dev: bump the safe group across 1 directory with 25 updates by dependabot[bot] · Pull Request #7994 · TheThingsNetwork/lorawan-stack

dependabot · 2026-08-10T22:58:00Z

Bumps the safe group with 13 updates in the / directory:

Package	From	To
github.com/aws/aws-sdk-go-v2/config	`1.32.24`	`1.32.35`
github.com/aws/aws-sdk-go-v2/service/s3	`1.103.3`	`1.107.0`
github.com/coder/websocket	`1.8.14`	`1.8.15`
github.com/felixge/httpsnoop	`1.0.4`	`1.1.0`
github.com/getsentry/sentry-go	`0.46.2`	`0.48.0`
github.com/grpc-ecosystem/grpc-gateway/v2	`2.29.0`	`2.30.0`
github.com/jarcoal/httpmock	`1.4.1`	`1.4.2`
github.com/klauspost/compress	`1.18.6`	`1.19.2`
github.com/nats-io/nats-server/v2	`2.14.2`	`2.14.4`
github.com/oklog/ulid/v2	`2.1.1`	`2.1.2`
github.com/prometheus/client_golang	`1.23.2`	`1.24.1`
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux	`0.69.0`	`0.70.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`1.44.0`	`1.45.0`

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.24 to 1.32.35

Commits

ebd1f6a Release 2026-08-05
bc99825 Regenerated Clients
8868ff7 Update API model
9604fe3 Set FIPS-approved TLS curve preferences when the FIPS module is active (#3499)
4af61eb Release 2026-08-04
73d66ab Regenerated Clients
e830452 Update API model
5d3779f Release 2026-08-03
27a73ff Regenerated Clients
8b197b7 Update API model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.103.3 to 1.107.0

Commits

8e53001 Release 2026-08-06
c1512a0 Regenerated Clients
655c574 Update endpoints model
22a51fa Update API model
ebd1f6a Release 2026-08-05
bc99825 Regenerated Clients
8868ff7 Update API model
9604fe3 Set FIPS-approved TLS curve preferences when the FIPS module is active (#3499)
4af61eb Release 2026-08-04
73d66ab Regenerated Clients
Additional commits viewable in compare view

Updates github.com/coder/websocket from 1.8.14 to 1.8.15

Release notes

Sourced from github.com/coder/websocket's releases.

v1.8.15

Changes

chore: fix typo in Accept function by @IgorSilvestre in coder/websocket#544

fix: transmit in single frame when compression enabled by @DanielleMaywood in coder/websocket#552

docs: add document for AI agents (AGENTS.md) by @mafredri in coder/websocket#547

docs: remove mention of resolved issue in README by @tamird in coder/websocket#556

docs: fix lint issue by @mafredri in coder/websocket#557

docs: fix roadmap links after repo transfer by @GeObts in coder/websocket#558

avoid per-frame cleanup closures on read to remove 2 allocs per frame read by @mitchellh in coder/websocket#565

conn: skip timeout callbacks for background contexts by @mitchellh in coder/websocket#566

New Contributors

@IgorSilvestre made their first contribution in coder/websocket#544

@tamird made their first contribution in coder/websocket#556

@GeObts made their first contribution in coder/websocket#558

@mitchellh made their first contribution in coder/websocket#565

Full Changelog: coder/websocket@v1.8.14...v1.8.15

Commits

9c8faad conn: skip timeout callbacks for background contexts (#566)
7039364 avoid per-frame cleanup closures on read to remove 2 allocs per frame read (#...
d099e16 docs: fix roadmap links (#558)
c98e9dc docs: fix lint issue (#557)
39b7b07 docs: remove mention of resolved issue in README (#556)
9f473ad docs: add document for AI agents (AGENTS.md) (#547)
8d3545a fix: transmit in single frame when compression enabled (#552)
8bf6dd2 chore: fix typo in Accept function (#544)
See full diff in compare view

Updates github.com/felixge/httpsnoop from 1.0.4 to 1.1.0

Release notes

Sourced from github.com/felixge/httpsnoop's releases.

v1.1.0

felixge/httpsnoop@v1.0.4...v1.1.0

Commits

0fc9006 fix: preserve hooks for added writer interfaces (#35)
e413b2a Bump golang version, add io.StringWriter and improve performance (#33)
9a9390b fix: populate duration when handler panics (#31)
d3fc968 feat: Support SetReadDeadline, SetWriteDeadline and EnableFullDuplex (#29)
See full diff in compare view

Updates github.com/getsentry/sentry-go from 0.46.2 to 0.48.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.48.0

Breaking Changes 🛠

Remove issue creation from logging integrations by @giortzisg in #1340

New Features ✨
Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by @giortzisg in #1339

For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
// Opt in to the new data collection defaults. Omitted fields use their
// defaults: user info, cookies, headers, query params, and supported HTTP
// bodies are collected, with sensitive values filtered.
DataCollection: &amp;sentry.DataCollection{},

})
To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
    DataCollection: &sentry.DataCollection{
        UserInfo:   sentry.Set(false),
        HTTPBodies: []sentry.BodyType{},
    },
})
PushScope shorthand now returns the new scope reference by @DoctorJohn in #1335
Bug Fixes 🐛

Fix fiber route name when using middlewares by @giortzisg in #1363

Omit empty event id for standalone client reports by @giortzisg in #1362

Preserve '%' literal in log messages by @giortzisg in #1358

Unaligned 64-bit atomic panic on 32-bit platforms in telemetry buffers by @Kirill-INQ in #1355

Isolate event processor across clones by @giortzisg in #1337

Internal Changes 🔧

Deps

Bump fiber/v2 to 2.52.14 by @giortzisg in #1359

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #1349

Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #1346

Bump codecov/codecov-action from 6.0.0 to 7.0.0 by @dependabot in #1347

Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #1343

Bump golang.org/x/crypto to 0.52.0 and golang/x/net to 0.55.0 by @giortzisg in #1341

Bump getsentry/github-workflows/validate-pr from c802283cd9075b7a2b7a32655019c21c21676e34 to 4013fc6e1aeb1be1f9d3b4d232624f0ec1afa613 by @dependabot in #1344

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.48.0

Breaking Changes 🛠

Remove issue creation from logging integrations by @giortzisg in #1340

New Features ✨
Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by @giortzisg in #1339

For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
// Opt in to the new data collection defaults. Omitted fields use their
// defaults: user info, cookies, headers, query params, and supported HTTP
// bodies are collected, with sensitive values filtered.
DataCollection: &amp;sentry.DataCollection{},

})
To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
    DataCollection: &sentry.DataCollection{
        UserInfo:   sentry.Set(false),
        HTTPBodies: []sentry.BodyType{},
    },
})
PushScope shorthand now returns the new scope reference by @DoctorJohn in #1335
Bug Fixes 🐛

Fix fiber route name when using middlewares by @giortzisg in #1363

Omit empty event id for standalone client reports by @giortzisg in #1362

Preserve '%' literal in log messages by @giortzisg in #1358

Unaligned 64-bit atomic panic on 32-bit platforms in telemetry buffers by @Kirill-INQ in #1355

Isolate event processor across clones by @giortzisg in #1337

Internal Changes 🔧

Deps

Bump fiber/v2 to 2.52.14 by @giortzisg in #1359

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #1349

Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #1346

Bump codecov/codecov-action from 6.0.0 to 7.0.0 by @dependabot in #1347

Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #1343

Bump golang.org/x/crypto to 0.52.0 and golang/x/net to 0.55.0 by @giortzisg in #1341

... (truncated)

Commits

d02f9ba release: 0.48.0
99c424f feat!: remove issue creation from logging integrations (#1340)
d1c1d3f feat: parse request body for outgoing http (#1339)
9b5cab2 fix: fix fiber route name when using middlewares (#1363)
07a7975 fix: omit empty event id for standalone client reports (#1362)
c255382 build(deps): bump fiber/v2 to 2.52.14 (#1359)
06c58dc ci: remove changelog-preview and codecov actions (#1357)
a99e044 fix: preserve '%' literal in log messages (#1358)
8aaf1d4 feat: apply sensitive data filters to grpc & sql (#1333)
4347773 feat: apply sensitive data filters to http (#1332)
Additional commits viewable in compare view

Updates github.com/grpc-ecosystem/grpc-gateway/v2 from 2.29.0 to 2.30.0

Release notes

Sourced from github.com/grpc-ecosystem/grpc-gateway/v2's releases.

v2.30.0

New Features

protoc-gen-openapiv3: Brand new minimal OpenAPI v3 generator (#6623), plus follow-ups:

Visibility selectors (#6673)

disable_default_errors option (#6672)

Annotation support (#6681)

Improved plugin error surfacing (#6937)

field_behavior REQUIRED support for query parameters (#7180) — @maydietwice

openapiv3-merge: New standalone tool for merging OpenAPI v3 documents (#6771) — @johanbrandhorst

protoc-gen-openapiv2 moved to the protoc toolchain (#6988) — @EliSauder

Fixes

Change PR Contributor

OpenAPI v2: messages sorted before rendering definitions for determinism #6732 @alliasgher

OpenAPI v2: enum comments now go to description instead of title #6785 @superShen0916

OpenAPI v2: include field schema metadata on parameters #6894 @puneetdixit200

OpenAPI v2: omit empty body objects for nested path parameters #7065 @alliasgher

OpenAPI v3: omit empty body objects for nested path parameters #7068 @alliasgher

OpenAPI v2: preserve x-nullable when use_allof_for_refs wraps a $ref #7026 @pkhanaljc

OpenAPI v2: fix path joining for colon-prefixed segments #7191 @Ritik100-AIT

Prioritize OpenAPI config options over proto options #6973 @maskedmaxx

Support Service doc comments for OpenAPI/Swagger generation #6200 @majiayu000

Fix nested body path initialization for oneof fields #6948 @cyphercodes

Remove redundant enum assignment for nested proto3 fields #7059 @abhishek-dalbanjan

Drain request only after ParseForm in generated code #7192 @paskozdilar

Support field extensions with use_allof_for_refs #3100 @same-id

Ignore M import-path mappings in openapiv3 plugin params #6936 @johanbrandhorst

Documentation

Clarify HttpBody download usage (#6904) — @ketpatil77

Clarify Go tool dependency options (#7042) — @hawk-roy

Add a runnable OpenTelemetry tracing example (#7110) — @hsdfat

Fix SLSA link in README (#7149) — @ZayanKhan-12

Explain Buf strategy for shared API config (#7147) — @dlanov

Tests / CI / Infra

Add test coverage for slice converters in convert.go (#7041) — @viniciusmtsantos

Remove Java swagger generator test dependency (#6735) — @johanbrandhorst

CI improvements — go-version-file usage, release workflow tag input, checkout ref fixes, node_test timeouts, Node 22 LTS for browser tests (avoids a Node 24 zlib hang) (#6627, #6632, #6633, #6867, #6868) — @johanbrandhorst

Better Bazel caching; auto-merge job for dependabot PRs (#6667, #6668) — @johanbrandhorst

Run gazelle on openapiv3 files; add missing Bazel files (#6734, #6738) — @johanbrandhorst

New Contributors

@alliasgher, @superShen0916, @puneetdixit200, @ketpatil77, @EliSauder, @maskedmaxx, @hawk-roy, @viniciusmtsantos, @cyphercodes, @abhishek-dalbanjan, @hsdfat, @ZayanKhan-12, @dlanov, @maydietwice, @pkhanaljc, @Ritik100-AIT

... (truncated)

Commits

1debdea Fix openapiv2 path joining for colon-prefixed segments (#7191)
561f393 Drain request only after ParseForm in generated code (#7192)
a16cad8 fix(openapiv2): preserve x-nullable when use_allof_for_refs wraps $ref (#7026)
544d99d openapiv3: support field_behavior REQUIRED for query parameters (#7180)
89a9e41 chore(deps): update google/oss-fuzz digest to 3ea2a9b (#7195)
42ced5f fix(deps): update opentelemetry-go-contrib monorepo to v0.70.0 (#7194)
c63e364 chore(deps): update googleapis digest to 5739471 (#7193)
873f41a chore(deps): update google/oss-fuzz digest to 8d292af (#7190)
f56f8ad chore(deps): update googleapis digest to f3ff3a1 (#7189)
3087cc7 build(deps-dev): bump fast-uri in /examples/internal/browser (#7187)
Additional commits viewable in compare view

Updates github.com/jarcoal/httpmock from 1.4.1 to 1.4.2

Release notes

Sourced from github.com/jarcoal/httpmock's releases.

v1.4.2

What's Changed

test: also test with go v1.26 and use golangci-lint v2.9.0 by @maxatome in jarcoal/httpmock#166

test: use golangci-lint v2.12.2 by @maxatome in jarcoal/httpmock#167

test: update install-go by @maxatome in jarcoal/httpmock#168

feat: Responder.Delay can be interrupted by context cancellation by @maxatome in jarcoal/httpmock#169

Full Changelog: jarcoal/httpmock@v1.4.1...v1.4.2

Commits

1ddfb9e feat: Responder.Delay can be interrupted by context cancellation (#169)
a796508 test: update install-go
52e7107 test: use golangci-lint v2.12.2
0147409 test: also test with go v1.26 and use golangci-lint v2.9.0
See full diff in compare view

Updates github.com/klauspost/compress from 1.18.6 to 1.19.2

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.19.2

What's Changed

huff0: add arm64 assembly for Decompress4X/1X via avo lowering by @lizthegrey in klauspost/compress#1172

zstd: Re-enable unsafe decodeSync memory copies (#1168) by @lizthegrey in klauspost/compress#1171

zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by @lizthegrey in klauspost/compress#1176

zstd: avoid racing MaxDecodedSize write on shared dict litEnc by @zanarellidev in klauspost/compress#1182

zstd: keep BuildDict recent-offsets positive and loadable by @zanarellidev in klauspost/compress#1184

zstd: handle zero-literal BuildDict corpus by @cyphercodes in klauspost/compress#1178

zstd: don't clear the registered dictionary when decoding past the window by @sueun-dev in klauspost/compress#1177

New Contributors

@zanarellidev made their first contribution in klauspost/compress#1183

@cyphercodes made their first contribution in klauspost/compress#1178

@sueun-dev made their first contribution in klauspost/compress#1177

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

What's Changed

zstd: Validate SnappyConverter literal copies by @klauspost in klauspost/compress#1170

flate: use Peek instead of ReadByte for the bufio.Reader decode path by @joechenrh in klauspost/compress#1169

zstd: bump avo pin, regenerate arm64 asm by @lizthegrey in klauspost/compress#1167

New Contributors

@joechenrh made their first contribution in klauspost/compress#1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

What's Changed

zstd: Add true concurrent stream encoding by @klauspost in klauspost/compress#1136

zstd: arm64 decoder asm by @lizthegrey in klauspost/compress#1160

zstd: avoid unused BuildDict encoder allocation by @snissn in klauspost/compress#1147

flate: Add inflate checkpoints by @klauspost in klauspost/compress#1154

snappy/s2: Limit length of varint in decodedLen by @eustas in klauspost/compress#1148

gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in klauspost/compress#1149

zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in klauspost/compress#1150

huff0: Allow building tables from histogram. by @klauspost in klauspost/compress#1155

huff0: Allow building table from oversized histogram. by @klauspost in klauspost/compress#1156

s2sx: Clean symlink targets by @klauspost in klauspost/compress#1163

New Contributors

@snissn made their first contribution in klauspost/compress#1147

@eustas made their first contribution in klauspost/compress#1148

@z9z made their first contribution in klauspost/compress#1149

@SAY-5 made their first contribution in klauspost/compress#1150

@HNO3Miracle made their first contribution in klauspost/compress#1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

... (truncated)

Commits

c3b3439 zstd: don't clear the registered dictionary when decoding past the window (#1...
9874bc9 fix(zstd): handle zero-literal BuildDict corpus (#1178)
71bb6fd zstd: keep BuildDict recent-offsets positive and loadable (#1184)
3d4dacb zstd: avoid racing MaxDecodedSize write on shared dict litEnc (#1182)
3ceaa81 build(deps): bump the github-actions group with 5 updates (#1185)
72cb4d3 chore: add OpenSSF Scorecard GitHub Action (#1183)
69c9db4 zstd: fix arm64 asm locals overwriting the saved link register (#1176)
117430d zstd: Re-enable unsafe decodeSync memory copies (#1168) (#1171)
c73af0c huff0: add arm64 assembly for Decompress4X/1X via avo lowering (#1172)
2602f4a Update changelog for version 1.19.0
Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.14.2 to 2.14.4

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.14.4

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

1.26.5 (#8435)

Dependencies

github.com/klauspost/compress v1.19.0 (#8385)

golang.org/x/crypto v0.54.0 (#8385)

golang.org/x/sys v0.47.0 (#8385)

github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op (#8385)

Improved

JetStream

The Raft transport layer has been decoupled, improves testing but does not change server behaviour (#8181)

The disk concurrency semaphore has been increased to 4096 slots, up from the previous CPU-scaled count (#8336)

The disk concurrency semaphore can now be configured with the max_concurrent_io option in the jetstream config block (#8336)

Filestore underlying block cache buffers are now recycled to the pool when the weak reference is collected by the GC, which should smooth out memory usage with some usage patterns (#8395)

Calculating and looking up sequences in delete maps for file-backed streams with large numbers of interior deletes is now faster and holds locks for less time (#8403)

Inserts, iterations and deletes in AVL sequence sets are now faster in many cases, which speeds up the tracking of interior deletes (#8406)

Stream snapshots now attempt to determine the correct encode buffer size up front, avoiding many unnecessary allocations on streams with large numbers of interior deletes (#8405)

Reduced memory usage of the structure that is used to track subjects within a stream (#8412)

Fixed

General

allow_non_tls will no longer log an incorrect message at startup claiming that TLS is required (#8420)

Combining no_auth_user with auth callouts will no longer skip authentication checks when no CONNECT message is sent

JWT validation no longer crashes the server with whitespace-only permissions

Several paths that enforce the permissions of queue subscriptions no longer treat the whole permission as a subject literal

Several JetStream and MQTT endpoints now correctly guard against null values in JSON

Fixed an authentication bypass with TLS verify_and_map authenticating users with blank passwords

Monitoring

The healthz endpoint will now skip and no longer report on expired JWT accounts (#8379, thanks to @ByapakSigdel)

The varz endpoint will now correctly report JetStream limits after they were changed via a config reload (#8394)

JetStream

Malformed cluster replicated acks or delivered updates are now correctly rejected by the decoder (#8284, thanks to @uwezkhan)

Malformed cluster replicated skip or reset updates are now correctly rejected by the decoder (#8345, thanks to @uwezkhan)

Empty cluster replicated entries are now correctly ignored (#8347, thanks to @uwezkhan)

... (truncated)

Commits

bbd6dc5 Release v2.14.4
7d26d07 Update to Go 1.26.5/1.25.12
c7163b2 Release v2.14.4-RC.4
ee56a6c Cherry-picks for 2.14.4-RC.4 (#147)
725f008 [FIXED] Certificate users authenticatable by username on other listeners
566e772 [FIXED] Block MQTT subscriptions to internal MQTT subjects
43607c4 [FIXED] Consumer assignment proposed without a raft group
3b90b2c [FIXED] Panic setting up a stream source/mirror on malformed create response
f44c537 [FIXED] Panic decoding MQTT retained messages, sessions and JS API replies
c6c7061 [FIXED] Panic decoding counter source with null entry
Additional commits viewable in compare view

Updates github.com/oklog/ulid/v2 from 2.1.1 to 2.1.2

Release notes

Sourced from github.com/oklog/ulid/v2's releases.

v2.1.2

What's Changed

fix: Scan accepts text-encoded ULIDs in []byte by @sonnemusk in oklog/ulid#134

New Contributors

@sonnemusk made their first contribution in oklog/ulid#134

Full Changelog: oklog/ulid@v2.1.1...v2.1.2

Commits

75921a7 fix: Scan accepts text-encoded ULIDs in []byte (#134)
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Ad... Description has been truncated

Bumps the safe group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.24` | `1.32.35` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.103.3` | `1.107.0` | | [github.com/coder/websocket](https://github.com/coder/websocket) | `1.8.14` | `1.8.15` | | [github.com/felixge/httpsnoop](https://github.com/felixge/httpsnoop) | `1.0.4` | `1.1.0` | | [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) | `0.46.2` | `0.48.0` | | [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.29.0` | `2.30.0` | | [github.com/jarcoal/httpmock](https://github.com/jarcoal/httpmock) | `1.4.1` | `1.4.2` | | [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.18.6` | `1.19.2` | | [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.2` | `2.14.4` | | [github.com/oklog/ulid/v2](https://github.com/oklog/ulid) | `2.1.1` | `2.1.2` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.69.0` | `0.70.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.24 to 1.32.35 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.32.24...config/v1.32.35) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.103.3 to 1.107.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.103.3...service/s3/v1.107.0) Updates `github.com/coder/websocket` from 1.8.14 to 1.8.15 - [Release notes](https://github.com/coder/websocket/releases) - [Commits](coder/websocket@v1.8.14...v1.8.15) Updates `github.com/felixge/httpsnoop` from 1.0.4 to 1.1.0 - [Release notes](https://github.com/felixge/httpsnoop/releases) - [Commits](felixge/httpsnoop@v1.0.4...v1.1.0) Updates `github.com/getsentry/sentry-go` from 0.46.2 to 0.48.0 - [Release notes](https://github.com/getsentry/sentry-go/releases) - [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-go@v0.46.2...v0.48.0) Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.29.0 to 2.30.0 - [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases) - [Commits](grpc-ecosystem/grpc-gateway@v2.29.0...v2.30.0) Updates `github.com/jarcoal/httpmock` from 1.4.1 to 1.4.2 - [Release notes](https://github.com/jarcoal/httpmock/releases) - [Commits](jarcoal/httpmock@v1.4.1...v1.4.2) Updates `github.com/klauspost/compress` from 1.18.6 to 1.19.2 - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](klauspost/compress@v1.18.6...v1.19.2) Updates `github.com/nats-io/nats-server/v2` from 2.14.2 to 2.14.4 - [Release notes](https://github.com/nats-io/nats-server/releases) - [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md) - [Commits](nats-io/nats-server@v2.14.2...v2.14.4) Updates `github.com/oklog/ulid/v2` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/oklog/ulid/releases) - [Changelog](https://github.com/oklog/ulid/blob/main/CHANGELOG.md) - [Commits](oklog/ulid@v2.1.1...v2.1.2) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux` from 0.69.0 to 0.70.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.69.0...zpages/v0.70.0) Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.69.0 to 0.70.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.69.0...zpages/v0.70.0) Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.69.0 to 0.70.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.69.0...zpages/v0.70.0) Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/trace` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `golang.org/x/net` from 0.55.0 to 0.57.0 - [Commits](golang/net@v0.55.0...v0.57.0) Updates `golang.org/x/sync` from 0.21.0 to 0.22.0 - [Commits](golang/sync@v0.21.0...v0.22.0) Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20260526163538-3dc84a4a5aaa to 0.0.0-20260803160001-6ac0973c030d - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260526163538-3dc84a4a5aaa to 0.0.0-20260803160001-6ac0973c030d - [Commits](https://github.com/googleapis/go-genproto/commits) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.35 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.107.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: github.com/coder/websocket dependency-version: 1.8.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe - dependency-name: github.com/felixge/httpsnoop dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: github.com/getsentry/sentry-go dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2 dependency-version: 2.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: github.com/jarcoal/httpmock dependency-version: 1.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe - dependency-name: github.com/klauspost/compress dependency-version: 1.19.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: github.com/nats-io/nats-server/v2 dependency-version: 2.14.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe - dependency-name: github.com/oklog/ulid/v2 dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux dependency-version: 0.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc dependency-version: 0.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp dependency-version: 0.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/otel dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/otel/metric dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe - dependency-name: google.golang.org/genproto/googleapis/api dependency-version: 0.0.0-20260803160001-6ac0973c030d dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260803160001-6ac0973c030d dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 10, 2026

dependabot Bot requested a review from a team as a code owner August 10, 2026 22:58

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026

dependabot Bot requested a review from halimi August 10, 2026 22:58

dependabot Bot added the go Pull requests that update Go code label Aug 10, 2026

dependabot Bot changed the base branch from v3.36 to v3.37 August 12, 2026 11:50

Navigation Menu

Uh oh!

dev: bump the safe group across 1 directory with 25 updates - #7994

dev: bump the safe group across 1 directory with 25 updates#7994
dependabot[bot] wants to merge 1 commit into
v3.37from
dependabot/go_modules/safe-29cbca5f76

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Change	PR	Contributor
OpenAPI v2: messages sorted before rendering definitions for determinism	#6732	`@alliasgher`
OpenAPI v2: enum comments now go to `description` instead of `title`	#6785	`@superShen0916`
OpenAPI v2: include field schema metadata on parameters	#6894	`@puneetdixit200`
OpenAPI v2: omit empty body objects for nested path parameters	#7065	`@alliasgher`
OpenAPI v3: omit empty body objects for nested path parameters	#7068	`@alliasgher`
OpenAPI v2: preserve `x-nullable` when `use_allof_for_refs` wraps a `$ref`	#7026	`@pkhanaljc`
OpenAPI v2: fix path joining for colon-prefixed segments	#7191	`@Ritik100-AIT`
Prioritize OpenAPI config options over proto options	#6973	`@maskedmaxx`
Support Service doc comments for OpenAPI/Swagger generation	#6200	`@majiayu000`
Fix nested body path initialization for oneof fields	#6948	`@cyphercodes`
Remove redundant enum assignment for nested proto3 fields	#7059	`@abhishek-dalbanjan`
Drain request only after `ParseForm` in generated code	#7192	`@paskozdilar`
Support field extensions with `use_allof_for_refs`	#3100	`@same-id`
Ignore `M` import-path mappings in openapiv3 plugin params	#6936	`@johanbrandhorst`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026

v1.8.15

Changes

New Contributors

v1.1.0

0.48.0

Breaking Changes 🛠

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

Deps

0.48.0

Breaking Changes 🛠

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

Deps

v2.30.0

New Features

Fixes

Documentation

Tests / CI / Infra

New Contributors

v1.4.2

What's Changed

v1.19.2

What's Changed

New Contributors

v1.19.1

What's Changed

New Contributors

v1.19.0

What's Changed

New Contributors

Release v2.14.4

Changelog

Go Version

Dependencies

Improved

Fixed

v2.1.2

What's Changed

New Contributors

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants