23.2 age confidence indirect minor
github.com/prometheus/client_model v0.6.1 -> v0.6.2 age confidence indirect patch
github.com/prometheus/common v0.62.0 -> v0.67.2 age confidence indirect minor
github.com/prometheus/procfs v0.15.1 -> v0.19.2 age confidence indirect minor
github.com/spf13/cast v1.7.0 -> v1.10.0 age confidence indirect minor
github.com/spf13/pflag v1.0.9 -> v1.0.10 age confidence indirect patch
go.opentelemetry.io/otel v1.35.0 -> v1.38.0 age confidence indirect minor
go.opentelemetry.io/otel/trace v1.35.0 -> v1.38.0 age confidence indirect minor
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3 age confidence indirect patch
golang.org/x/oauth2 v0.30.0 -> v0.33.0 age confidence indirect minor
golang.org/x/sync v0.17.0 -> v0.18.0 age confidence indirect minor
golang.org/x/sys v0.37.0 -> v0.38.0 age confidence indirect minor
golang.org/x/time v0.12.0 -> v0.14.0 age confidence indirect minor
golang.org/x/tools v0.37.0 -> v0.38.0 age confidence indirect minor
gomodules.xyz/jsonpatch/v2 v2.4.0 -> v2.5.0 age confidence indirect minor
google.golang.org/genproto/googleapis/rpc a0af3ef -> f26f940 age confidence indirect digest
google.golang.org/protobuf v1.36.5 -> v1.36.10 age confidence indirect patch
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0 age confidence indirect minor
k8s.io/kube-openapi f3f2b99 -> 589584f age confidence indirect digest
sigs.k8s.io/json cfa47c3 -> 2d32026 age confidence indirect digest

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

cyphar/filepath-securejoin (github.com/cyphar/filepath-securejoin)

v0.6.0

Compare Source

This is our first release of github.com/cyphar/filepath-securejoin,
containing a full implementation with a coverage of 93.5% (the only missing
cases are the error cases, which are hard to mocktest at the moment).

v0.5.1: -- "Spooky scary skeletons send shivers down your spine!"

Compare Source

Changed
  • openat2 can return -EAGAIN if it detects a possible attack in certain
    scenarios (namely if there was a rename or mount while walking a path with a
    .. component). While this is necessary to avoid a denial-of-service in the
    kernel, it does require retry loops in userspace.

    In previous versions, pathrs-lite would retry openat2 32 times before
    returning an error, but we've received user reports that this limit can be
    hit on systems with very heavy load. In some synthetic benchmarks (testing
    the worst-case of an attacker doing renames in a tight loop on every core of
    a 16-core machine) we managed to get a ~3% failure rate in runc. We have
    improved this situation in two ways:

    • We have now increased this limit to 128, which should be good enough for
      most use-cases without becoming a denial-of-service vector (the number of
      syscalls called by the O_PATH resolver in a typical case is within the
      same ballpark). The same benchmarks show a failure rate of ~0.12% which
      (while not zero) is probably sufficient for most users.

    • In addition, we now return a unix.EAGAIN error that is bubbled up and can
      be detected by callers. This means that callers with stricter requirements
      to avoid spurious errors can choose to do their own infinite EAGAIN retry
      loop (though we would strongly recommend users use time-based deadlines in
      such retry loops to avoid potentially unbounded denials-of-service).

v0.5.0

Compare Source

This is our first release of github.com/cyphar/filepath-securejoin,
containing a full implementation with a coverage of 93.5% (the only missing
cases are the error cases, which are hard to mocktest at the moment).

emicklei/go-restful (github.com/emicklei/go-restful/v3)

v3.13.0

Compare Source

  • optimize performance of path matching in CurlyRouter ( thanks @​wenhuang, Wen Huang)
go-logr/logr (github.com/go-logr/logr)

v1.4.3

Compare Source

Minor release.

What's Changed

New Contributors

Full Changelog: go-logr/logr@v1.4.2...v1.4.3

go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)

v0.22.1

Compare Source

v0.22.0

Compare Source

v0.21.2

Compare Source

v0.21.1

Compare Source

go-openapi/jsonreference (github.com/go-openapi/jsonreference)

v0.21.2

Compare Source

v0.21.1

Compare Source

v0.21.0

Compare Source

v0.20.5

Compare Source

v0.20.4

Compare Source

v0.20.3

Compare Source

mailru/easyjson (github.com/mailru/easyjson)

v0.9.1

Compare Source

What's Changed

New Contributors

Full Changelog: mailru/easyjson@v0.9.0...v0.9.1

v0.9.0

Compare Source

up go version and bugfixes

v0.8.0

Compare Source

stable version before go version bump

prometheus/client_golang (github.com/prometheus/client_golang)

v1.23.2: - 2025-09-05

Compare Source

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

All Changes

Full Changelog: prometheus/client_golang@v1.23.1...v1.23.2

v1.23.1: - 2025-09-04

Compare Source

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

All Changes

Full Changelog: prometheus/client_golang@v1.23.0...v1.23.1

v1.23.0: - 2025-07-30

Compare Source

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #​1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #​1766
  • [FEATURE] Add exemplars for native histograms #​1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #​1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #​1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #​1729
All Changes * Update example test by @​SuperQ in https://github.com/prometheus/client_golang/pull/1770 * build(deps): bump golang.org/x/net from 0.34.0 to 0.36.0 in /tutorials/whatsup by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1776 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1771 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1778 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1779 * build(deps): bump google.golang.org/protobuf from 1.36.5 to 1.36.6 in /exp by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1782 * build(deps): bump github.com/prometheus/common from 0.62.0 to 0.63.0 in /exp by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1781 * build(deps): bump github.com/prometheus/common from 0.62.0 to 0.63.0 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1783 * build(deps): bump google.golang.org/protobuf from 1.36.5 to 1.36.6 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1784 * build(deps): bump github.com/prometheus/procfs from 0.15.1 to 0.16.0 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1786 * chore: Upgrade golangci-lint to v2 by @​kakkoyun in https://github.com/prometheus/client_golang/pull/1789 * build(deps): bump the github-actions group across 1 directory with 3 updates by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1790 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1791 * Add `WrapCollectorWith` and `WrapCollectorWithPrefix` by @​colega in https://github.com/prometheus/client_golang/pull/1766 * feat(github-actions): add Go file change detection to golangci-lint workflow by @​kakkoyun in https://github.com/prometheus/client_golang/pull/1794 * chore(ci): Fix flaky tests by @​kakkoyun in https://github.com/prometheus/client_golang/pull/1795 * build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 in /tutorials/whatsup by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1799 * test(registry): Add goleak-based goroutine leak detection by @​surinkim in https://github.com/prometheus/client_golang/pull/1797 * build(deps): bump go.uber.org/goleak from 1.2.0 to 1.3.0 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1806 * build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1804 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1809 * Add exemplars for native histograms by @​shivanthzen in https://github.com/prometheus/client_golang/pull/1686 * build(deps): bump golang.org/x/sys from 0.30.0 to 0.32.0 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1807 * build(deps): bump github.com/prometheus/client_model from 0.6.1 to 0.6.2 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1805 * build(deps): bump github.com/prometheus/procfs from 0.16.0 to 0.16.1 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1808 * build(deps): bump golang.org/x/net from 0.35.0 to 0.38.0 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1800 * Update supported Go versions by @​SuperQ in https://github.com/prometheus/client_golang/pull/1812 * Cleaup Go modules by @​SuperQ in https://github.com/prometheus/client_golang/pull/1813 * fix: client prompt return on context cancellation by @​umegbewe in https://github.com/prometheus/client_golang/pull/1729 * Simplify buf binary install by @​SuperQ in https://github.com/prometheus/client_golang/pull/1814 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1815 * build(deps): bump the github-actions group with 5 updates by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1817 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1821 * exp/api: Bubble up status code from writeResponse by @​saswatamcode in https://github.com/prometheus/client_golang/pull/1823 * build(deps): bump github.com/prometheus/common from 0.64.0 to 0.65.0 by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1827 * build(deps): bump github.com/prometheus/common from 0.64.0 to 0.65.0 in /exp by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1828 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1831 * Update runtime metrics for Go v1.23 and v1.24 by @​aknuds1 in https://github.com/prometheus/client_golang/pull/1833 * Fix `errNotImplemented` reference by @​aknuds1 in https://github.com/prometheus/client_golang/pull/1835 * build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in https://github.com/prometheus/client_golang/pull/1826 * Synchronize common files from prometheus/prometheus by @​prombot in https://github.com/prometheus/client_golang/pull/1832 * Cut v1.23.0-rc.0 by @​vesari in https://github.com/prometheus/client_golang/pull/1837 * cut v1.23.0-rc.1 by @​vesari in https://github.com/prometheus/client_golang/pull/1842

New Contributors

Full Changelog: prometheus/client_golang@v1.22.0...v1.23.0

prometheus/common (github.com/prometheus/common)

v0.67.2

Compare Source

v0.67.1

Compare Source

v0.67.0

Compare Source

v0.66.1

Compare Source

This release has no functional changes, it just drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement).

What's Changed

Full Changelog: prometheus/common@v1.20.99...v0.66.1

v0.66.0

Compare Source

⚠️ Breaking Changes ⚠️
  • A default-constructed TextParser will be invalid. It must have a valid scheme set, so users should use the NewTextParser function to create a valid TextParser. Otherwise parsing will panic with "Invalid name validation scheme requested: unset".
What's Changed
New Contributors

v0.65.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.64.0...v0.65.0

v0.64.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.63.0...v0.64.0

v0.63.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.62.0...v0.63.0

prometheus/procfs (github.com/prometheus/procfs)

v0.19.2

Compare Source

What's Changed

Full Changelog: prometheus/procfs@v0.19.1...v0.19.2

v0.19.1

Compare Source

What's Changed

Full Changelog: prometheus/procfs@v0.19.0...v0.19.1

v0.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/procfs@v0.18.0...v0.19.0

v0.18.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/procfs@v0.17.0...v0.18.0

v0.17.0

Compare Source

What's Changed

  • Synchronize common files from prometheus/prometheus by @​prombot in #​718
  • Synchronize common files from prometheus/prometheus by @​prombot in #​721
  • btrfs: correct allocation ratios for raid1c[34] by @​SimSaladin in #​722
  • build(deps): bump golang.org/x/sync from 0.13.0 to 0.14

Configuration

📅 Schedule: Branch creation - "on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux red-hat-konflux bot force-pushed the konflux/mintmaker/backplane-2.10-backplane-2.10/go-deps branch from 9516b35 to f9407c2 Compare November 9, 2025 16:42
@red-hat-konflux red-hat-konflux bot force-pushed the konflux/mintmaker/backplane-2.10-backplane-2.10/go-deps branch 3 times, most recently from 124810e to f3a037f Compare November 9, 2025 16:44
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux red-hat-konflux bot force-pushed the konflux/mintmaker/backplane-2.10-backplane-2.10/go-deps branch from f3a037f to 882ebe9 Compare November 9, 2025 16:45
@openshift-ci
Copy link

openshift-ci bot commented Nov 9, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign qiujian16 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

1 similar comment
@openshift-ci
Copy link

openshift-ci bot commented Nov 9, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign qiujian16 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants