Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.2 in the global group across 1 directory

[dependabot]

Bumps the global group with 1 update in the / directory: github.com/prometheus/client_golang.

Updates github.com/prometheus/client_golang from 1.19.1 to 1.20.2

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.20.2

• [BUGFIX] promhttp: Unset Content-Encoding header when data is uncompressed. #1596

v1.20.1

This release contains the critical fix for the issue. Thanks to @​geberl, @​CubicrootXYZ, @​zetaab and @​timofurrer for helping us with the investigation!

• [BUGFIX] process-collector: Fixed unregistered descriptor error when using process collector with PedanticRegistry on Linux machines. #1587

v1.20.0

Thanks everyone for contributions!

⚠️ In this release we remove one (broken anyway, given Go runtime changes) metric and add three new (representing GOGC, GOMEMLIMIT and GOMAXPROCS flags) to the default collectors.NewGoCollector() collector. Given its popular usage, expect your binary to expose two additional metric.

Changes

• [CHANGE] ⚠️ go-collector: Remove go_memstat_lookups_total metric which was always 0; Go runtime stopped sharing pointer lookup statistics. #1577
• [FEATURE] ⚠️ go-collector: Add 3 default metrics: go_gc_gogc_percent, go_gc_gomemlimit_bytes and go_sched_gomaxprocs_threads as those are recommended by the Go team. #1559
• [FEATURE] go-collector: Add more information to all metrics' HELP e.g. the exact runtime/metrics sourcing each metric (if relevant). #1568 #1578
• [FEATURE] testutil: Add CollectAndFormat method. #1503
• [FEATURE] histograms: Add support for exemplars in native histograms. #1471
• [FEATURE] promhttp: Add experimental support for zstd on scrape, controlled by the request Accept-Encoding header. #1496
• [FEATURE] api/v1: Add WithLimit parameter to all API methods that supports it. #1544
• [FEATURE] prometheus: Add support for created timestamps in constant histograms and constant summaries. #1537
• [FEATURE] process-collectors: Add network usage metrics: process_network_receive_bytes_total and process_network_transmit_bytes_total. #1555
• [FEATURE] promlint: Add duplicated metric lint rule. #1472
• [BUGFIX] promlint: Relax metric type in name linter rule. #1455
• [BUGFIX] promhttp: Make sure server instrumentation wrapping supports new and future extra responseWriter methods. #1480
• [BUGFIX] testutil: Functions using compareMetricFamilies are now failing if filtered metricNames are not in the input. #1424

• feat(prometheus/testutil/promlint/validations): refine lintMetricType… by @​foehammer127 in prometheus/client_golang#1455
• Bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 in /examples/middleware by @​dependabot in prometheus/client_golang#1457
• Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0 by @​dependabot in prometheus/client_golang#1458
• Bump golang.org/x/sys from 0.16.0 to 0.17.0 by @​dependabot in prometheus/client_golang#1459
• Bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 in /tutorial/whatsup by @​dependabot in prometheus/client_golang#1461
• Merge Release 1.19 back to main by @​ArthurSens in prometheus/client_golang#1462
• Bump the github-actions group with 2 updates by @​dependabot in prometheus/client_golang#1456
• Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @​dependabot in prometheus/client_golang#1466
• Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /examples/middleware by @​dependabot in prometheus/client_golang#1467
• Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /tutorial/whatsup by @​dependabot in prometheus/client_golang#1469
• Add LintDuplicateMetric to promlint by @​bboreham in prometheus/client_golang#1472
• Auto-update Go Collector Metrics for new Go versions by @​SachinSahu431 in prometheus/client_golang#1476
• Implement Unwrap() for responseWriterDelegator by @​igor-drozdov in prometheus/client_golang#1480
• Bump golang.org/x/sys from 0.17.0 to 0.18.0 by @​dependabot in prometheus/client_golang#1485
• Bump github.com/prometheus/procfs from 0.12.0 to 0.13.0 by @​dependabot in prometheus/client_golang#1486
• ci: Remove hardcoded supported Go versions from go.yml by @​SachinSahu431 in prometheus/client_golang#1489
• feat: metrics generation workflow by @​SachinSahu431 in prometheus/client_golang#1481

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.20.2 / 2024-08-23

• [BUGFIX] promhttp: Unset Content-Encoding header when data is uncompressed. #1596

1.20.1 / 2024-08-20

• [BUGFIX] process-collector: Fixed unregistered descriptor error when using process collector with PedanticRegistry on linux machines. #1587

1.20.0 / 2024-08-14

• [CHANGE] ⚠️ go-collector: Remove go_memstat_lookups_total metric which was always 0; Go runtime stopped sharing pointer lookup statistics. #1577
• [FEATURE] ⚠️ go-collector: Add 3 default metrics: go_gc_gogc_percent, go_gc_gomemlimit_bytes and go_sched_gomaxprocs_threads as those are recommended by the Go team. #1559
• [FEATURE] go-collector: Add more information to all metrics' HELP e.g. the exact runtime/metrics sourcing each metric (if relevant). #1568 #1578
• [FEATURE] testutil: Add CollectAndFormat method. #1503
• [FEATURE] histograms: Add support for exemplars in native histograms. #1471
• [FEATURE] promhttp: Add experimental support for zstd on scrape, controlled by the request Accept-Encoding header. #1496
• [FEATURE] api/v1: Add WithLimit parameter to all API methods that supports it. #1544
• [FEATURE] prometheus: Add support for created timestamps in constant histograms and constant summaries. #1537
• [FEATURE] process-collector: Add network usage metrics: process_network_receive_bytes_total and process_network_transmit_bytes_total. #1555
• [FEATURE] promlint: Add duplicated metric lint rule. #1472
• [BUGFIX] promlint: Relax metric type in name linter rule. #1455
• [BUGFIX] promhttp: Make sure server instrumentation wrapping supports new and future extra responseWriter methods. #1480
• [BUGFIX] testutil: Functions using compareMetricFamilies are now failing if filtered metricNames are not in the input. #1424

1.19.0 / 2024-02-27

The module prometheus/common v0.48.0 introduced an incompatibility when used together with client_golang (See prometheus/client_golang#1448 for more details). If your project uses client_golang and you want to use prometheus/common v0.48.0 or higher, please update client_golang to v1.19.0.

• [CHANGE] Minimum required go version is now 1.20 (we also test client_golang against new 1.22 version). #1445 #1449
• [FEATURE] collectors: Add version collector. #1422 #1427

1.18.0 / 2023-12-22

• [FEATURE] promlint: Allow creation of custom metric validations. #1311
• [FEATURE] Go programs using client_golang can be built in wasip1 OS. #1350
• [BUGFIX] histograms: Add timer to reset ASAP after bucket limiting has happened. #1367
• [BUGFIX] testutil: Fix comparison of metrics with empty Help strings. #1378
• [ENHANCEMENT] Improved performance of MetricVec.WithLabelValues(...). #1360

1.17.0 / 2023-09-27

• [CHANGE] Minimum required go version is now 1.19 (we also test client_golang against new 1.21 version). #1325
• [FEATURE] Add support for Created Timestamps in Counters, Summaries and Historams. #1313
• [ENHANCEMENT] Enable detection of a native histogram without observations. #1314

1.16.0 / 2023-06-15

• [BUGFIX] api: Switch to POST for LabelNames, Series, and QueryExemplars. #1252
• [BUGFIX] api: Fix undefined execution order in return statements. #1260
• [BUGFIX] native histograms: Fix bug in bucket key calculation. #1279

... (truncated)

Commits

• 67121dc Merge pull request #1596 from mrueg/fix-uncompressed-content-header
• 187acd4 Cut 1.20.2
• f7f8f3a fix: Unset Content-Encoding header when uncompressed
• 2254d6c Merge pull request #1587 from prometheus/fix-processcollector
• 4a15d05 Cut 1.20.1
• f2dd7b3 Use pedantic registry in other places too, to double check.
• 261fe84 bugfix: Pass network metrics to processCollector's Describe() function
• 5bf3341 Use NewPedanticRegistry in Process' Collector tests
• 73b811c Cut 1.20.0 release. (#1580)
• 7ce5089 gocollector: Attach original runtime/metrics metric name to help. (#1578)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

The following labels could not be found: go, Changed.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
golang/github.com/prometheus/[email protected]	filesystem, network, unsafe	0	1.15 MB

🚮 Removed packages: golang/github.com/prometheus/[email protected])

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	CI
AI warning	golang/google.golang.org/[email protected]	Notes: The code contains multiple potential security risks, including unauthorized file writes, command injection, information leakage, and code injection. It should be reviewed and modified to ensure proper input validation, sanitization, and secure handling of user input. The presence of 'eval' raises concerns about the safety and security of the code. Confidence: 0.80 Severity: 0.70	🚫

View full report↗︎

Next steps

What is an AI-detected potential code anomaly?

AI has identified unusual behaviors that may pose a security risk.

An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore golang/google.golang.org/[email protected]