Repository navigation
deps(go): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 - #1773
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model) from 0.6.2 to 0.6.3. - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.2...v0.6.3) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Superseded by the reviewed dependency batch #1786, which includes this update (soak + upstream review recorded there). Closing in favor of that PR. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/go_modules/github.com/prometheus/client_model-0.6.3
branch
September 16, 2026 10:46
nadaverell
added a commit
that referenced
this pull request
Sep 16, 2026
…-eslint 8.70, +6) (#1786) ## Summary One evidence-backed dependency PR replacing this week's open Dependabot PRs. Every included version was published at least 72 hours before screening, was reviewed against upstream release notes / commit ranges, and was judged by how Radar actually uses the package. Dependency-only: no application source changes. **Screening time:** 2026-09-16T10:11:50Z · **72-hour cutoff:** 2026-09-13T10:11:50Z ## Included | Dependabot PR | Dependency | Old → New | Published (UTC) | Soak | Risk conclusion | |---|---|---|---|---|---| | #1779 | `react`, `react-dom`, `@types/react`, `@types/react-dom` | 19.2.8 / 19.2.18 / 19.2.3 → **19.3.0** (+ `scheduler` 0.27→0.28) | 2026-09-09 17:17–18:08 | 6.7d | Minor with new opt-in APIs (ViewTransition, Fragment refs, `browser()`) Radar doesn't use. Behavioral changes reviewed: independent transition rendering (Radar uses `useDeferredValue` in ResourcesView / log search — full suites pass), Trusted Types integration (Radar sets no Trusted Types CSP), `resize` batching / form `submitter` / `type=number` defaultValue (no affected call sites). No upstream regressions filed against client-only usage since release. **Dependabot's PR only bumped `react`; react-dom must move in lockstep** (`ensureCorrectIsomorphicReactVersion` hard-fails otherwise — that was its CI failure). | | #1781 | `@vitejs/plugin-react` | 6.1.0 → 6.1.1 | 2026-08-28 | 19d | Only change is React Compiler diagnostics logging (`compiler.logDiagnostics`) + a `builder.sharedPlugins` sourcemap fix. Radar's Vite config uses `react()` with no compiler. | | #1780 | `typescript-eslint` (+ all `@typescript-eslint/*`, nested `ignore` 7.0.6→7.0.9) | 8.67.0 → 8.70.0 | 2026-09-07 | 8.7d | 8.68–8.70: rule fixes + one new rule not in `recommended`. Before/after `npm run lint` in `web/` is identical: 365 warnings, 0 errors (before = `main@77a4a2f` CI). `ignore` changes are gitignore-pattern parsing fixes. | | #1778 | `@fontsource-variable/dm-sans` | 5.2.8 → 5.3.0 | 2026-07-19 | 59d | Tarball diff: font files and `index.css` byte-identical; only adds `index.d.css.ts` + `types` export. Visually inert. | | #1777 | `golang.org/x/net` (+ `x/sync` 0.23.0, `x/text` 0.42.0, `x/crypto` 0.57.0, `x/mod` 0.41.0 via MVS) | 0.58.0 → 0.59.0 | 2026-09-08 (all ≤ 2026-09-08) | ≥7.6d | Radar imports only `x/net/http/httpguts` (no commits in range); `http2` is used transitively by client-go — changes are `Transport`/`Server` deprecation notes, IDNA lookup for non-ASCII hosts, http3/quic fixes. `x/sync`: `semaphore` negative-capacity panic (Radar uses only `singleflight`/`errgroup`). `x/crypto`: ssh/acme fixes (unused by Radar). `x/mod`: sumdb auth-bypass fix. All require `go 1.26.0`, which Radar already is. | | #1775 | `golang.org/x/term` | 0.45.0 → 0.46.0 | 2026-09-08 | 7.7d | Single commit: `Terminal.ReadLine` now surfaces a read error after processing the bytes returned with it. | | #1774 | `golang.org/x/oauth2` | 0.36.0 → 0.37.0 | 2026-08-25 | 21d | Single change in `google/`: GCE metadata path `universe/universe_domain` → `universe/universe-domain`. Radar's OIDC code uses the core package only. | | #1773 | `github.com/prometheus/client_model` | 0.6.2 → 0.6.3 | 2026-08-31 | 16d | Only Go-visible change is a comment edit in `metrics.proto`; rest is repo tooling. | | #1709 | `baseline-browser-mapping` (transitive of browserslist) | 2.10.38 → 2.11.21 | 2026-09-03 | 12.7d | Data-only package; Radar has no browserslist query so it's never consulted. 2.11.0 also fixed CVE-2026-45819. **Pinned explicitly** — `npm update` would float to 2.11.24 (2026-09-15, unsoaked). | ## Excluded / held - **#1776 `github.com/modelcontextprotocol/go-sdk` 1.6.1 → 1.8.0 — excluded, needs a Radar source change.** Its Backend CI fails `TestInvestigationHandlerAnnotatesRealToolCallWithoutChangingPublicContract` ("private mount handshake did not mark the scope connected"). Root cause: v1.7.0 implements protocol `2026-07-28`, which drops the `initialize` handshake in favor of `server/discover`; stateless handlers negotiate it, and `investigationEvidenceReferenceMiddleware` (`internal/mcp/server.go`) only marks the scope connected on `initialize` / `tools/list`. Also worth noting for the follow-up: 1.7 stateless servers ignore `Mcp-Session-Id` entirely and 1.8 changes the stateful rejection body and cancel-notify semantics. Independently, its GitHub Release was only published 2026-09-14 (<72h) even though the tag is older. Left open. ## Graph movement beyond the PR titles - `scheduler` 0.27.0 → 0.28.0 — `react-dom` 19.3.0's pinned dependency, published in the same release (2026-09-09). - `golang.org/x/{sync,text,crypto,mod}` — pulled by `x/net` 0.59.0's `go.mod`; each reviewed above. Identical to the set Dependabot's #1777 produced. - `pkg/go.mod` (separately-versioned shared module) is untouched: no Dependabot PR targeted it and the root `replace` means the root build already uses the root versions. Full resolved-graph diffs (`go list -m all`, lockfile package list) contain exactly the entries above — no other churn. ## Verification - `make tsc` ✓ - `make test` (Go, `-v ./...`) — 40 packages ok, 0 failed - `web/`: vitest 108 files / 1254 tests ✓ · `packages/k8s-ui/`: 189 files / 3763 tests ✓ (1 pre-existing skip) - `node --test scripts/workload-metrics-demo/capture.test.mjs` ✓ · `cd pkg && go test ./...` ✓ - `make build` ✓ (frontend + embed + binary) - `go mod verify` — all modules verified · `git diff --check` clean · worktree clean after build - `web/` lint before/after: 365 warnings / 0 errors both sides - visual-test: **skipped** — React 19.3's runtime changes are covered by the 5,000+ rendering tests across both suites and the production build; no rendered surface in Radar changes by design (fonts byte-identical, no new components). Happy to run one on request before merge. ## Upstream references - React 19.3.0: https://github.com/facebook/react/releases/tag/v19.3.0 - @vitejs/plugin-react 6.1.1: https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-react%406.1.1 - typescript-eslint: https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 · v8.69.0 · v8.70.0 - x/net: golang/net@v0.58.0...v0.59.0 · x/term: golang/term@v0.45.0...v0.46.0 · x/oauth2: golang/oauth2@v0.36.0...v0.37.0 · x/crypto: golang/crypto@v0.55.0...v0.57.0 · x/mod: golang/mod@v0.39.0...v0.41.0 · x/sync: golang/sync@v0.22.0...v0.23.0 · x/text: golang/text@v0.41.0...v0.42.0 - client_model: prometheus/client_model@v0.6.2...v0.6.3 - baseline-browser-mapping 2.11.0: https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0 - go-sdk (excluded): https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0 · https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0 Supersedes #1779, #1781, #1780, #1778, #1777, #1775, #1774, #1773, #1709 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Lockfile and manifest bumps only; excluded packages like MCP go-sdk were not upgraded, limiting exposure to reviewed minor/patch releases. > > **Overview** > This PR is **dependency-only**: it updates lockfiles and `package.json` / `go.mod` manifests with **no application source changes**. > > **Go** bumps include `golang.org/x/net` (0.58→0.59) with related MVS pulls (`x/sync`, `x/text`, `x/crypto`, `x/mod`), plus `x/oauth2`, `x/term`, and `prometheus/client_model`. > > **Frontend** moves **`react` / `react-dom` and matching `@types/*` to 19.3.0** (with `scheduler` 0.28 via `react-dom`) in both `web/` and `packages/k8s-ui`. Dev tooling updates cover **`typescript-eslint` 8.67→8.70**, **`@vitejs/plugin-react` 6.1.1**, and **`@fontsource-variable/dm-sans` 5.3.0**. The root **`package-lock.json`** also refreshes transitive entries such as **`baseline-browser-mapping`**. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1e036fe. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/prometheus/client_model from 0.6.2 to 0.6.3.
Release notes
Sourced from github.com/prometheus/client_model's releases.
... (truncated)
Commits
a834711Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#149)07078d2Update common Prometheus files (#148)6ab4937Update common Prometheus files (#146)10dc9dfdocs: Explained current state of the repo (#143)abfdc7eMerge pull request #144 from prombot/repo_syncc99203fUpdate common Prometheus files46d9cfbUpdate common Prometheus files (#141)6d9be57Update common Prometheus files2d24e7eMerge pull request #138 from prometheus/repo_sync1a0f082Update common Prometheus filesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Patch-only module bump with no source edits; existing Prometheus metric parsing paths are unchanged.
Overview
Bumps
github.com/prometheus/client_modelfrom 0.6.2 to 0.6.3 ingo.modand refreshes the matching checksums ingo.sum. There are no application code changes.Upstream 0.6.3 mainly syncs Prometheus housekeeping, bumps transitive protobuf, and marks native histograms as non-experimental in the metric model. This repo still uses the library only for parsing standard metric types in
internal/upgrade/collectors_live.goviagithub.com/prometheus/client_golang.Reviewed by Cursor Bugbot for commit 72e24b2. Bugbot is set up for automated code reviews on this repo. Configure here.