Skip to content

🌱(deps): Bump the all-go-deps group across 1 directory with 5 updates - #480

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-go-deps-af9613c2ac
Open

🌱(deps): Bump the all-go-deps group across 1 directory with 5 updates#480
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-go-deps-af9613c2ac

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-go-deps group with 5 updates in the / directory:

Package From To
cloud.google.com/go/cloudsqlconn 1.25.3 1.26.0
github.com/prometheus/client_golang 1.24.1 1.25.0
golang.org/x/mod 0.41.0 0.42.0
golang.org/x/sync 0.23.0 0.24.0
google.golang.org/grpc 1.84.0 1.85.0

Updates cloud.google.com/go/cloudsqlconn from 1.25.3 to 1.26.0

Release notes

Sourced from cloud.google.com/go/cloudsqlconn's releases.

v1.26.0

1.26.0 (2026-10-29)

Features

v1.25.4

1.25.4 (2026-10-14)

Bug Fixes

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Changelog

Sourced from cloud.google.com/go/cloudsqlconn's changelog.

1.26.0 (2026-10-29)

Features

  • add built-in client metrics exported to Cloud Monitoring, on by default (BETA) (#1123) (a814420)

1.25.4 (2026-10-14)

Bug Fixes

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Commits
  • 7f5e5b9 chore(main): release 1.26.0 (#1201)
  • fc340ae deps: update dependencies to latest (#1192)
  • a814420 feat: add built-in client metrics exported to Cloud Monitoring, on by default...
  • 6797309 chore(main): release 1.25.4 (#1172)
  • d6088c5 fix: Update dependencies (#1171)
  • 3414344 deps: update all dependencies to latest (#1170)
  • 70e1852 ci: remove pull_request_review trigger from multi-approvers workflow (#1169)
  • ea5e6aa docs: add note on pgx v5.11.0+ keyword/value connection string escaping (#1166)
  • See full diff in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits
  • 36f2d70 errgroup: modernize the usage of closures in goroutines
  • See full diff in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
🌱(deps): Bump the all-go-deps group across 1 directory with 5 updates
a984328 
Bumps the all-go-deps group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/cloudsqlconn](https://github.com/googlecloudplatform/cloud-sql-go-connector) | `1.25.3` | `1.26.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` | `0.42.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.84.0` | `1.85.0` |



Updates `cloud.google.com/go/cloudsqlconn` from 1.25.3 to 1.26.0
- [Release notes](https://github.com/googlecloudplatform/cloud-sql-go-connector/releases)
- [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/blob/main/CHANGELOG.md)
- [Commits](GoogleCloudPlatform/cloud-sql-go-connector@v1.25.3...v1.26.0)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.84.0...v1.85.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/cloudsqlconn
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants