chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/upload-artifact	action	patch	v7.0.1 → v7.0.2
github.com/prometheus/client_golang	require	minor	v1.24.1 → v1.25.0
github/codeql-action	action	patch	v4.38.2 → v4.38.3
golang (source)	stage	patch	1.27.1-alpine3.23 → 1.27.2-alpine3.23
golang (source)	final	patch	1.27.1-alpine3.23 → 1.27.2-alpine3.23

---

Release Notes

actions/upload-artifact (actions/upload-artifact)

v7.0.2

Compare Source

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in #​821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

prometheus/client_golang (github.com/prometheus/client_golang)

v1.25.0

Compare Source

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

• [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #​2138
• [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #​1963
• [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #​1928
• [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #​2091
• [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #​2146
• [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #​2142
• [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #​2090, #​2095
• [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #​2125
• [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #​2136
• [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #​2139
• [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #​2135

What's changed

What's Changed

• fix: Remove unneeded and broken CI badge by @​bwplothttps://github.com/prometheus/client_golang/pull/2057l/2057
• Synchronize common files from prometheus/prometheus by @​prombhttps://github.com/prometheus/client_golang/pull/2060l/2060
• build(deps): bump the codeql group with 4 updates by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2066l/2066
• build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2071l/2071
• build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-org-x group across 1 directory by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2069l/2069
• build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 in /exp by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2072l/2072
• build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1 in /exp by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2073l/2073
• build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2070l/2070
• build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /tutorials/whatsup by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2075l/2075
• Pin GitHub Actions by @​Supehttps://github.com/prometheus/client_golang/pull/2074l/2074
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2067l/2067
• promhttp: fix panic on requests with nil URL by @​SAYhttps://github.com/prometheus/client_golang/pull/2065l/2065
• Return info annotations in addition to warnings in the API by @​zenadhttps://github.com/prometheus/client_golang/pull/1963l/1963
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2082l/2082
• Synchronize common files from prometheus/prometheus by @​prombhttps://github.com/prometheus/client_golang/pull/2084l/2084
• Synchronize common files from prometheus/prometheus by @​prombhttps://github.com/prometheus/client_golang/pull/2086l/2086
• Synchronize common files from prometheus/prometheus by @​prombhttps://github.com/prometheus/client_golang/pull/2088l/2088
• Regenerate Go collector runtime metrics for Go 1.25 and Go 1.26 by @​bwplothttps://github.com/prometheus/client_golang/pull/2090l/2090
• go.mod: remove obsolete exclude rule by @​thaJezthttps://github.com/prometheus/client_golang/pull/2077l/2077
• Synchronize common files from prometheus/prometheus by @​prombhttps://github.com/prometheus/client_golang/pull/2093l/2093
• README: document the OpenTelemetry OTLP push bridge by @​mvanhohttps://github.com/prometheus/client_golang/pull/1987l/1987
• docs: add AGENTS.md contributor and maintainer guide by @​bwplothttps://github.com/prometheus/client_golang/pull/2056l/2056
• testutil: add GatherAndFormat helper by @​wieghttps://github.com/prometheus/client_golang/pull/2091l/2091
• build(deps): bump the codeql group with 4 updates by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2101l/2101
• build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2097l/2097
• build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2098l/2098
• build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 in /exp by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2099l/2099
• build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 in /exp by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2100l/2100
• build(deps): bump github.com/prometheus/procfs from 0.21.1 to 0.22.0 in the prometheus group across 1 directory by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2096l/2096
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /tutorials/whatsup by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2102l/2102
• chore: Update metrics for new Go version by @​github-actions[bohttps://github.com/prometheus/client_golang/pull/2095l/2095
• Benchmark json-iter, stdlib json and json/v2 by @​liggihttps://github.com/prometheus/client_golang/pull/2107l/2107
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /tutorials/whatsup by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2112l/2112
• RuleGroup: use stdlib for json decoding, optimize decoding by @​liggihttps://github.com/prometheus/client_golang/pull/2109l/2109
• Modernize micro benchmarks: b.Loop and key=value case names by @​radiancedhttps://github.com/prometheus/client_golang/pull/2114l/2114
• QueryResult: use stdlib for envelope decoding by @​liggihttps://github.com/prometheus/client_golang/pull/2110l/2110
• Use stdlib to decode apiResult envelope by @​liggihttps://github.com/prometheus/client_golang/pull/2111l/2111
• Improve linting by @​Supehttps://github.com/prometheus/client_golang/pull/2115l/2115
• Delete unused custom json-iterator marshaling by @​liggihttps://github.com/prometheus/client_golang/pull/2121l/2121
• Simplify apiClientImpl#Do error path by @​liggihttps://github.com/prometheus/client_golang/pull/2120l/2120
• testutil: finalize OpenMetrics output by @​ajavanhttps://github.com/prometheus/client_golang/pull/2125l/2125
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in /tutorials/whatsup by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2124l/2124
• Synchronize common files from prometheus/prometheus by @​prombhttps://github.com/prometheus/client_golang/pull/2116l/2116
• prometheus: fix revive indent-error-flow lint on Darwin by @​bwplothttps://github.com/prometheus/client_golang/pull/2131l/2131
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.34.0 to 1.45.0 in /tutorials/whatsup by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2123l/2123
• Combine envelope/inner apiResponse decoding, switch to stdlib json by @​liggihttps://github.com/prometheus/client_golang/pull/2118l/2118
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.34.0 to 1.45.0 in /tutorials/whatsup by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2122l/2122
• testutil/promlint: fix "mibi" unit prefix to "mebi" by @​ZainnQureshhttps://github.com/prometheus/client_golang/pull/2135l/2135
• all: update prometheus/common to v0.72.0 and apply modernize fixes by @​bwplothttps://github.com/prometheus/client_golang/pull/2138l/2138
• limit json-iterator use to Go 1.26 by @​liggihttps://github.com/prometheus/client_golang/pull/2128l/2128
• promhttp: add AcceptedFormats option to customize format negotiation by @​bwplothttps://github.com/prometheus/client_golang/pull/2146l/2146
• build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.1 by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2143l/2143
• build(deps): bump the codeql group with 4 updates by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2145l/2145
• build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.1 in /exp by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2144l/2144
• promhttp: vary negotiated metrics responses by @​lowgahttps://github.com/prometheus/client_golang/pull/2142l/2142
• exp/api/remote: reset pooled buffer before generic marshal by @​lowgahttps://github.com/prometheus/client_golang/pull/2139l/2139
• api: match complete URL placeholders by @​lowgahttps://github.com/prometheus/client_golang/pull/2136l/2136
• fix: updates for tsdb blocks handling by @​tjhhttps://github.com/prometheus/client_golang/pull/1928l/1928
• prometheus: fix modernize lint findings by @​kakkoyhttps://github.com/prometheus/client_golang/pull/2151l/2151
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /api/prometheus/v1/paritytest by @​dependabot[bohttps://github.com/prometheus/client_golang/pull/2152l/2152
• Cut v1.25.0-rc.0 by @​kakkoyhttps://github.com/prometheus/client_golang/pull/2154l/2154
• Cut v1.25.0 by @​kakkoyhttps://github.com/prometheus/client_golang/pull/2164l/2164

New Contributors

• @​SAY-5 made their first contributihttps://github.com/prometheus/client_golang/pull/2065l/2065
• @​zenador made their first contributihttps://github.com/prometheus/client_golang/pull/1963l/1963
• @​thaJeztah made their first contributihttps://github.com/prometheus/client_golang/pull/2077l/2077
• @​mvanhorn made their first contributihttps://github.com/prometheus/client_golang/pull/1987l/1987
• @​wieghx made their first contributihttps://github.com/prometheus/client_golang/pull/2091l/2091
• @​radianceded made their first contributihttps://github.com/prometheus/client_golang/pull/2114l/2114
• @​ajavanma made their first contributihttps://github.com/prometheus/client_golang/pull/2125l/2125
• @​ZainnQureshii made their first contributihttps://github.com/prometheus/client_golang/pull/2135l/2135
• @​lowgame made their first contributihttps://github.com/prometheus/client_golang/pull/2142l/2142

Full Changelog: prometheus/client_golang@v1.24.1...v1.25.0

github/codeql-action (github/codeql-action)

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
github.com/prometheus/client_model	v0.6.2 -> v0.6.3
github.com/prometheus/common	v0.70.1 -> v0.72.0
github.com/prometheus/procfs	v0.21.1 -> v0.22.0
golang.org/x/sys	v0.47.0 -> v0.48.0
google.golang.org/protobuf	v1.36.11 -> v1.36.12