Update module github.com/prometheus/client_golang to v1.19.0

renovate[bot] commented 6 months ago

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/prometheus/client_golang	`v1.17.0` -> `v1.19.0`

Release Notes

prometheus/client_golang (github.com/prometheus/client_golang)

### [`v1.19.0`](https://togithub.com/prometheus/client_golang/releases/tag/v1.19.0) [Compare Source](https://togithub.com/prometheus/client_golang/compare/v1.18.0...v1.19.0) #### What's Changed The module `prometheus/common v0.48.0` introduced an incompatibility when used together with client_golang (See [https://github.com/prometheus/client_golang/pull/1448](https://togithub.com/prometheus/client_golang/pull/1448) for more details). If your project uses client_golang and you want to use `prometheus/common v0.48.0` or higher, please update client_golang to v1.19.0. - \[CHANGE] Minimum required go version is now 1.20 (we also test client_golang against new 1.22 version). [#1445](https://togithub.com/prometheus/client_golang/issues/1445) [#1449](https://togithub.com/prometheus/client_golang/issues/1449) - \[FEATURE] collectors: Add version collector. [#1422](https://togithub.com/prometheus/client_golang/issues/1422) [#1427](https://togithub.com/prometheus/client_golang/issues/1427) #### New Contributors - [@michurin](https://togithub.com/michurin) made their first contribution in [https://github.com/prometheus/client_golang/pull/1423](https://togithub.com/prometheus/client_golang/pull/1423) - [@kavu](https://togithub.com/kavu) made their first contribution in [https://github.com/prometheus/client_golang/pull/1445](https://togithub.com/prometheus/client_golang/pull/1445) - [@ywwg](https://togithub.com/ywwg) made their first contribution in [https://github.com/prometheus/client_golang/pull/1448](https://togithub.com/prometheus/client_golang/pull/1448) **Full Changelog**: https://github.com/prometheus/client_golang/compare/v1.18.0...v1.19.0 ### [`v1.18.0`](https://togithub.com/prometheus/client_golang/releases/tag/v1.18.0) [Compare Source](https://togithub.com/prometheus/client_golang/compare/v1.17.0...v1.18.0) #### What's Changed - \[FEATURE] promlint: Allow creation of custom metric validations. [#1311](https://togithub.com/prometheus/client_golang/issues/1311) - \[FEATURE] Go programs using client_golang can be built in wasip1 OS. [#1350](https://togithub.com/prometheus/client_golang/issues/1350) - \[BUGFIX] histograms: Add timer to reset ASAP after bucket limiting has happened. [#1367](https://togithub.com/prometheus/client_golang/issues/1367) - \[BUGFIX] testutil: Fix comparison of metrics with empty Help strings. [#1378](https://togithub.com/prometheus/client_golang/issues/1378) - \[ENHANCEMENT] Improved performance of `MetricVec.WithLabelValues(...)`. [#1360](https://togithub.com/prometheus/client_golang/issues/1360) #### New Contributors - [@srenatus](https://togithub.com/srenatus) made their first contribution in [https://github.com/prometheus/client_golang/pull/1350](https://togithub.com/prometheus/client_golang/pull/1350) - [@jadolg](https://togithub.com/jadolg) made their first contribution in [https://github.com/prometheus/client_golang/pull/1342](https://togithub.com/prometheus/client_golang/pull/1342) - [@manas-rust](https://togithub.com/manas-rust) made their first contribution in [https://github.com/prometheus/client_golang/pull/1383](https://togithub.com/prometheus/client_golang/pull/1383) - [@bluekeyes](https://togithub.com/bluekeyes) made their first contribution in [https://github.com/prometheus/client_golang/pull/1378](https://togithub.com/prometheus/client_golang/pull/1378) - [@tsipo](https://togithub.com/tsipo) made their first contribution in [https://github.com/prometheus/client_golang/pull/1387](https://togithub.com/prometheus/client_golang/pull/1387) **Full Changelog**: https://github.com/prometheus/client_golang/compare/v1.17.0...v1.18.0

Configuration

📅 Schedule: Branch creation - " 0-4 * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

github-actions[bot] commented 6 months ago

[puLL-Merge] - prometheus/client_golang@v1.17.0..v1.18.0

logError 400 This model's maximum context length is 16385 tokens. However, your messages resulted in 27948 tokens. Please reduce the length of the messages.

github-actions[bot] commented 5 months ago

[puLL-Merge] - prometheus/client_golang@v1.17.0..v1.19.0

Description

This PR updates various dependencies, GitHub Actions workflows, and Go version requirements for the Prometheus client_golang library. The main motivation seems to be keeping the project up-to-date and secure by bumping dependency versions, using the latest Go releases, and updating GitHub Actions to their latest tags.

Changes

### Changes * `.github/dependabot.yml`: Adds configuration for Dependabot to automatically update GitHub Actions monthly. * `.github/workflows/automerge-dependabot.yml`: Adds a new workflow to automatically merge minor and patch version updates from Dependabot PRs. * `.github/workflows/codeql-analysis.yml`, `.github/workflows/go.yml`, `.github/workflows/golangci-lint.yml`: Updates the actions/checkout, actions/setup-go, and golangci/golangci-lint-action actions to their latest versions. Adds permissions configuration. Updates tested Go versions. * `CHANGELOG.md`: Adds entries for upcoming 1.19.0 release and prior 1.18.0 and 1.17.0 releases. * `MAINTAINERS.md`: Adds Arthur Silva Sens as a maintainer. * `Makefile`: Updates tested Go versions. Improves `generate-go-collector-test-files` target. * `README.md`: Updates required Go version to 1.20. * `VERSION`: Bumps version to 1.19.0. * `api/prometheus/v1/example_test.go`: Updates RoundTripper usage. * `examples/versioncollector/main.go`: Adds an example of using the new version collector. * `go.mod`, `go.sum`: Updates dependencies to latest versions. Removes `github.com/golang/protobuf` and `github.com/matttproud/golang_protobuf_extensions`. * `prometheus/testutil/promlint/`: Allows creation of custom metric validations. * Various other code changes to accomodate updated dependencies and Go version.

Security Hotspots

The automerge-dependabot.yml workflow could potentially allow unauthorized code changes to be automatically merged if Dependabot is compromised or sends malicious PRs. However, this risk is mitigated by only automerging minor/patch updates which should be safer. The workflow also doesn't use a privileged token.
Bumping dependencies to their latest versions, while good for getting bug fixes and security patches, could potentially introduce new bugs or vulnerabilities. However, the diff shows the dependencies are being updated to seemingly stable release versions from trustworthy sources. The PR validation workflows also test the updates.

Overall this PR looks like a useful, low-risk update to keep client_golang well-maintained and secure. Manually review the code changes to check for anything potentially concerning, but in general the updates look reasonable. The automerge workflow introduces a small risk vector but is implemented safely. Suggest thoroughly testing after merging to catch any regressions from the version bumps.

brave / go-sync