mirror of
https://gitea.com/gitea/act_runner.git
synced 2026-10-29 03:16:43 +08:00
v5.2.2
459 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
silverwind
|
923a0bfb59 |
refactor: remove bolthold and gofakes3 deps (#1336)
1. Replace bolthold with direct bbolt access in the cache server. bolthold has not changed since March 2024 and kept `encoding/gob` in the binary although the store was already JSON. The on-disk layout stays the same, so existing caches keep working, and the index buckets bolthold left behind are dropped on the first sweep. Queries now run against an in-memory copy of the entries that is only re-read after another process wrote to the store, so lookups and sweeps no longer decode the whole store. 2. Replace gofakes3 with a small in-memory S3 fake in the one test that used it, which removes aws-sdk-go-v2, afero, mgo and x/tools from the module graph. Reviewed-on: https://gitea.com/gitea/runner/pulls/1336 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
6f0d4f1b48 |
refactor: migrate to connect-go v2 (#1325)
Migrates the runner to `connectrpc.com/connect/v2` by pinning actionslib v1.5.0, which carries https://gitea.com/gitea/actionslib/pulls/28. The wire behaviour towards Gitea is unchanged and works against Gitea servers on connect v1 and v2. The client keeps v1's unlimited response size, and the error codes and messages the runner checks stay the same. Reviewed-on: https://gitea.com/gitea/runner/pulls/1325 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
bircni
|
af2b3f6df5 |
fix(deps): update go toolchain directive to v1.27.3 (#1332)
Go 1.27.3 includes a crypto/x509 security fix that distrusts a set of intermediate certificates (https://github.com/golang/go/issues/82345), so release builds need the new toolchain. Reviewed-on: https://gitea.com/gitea/runner/pulls/1332 Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com> |
||
|
silverwind
|
4158e05dae |
refactor: drop logrus and other direct dependencies (#1319)
After https://gitea.com/gitea/runner/pulls/1304, logrus stayed only to forward logs from docker/cli and moby/go-archive. The runner used a small part of those: volume parsing, the build context tar, the `ssh://` connection and registry credentials. Own code that matches them replaces them, so logrus leaves the module graph. docker/cli stays for its logrus-free `opts` and `connhelper/ssh` packages. Other dependencies that the standard library or existing ones cover go too: mergo, httprouter (replaced by `http.ServeMux`), retry-go, go-isatty, go-selinux, container-device-interface, gotest.tools and go-cmp (replaced by testify). The binary shrinks by 5%. Behaviour differences: 1. An unreadable file in a build context is skipped with a warning, where go-archive left a truncated tar. 2. Build contexts no longer carry `security.capability` xattrs. 3. The cache and artifact servers answer HEAD on GET routes, and no longer redirect trailing slashes or answer OPTIONS. *Written by Claude.* --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1319 Reviewed-by: bircni <bircni@icloud.com> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
silverwind
|
b9aa47d1a5 |
fix(deps): bump go-yaml to fix block and folded scalar round-trips (#1321)
Bumps go-yaml to its main branch and drops the workaround it makes obsolete, matching https://github.com/go-gitea/gitea/pull/39787. - go-yaml main keeps block scalar indentation indicators (https://github.com/yaml/go-yaml/pull/414), so values with a leading newline no longer need quoting - `config edit` no longer wraps lines, because go-yaml still wraps more-indented lines of folded scalars and turns a space into a newline Reviewed-on: https://gitea.com/gitea/runner/pulls/1321 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lunny Xiao
|
470969dc74 |
chore(deps): update actionslib to v1.4.1 (#1313)
actionslib v1.4.1 no longer logs through logrus, so the workflow model no longer needs the logrus bridge. The bridge stays for docker/cli and moby/go-archive, which still log through logrus's global logger; the comment now says so. actionslib now logs through slog's global logger, which the runner did not capture. A new slog bridge forwards it to the process-wide logger, so its messages keep the runner's level, format and secret masking. Assisted-by: Codet Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1313 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
bircni
|
160e18e705 |
enhance: report the steps of a task as they run (#1293)
Gitea derives the steps of a job from the workflow file, so the `pre` and `post` steps of actions only show up inside "Set up job" and "Complete job", see https://github.com/go-gitea/gitea/issues/24604. The runner now also reports the steps as it runs them (https://gitea.com/gitea/actions-proto-def/pulls/19): "Set up job", a "Pre" and "Post" step for each action that has one, the workflow steps with their evaluated names, and "Complete job", as actions/runner shows them. The per-step state Gitea reads today is unchanged, and the job log only moves "Complete job name" and "Matrix:" ahead of the pre steps, so older Gitea versions keep showing everything as before. Job hooks and containers stay part of "Set up job" and "Complete job". The `replace` of `gitea.dev/actionslib` is swapped for the release once the proto change is merged. Reviewed-on: https://gitea.com/gitea/runner/pulls/1293 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
20c8b4abc4 |
refactor: replace go-git with the git CLI for gitignore filtering (#1309)
Replace go-git in `exec --use-gitignore` filtering with `git ls-files`. The git CLI is already required for action clones since https://gitea.com/gitea/runner/pulls/1277, so this drops `go-git` and 14 other modules, and filtering now follows git's own ignore rules. Also stop deleting a remote action's `.gitignore` before copying it. Tracked files are never filtered, so the deletion only made copied actions differ from GitHub's action tarballs. Reviewed-on: https://gitea.com/gitea/runner/pulls/1309 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
ccb9afd7a5 |
chore(deps): update dependencies (#1308)
This PR contains the following updates:
| Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|---|
| [actions/setup-node](https://github.com/actions/setup-node) ([changelog](
|
||
|
Renovate Bot
|
b741335222 |
fix(deps): update module golang.org/x/net to v0.60.0 [security] (#1292)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.59.0` → `v0.60.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.59.0...refs/tags/v0.60.0) |  |  | --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1292 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
20143c9558 |
fix(deps): update go toolchain directive to v1.27.2 [security] (#1291)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.27.1` → `1.27.2` | --- ### Reset context tracking on consecutive template expressions in html/template [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) / [GO-2026-6599](https://pkg.go.dev/vuln/GO-2026-6599) <details> <summary>More information</summary> #### Details When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped. #### Severity Unknown #### References - [https://go.dev/cl/839866](https://go.dev/cl/839866) - [https://go.dev/issue/81821](https://go.dev/issue/81821) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6599) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Recognize yield as regexp preceder keyword in html/template [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) / [GO-2026-6600](https://pkg.go.dev/vuln/GO-2026-6600) <details> <summary>More information</summary> #### Details A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped. #### Severity Unknown #### References - [https://go.dev/cl/840925](https://go.dev/cl/840925) - [https://go.dev/issue/81823](https://go.dev/issue/81823) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6600) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Root.Mkdir(All) can follow junctions out of the root on Windows in os [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) / [GO-2026-6604](https://pkg.go.dev/vuln/GO-2026-6604) <details> <summary>More information</summary> #### Details On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target). #### Severity Unknown #### References - [https://go.dev/cl/847305](https://go.dev/cl/847305) - [https://go.dev/issue/81739](https://go.dev/issue/81739) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6604) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/1 client connection desynchronization after CONNECT rejection in net/http [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) / [GO-2026-6605](https://pkg.go.dev/vuln/GO-2026-6605) <details> <summary>More information</summary> #### Details When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning. #### Severity Unknown #### References - [https://go.dev/cl/847306](https://go.dev/cl/847306) - [https://go.dev/issue/81740](https://go.dev/issue/81740) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6605) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Reject malformed ECH outer extension references in crypto/tls [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) / [GO-2026-6607](https://pkg.go.dev/vuln/GO-2026-6607) <details> <summary>More information</summary> #### Details Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result. #### Severity Unknown #### References - [https://go.dev/cl/847312](https://go.dev/cl/847312) - [https://go.dev/issue/81855](https://go.dev/issue/81855) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6607) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) / [GO-2026-6608](https://pkg.go.dev/vuln/GO-2026-6608) <details> <summary>More information</summary> #### Details Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. #### Severity Unknown #### References - [https://go.dev/cl/847307](https://go.dev/cl/847307) - [https://go.dev/issue/81741](https://go.dev/issue/81741) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6608) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Lack of limit on size of parsed Range headers in net/http [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) / [GO-2026-6609](https://pkg.go.dev/vuln/GO-2026-6609) <details> <summary>More information</summary> #### Details When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU. #### Severity Unknown #### References - [https://go.dev/cl/847309](https://go.dev/cl/847309) - [https://go.dev/issue/81858](https://go.dev/issue/81858) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6609) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) / [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613) <details> <summary>More information</summary> #### Details When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP. #### Severity Unknown #### References - [https://go.dev/cl/847311](https://go.dev/cl/847311) - [https://go.dev/issue/81744](https://go.dev/issue/81744) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6613) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1291 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
711b72735b |
chore(deps): update dependencies (#1288)
Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1288 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
silverwind
|
a284a62d96 |
chore(deps): update gitea.dev/actionslib to v1.3.0 (#1278)
Updates to [actionslib v1.3.0](https://gitea.com/gitea/actionslib/releases/tag/v1.3.0). Matrix include and exclude entries now match combinations with expression equality like GitHub, so an include of `os: LINUX` extends the `os: linux` combination instead of adding a new one. No code changes are needed. Reviewed-on: https://gitea.com/gitea/runner/pulls/1278 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
0cedd98051 |
feat: add Kubernetes backend (#1260)
Adds a Kubernetes backend. A `name:kubernetes://image` label runs the job as one pod through the Kubernetes API, with services as containers of the same pod. Step env is exported by a script sent over exec stdin, keeping it out of the pod spec and process arguments, and service env goes into a per-job Secret. Docker actions and container options are rejected. See `docs/kubernetes.md`. Operators shape job pods with `kubernetes.pod_template`, with per-label `pod_templates` merged in `runs-on` order and a `$services` entry for service containers. The idle cleanup removes pods and Secrets a runner left behind. The client calls the Kubernetes API directly and runs step commands over `coder/websocket` (same dependency used in gitea) instead of pulling in the heavyweight `kubernetes/client-go`. Includes an e2e test against k3s. Replaces: https://gitea.com/gitea/runner/pulls/1000 Fixes: https://gitea.com/gitea/runner/issues/31 Assisted-by: Claude Code:claude-opus-5-5 Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1260 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
5a38a3d0c4 |
chore(deps): update dependencies (#1254)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) | `v4.10.0` → `v4.10.2` |  |  | require | patch | | [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `v0.5.16` → `v0.5.17` |  |  | | patch | | nginx | `62ff208` → `df221db` | | | | digest | --- ### Release Notes <details> <summary>bmatcuk/doublestar (github.com/bmatcuk/doublestar/v4)</summary> ### [`v4.10.2`](https://github.com/bmatcuk/doublestar/releases/tag/v4.10.2): Better support for Windows "Junctions" [Compare Source](https://github.com/bmatcuk/doublestar/compare/v4.10.1...v4.10.2) Has improved support for reading "junctions" in Windows (ie, Windows' version of symlinks). Thanks [@​x0Lazarus](https://github.com/x0Lazarus) for the PR! #### What's Changed - Fix Windows junction traversal with Go 1.23 and later by [@​x0Lazarus](https://github.com/x0Lazarus) in [#​117](https://github.com/bmatcuk/doublestar/pull/117) #### New Contributors - [@​x0Lazarus](https://github.com/x0Lazarus) made their first contribution in [#​117](https://github.com/bmatcuk/doublestar/pull/117) **Full Changelog**: <https://github.com/bmatcuk/doublestar/compare/v4.10.1...v4.10.2> ### [`v4.10.1`](https://github.com/bmatcuk/doublestar/releases/tag/v4.10.1): Fixed issue with alternatives and character classes [Compare Source](https://github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1) There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes. Thanks to [@​sidsri14](https://github.com/sidsri14) for the fix! #### What's Changed - fix brace alternation scanning with character classes by [@​sidsri14](https://github.com/sidsri14) in [#​115](https://github.com/bmatcuk/doublestar/pull/115) #### New Contributors - [@​sidsri14](https://github.com/sidsri14) made their first contribution in [#​115](https://github.com/bmatcuk/doublestar/pull/115) **Full Changelog**: <https://github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1> </details> <details> <summary>ulikunitz/xz (github.com/ulikunitz/xz)</summary> ### [`v0.5.17`](https://github.com/ulikunitz/xz/compare/v0.5.16...v0.5.17) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.16...v0.5.17) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1254 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
bircni
|
81add27459 |
feat(cache): add shared S3-compatible storage (#1244)
Store the cache used by `actions/cache` in an S3-compatible bucket such as AWS S3 or RustFS, with no `cache-server`. Runners with the same settings use the same cache. A cache saved on one runner can be restored on the others within 30 seconds. The runner talks to the bucket over the S3 REST API with SigV4, without an SDK. Lifecycle rules on the bucket expire old caches. *Description rewritten by Claude.* --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1244 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
95daa50d9b |
enhance!: match valid_volumes with bmatcuk/doublestar (#1214)
`valid_volumes` patterns now match with doublestar instead of gobwas/glob, which was compiled without separators so `*` crossed slashes. doublestar is already in the module graph, keeps `*` within one path segment and matches host paths with the OS separator, which fixes Windows patterns where a backslash was read as an escape. Breaking: a host pattern that relied on `*` matching nested paths needs `**`, e.g. `/data/**` instead of `/data/*`. Named volumes and the bare `**` are unaffected. Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1214 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
wmTJc9IK0Q
|
1952e5cdb6 |
feat: OpenTelemetry tracing (#1206)
Adds OpenTelemetry tracing, configured through the standard `OTEL_*` environment variables and off until an OTLP endpoint is set.  Each job becomes a trace with a span per step, so operators can see where CI time goes in their existing observability backend. Jobs receive only `TRACEPARENT`, so instrumented tools inside them join the trace without seeing the collector's credentials. Metrics stay on the Prometheus endpoint, which a collector can scrape. See [docs/telemetry.md](https://gitea.com/wmTJc9IK0Q/runner/src/branch/otel/docs/telemetry.md) for setup and security notes. Also keeps `GITHUB_SHA` and `GITHUB_REF` fixed for a whole run when HEAD moves during `exec` runs and the act tests. [image.png](https://gitea.com/attachments/c4b49cdf-a32d-403c-94e9-30cd06ee6477) [image.png](https://gitea.com/attachments/c4b49cdf-a32d-403c-94e9-30cd06ee6477) --------- Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1206 Reviewed-by: bircni <bircni@icloud.com> Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: wmTJc9IK0Q <231276+wmtjc9ik0q@noreply.gitea.com> |
||
|
silverwind
|
98816a605c |
fix: skip jobs whose if fails to evaluate, update actionslib (#1247)
Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1. 1. A job whose `if:` fails to evaluate, like `fromJSON` of an invalid job output, is skipped with the error in its log instead of failing, like on GitHub Actions. 1. Workflows the runner reads itself, like with `exec`, are rejected when an expression does not parse, like an unclosed `${{` or an unknown context, instead of failing later. 1. Task payloads from Gitea are read without that check, because they hold evaluated text that may contain `${{`. 1. `if: False`, `if: ~` and other boolean, null or number conditions work. Gitea PR: https://github.com/go-gitea/gitea/pull/39358 Reviewed-on: https://gitea.com/gitea/runner/pulls/1247 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
e0d00e543d |
feat: update to actionslib v1.2.0, support self: (#1233)
Update to [actionslib v1.2.0](https://gitea.com/gitea/actionslib/releases/tag/v1.2.0) and move logic to it. 1. `self:{owner}/{repo}[/{path}]@{ref}` in step `uses` resolves on the runner's Gitea instance, for https://github.com/go-gitea/gitea/issues/38990. 2. `strategy.job-index` and `strategy.job-total` come from Gitea when it sends them. 3. Container, services and `with` are evaluated once instead of on every use. 4. Fixes a flaky clone-lock test. Gitea PR: https://github.com/go-gitea/gitea/pull/39358 Docs PR: https://gitea.com/gitea/docs/pulls/553 --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1233 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
Renovate Bot
|
58ed5921f3 |
chore(deps): update dependencies (#1236)
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [docker/build-push-action](https://github.com/docker/build-push-action) ([changelog]( |
||
|
silverwind
|
3d116eb0c2 |
fix(deps): update to actionslib v1.0.0 (#1221)
Updates `gitea.dev/actionslib` to v1.0.0, see https://gitea.com/gitea/actionslib/pulls/17: 1. First-party expression parser passing GitHub's full conformance suite, replacing actionlint 1. Expression results match GitHub, including truthiness, numbers, `fromJSON`, `toJSON` and `hashFiles` cache keys 1. Whole-value `${{ }}` works for `strategy`, `env`, `with`, `services` and `outputs` 1. Matrix validation matches GitHub --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1221 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
69d5c22300 |
chore(deps): update dependencies (#1223)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.20.0` → `v1.21.0` |  |  | require | minor | | [github.com/docker/cli](https://github.com/docker/cli) | `v29.7.2+incompatible` → `v29.8.0+incompatible` |  |  | require | minor | | [github.com/moby/moby/api](https://github.com/moby/moby) | `v1.55.0` → `v1.56.0` |  |  | require | minor | | [github.com/moby/moby/client](https://github.com/moby/moby) | `v0.5.1` → `v0.6.0` |  |  | require | minor | | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.58.0` → `v0.59.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.58.0...refs/tags/v0.59.0) |  |  | require | minor | | [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) | [`v0.22.0` → `v0.23.0`](https://cs.opensource.google/go/x/sync/+/refs/tags/v0.22.0...refs/tags/v0.23.0) |  |  | require | minor | | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | [`v0.47.0` → `v0.48.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.47.0...refs/tags/v0.48.0) |  |  | require | minor | | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.45.0` → `v0.46.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.45.0...refs/tags/v0.46.0) |  |  | require | minor | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.41.0` → `v0.42.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.41.0...refs/tags/v0.42.0) |  |  | require | minor | | golang.org/x/vuln | `v1.7.0` → `v1.8.0` |  |  | | minor | | [node](https://github.com/nodejs/node) | `be23f54` → `6dac556` | | | | digest | | [node](https://github.com/nodejs/node) | `ba849c6` → `2fe369e` | | | | digest | | [tags.cncf.io/container-device-interface](https://github.com/cncf-tags/container-device-interface) | `v1.1.0` → `v1.1.1` |  |  | require | patch | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.21.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.21.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.20.0...v1.21.0) #### What's Changed > \[!IMPORTANT] > > This release adds a security-related feature for servers. The new handler option [`WithRequestGate`](https://pkg.go.dev/connectrpc.com/connect#WithRequestGate) runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the [documentation for details](https://connectrpc.com/docs/go/interceptors/#authentication). ##### Governance - Add pkwarren as a maintainer by [@​bufdev](https://github.com/bufdev) in [#​929](https://github.com/connectrpc/connect-go/pull/929) 🎉 ##### Enhancements - Add WithRequestGate handler option by [@​emcfarlane](https://github.com/emcfarlane) in [#​962](https://github.com/connectrpc/connect-go/pull/962) - Create release binary for protoc-gen-connect-go by [@​emcfarlane](https://github.com/emcfarlane) in [#​966](https://github.com/connectrpc/connect-go/pull/966) ##### Bugfixes - Fix issue with user-agent getting inappropriately injected into request headers by [@​jhump](https://github.com/jhump) in [#​934](https://github.com/connectrpc/connect-go/pull/934) - Fix client streaming operations blocking indefinitely after context cancellation by [@​haru0017](https://github.com/haru0017) in [#​937](https://github.com/connectrpc/connect-go/pull/937) - Fix flaky HTTP2 testcase assertion by [@​emcfarlane](https://github.com/emcfarlane) in [#​940](https://github.com/connectrpc/connect-go/pull/940) - Fix data race and connection leak in duplexHTTPCall by [@​emcfarlane](https://github.com/emcfarlane) in [#​938](https://github.com/connectrpc/connect-go/pull/938) - Fix off-by-one in WithHTTPGetMaxURLSize URL length check by [@​fchimpan](https://github.com/fchimpan) in [#​955](https://github.com/connectrpc/connect-go/pull/955) - Fix connect.WithGRPC typo in the missing client option error by [@​NotAFlightRisk](https://github.com/NotAFlightRisk) in [#​956](https://github.com/connectrpc/connect-go/pull/956) - Only send a 304 when the request was a GET by [@​NotAFlightRisk](https://github.com/NotAFlightRisk) in [#​957](https://github.com/connectrpc/connect-go/pull/957) - Fix panic in stream Spec and Peer when client construction failed by [@​NotAFlightRisk](https://github.com/NotAFlightRisk) in [#​959](https://github.com/connectrpc/connect-go/pull/959) - Fix dropped headers on errStreamingClientConn by [@​mohit-bhandari45](https://github.com/mohit-bhandari45) in [#​964](https://github.com/connectrpc/connect-go/pull/964) #### New Contributors - [@​haru0017](https://github.com/haru0017) made their first contribution in [#​937](https://github.com/connectrpc/connect-go/pull/937) - [@​dongjiang1989](https://github.com/dongjiang1989) made their first contribution in [#​945](https://github.com/connectrpc/connect-go/pull/945) - [@​fchimpan](https://github.com/fchimpan) made their first contribution in [#​955](https://github.com/connectrpc/connect-go/pull/955) - [@​NotAFlightRisk](https://github.com/NotAFlightRisk) made their first contribution in [#​956](https://github.com/connectrpc/connect-go/pull/956) - [@​mohit-bhandari45](https://github.com/mohit-bhandari45) made their first contribution in [#​964](https://github.com/connectrpc/connect-go/pull/964) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v1.20.0...v1.21.0> </details> <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.8.0+incompatible`](https://github.com/docker/cli/compare/v29.7.2...v29.8.0) [Compare Source](https://github.com/docker/cli/compare/v29.7.2...v29.8.0) </details> <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.6.0`](https://github.com/moby/moby/compare/v0.5.1...v0.6.0) [Compare Source](https://github.com/moby/moby/compare/v0.5.1...v0.6.0) </details> <details> <summary>cncf-tags/container-device-interface (tags.cncf.io/container-device-interface)</summary> ### [`v1.1.1`](https://github.com/cncf-tags/container-device-interface/releases/tag/v1.1.1) [Compare Source](https://github.com/cncf-tags/container-device-interface/compare/v1.1.0...v1.1.1) #### What's Changed - spec: Fix comment to reference containerEdits field by [@​zrezke](https://github.com/zrezke) in [#​303](https://github.com/cncf-tags/container-device-interface/pull/303) - cdi: inject mount UID/GID mappings if user NS is in use. by [@​klihub](https://github.com/klihub) in [#​288](https://github.com/cncf-tags/container-device-interface/pull/288) - cdi,SPECS.md: allow empty cgroup permissions. by [@​klihub](https://github.com/klihub) in [#​301](https://github.com/cncf-tags/container-device-interface/pull/301) - .github: bump golangci-lint to v2.9.0. by [@​klihub](https://github.com/klihub) in [#​307](https://github.com/cncf-tags/container-device-interface/pull/307) - add local build and install procedure in README.md. by [@​fujitatomoya](https://github.com/fujitatomoya) in [#​305](https://github.com/cncf-tags/container-device-interface/pull/305) - Revert to default spec dirs if none are specified by [@​elezar](https://github.com/elezar) in [#​310](https://github.com/cncf-tags/container-device-interface/pull/310) - SPEC.md: fix a few typos/clarify a sentence. by [@​klihub](https://github.com/klihub) in [#​312](https://github.com/cncf-tags/container-device-interface/pull/312) - add beginner's tutorial to see how CDI works. by [@​fujitatomoya](https://github.com/fujitatomoya) in [#​311](https://github.com/cncf-tags/container-device-interface/pull/311) - Makefile: add GO\_EXTRAFLAGS to go build call by [@​koenkooi](https://github.com/koenkooi) in [#​313](https://github.com/cncf-tags/container-device-interface/pull/313) - Remove runtime-tools dependency by [@​elezar](https://github.com/elezar) in [#​317](https://github.com/cncf-tags/container-device-interface/pull/317) - schema: add validation for top-level container edits by [@​marquiz](https://github.com/marquiz) in [#​323](https://github.com/cncf-tags/container-device-interface/pull/323) - parser: guard single-character vendor and class names against a slice-bounds panic by [@​thc1006](https://github.com/thc1006) in [#​321](https://github.com/cncf-tags/container-device-interface/pull/321) - chore(deps): replace deprecated gopkg.in/yaml.v3 for go.yaml.in/yaml/v3 by [@​thaJeztah](https://github.com/thaJeztah) in [#​328](https://github.com/cncf-tags/container-device-interface/pull/328) - schema: make validation error private by [@​thaJeztah](https://github.com/thaJeztah) in [#​329](https://github.com/cncf-tags/container-device-interface/pull/329) - pkg/cdi: stop embedding Cache mutex by [@​thaJeztah](https://github.com/thaJeztah) in [#​335](https://github.com/cncf-tags/container-device-interface/pull/335) - build(deps): bump actions/stale from 10 to 11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​327](https://github.com/cncf-tags/container-device-interface/pull/327) - specs-go: add test coverage by [@​thaJeztah](https://github.com/thaJeztah) in [#​332](https://github.com/cncf-tags/container-device-interface/pull/332) - replace strings.Split for strings.Cut by [@​thaJeztah](https://github.com/thaJeztah) in [#​336](https://github.com/cncf-tags/container-device-interface/pull/336) - schema, validation: minor fixes and modernization by [@​thaJeztah](https://github.com/thaJeztah) in [#​330](https://github.com/cncf-tags/container-device-interface/pull/330) - pkg/cdi: deprecate ErrStopScan and use os.ReadDir for scanning Spec directories by [@​thaJeztah](https://github.com/thaJeztah) in [#​339](https://github.com/cncf-tags/container-device-interface/pull/339) - Bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​318](https://github.com/cncf-tags/container-device-interface/pull/318) - pkg/cdi: synchronize access to specDirs by [@​thaJeztah](https://github.com/thaJeztah) in [#​337](https://github.com/cncf-tags/container-device-interface/pull/337) - schema: migrate to github.com/santhosh-tekuri/jsonschema/v6 by [@​thaJeztah](https://github.com/thaJeztah) in [#​331](https://github.com/cncf-tags/container-device-interface/pull/331) - pkg/cdi: fix deprecations, add doc-links and "go fix" by [@​thaJeztah](https://github.com/thaJeztah) in [#​338](https://github.com/cncf-tags/container-device-interface/pull/338) - internal/validation/k8s: remove unused validation helpers by [@​thaJeztah](https://github.com/thaJeztah) in [#​334](https://github.com/cncf-tags/container-device-interface/pull/334) - specs-go: remove x/mod semver dependency by [@​thaJeztah](https://github.com/thaJeztah) in [#​333](https://github.com/cncf-tags/container-device-interface/pull/333) - chore(deps): github.com/stretchr/testify v1.12.1 by [@​thaJeztah](https://github.com/thaJeztah) in [#​342](https://github.com/cncf-tags/container-device-interface/pull/342) - ci: update golangci-lint to v2.13, and fix linting by [@​thaJeztah](https://github.com/thaJeztah) in [#​352](https://github.com/cncf-tags/container-device-interface/pull/352) - ci: apply zizmor hardening fixes by [@​thaJeztah](https://github.com/thaJeztah) in [#​350](https://github.com/cncf-tags/container-device-interface/pull/350) - specs-go: fix benchmark compatibility with go1.19 by [@​thaJeztah](https://github.com/thaJeztah) in [#​353](https://github.com/cncf-tags/container-device-interface/pull/353) - pkg/cdi: fix flaky TestRefreshCache by [@​thaJeztah](https://github.com/thaJeztah) in [#​355](https://github.com/cncf-tags/container-device-interface/pull/355) - ci: test against oldest supported, oldstable, and stable Go versions by [@​thaJeztah](https://github.com/thaJeztah) in [#​351](https://github.com/cncf-tags/container-device-interface/pull/351) - pkg/cdi: TestRefreshCache: consolidate cache state checks by [@​thaJeztah](https://github.com/thaJeztah) in [#​357](https://github.com/cncf-tags/container-device-interface/pull/357) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​349](https://github.com/cncf-tags/container-device-interface/pull/349) - remove "sigs.k8s.io/yaml" dependency by [@​thaJeztah](https://github.com/thaJeztah) in [#​340](https://github.com/cncf-tags/container-device-interface/pull/340) - build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​348](https://github.com/cncf-tags/container-device-interface/pull/348) - build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​346](https://github.com/cncf-tags/container-device-interface/pull/346) - build(deps): bump codespell-project/actions-codespell from 2.1 to 2.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​347](https://github.com/cncf-tags/container-device-interface/pull/347) - pkg/cdi: fix, and cleanup some locks, and use RWMutex by [@​thaJeztah](https://github.com/thaJeztah) in [#​345](https://github.com/cncf-tags/container-device-interface/pull/345) - update minimum go version to go1.23 and modernize some code by [@​thaJeztah](https://github.com/thaJeztah) in [#​354](https://github.com/cncf-tags/container-device-interface/pull/354) - chore(deps): github.com/fsnotify/fsnotify v1.7.0 by [@​thaJeztah](https://github.com/thaJeztah) in [#​359](https://github.com/cncf-tags/container-device-interface/pull/359) - pkg/cdi: clean up watcher lifecycle handling and simplify refresh logic by [@​thaJeztah](https://github.com/thaJeztah) in [#​358](https://github.com/cncf-tags/container-device-interface/pull/358) - pkg/cdi: fix cache refresh handling for filesystem events by [@​thaJeztah](https://github.com/thaJeztah) in [#​344](https://github.com/cncf-tags/container-device-interface/pull/344) - Bump version to v1.1.1 by [@​elezar](https://github.com/elezar) in [#​361](https://github.com/cncf-tags/container-device-interface/pull/361) #### New Contributors - [@​zrezke](https://github.com/zrezke) made their first contribution in [#​303](https://github.com/cncf-tags/container-device-interface/pull/303) - [@​fujitatomoya](https://github.com/fujitatomoya) made their first contribution in [#​305](https://github.com/cncf-tags/container-device-interface/pull/305) - [@​koenkooi](https://github.com/koenkooi) made their first contribution in [#​313](https://github.com/cncf-tags/container-device-interface/pull/313) - [@​thc1006](https://github.com/thc1006) made their first contribution in [#​321](https://github.com/cncf-tags/container-device-interface/pull/321) **Full Changelog**: <https://github.com/cncf-tags/container-device-interface/compare/v1.1.0...v1.1.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1223 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
ba4d3c5b4f |
chore(deps): update dependencies and tweak make checks (#1212)
1. Dependency updates: gobwas/glob v1.0.0, which replaced its `Glob` interface with `*Pattern`, logrus v1.10.2, prometheus/client_model v0.6.3, golangci-lint v2.13.2, Go 1.27.1, docker/setup-qemu-action and nginx digests. 2. `make fmt-check` and `make tidy-check` report only what the formatter or `go mod tidy` would change, so unrelated uncommitted work no longer fails `make checks`. --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1212 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
7f53eca716 |
fix(deps): update module golang.org/x/crypto to v0.56.0 [security] (#1205)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.55.0` → `v0.56.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.55.0...refs/tags/v0.56.0) |  |  | --- ### Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh [CVE-2026-78662](https://nvd.nist.gov/vuln/detail/CVE-2026-78662) / [GO-2026-6354](https://pkg.go.dev/vuln/GO-2026-6354) <details> <summary>More information</summary> #### Details Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. #### Severity Unknown #### References - [https://go.dev/issue/81316](https://go.dev/issue/81316) - [https://go.dev/cl/826504](https://go.dev/cl/826504) - [https://groups.google.com/g/golang-announce/c/1y3fb2np35U](https://groups.google.com/g/golang-announce/c/1y3fb2np35U) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6354) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh [CVE-2026-56855](https://nvd.nist.gov/vuln/detail/CVE-2026-56855) / [GO-2026-6355](https://pkg.go.dev/vuln/GO-2026-6355) <details> <summary>More information</summary> #### Details Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. #### Severity Unknown #### References - [https://go.dev/issue/81317](https://go.dev/issue/81317) - [https://go.dev/cl/826524](https://go.dev/cl/826524) - [https://groups.google.com/g/golang-announce/c/1y3fb2np35U](https://groups.google.com/g/golang-announce/c/1y3fb2np35U) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6355) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1205 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
e30c2fed62 |
chore: update deps, adapt lint, use json v2 (#1185)
- Raised go to 1.27 - Adopted json v2 - Sync lint config from gitea - Fixed all issues Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1185 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
e78123cee3 |
fix(deps): update go toolchain directive to v1.26.6 [security] (#1183)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.26.5` → `1.26.6` | --- ### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) <details> <summary>More information</summary> #### Details The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". #### Severity Unknown #### References - [https://go.dev/cl/767220](https://go.dev/cl/767220) - [https://go.dev/issue/78760](https://go.dev/issue/78760) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage BIT-golang-2026-46600 / [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) / [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) <details> <summary>More information</summary> #### Details Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. #### Severity Unknown #### References - [https://go.dev/cl/786345](https://go.dev/cl/786345) - [https://go.dev/issue/79795](https://go.dev/issue/79795) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5942) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Enforce maximum recursion depth in encoding/asn1 BIT-golang-2026-33818 / [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) / [GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972) <details> <summary>More information</summary> #### Details Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. #### Severity Unknown #### References - [https://go.dev/issue/80405](https://go.dev/issue/80405) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) - [https://go.dev/cl/814980](https://go.dev/cl/814980) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5972) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Add recursion depth guard during decode in encoding/xml BIT-golang-2026-56859 / [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) / [GO-2026-6088](https://pkg.go.dev/vuln/GO-2026-6088) <details> <summary>More information</summary> #### Details Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. #### Severity Unknown #### References - [https://go.dev/issue/80481](https://go.dev/issue/80481) - [https://go.dev/cl/803320](https://go.dev/cl/803320) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6088) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http BIT-golang-2026-56853 / [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) / [GO-2026-6089](https://pkg.go.dev/vuln/GO-2026-6089) <details> <summary>More information</summary> #### Details When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. #### Severity Unknown #### References - [https://go.dev/issue/80205](https://go.dev/issue/80205) - [https://go.dev/cl/795540](https://go.dev/cl/795540) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6089) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Limit handshake messages we are willing to accept post-handshake in crypto/tls BIT-golang-2026-56862 / [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) / [GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090) <details> <summary>More information</summary> #### Details Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. #### Severity Unknown #### References - [https://go.dev/issue/80528](https://go.dev/issue/80528) - [https://go.dev/cl/804261](https://go.dev/cl/804261) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6090) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Fix Javascript regexp context tracking in html/template BIT-golang-2026-56858 / [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) / [GO-2026-6091](https://pkg.go.dev/vuln/GO-2026-6091) <details> <summary>More information</summary> #### Details Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. #### Severity Unknown #### References - [https://go.dev/issue/80435](https://go.dev/issue/80435) - [https://go.dev/cl/807100](https://go.dev/cl/807100) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6091) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Avoid quadratic complexity in resolvePath in net/url BIT-golang-2026-56860 / [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) / [GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) <details> <summary>More information</summary> #### Details Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. #### Severity Unknown #### References - [https://go.dev/cl/803681](https://go.dev/cl/803681) - [https://go.dev/issue/80494](https://go.dev/issue/80494) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6218) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1183 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
bircni
|
be90c01468 |
feat: add size-based cache eviction (#1170)
The cache server retired entries 30 days after creation regardless of use, so a job that ran often enough to keep its cache warm still lost it on a fixed schedule. Nothing bounded the disk either. Retention now counts from last access alone, and a repository over its limit sheds least recently accessed entries until it fits, enforced on commit as well as on the periodic sweep. ```yaml cache: retention: 168h # remove entries not accessed for seven days repo_size_limit: 10GB # cap each repository size_limit: 0 # cap the whole cache, off by default sweep_interval: 1h # minimum time between sweeps ``` Sizes accept `10GB`, `512mb`, `1TiB` or a plain byte count, binary either way. Leave a key out for its default; `0` turns a limit off, and `0s` does the same for `retention`. Whatever these allow, the cache also sheds entries to keep free space above `health_check.min_free_disk_space_mb` when health checks are enabled, so it cannot grow past the point where the runner stops accepting work. Supporting fixes: serving an entry stamps its access time, so a find cannot hand a job a download URL for an entry the next eviction is about to remove; an entry larger than the limit is dropped on its own account rather than emptying its repository to make room; and a blob that cannot be unlinked keeps its row, so the next sweep retries instead of orphaning bytes no limit can account for. Closes https://gitea.com/gitea/runner/issues/1168 --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1170 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
Renovate Bot
|
dbd9a892f8 |
chore(deps): update dependencies (#1160)
This PR contains the following updates: | Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---|---| | docker | stage | minor | `29.6.2-dind-rootless` → `29.7.1-dind-rootless` | |  |  | | docker | stage | minor | `29.6.2-dind` → `29.7.1-dind` | |  |  | | [github.com/docker/cli](https://github.com/docker/cli) | require | minor | `v29.6.2+incompatible` → `v29.7.1+incompatible` | `v29.7.2+incompatible` |  |  | | [github.com/moby/go-archive](https://github.com/moby/go-archive) | require | minor | `v0.2.1` → `v0.3.2` | `v0.3.3` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.7.1+incompatible`](https://github.com/docker/cli/compare/v29.7.0...v29.7.1) [Compare Source](https://github.com/docker/cli/compare/v29.7.0...v29.7.1) ### [`v29.7.0+incompatible`](https://github.com/docker/cli/compare/v29.6.2...v29.7.0) [Compare Source](https://github.com/docker/cli/compare/v29.6.2...v29.7.0) </details> <details> <summary>moby/go-archive (github.com/moby/go-archive)</summary> ### [`v0.3.2`](https://github.com/moby/go-archive/releases/tag/v0.3.2) [Compare Source](https://github.com/moby/go-archive/compare/v0.3.1...v0.3.2) #### What's Changed Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as `var/run -> /run`. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. [#​93](https://github.com/moby/go-archive/pull/93) **Full Changelog**: <https://github.com/moby/go-archive/compare/v0.3.1...v0.3.2> ### [`v0.3.1`](https://github.com/moby/go-archive/releases/tag/v0.3.1) [Compare Source](https://github.com/moby/go-archive/compare/v0.3.0...v0.3.1) #### Fixes This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting `etc/dnf/` without a preceding `etc/` entry could return `mkdirat etc/dnf: no such file or directory`. This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries. #### What's Changed - archive: create implied parents for directory entries [#​92](https://github.com/moby/go-archive/pull/92) - archive: Tarballer.Go: suppress io.ErrClosedPipe logs on close [#​94](https://github.com/moby/go-archive/pull/94) **Full Changelog**: <https://github.com/moby/go-archive/compare/v0.3.0...v0.3.1> ### [`v0.3.0`](https://github.com/moby/go-archive/releases/tag/v0.3.0) [Compare Source](https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0) #### Security This release fixes **CVE-2026-17106** / **[GHSA-hfg8-hc9c-6c3h](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)**, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory. The issue affected `Unpack`, `UnpackLayer`, `Untar`, `UntarUncompressed`, and the `ApplyLayer` helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions. #### What's Changed - archive: harden tar extraction against path traversal [#​45](https://github.com/moby/go-archive/pull/45) - archive: do not follow reparse points in chtimes [#​90](https://github.com/moby/go-archive/pull/90) - archive: fix creation time updates on Windows [#​79](https://github.com/moby/go-archive/pull/79) - archive: minor cleanups and godoc touch-up [#​87](https://github.com/moby/go-archive/pull/87) - archive: RebaseArchiveEntries: fix archive path rebasing [#​43](https://github.com/moby/go-archive/pull/43) #### Test and CI changes - ci: enable dependabot for actions [#​81](https://github.com/moby/go-archive/pull/81) - archive: make breakoutErr unwrap its cause [#​91](https://github.com/moby/go-archive/pull/91) - archive: use filepath for filesystem paths in tests [#​80](https://github.com/moby/go-archive/pull/80) - archive: use filepath for filesystem paths in tests [#​80](https://github.com/moby/go-archive/pull/80) **Full Changelog**: <https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1160 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
b66433e667 |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (#1156)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.19.1` → `v5.19.2` |  |  | --- ### go-git: Worktree operations may follow symlinks [CVE-2026-71556](https://nvd.nist.gov/vuln/detail/CVE-2026-71556) / [GHSA-hc8v-wwc9-vgxm](https://github.com/advisories/GHSA-hc8v-wwc9-vgxm) <details> <summary>More information</summary> #### Details ##### Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path. The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree. As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`. A symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration. Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path. Applications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability. ##### Patches The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary. Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component. Users of filesystem-backed worktrees should upgrade to a patched version. ##### Credits Thanks to @​kodareef5 for reporting this issue and working with the go-git security team toward its resolution. 🥇 We would also like to thank @​HughLewis20, who independently reported the same issue while a fix was already in progress. #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm](https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm) - [ |
||
|
Lunny Xiao
|
a8dcd5b67c |
refactor: move act/model and act/exprparser to actionslib (#1143)
Gitea needs the workflow model and the expression evaluator to parse workflows and to build the task payload this runner consumes, so today it depends on `gitea.com/gitea/runner` just for `act/model` and `act/exprparser`. Both packages now live in `gitea.dev/actionslib` (`pkg/model`, `pkg/exprparser`), the module both sides already share, and this repository consumes them from there. ### Changes - `act/model` and `act/exprparser` are deleted, all imports point at `gitea.dev/actionslib/pkg/...`. - New `act/ghcontext` package: the `GithubContext` helpers that need a git checkout on disk (`SetRef`, `SetSha`, `SetRepositoryAndOwner`) are runner only and would drag a git client plus the act context logger into the shared module, so they stay here as functions, with their tests. Only caller is `RunContext.getGithubContext`. - `act/common.CartesianProduct` moved to the shared model package, `act/model` was its only user. - `act/model/testdata/container-volumes` moved to `act/runner/testdata/container-volumes`, its only user is `runner_test.go`. - `internal/pkg/client.UUIDHeader` / `TokenHeader` now alias `pkg/protocol`, so the header names cannot drift apart from Gitea. ### Notes - No behaviour change intended: the moved files are unchanged apart from the import paths and the split described above. - `go.mod` depends on the released `gitea.dev/actionslib v0.7.0`, which carries both https://gitea.com/gitea/actionslib/pulls/11 and the `model.UsesHash` port in https://gitea.com/gitea/actionslib/pulls/14 that `main` needs after https://gitea.com/gitea/runner/pulls/1150. - Verified with `go build ./...`, `go vet ./...` and `go test ./act/... ./internal/...`; the docker based `act/runner` integration tests (`TestRunEvent`, `TestRunMatrixWithUserDefinedInclusions`) fail identically with and without this change in my environment. Assisted-by: Codet:GPT-5.1-Codex Reviewed-on: https://gitea.com/gitea/runner/pulls/1143 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
Lunny Xiao
|
24c13a1fd0 |
chore: revert 4c2ab943a8 (#1148)
Revert #1136 and use actionslib instead. revert chore: bump the module path to `/v3`, take the version from the VCS stamp (#1136) gitea can not consume the runner's api by version while it's version mismatches the module version: ``` go: gitea.com/gitea/runner@v3.0.1: invalid version: module contains a go.mod file, so module path must match major version ("gitea.com/gitea/runner/v3") ``` Fix that by bumping the module version now. The existing `v3.0.0` and `v3.0.1` tags stay unusable, so a new tag is needed after this lands. Also drop the version `-X` linker flags, which would otherwise have to repeat the new path in both `Makefile` and `.goreleaser.yaml`, where a stale path makes injection silently no-op. Go has recorded the module version in the build info since 1.24, so `Version()` reads it from there, keeping the variable as an override for builds without a VCS stamp. That part started as https://gitea.com/gitea/runner/pulls/1137 but belongs here: the stamp resolves against the tags that are legal for the module path, so without the `/v3` bump it would report `v1.0.9-0.<ts>-<sha>`. Since `release-nightly.yml` triggers on every push to `main`, splitting them would publish a nightly with a `v1` version. --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1136 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1148 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
silverwind
|
4c2ab943a8 |
chore: bump the module path to /v3, take the version from the VCS stamp (#1136)
gitea can not consume the runner's api by version while it's version mismatches the module version:
```
go: gitea.com/gitea/runner@v3.0.1: invalid version: module contains a go.mod file,
so module path must match major version ("gitea.com/gitea/runner/v3")
```
Fix that by bumping the module version now. The existing `v3.0.0` and `v3.0.1` tags stay unusable, so a new tag is needed after this lands.
Also drop the version `-X` linker flags, which would otherwise have to repeat the new path in both `Makefile` and `.goreleaser.yaml`, where a stale path makes injection silently no-op. Go has recorded the module version in the build info since 1.24, so `Version()` reads it from there, keeping the variable as an override for builds without a VCS stamp.
That part started as https://gitea.com/gitea/runner/pulls/1137 but belongs here: the stamp resolves against the tags that are legal for the module path, so without the `/v3` bump it would report `v1.0.9-0.<ts>-<sha>`. Since `release-nightly.yml` triggers on every push to `main`, splitting them would publish a nightly with a `v1` version.
---------
Co-authored-by: bircni <bircni@icloud.com>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1136
Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com>
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
silverwind
|
70387cca44 |
chore: align go version handling with gitea (#1144)
Aligns Go version handling with gitea, see https://github.com/go-gitea/gitea/pull/38559. `toolchain` names the build version, `go` stays the minimum. Reviewed-on: https://gitea.com/gitea/runner/pulls/1144 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
bircni
|
68547886a5 |
feat: wait for healthy services and fill the job context (#1107)
Service containers were started and then left alone, so a job's first step could run while a database was still starting up. The runner now waits for every service whose image or `options` declare a healthcheck, as GitHub does. An unhealthy service fails the job with its container log, one that never becomes healthy fails it after `container.service_ready_timeout` (default `5m`, negative disables the wait), and one that exits without a healthcheck only gets its log and a warning.
The started containers also fill the `job` context, whose fields existed but were never populated: `job.container.{id,network}` and `job.services.<id>.{id,network,ports}`. `ports` is keyed by the plain container port, so `job.services.postgres.ports['5432']` resolves to the host port Docker picked.
---------
Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1107
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: bircni <bircni@icloud.com>
|
||
|
Renovate Bot
|
55a625f733 |
chore(deps): update dependencies (#1138)
Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
silverwind
|
aced51b4d5 |
chore: drop Masterminds/semver and pkg/errors, re-sync the docker/cli copies (#1132)
1. Drop `Masterminds/semver`, the Docker API version check needs dotted-numeric comparison and moby's client ships `versions.GreaterThanOrEqualTo`. 1. A malformed API version now reports as unsupported instead of panicking. 1. Drop `pkg/errors`, nothing used stack traces, `Wrap` or `Cause`. 1. Drop its depguard rule, and the `io/ioutil` one that only masked staticcheck's `SA1019`. 1. Re-sync `act/container/docker_cli.go` and `act/container/docker_cli_test.go`, copies of docker/cli's `opts.go` and `opts_test.go`, from a March and a 2022 commit to the version go.mod pins. 1. Record the local deviations in each header. 1. Fix `invalidParameter`, which lacked `Unwrap`, hiding the wrapped cause from `errors.Is` and `errors.As`. Reviewed-on: https://gitea.com/gitea/runner/pulls/1132 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
bircni
|
41c72216bf |
feat: propagate proxy variables to jobs, services and builds (#1112)
Set `http_proxy`, `https_proxy` and `no_proxy` in the runner's environment and everything the runner controls uses them. Go already read them for the runner's own requests. This adds jobs, in lower and upper case, service containers, and Dockerfile action builds. Some hosts are added to `no_proxy` for jobs so they stay direct: the cache server, loopback, the job's service containers, and a `tcp://` Docker daemon. Without the last one the Docker client sends its API calls to the proxy and docker-in-docker breaks. Gitea is not added. Images are pulled by the Docker daemon, which has its own proxy setting. In the `dind` images it reads these same variables. The runner warns at startup if it has a proxy and the daemon does not. Fixes https://gitea.com/gitea/runner/issues/1118, originally reported as https://gitea.com/gitea/runner/issues/708. --------- Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1112 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
Renovate Bot
|
8c519ce318 |
fix(deps): update module github.com/prometheus/client_golang to v1.24.0 (#1113)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `v1.23.2` → `v1.24.0` |  |  | --- ### Release Notes <details> <summary>prometheus/client_golang (github.com/prometheus/client_golang)</summary> ### [`v1.24.0`](https://github.com/prometheus/client_golang/releases/tag/v1.24.0): - 2026-07-20 [Compare Source](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0) ##### Changes - \[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. [#​1862](https://github.com/prometheus/client_golang/issues/1862) - \[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated `model.NameValidationScheme` global. Default behavior is unchanged; code that set `NameValidationScheme = LegacyValidation` no longer gets legacy enforcement at metric, label, and push-grouping construction. [#​2051](https://github.com/prometheus/client_golang/issues/2051) - \[CHANGE] api/prometheus/v1: Support matchers (`matches[]` parameter) in `Rules` method (`Rules(ctx context.Context, matches []string) (RulesResult, error)`). [#​1843](https://github.com/prometheus/client_golang/issues/1843) - \[CHANGE] api/prometheus/v1: Refactor `LabelNames` method to return `model.LabelNames` instead of `[]string` for consistency across the API. [#​1850](https://github.com/prometheus/client_golang/issues/1850) - \[CHANGE] exp/api/remote: Simplify `Store` interface, rename `Handler` to `WriteHandler`, and encapsulate write response handling. [#​1855](https://github.com/prometheus/client_golang/issues/1855) - \[FEATURE] prometheus: Add new Go 1.26 runtime metrics (`/sched/goroutines-created:goroutines`, `/sched/goroutines/not-in-go:goroutines`, `/sched/goroutines/runnable:goroutines`, `/sched/goroutines/running:goroutines`, `/sched/goroutines/waiting:goroutines`, `/sched/threads/total:threads`). [#​1942](https://github.com/prometheus/client_golang/issues/1942) - \[FEATURE] prometheus: Add `WithUnit(unit string)` option and explicit OpenMetrics unit support in `CounterOpts`, `GaugeOpts`, `SummaryOpts`, and `HistogramOpts`. [#​1392](https://github.com/prometheus/client_golang/issues/1392) - \[FEATURE] prometheus: Expose descriptor construction error through public `Err()` method on `Desc`. [#​1902](https://github.com/prometheus/client_golang/issues/1902) - \[FEATURE] promhttp: Add opt-in `HandlerOpts.CoalesceGather` to deduplicate concurrent `Gather` calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. [#​1969](https://github.com/prometheus/client_golang/issues/1969) - \[FEATURE] promhttp: HTTP handlers created by `promhttp` package now support metrics filtering by providing one or more `name[]` query parameters. The default behavior when none are provided remains the same, returning all metrics. [#​1925](https://github.com/prometheus/client_golang/issues/1925) - \[FEATURE] api/prometheus/v1: Add query formatting endpoint support (`/format_query`) and `FormatQuery(ctx context.Context, query string) (string, error)` method. [#​1846](https://github.com/prometheus/client_golang/issues/1846), [#​1856](https://github.com/prometheus/client_golang/issues/1856) - \[FEATURE] api/prometheus/v1: Add support for `/status/tsdb/blocks` endpoint via `TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)` method. [#​1896](https://github.com/prometheus/client_golang/issues/1896) - \[FEATURE] exp/api/remote: Export `BackoffConfig` to allow customization when using `WithAPIBackoff`. [#​1895](https://github.com/prometheus/client_golang/issues/1895) - \[FEATURE] exp/api/remote: Add `RetryCallBack` to allow custom logging or handling on retry attempts in the remote write client. [#​1888](https://github.com/prometheus/client_golang/issues/1888), [#​1890](https://github.com/prometheus/client_golang/issues/1890) - \[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. [#​1860](https://github.com/prometheus/client_golang/issues/1860) - \[ENHANCEMENT] api: Use cloned `http.DefaultTransport` when constructing default HTTP clients to prevent accidental mutations of shared global transport state. [#​1885](https://github.com/prometheus/client_golang/issues/1885) - \[BUGFIX] prometheus: Recover from collector panics during `Gather()` and return an error instead of crashing the process. [#​1961](https://github.com/prometheus/client_golang/issues/1961) - \[BUGFIX] prometheus: Fix `cpu-seconds` unit suffix handling for metric `go_cpu_classes_gc_mark_assist_cpu_seconds`. [#​1991](https://github.com/prometheus/client_golang/issues/1991) - \[BUGFIX] promhttp: `InstrumentHandlerDuration` and `InstrumentHandlerCounter` no longer panic when given an observer/counter that does not implement `ExemplarObserver`/`ExemplarAdder` (e.g. a `SummaryVec`). The exemplar is dropped and the value is recorded via the plain `Observe`/`Add` path, matching the safe-cast already used by `Timer.ObserveDurationWithExemplar`. [#​2005](https://github.com/prometheus/client_golang/issues/2005) - \[BUGFIX] api/prometheus/v1: Fall back to `GET` requests when `POST` requests return `403 Forbidden` or method not allowed. [#​2030](https://github.com/prometheus/client_golang/issues/2030) - \[BUGFIX] api: Respect context cancellation inside `httpClient.Do`. [#​1971](https://github.com/prometheus/client_golang/issues/1971) - \[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. [#​1889](https://github.com/prometheus/client_golang/issues/1889) - \[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. [#​1917](https://github.com/prometheus/client_golang/issues/1917) - \[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. [#​1927](https://github.com/prometheus/client_golang/issues/1927) <details> <summary> All commits </summary> - build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1839](https://github.com/prometheus/client_golang/pull/1839) - build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1838](https://github.com/prometheus/client_golang/pull/1838) - prometheus/collectors: use godoc link for runtime/metrics supported metrics by [@​xieyuschen](https://github.com/xieyuschen) in [#​1844](https://github.com/prometheus/client_golang/pull/1844) - Fix doc typo by [@​torrca](https://github.com/torrca) in [#​1849](https://github.com/prometheus/client_golang/pull/1849) - Merge release-1.23 into main by [@​vesari](https://github.com/vesari) in [#​1851](https://github.com/prometheus/client_golang/pull/1851) - build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1852](https://github.com/prometheus/client_golang/pull/1852) - Refactor LabelNames to return model.LabelNames type for consistency by [@​yshngg](https://github.com/yshngg) in [#​1850](https://github.com/prometheus/client_golang/pull/1850) - remote: simplified Store interface; renamed Handler to WriteHandler by [@​bwplotka](https://github.com/bwplotka) in [#​1855](https://github.com/prometheus/client_golang/pull/1855) - feat(api/prometheus): add format\_query endpoint for query formatting by [@​yshngg](https://github.com/yshngg) in [#​1846](https://github.com/prometheus/client_golang/pull/1846) - feat(api): add FormatQuery method to Prometheus v1 API by [@​yshngg](https://github.com/yshngg) in [#​1856](https://github.com/prometheus/client_golang/pull/1856) - Support matchers in rules API by [@​jotak](https://github.com/jotak) in [#​1843](https://github.com/prometheus/client_golang/pull/1843) - Use prometheus/common.expfmt.NewTextParser by [@​aknuds1](https://github.com/aknuds1) in [#​1859](https://github.com/prometheus/client_golang/pull/1859) - Merge release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1861](https://github.com/prometheus/client_golang/pull/1861) - chore: Drop support for \<go1.22 by [@​mrueg](https://github.com/mrueg) in [#​1862](https://github.com/prometheus/client_golang/pull/1862) - collectors/version: Allow custom additional labels by [@​mrueg](https://github.com/mrueg) in [#​1860](https://github.com/prometheus/client_golang/pull/1860) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by [@​ywwg](https://github.com/ywwg) in [#​1865](https://github.com/prometheus/client_golang/pull/1865) - Sync release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1868](https://github.com/prometheus/client_golang/pull/1868) - Sync main with release-1.23 by [@​aknuds1](https://github.com/aknuds1) in [#​1871](https://github.com/prometheus/client_golang/pull/1871) - chore: clean up golangci-lint configuration by [@​mmorel-35](https://github.com/mmorel-35) in [#​1802](https://github.com/prometheus/client_golang/pull/1802) - build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1880](https://github.com/prometheus/client_golang/pull/1880) - build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1882](https://github.com/prometheus/client_golang/pull/1882) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1883](https://github.com/prometheus/client_golang/pull/1883) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1881](https://github.com/prometheus/client_golang/pull/1881) - Fix typo in remote api err msg by [@​SungJin1212](https://github.com/SungJin1212) in [#​1878](https://github.com/prometheus/client_golang/pull/1878) - chore: Update metrics for new Go version by [@​github-actions](https://github.com/github-actions)\[bot] in [#​1864](https://github.com/prometheus/client_golang/pull/1864) - Add RetryCallBack to remote\_api.go by [@​pipiland2612](https://github.com/pipiland2612) in [#​1888](https://github.com/prometheus/client_golang/pull/1888) - bug(remote\_write): Fix compression buffer pooling by [@​fpetkovski](https://github.com/fpetkovski) in [#​1889](https://github.com/prometheus/client_golang/pull/1889) - Change RetryCallBack initialized by [@​pipiland2612](https://github.com/pipiland2612) in [#​1890](https://github.com/prometheus/client_golang/pull/1890) - Fix CI bug by [@​pipiland2612](https://github.com/pipiland2612) in [#​1892](https://github.com/prometheus/client_golang/pull/1892) - Use cloned http.DefaultTransport. issue-1857 by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1885](https://github.com/prometheus/client_golang/pull/1885) - Public backoff config to allow usage of WithAPIBackoff by [@​pipiland2612](https://github.com/pipiland2612) in [#​1895](https://github.com/prometheus/client_golang/pull/1895) - Clarify exp library stability by [@​pipiland2612](https://github.com/pipiland2612) in [#​1894](https://github.com/prometheus/client_golang/pull/1894) - feat: add support for `/status/tsdb/blocks` endpoint by [@​tjhop](https://github.com/tjhop) in [#​1896](https://github.com/prometheus/client_golang/pull/1896) - minor refactor of replaceInvalidRune() in bridge.go by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1897](https://github.com/prometheus/client_golang/pull/1897) - build(deps): bump github.com/prometheus/procfs from 0.17.0 to 0.19.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1903](https://github.com/prometheus/client_golang/pull/1903) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1906](https://github.com/prometheus/client_golang/pull/1906) - build(deps): bump golang.org/x/sys from 0.35.0 to 0.37.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1904](https://github.com/prometheus/client_golang/pull/1904) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1907](https://github.com/prometheus/client_golang/pull/1907) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1911](https://github.com/prometheus/client_golang/pull/1911) - build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1909](https://github.com/prometheus/client_golang/pull/1909) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1910](https://github.com/prometheus/client_golang/pull/1910) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1908](https://github.com/prometheus/client_golang/pull/1908) - chore(ci): Add CRLF detection and fix targets to prevent CRLF contamination by [@​kakkoyun](https://github.com/kakkoyun) in [#​1898](https://github.com/prometheus/client_golang/pull/1898) - chore(ci): Use stable names for CI steps by [@​kakkoyun](https://github.com/kakkoyun) in [#​1914](https://github.com/prometheus/client_golang/pull/1914) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1920](https://github.com/prometheus/client_golang/pull/1920) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1921](https://github.com/prometheus/client_golang/pull/1921) - build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1922](https://github.com/prometheus/client_golang/pull/1922) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1923](https://github.com/prometheus/client_golang/pull/1923) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1924](https://github.com/prometheus/client_golang/pull/1924) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1919](https://github.com/prometheus/client_golang/pull/1919) - feat: expose Desc error through public Err() method by [@​duricanikolic](https://github.com/duricanikolic) in [#​1902](https://github.com/prometheus/client_golang/pull/1902) - Allow `/metrics` handler output filtering via `name[]` query param by [@​colega](https://github.com/colega) in [#​1925](https://github.com/prometheus/client_golang/pull/1925) - Prevent OOM from malformed snappy payloads by validating decoded length by [@​makasim](https://github.com/makasim) in [#​1917](https://github.com/prometheus/client_golang/pull/1917) - Ensure remote write v2 headers cannot be returned on v1 requests by [@​kgeckhart](https://github.com/kgeckhart) in [#​1927](https://github.com/prometheus/client_golang/pull/1927) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1932](https://github.com/prometheus/client_golang/pull/1932) - build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1933](https://github.com/prometheus/client_golang/pull/1933) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1935](https://github.com/prometheus/client_golang/pull/1935) - build(deps): bump the github-actions group with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1934](https://github.com/prometheus/client_golang/pull/1934) - promhttp/zstd: add unit tests for zstd writer registration by [@​90ashish](https://github.com/90ashish) in [#​1929](https://github.com/prometheus/client_golang/pull/1929) - feat(collector): add Go 1.26 new runtime metrics by [@​kakkoyun](https://github.com/kakkoyun) in [#​1942](https://github.com/prometheus/client_golang/pull/1942) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1948](https://github.com/prometheus/client_golang/pull/1948) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1946](https://github.com/prometheus/client_golang/pull/1946) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1944](https://github.com/prometheus/client_golang/pull/1944) - build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1945](https://github.com/prometheus/client_golang/pull/1945) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1947](https://github.com/prometheus/client_golang/pull/1947) - chore(test): bump 1.25, tests with synctest and check not panic by [@​manute](https://github.com/manute) in [#​1950](https://github.com/prometheus/client_golang/pull/1950) - build(deps): bump github.com/prometheus/procfs from 0.19.2 to 0.20.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1954](https://github.com/prometheus/client_golang/pull/1954) - build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1957](https://github.com/prometheus/client_golang/pull/1957) - build(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1955](https://github.com/prometheus/client_golang/pull/1955) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.34.0 to 1.40.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1959](https://github.com/prometheus/client_golang/pull/1959) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1956](https://github.com/prometheus/client_golang/pull/1956) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1958](https://github.com/prometheus/client_golang/pull/1958) - chore(collectors/go): generate the tests after new metric by [@​kakkoyun](https://github.com/kakkoyun) in [#​1962](https://github.com/prometheus/client_golang/pull/1962) - Remove Arthur from the list of maintainers by [@​ArthurSens](https://github.com/ArthurSens) in [#​1964](https://github.com/prometheus/client_golang/pull/1964) - build(deps): bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1965](https://github.com/prometheus/client_golang/pull/1965) - fix: recover from collector panic and return error in Gather by [@​Saflaski](https://github.com/Saflaski) in [#​1961](https://github.com/prometheus/client_golang/pull/1961) - prometheus: clarify MetricVec delete semantics in godoc by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1967](https://github.com/prometheus/client_golang/pull/1967) - build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1973](https://github.com/prometheus/client_golang/pull/1973) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1974](https://github.com/prometheus/client_golang/pull/1974) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1976](https://github.com/prometheus/client_golang/pull/1976) - Optionally add OM unit by [@​vesari](https://github.com/vesari) in [#​1392](https://github.com/prometheus/client_golang/pull/1392) - fix: respect context cancellation in httpClient.Do by [@​pedrampdd](https://github.com/pedrampdd) in [#​1971](https://github.com/prometheus/client_golang/pull/1971) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1978](https://github.com/prometheus/client_golang/pull/1978) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1977](https://github.com/prometheus/client_golang/pull/1977) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1980](https://github.com/prometheus/client_golang/pull/1980) - examples: add native histogram usage example by [@​thegdsks](https://github.com/thegdsks) in [#​1981](https://github.com/prometheus/client_golang/pull/1981) - chore(ci): add macOS, Windows and arm64 test runners by [@​kakkoyun](https://github.com/kakkoyun) in [#​1968](https://github.com/prometheus/client_golang/pull/1968) - prometheus: honor PidFn on windows and darwin by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1966](https://github.com/prometheus/client_golang/pull/1966) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1984](https://github.com/prometheus/client_golang/pull/1984) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1985](https://github.com/prometheus/client_golang/pull/1985) - promhttp: implement WithXFromContext in terms of WithXFromRequest by [@​tie](https://github.com/tie) in [#​1863](https://github.com/prometheus/client_golang/pull/1863) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1988](https://github.com/prometheus/client_golang/pull/1988) - Fix bug unit cpu-seconds not a suffix of metric go\_cpu\_classes\_gc\_mark\_assist\_cpu\_seconds by [@​vesari](https://github.com/vesari) in [#​1991](https://github.com/prometheus/client_golang/pull/1991) - build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1993](https://github.com/prometheus/client_golang/pull/1993) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1992](https://github.com/prometheus/client_golang/pull/1992) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1995](https://github.com/prometheus/client_golang/pull/1995) - exp/api/remote: limit request body size in SnappyDecodeMiddleware by [@​roidelapluie](https://github.com/roidelapluie) in [#​1996](https://github.com/prometheus/client_golang/pull/1996) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2001](https://github.com/prometheus/client_golang/pull/2001) - build(deps): bump the github-actions group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1994](https://github.com/prometheus/client_golang/pull/1994) - ci(update-go-versions): declare permissions for the monthly chore PR by [@​arpitjain099](https://github.com/arpitjain099) in [#​2003](https://github.com/prometheus/client_golang/pull/2003) - docs: fix godoc indentation and typos in timer.go and wrap.go by [@​immanuwell](https://github.com/immanuwell) in [#​2009](https://github.com/prometheus/client_golang/pull/2009) - ci: harden actions/checkout with persist-credentials: false by [@​roidelapluie](https://github.com/roidelapluie) in [#​2011](https://github.com/prometheus/client_golang/pull/2011) - fix(registry): prevent file descriptor leak in WriteToTextfile by [@​ProjectMutilation](https://github.com/ProjectMutilation) in [#​2010](https://github.com/prometheus/client_golang/pull/2010) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2008](https://github.com/prometheus/client_golang/pull/2008) - promhttp: add regression test for concurrent map writes ([#​1274](https://github.com/prometheus/client_golang/issues/1274)) by [@​pedrampdd](https://github.com/pedrampdd) in [#​2000](https://github.com/prometheus/client_golang/pull/2000) - build(deps): bump github.com/prometheus/common from 0.67.6-0.20260224092343-e4c38a0aea47 to 0.68.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2015](https://github.com/prometheus/client_golang/pull/2015) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2016](https://github.com/prometheus/client_golang/pull/2016) - build(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2014](https://github.com/prometheus/client_golang/pull/2014) - build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2017](https://github.com/prometheus/client_golang/pull/2017) - promhttp: fix grammar in exemplar option doc comments by [@​s3onghyun](https://github.com/s3onghyun) in [#​2023](https://github.com/prometheus/client_golang/pull/2023) - fix: use keyed fields in SamplePair struct literals in api\_test.go by [@​immanuwell](https://github.com/immanuwell) in [#​2012](https://github.com/prometheus/client_golang/pull/2012) - refactor: replace interface{} with any (Go 1.18+) by [@​MD-Mushfiqur123](https://github.com/MD-Mushfiqur123) in [#​2021](https://github.com/prometheus/client_golang/pull/2021) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2013](https://github.com/prometheus/client_golang/pull/2013) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2025](https://github.com/prometheus/client_golang/pull/2025) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2027](https://github.com/prometheus/client_golang/pull/2027) - build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2026](https://github.com/prometheus/client_golang/pull/2026) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2028](https://github.com/prometheus/client_golang/pull/2028) - build(deps): bump github.com/prometheus/procfs from 0.20.1 to 0.21.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2033](https://github.com/prometheus/client_golang/pull/2033) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2036](https://github.com/prometheus/client_golang/pull/2036) - build(deps): bump github.com/prometheus/procfs from 0.21.0 to 0.21.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2035](https://github.com/prometheus/client_golang/pull/2035) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2038](https://github.com/prometheus/client_golang/pull/2038) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2041](https://github.com/prometheus/client_golang/pull/2041) - fix(api): fall back to GET on forbidden POSTs by [@​immanuwell](https://github.com/immanuwell) in [#​2030](https://github.com/prometheus/client_golang/pull/2030) - build(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2042](https://github.com/prometheus/client_golang/pull/2042) - build(deps): bump the github-actions group across 1 directory with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2043](https://github.com/prometheus/client_golang/pull/2043) - chores: remove example Dockerfile and container\_description.yaml by [@​bwplotka](https://github.com/bwplotka) in [#​2044](https://github.com/prometheus/client_golang/pull/2044) - Update dependabot config by [@​SuperQ](https://github.com/SuperQ) in [#​2046](https://github.com/prometheus/client_golang/pull/2046) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2048](https://github.com/prometheus/client_golang/pull/2048) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2047](https://github.com/prometheus/client_golang/pull/2047) - promhttp: don't panic when instrumenting with non-exemplar observers by [@​spor3006](https://github.com/spor3006) in [#​2005](https://github.com/prometheus/client_golang/pull/2005) - Replace deprecated model.NameValidationScheme with explicit UTF8Validation by [@​kakkoyun](https://github.com/kakkoyun) in [#​2051](https://github.com/prometheus/client_golang/pull/2051) - test: fix two flaky tests (darwin start\_time regex, memstats HeapReleased drift) by [@​kakkoyun](https://github.com/kakkoyun) in [#​2050](https://github.com/prometheus/client_golang/pull/2050) - fix: correct typos in comments and test error messages by [@​maxtaran2010](https://github.com/maxtaran2010) in [#​2049](https://github.com/prometheus/client_golang/pull/2049) - examples: improve simple main.go example by [@​dhanudhanushree](https://github.com/dhanudhanushree) in [#​1999](https://github.com/prometheus/client_golang/pull/1999) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2055](https://github.com/prometheus/client_golang/pull/2055) - feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather calls by [@​kakkoyun](https://github.com/kakkoyun) in [#​1969](https://github.com/prometheus/client_golang/pull/1969) - build(deps): update all Go dependencies in all go.mod files by [@​bwplotka](https://github.com/bwplotka) in [#​2059](https://github.com/prometheus/client_golang/pull/2059) - Cut v1.24.0-rc.0 by [@​bwplotka](https://github.com/bwplotka) in [#​2058](https://github.com/prometheus/client_golang/pull/2058) </details> #### New Contributors * @​xieyuschen made their first contribution in https://github.com/prometheus/client_golang/pull/1844 * @​torrca made their first contribution in https://github.com/prometheus/client_golang/pull/1849 * @​yshngg made their first contribution in https://github.com/prometheus/client_golang/pull/1850 * @​jotak made their first contribution in https://github.com/prometheus/client_golang/pull/1843 * @​SungJin1212 made their first contribution in https://github.com/prometheus/client_golang/pull/1878 * @​github-actions[bot] made their first contribution in https://github.com/prometheus/client_golang/pull/1864 * @​pipiland2612 made their first contribution in https://github.com/prometheus/client_golang/pull/1888 * @​fpetkovski made their first contribution in https://github.com/prometheus/client_golang/pull/1889 * @​karthikkondapally made their first contribution in https://github.com/prometheus/client_golang/pull/1885 * @​tjhop made their first contribution in https://github.com/prometheus/client_golang/pull/1896 * @​duricanikolic made their first contribution in https://github.com/prometheus/client_golang/pull/1902 * @​makasim made their first contribution in https://github.com/prometheus/client_golang/pull/1917 * @​kgeckhart made their first contribution in https://github.com/prometheus/client_golang/pull/1927 * @​90ashish made their first contribution in https://github.com/prometheus/client_golang/pull/1929 * @​manute made their first contribution in https://github.com/prometheus/client_golang/pull/1950 * @​Saflaski made their first contribution in https://github.com/prometheus/client_golang/pull/1961 * @​Retr0-XD made their first contribution in https://github.com/prometheus/client_golang/pull/1967 * @​pedrampdd made their first contribution in https://github.com/prometheus/client_golang/pull/1971 * @​thegdsks made their first contribution in https://github.com/prometheus/client_golang/pull/1981 * @​tie made their first contribution in https://github.com/prometheus/client_golang/pull/1863 * @​arpitjain099 made their first contribution in https://github.com/prometheus/client_golang/pull/2003 * @​immanuwell made their first contribution in https://github.com/prometheus/client_golang/pull/2009 * @​ProjectMutilation made their first contribution in https://github.com/prometheus/client_golang/pull/2010 * @​s3onghyun made their first contribution in https://github.com/prometheus/client_golang/pull/2023 * @​MD-Mushfiqur123 made their first contribution in https://github.com/prometheus/client_golang/pull/2021 * @​spor3006 made their first contribution in https://github.com/prometheus/client_golang/pull/2005 * @​maxtaran2010 made their first contribution in https://github.com/prometheus/client_golang/pull/2049 * @​dhanudhanushree made their first contribution in https://github.com/prometheus/client_golang/pull/1999 **Full Changelog**: <https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1113 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
de43c84203 |
fix(deps): update module go.opentelemetry.io/otel to v1.44.0 [security] (#1115)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `v1.43.0` → `v1.44.0` |  |  | --- ### Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel [CVE-2026-41178](https://nvd.nist.gov/vuln/detail/CVE-2026-41178) / [GHSA-5wrp-cwcj-q835](https://github.com/advisories/GHSA-5wrp-cwcj-q835) / [GO-2026-5158](https://pkg.go.dev/vuln/GO-2026-5158) <details> <summary>More information</summary> #### Details Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel #### Severity Unknown #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835) - [https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://github.com/open-telemetry/opentelemetry-go/pull/7880) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5158) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.44.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.44.0): /v0.66.0/v0.20.0/v0.0.17 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0) ##### Added - Add `ByteSlice` and `ByteSliceValue` functions for new `BYTESLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​7948](https://github.com/open-telemetry/opentelemetry-go/issues/7948)) - Apply attribute value limit to the `KindBytes` attribute type in `go.opentelemetry.io/otel/sdk/log`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Apply attribute value limit to the `BYTESLICE` attribute type in `go.opentelemetry.io/otel/sdk/trace`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/trace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Add `String` method for `Value` type in `go.opentelemetry.io/otel/attribute`. ([#​8142](https://github.com/open-telemetry/opentelemetry-go/issues/8142)) - Add `Slice` and `SliceValue` functions for new `SLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​8166](https://github.com/open-telemetry/opentelemetry-go/issues/8166)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Apply `AttributeValueLengthLimit` to `attribute.SLICE` type attribute values in `go.opentelemetry.io/otel/sdk/trace`, recursively truncating contained string values. ([#​8217](https://github.com/open-telemetry/opentelemetry-go/issues/8217)) - Add `Error` field on `Record` type in `go.opentelemetry.io/otel/log/logtest`. ([#​8148](https://github.com/open-telemetry/opentelemetry-go/issues/8148)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `Settable` to `go.opentelemetry.io/otel/metric/x` to allow reusing attribute options. ([#​8178](https://github.com/open-telemetry/opentelemetry-go/issues/8178)) - Add experimental support for splitting metric data across multiple batches in `go.opentelemetry.io/otel/sdk/metric`. Set `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size>` to enable for all periodic readers. See `go.opentelemetry.io/otel/sdk/metric/internal/x` for feature documentation. ([#​8071](https://github.com/open-telemetry/opentelemetry-go/issues/8071)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x` for feature documentation. ([#​8192](https://github.com/open-telemetry/opentelemetry-go/issues/8192)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x` for feature documentation. ([#​8194](https://github.com/open-telemetry/opentelemetry-go/issues/8194)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/stdout/stdoutlog/internal/x` for feature documentation. ([#​8263](https://github.com/open-telemetry/opentelemetry-go/issues/8263)) - Add `WithDefaultAttributes` to `go.opentelemetry.io/otel/metric/x` to support setting default attributes on instruments. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Add `go.opentelemetry.io/otel/semconv/v1.41.0` package. The package contains semantic conventions from the `v1.41.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.41.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.40.0`. ([#​8324](https://github.com/open-telemetry/opentelemetry-go/issues/8324)) - Add Observable variants of instruments to `go.opentelemetry.io/otel/semconv/v1.41.0` package. ([#​8350](https://github.com/open-telemetry/opentelemetry-go/issues/8350)) - Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#​8002](https://github.com/open-telemetry/opentelemetry-go/issues/8002)) ##### Changed - ⚠️ **Breaking Change:** `go.opentelemetry.io/otel/sdk/metric` now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing `attribute.Bool("otel.metric.overflow", true)`. This can break users who relied on the previous unlimited default. Set `WithCardinalityLimit(0)` or the deprecated `OTEL_GO_X_CARDINALITY_LIMIT=0` environment variable to preserve unlimited cardinality. Note that support for `OTEL_GO_X_CARDINALITY_LIMIT` may be removed in a future release. ([#​8247](https://github.com/open-telemetry/opentelemetry-go/issues/8247)) - `ErrorType` in `go.opentelemetry.io/otel/semconv` now unwraps errors created with `fmt.Errorf` when deriving the `error.type` attribute. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `go.opentelemetry.io/otel/sdk/log` now unwraps error chains created with `fmt.Errorf` when deriving the `error.type` attribute from errors on log records. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `Set.MarshalLog` method in `go.opentelemetry.io/otel/attribute` now uses `Value.String` formatting following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8169](https://github.com/open-telemetry/opentelemetry-go/issues/8169)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir and short-circuit `Offer` calls to the exemplar reservoir when `exemplar.AlwaysOffFilter` is configured. ([#​8211](https://github.com/open-telemetry/opentelemetry-go/issues/8211)) ([#​8267](https://github.com/open-telemetry/opentelemetry-go/issues/8267)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir for asynchronous instruments when `exemplar.TraceBasedFilter` is configured. ([#​8286](https://github.com/open-telemetry/opentelemetry-go/issues/8286)) ##### Deprecated - Deprecate `Value.Emit` method in `go.opentelemetry.io/otel/attribute`. Use `Value.String` instead. ([#​8176](https://github.com/open-telemetry/opentelemetry-go/issues/8176)) ##### Fixed - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8152](https://github.com/open-telemetry/opentelemetry-go/issues/8152)) - `go.opentelemetry.io/otel/exporters/prometheus` now uses `Value.String` formatting for label values following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8170](https://github.com/open-telemetry/opentelemetry-go/issues/8170)) - Propagate errors from the exporter when calling `Shutdown` on `BatchSpanProcessor` in `go.opentelemetry.io/otel/sdk/trace`. ([#​8197](https://github.com/open-telemetry/opentelemetry-go/issues/8197)) - Fix stale status code reporting on self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8226](https://github.com/open-telemetry/opentelemetry-go/issues/8226)) - Fix a concurrent `Collect` data race and potential panic in `go.opentelemetry.io/otel/exporters/prometheus` when `WithResourceAsConstantLabels` option is used. ([#​8227](https://github.com/open-telemetry/opentelemetry-go/issues/8227)) - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting [#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447). ([#​8249](https://github.com/open-telemetry/opentelemetry-go/issues/8249)) - Fix `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` to safely handle zero size. A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in `Offer()` and `Collect()` ensure no-op behavior. ([#​8295](https://github.com/open-telemetry/opentelemetry-go/issues/8295)) - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8254](https://github.com/open-telemetry/opentelemetry-go/issues/8254)) - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. ([#​8264](https://github.com/open-telemetry/opentelemetry-go/issues/8264)) - Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m)) - Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ([#​8222](https://github.com/open-telemetry/opentelemetry-go/issues/8222)) - Fix `go.opentelemetry.io/otel/semconv/v1.41.0` to include `Attr*` helper methods for required attributes on observable instruments. ([#​8361](https://github.com/open-telemetry/opentelemetry-go/issues/8361)) - Limit baggage extraction error reporting in `go.opentelemetry.io/otel/propagation` to prevent malformed or oversized baggage headers from flooding logs. ([GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835)) #### What's Changed - Document how to implement experimental features by [@​dashpole](https://github.com/dashpole) in [#​8124](https://github.com/open-telemetry/opentelemetry-go/pull/8124) - Add support for experimental options in the metrics API by [@​dashpole](https://github.com/dashpole) in [#​8111](https://github.com/open-telemetry/opentelemetry-go/pull/8111) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`e5db982`](https://github.com/open-telemetry/opentelemetry-go/commit/e5db982) by [@​renovate](https://github.com/renovate)\[bot] in [#​8136](https://github.com/open-telemetry/opentelemetry-go/pull/8136) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`32cd848`](https://github.com/open-telemetry/opentelemetry-go/commit/32cd848) by [@​renovate](https://github.com/renovate)\[bot] in [#​8141](https://github.com/open-telemetry/opentelemetry-go/pull/8141) - fix(deps): update googleapis to [`6f92a3b`](https://github.com/open-telemetry/opentelemetry-go/commit/6f92a3b) by [@​renovate](https://github.com/renovate)\[bot] in [#​8140](https://github.com/open-telemetry/opentelemetry-go/pull/8140) - chore(deps): update module github.com/jgautheron/goconst to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8134](https://github.com/open-telemetry/opentelemetry-go/pull/8134) - attribute: add BYTESLICE type support by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7948](https://github.com/open-telemetry/opentelemetry-go/pull/7948) - unwrap error chains created with fmt.Errorf by [@​pellared](https://github.com/pellared) in [#​8133](https://github.com/open-telemetry/opentelemetry-go/pull/8133) - log/logtest: add Error field to Record type by [@​pellared](https://github.com/pellared) in [#​8148](https://github.com/open-telemetry/opentelemetry-go/pull/8148) - attribute: add String method for Value type by [@​pellared](https://github.com/pellared) in [#​8142](https://github.com/open-telemetry/opentelemetry-go/pull/8142) - fix(deps): update module golang.org/x/sys to v0.43.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8156](https://github.com/open-telemetry/opentelemetry-go/pull/8156) - chore(deps): update codspeedhq/action action to v4.13.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8155](https://github.com/open-telemetry/opentelemetry-go/pull/8155) - fix(otlploghttp): replay gzipped bodies on redirect by [@​MrAlias](https://github.com/MrAlias) in [#​8152](https://github.com/open-telemetry/opentelemetry-go/pull/8152) - Improve test coverage for exponential histogram edge cases by [@​dashpole](https://github.com/dashpole) in [#​8129](https://github.com/open-telemetry/opentelemetry-go/pull/8129) - Add example test for the prometheus exporter by [@​dashpole](https://github.com/dashpole) in [#​8137](https://github.com/open-telemetry/opentelemetry-go/pull/8137) - chore(deps): update golang.org/x/telemetry digest to [`93c7c8a`](https://github.com/open-telemetry/opentelemetry-go/commit/93c7c8a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8158](https://github.com/open-telemetry/opentelemetry-go/pull/8158) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by [@​renovate](https://github.com/renovate)\[bot] in [#​8161](https://github.com/open-telemetry/opentelemetry-go/pull/8161) - chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8159](https://github.com/open-telemetry/opentelemetry-go/pull/8159) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`6b4d2bc`](https://github.com/open-telemetry/opentelemetry-go/commit/6b4d2bc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8160](https://github.com/open-telemetry/opentelemetry-go/pull/8160) - Add experimental support for batching in periodic reader by [@​dashpole](https://github.com/dashpole) in [#​8071](https://github.com/open-telemetry/opentelemetry-go/pull/8071) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8165](https://github.com/open-telemetry/opentelemetry-go/pull/8165) - Support `BYTESLICE` attributes across trace and exporter paths by [@​MrAlias](https://github.com/MrAlias) in [#​8153](https://github.com/open-telemetry/opentelemetry-go/pull/8153) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8171](https://github.com/open-telemetry/opentelemetry-go/pull/8171) - fix(deps): update module golang.org/x/tools to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8173](https://github.com/open-telemetry/opentelemetry-go/pull/8173) - metricdatatest: support BYTESLICE attribute comparisons by [@​pellared](https://github.com/pellared) in [#​8167](https://github.com/open-telemetry/opentelemetry-go/pull/8167) - test: add test case for ByteSlice in TestValueFromAttribute by [@​pellared](https://github.com/pellared) in [#​8168](https://github.com/open-telemetry/opentelemetry-go/pull/8168) - attribute: Set.MarshalLog to use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8169](https://github.com/open-telemetry/opentelemetry-go/pull/8169) - prometheus: use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8170](https://github.com/open-telemetry/opentelemetry-go/pull/8170) - fix(deps): update golang.org/x to [`746e56f`](https://github.com/open-telemetry/opentelemetry-go/commit/746e56f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8175](https://github.com/open-telemetry/opentelemetry-go/pull/8175) - Add support for the development attributes advisory parameter by [@​dashpole](https://github.com/dashpole) in [#​8135](https://github.com/open-telemetry/opentelemetry-go/pull/8135) - chore(deps): update actions/upload-artifact action to v7.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8177](https://github.com/open-telemetry/opentelemetry-go/pull/8177) - attribute: deprecate Value.Emit by [@​pellared](https://github.com/pellared) in [#​8176](https://github.com/open-telemetry/opentelemetry-go/pull/8176) - chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8181](https://github.com/open-telemetry/opentelemetry-go/pull/8181) - chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8180](https://github.com/open-telemetry/opentelemetry-go/pull/8180) - chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8182](https://github.com/open-telemetry/opentelemetry-go/pull/8182) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.56.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8184](https://github.com/open-telemetry/opentelemetry-go/pull/8184) - Update semconv template and 1.40.0 to use Enabled for metrics by [@​dashpole](https://github.com/dashpole) in [#​8172](https://github.com/open-telemetry/opentelemetry-go/pull/8172) - Add x.Settable to allow reusing attribute options by [@​dashpole](https://github.com/dashpole) in [#​8178](https://github.com/open-telemetry/opentelemetry-go/pull/8178) - chore(deps): update actions/cache action to v5.0.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8187](https://github.com/open-telemetry/opentelemetry-go/pull/8187) - fix(deps): update googleapis to [`3e5c5a5`](https://github.com/open-telemetry/opentelemetry-go/commit/3e5c5a5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8190](https://github.com/open-telemetry/opentelemetry-go/pull/8190) - fix(otlpmetrichttp): replay gzipped bodies on redirect by [@​pellared](https://github.com/pellared) in [#​8185](https://github.com/open-telemetry/opentelemetry-go/pull/8185) - fix(deps): update module golang.org/x/vuln to v1.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8193](https://github.com/open-telemetry/opentelemetry-go/pull/8193) - fix(deps): update googleapis to [`afd174a`](https://github.com/open-telemetry/opentelemetry-go/commit/afd174a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8195](https://github.com/open-telemetry/opentelemetry-go/pull/8195) - chore(deps): update module github.com/dave/dst to v0.27.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8198](https://github.com/open-telemetry/opentelemetry-go/pull/8198) - Fix exemplar tests in containerized environments by [@​dashpole](https://github.com/dashpole) in [#​8188](https://github.com/open-telemetry/opentelemetry-go/pull/8188) - Update contributing to recommend using Enabled by [@​dashpole](https://github.com/dashpole) in [#​8189](https://github.com/open-telemetry/opentelemetry-go/pull/8189) - otlptracehttp: reset pooled gzip writer before reuse by [@​pellared](https://github.com/pellared) in [#​8196](https://github.com/open-telemetry/opentelemetry-go/pull/8196) - chore(deps): update golang.org/x/telemetry digest to [`fac6e1c`](https://github.com/open-telemetry/opentelemetry-go/commit/fac6e1c) by [@​renovate](https://github.com/renovate)\[bot] in [#​8202](https://github.com/open-telemetry/opentelemetry-go/pull/8202) - fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8207](https://github.com/open-telemetry/opentelemetry-go/pull/8207) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`07c9668`](https://github.com/open-telemetry/opentelemetry-go/commit/07c9668) by [@​renovate](https://github.com/renovate)\[bot] in [#​8206](https://github.com/open-telemetry/opentelemetry-go/pull/8206) - attribute: make TestHashKVs linear-time by [@​pellared](https://github.com/pellared) in [#​8204](https://github.com/open-telemetry/opentelemetry-go/pull/8204) - chore(deps): update github/codeql-action action to v4.35.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8208](https://github.com/open-telemetry/opentelemetry-go/pull/8208) - sdk/trace: propagate SpanExporter.Shutdown error from BatchSpanProcessor by [@​alliasgher](https://github.com/alliasgher) in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - add GitHub Copilot code review instructions by [@​pellared](https://github.com/pellared) in [#​8212](https://github.com/open-telemetry/opentelemetry-go/pull/8212) - chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.29.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8214](https://github.com/open-telemetry/opentelemetry-go/pull/8214) - attribute: add SLICE type support by [@​pellared](https://github.com/pellared) in [#​8166](https://github.com/open-telemetry/opentelemetry-go/pull/8166) - Fix typos found by copilot by [@​dashpole](https://github.com/dashpole) in [#​8221](https://github.com/open-telemetry/opentelemetry-go/pull/8221) - chore(deps): update module github.com/go-git/go-git/v5 to v5.18.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8223](https://github.com/open-telemetry/opentelemetry-go/pull/8223) - docs: add agent guide for autonomous coding agents by [@​pellared](https://github.com/pellared) in [#​8215](https://github.com/open-telemetry/opentelemetry-go/pull/8215) - test: truncate attribute string values using Unicode rune count by [@​pellared](https://github.com/pellared) in [#​8219](https://github.com/open-telemetry/opentelemetry-go/pull/8219) - sdk/trace: apply AttributeValueLengthLimit to attribute.SLICE by [@​pellared](https://github.com/pellared) in [#​8217](https://github.com/open-telemetry/opentelemetry-go/pull/8217) - chore(deps): update module github.com/dlclark/regexp2 to v1.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8229](https://github.com/open-telemetry/opentelemetry-go/pull/8229) - prometheus: fix Collect data race for constant resource labels by [@​pellared](https://github.com/pellared) in [#​8227](https://github.com/open-telemetry/opentelemetry-go/pull/8227) - exporters: support SLICE attributes by [@​pellared](https://github.com/pellared) in [#​8216](https://github.com/open-telemetry/opentelemetry-go/pull/8216) - chore(deps): update codspeedhq/action action to v4.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8234](https://github.com/open-telemetry/opentelemetry-go/pull/8234) - Fix stale status code reporting on self-observability metrics by [@​dashpole](https://github.com/dashpole) in [#​8226](https://github.com/open-telemetry/opentelemetry-go/pull/8226) - fix(deps): update googleapis to [`e10c466`](https://github.com/open-telemetry/opentelemetry-go/commit/e10c466) by [@​renovate](https://github.com/renovate)\[bot] in [#​8241](https://github.com/open-telemetry/opentelemetry-go/pull/8241) - fix(deps): update build-tools to v0.30.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8244](https://github.com/open-telemetry/opentelemetry-go/pull/8244) - \[chore] changelog: re-run workflow on PR title edits by [@​cijothomas](https://github.com/cijothomas) in [#​8246](https://github.com/open-telemetry/opentelemetry-go/pull/8246) - stdlog observ: remove partial success handling by [@​yumosx](https://github.com/yumosx) in [#​8174](https://github.com/open-telemetry/opentelemetry-go/pull/8174) - feat: add self-observability metrics to otlpmetrichttp metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8194](https://github.com/open-telemetry/opentelemetry-go/pull/8194) - chore(deps): update golang.org/x/telemetry digest to [`392afab`](https://github.com/open-telemetry/opentelemetry-go/commit/392afab) by [@​renovate](https://github.com/renovate)\[bot] in [#​8248](https://github.com/open-telemetry/opentelemetry-go/pull/8248) - Use a DropReservoir when an exemplar.AlwaysOffFilter is provided by [@​dashpole](https://github.com/dashpole) in [#​8211](https://github.com/open-telemetry/opentelemetry-go/pull/8211) - metric: clarify sync vs observable Gauge in package godoc by [@​alliasgher](https://github.com/alliasgher) in [#​8225](https://github.com/open-telemetry/opentelemetry-go/pull/8225) - sdk/metric: apply default cardinality limit of 2000 by [@​pellared](https://github.com/pellared) in [#​8247](https://github.com/open-telemetry/opentelemetry-go/pull/8247) - Revert "Optimize fixedsize reservoir ([#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447))" by [@​dashpole](https://github.com/dashpole) in [#​8249](https://github.com/open-telemetry/opentelemetry-go/pull/8249) - fix(deps): update module golang.org/x/vuln to v1.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8256](https://github.com/open-telemetry/opentelemetry-go/pull/8256) - chore(deps): update otel/weaver docker tag to v0.23.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8255](https://github.com/open-telemetry/opentelemetry-go/pull/8255) - Run benchmarks using Settable for more accurate comparrisons by [@​dashpole](https://github.com/dashpole) in [#​8252](https://github.com/open-telemetry/opentelemetry-go/pull/8252) - Add MaxRequestSize option to OTLP exporters by [@​pellared](https://github.com/pellared) in [#​8157](https://github.com/open-telemetry/opentelemetry-go/pull/8157) - fix counting of spans/logs in self-observability metrics in otlp trace and log exporters by [@​dashpole](https://github.com/dashpole) in [#​8254](https://github.com/open-telemetry/opentelemetry-go/pull/8254) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`2f88a58`](https://github.com/open-telemetry/opentelemetry-go/commit/2f88a58) by [@​renovate](https://github.com/renovate)\[bot] in [#​8260](https://github.com/open-telemetry/opentelemetry-go/pull/8260) - chore(deps): update golang.org/x/telemetry digest to [`329d219`](https://github.com/open-telemetry/opentelemetry-go/commit/329d219) by [@​renovate](https://github.com/renovate)\[bot] in [#​8259](https://github.com/open-telemetry/opentelemetry-go/pull/8259) - chore(deps): update module github.com/sourcegraph/go-diff to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8262](https://github.com/open-telemetry/opentelemetry-go/pull/8262) - chore(deps): update module github.com/mattn/go-isatty to v0.0.22 by [@​renovate](https://github.com/renovate)\[bot] in [#​8265](https://github.com/open-telemetry/opentelemetry-go/pull/8265) - chore(deps): update module go.uber.org/zap to v1.28.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8269](https://github.com/open-telemetry/opentelemetry-go/pull/8269) - fix(deps): update googleapis to [`7cedc36`](https://github.com/open-telemetry/opentelemetry-go/commit/7cedc36) by [@​renovate](https://github.com/renovate)\[bot] in [#​8266](https://github.com/open-telemetry/opentelemetry-go/pull/8266) - chore(deps): update module github.com/securego/gosec/v2 to v2.26.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8270](https://github.com/open-telemetry/opentelemetry-go/pull/8270) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.57.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8275](https://github.com/open-telemetry/opentelemetry-go/pull/8275) - chore(deps): update codspeedhq/action action to v4.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8272](https://github.com/open-telemetry/opentelemetry-go/pull/8272) - chore(deps): update golang.org/x/telemetry digest to [`76f71b9`](https://github.com/open-telemetry/opentelemetry-go/commit/76f71b9) by [@​renovate](https://github.com/renovate)\[bot] in [#​8271](https://github.com/open-telemetry/opentelemetry-go/pull/8271) - Apply attribute value limit for BYTESLICE and KindBytes by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7990](https://github.com/open-telemetry/opentelemetry-go/pull/7990) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8277](https://github.com/open-telemetry/opentelemetry-go/pull/8277) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8280](https://github.com/open-telemetry/opentelemetry-go/pull/8280) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8281](https://github.com/open-telemetry/opentelemetry-go/pull/8281) - Prometheus Exporter: Drop Scope attributes name, version and schema\_url by [@​ArthurSens](https://github.com/ArthurSens) in [#​8264](https://github.com/open-telemetry/opentelemetry-go/pull/8264) - attribute: split HashKVs benchmark by value type by [@​pellared](https://github.com/pellared) in [#​8268](https://github.com/open-telemetry/opentelemetry-go/pull/8268) - \[chore] metric: document Enabled and WithAttributeSet in package docs by [@​cijothomas](https://github.com/cijothomas) in [#​8245](https://github.com/open-telemetry/opentelemetry-go/pull/8245) - chore(deps): update module github.com/bombsimon/wsl/v5 to v5.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8287](https://github.com/open-telemetry/opentelemetry-go/pull/8287) - fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8283](https://github.com/open-telemetry/opentelemetry-go/pull/8283) - chore(deps): update module github.com/pjbgf/sha1cd to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8288](https://github.com/open-telemetry/opentelemetry-go/pull/8288) - Optimize metrics sdk measurement with AlwaysOff exemplar filter by [@​dashpole](https://github.com/dashpole) in [#​8267](https://github.com/open-telemetry/opentelemetry-go/pull/8267) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8290](https://github.com/open-telemetry/opentelemetry-go/pull/8290) - chore(deps): update github/codeql-action action to v4.35.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8289](https://github.com/open-telemetry/opentelemetry-go/pull/8289) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6603726`](https://github.com/open-telemetry/opentelemetry-go/commit/6603726) by [@​renovate](https://github.com/renovate)\[bot] in [#​8291](https://github.com/open-telemetry/opentelemetry-go/pull/8291) - chore(deps): update github.com/golangci/rowserrcheck digest to [`8d53bbc`](https://github.com/open-telemetry/opentelemetry-go/commit/8d53bbc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8292](https://github.com/open-telemetry/opentelemetry-go/pull/8292) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8293](https://github.com/open-telemetry/opentelemetry-go/pull/8293) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8294](https://github.com/open-telemetry/opentelemetry-go/pull/8294) - chore(deps): update module github.com/ryancurrah/gomodguard/v2 to v2.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8296](https://github.com/open-telemetry/opentelemetry-go/pull/8296) - fix(deps): update module google.golang.org/grpc to v1.81.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8298](https://github.com/open-telemetry/opentelemetry-go/pull/8298) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8300](https://github.com/open-telemetry/opentelemetry-go/pull/8300) - chore(deps): update module github.com/uudashr/iface to v1.4.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8301](https://github.com/open-telemetry/opentelemetry-go/pull/8301) - fix(deps): update googleapis to [`60b97b3`](https://github.com/open-telemetry/opentelemetry-go/commit/60b97b3) by [@​renovate](https://github.com/renovate)\[bot] in [#​8303](https://github.com/open-telemetry/opentelemetry-go/pull/8303) - chore(deps): update codspeedhq/action action to v4.15.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8307](https://github.com/open-telemetry/opentelemetry-go/pull/8307) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8308](https://github.com/open-telemetry/opentelemetry-go/pull/8308) - chore(deps): update golang.org/x/telemetry digest to [`5a0966d`](https://github.com/open-telemetry/opentelemetry-go/commit/5a0966d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8310](https://github.com/open-telemetry/opentelemetry-go/pull/8310) - chore(deps): update module github.com/ghostiam/protogetter to v0.3.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8311](https://github.com/open-telemetry/opentelemetry-go/pull/8311) - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8312](https://github.com/open-telemetry/opentelemetry-go/pull/8312) - chore(deps): update module github.com/jgautheron/goconst to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8315](https://github.com/open-telemetry/opentelemetry-go/pull/8315) - chore(deps): update github/codeql-action action to v4.35.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8318](https://github.com/open-telemetry/opentelemetry-go/pull/8318) - chore(deps): update golang.org/x/telemetry digest to [`e88f59f`](https://github.com/open-telemetry/opentelemetry-go/commit/e88f59f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8317](https://github.com/open-telemetry/opentelemetry-go/pull/8317) - chore(deps): update module github.com/raeperd/recvcheck to v0.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8314](https://github.com/open-telemetry/opentelemetry-go/pull/8314) - fix(deps): update module golang.org/x/sys to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8322](https://github.com/open-telemetry/opentelemetry-go/pull/8322) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8313](https://github.com/open-telemetry/opentelemetry-go/pull/8313) - chore(deps): update module github.com/abirdcfly/dupword to v0.1.8 by [@​renovate](https://github.com/renovate)\[bot] in [#​8316](https://github.com/open-telemetry/opentelemetry-go/pull/8316) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8323](https://github.com/open-telemetry/opentelemetry-go/pull/8323) - docs: Expand SIG meeting welcoming language by [@​cijothomas](https://github.com/cijothomas) in [#​8319](https://github.com/open-telemetry/opentelemetry-go/pull/8319) - chore(deps): update module mvdan.cc/gofumpt to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8304](https://github.com/open-telemetry/opentelemetry-go/pull/8304) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8325](https://github.com/open-telemetry/opentelemetry-go/pull/8325) - chore(deps): update golang.org/x/telemetry digest to [`42602be`](https://github.com/open-telemetry/opentelemetry-go/commit/42602be) by [@​renovate](https://github.com/renovate)\[bot] in [#​8326](https://github.com/open-telemetry/opentelemetry-go/pull/8326) - Fix benchmark ci by [@​XSAM](https://github.com/XSAM) in [#​8282](https://github.com/open-telemetry/opentelemetry-go/pull/8282) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8327](https://github.com/open-telemetry/opentelemetry-go/pull/8327) - chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8328](https://github.com/open-telemetry/opentelemetry-go/pull/8328) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8329](https://github.com/open-telemetry/opentelemetry-go/pull/8329) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`c840852`](https://github.com/open-telemetry/opentelemetry-go/commit/c840852) by [@​renovate](https://github.com/renovate)\[bot] in [#​8331](https://github.com/open-telemetry/opentelemetry-go/pull/8331) - fix(deps): update googleapis to [`3700d41`](https://github.com/open-telemetry/opentelemetry-go/commit/3700d41) by [@​renovate](https://github.com/renovate)\[bot] in [#​8332](https://github.com/open-telemetry/opentelemetry-go/pull/8332) - fix: clear cached objects to enable GC by [@​ash2k](https://github.com/ash2k) in [#​8233](https://github.com/open-telemetry/opentelemetry-go/pull/8233) - Generate and upgrade to `semconv/v1.41.0` by [@​MrAlias](https://github.com/MrAlias) in [#​8324](https://github.com/open-telemetry/opentelemetry-go/pull/8324) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8345](https://github.com/open-telemetry/opentelemetry-go/pull/8345) - chore: Skip benchmark workflow when only non-Go files change by [@​cijothomas](https://github.com/cijothomas) in [#​8346](https://github.com/open-telemetry/opentelemetry-go/pull/8346) - chore(deps): update github/codeql-action action to v4.35.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8341](https://github.com/open-telemetry/opentelemetry-go/pull/8341) - Add max baggage length as limitation by [@​XSAM](https://github.com/XSAM) in [#​8222](https://github.com/open-telemetry/opentelemetry-go/pull/8222) - Generating histogram boundaries from weaver.yaml by [@​itssaharsh](https://github.com/itssaharsh) in [#​8015](https://github.com/open-telemetry/opentelemetry-go/pull/8015) - chore(deps): update codecov/codecov-action action to v6.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8342](https://github.com/open-telemetry/opentelemetry-go/pull/8342) - chore(deps): update module github.com/kisielk/errcheck to v1.20.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8333](https://github.com/open-telemetry/opentelemetry-go/pull/8333) - Add observable instrument variants to semconv v1.41.0 by [@​dashpole](https://github.com/dashpole) in [#​8350](https://github.com/open-telemetry/opentelemetry-go/pull/8350) - fix(semconv): clear pooled slices to enable GC by [@​pellared](https://github.com/pellared) in [#​8352](https://github.com/open-telemetry/opentelemetry-go/pull/8352) - chore(deps): update actions/stale action to v10.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8355](https://github.com/open-telemetry/opentelemetry-go/pull/8355) - chore(deps): update module github.com/uudashr/iface to v1.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8335](https://github.com/open-telemetry/opentelemetry-go/pull/8335) - fix(deps): update module google.golang.org/grpc to v1.81.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8340](https://github.com/open-telemetry/opentelemetry-go/pull/8340) - chore(deps): update module 4d63.com/gocheckcompilerdirectives to v1.4.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8334](https://github.com/open-telemetry/opentelemetry-go/pull/8334) - chore(deps): update golang.org/x/telemetry digest to [`eab6ae5`](https://github.com/open-telemetry/opentelemetry-go/commit/eab6ae5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8348](https://github.com/open-telemetry/opentelemetry-go/pull/8348) - fix(deps): update googleapis to [`aa98bba`](https://github.com/open-telemetry/opentelemetry-go/commit/aa98bba) by [@​renovate](https://github.com/renovate)\[bot] in [#​8344](https://github.com/open-telemetry/opentelemetry-go/pull/8344) - Fix semconv generation to include Attr helpers for required attributes on observable instruments by [@​dashpole](https://github.com/dashpole) in [#​8361](https://github.com/open-telemetry/opentelemetry-go/pull/8361) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8363](https://github.com/open-telemetry/opentelemetry-go/pull/8363) - chore(deps): update module github.com/antonboom/nilnil to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8360](https://github.com/open-telemetry/opentelemetry-go/pull/8360) - chore(deps): update module github.com/antonboom/errname to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8359](https://github.com/open-telemetry/opentelemetry-go/pull/8359) - chore(deps): update module github.com/uudashr/iface to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8362](https://github.com/open-telemetry/opentelemetry-go/pull/8362) - Fix Extrema failure test by [@​mujib77](https://github.com/mujib77) in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - Fix receiver-naming issues from revive by [@​mmorel-35](https://github.com/mmorel-35) in [#​8093](https://github.com/open-telemetry/opentelemetry-go/pull/8093) - docs: clarify that View attribute filters do not apply to Exemplars by [@​Dipanshusinghh](https://github.com/Dipanshusinghh) in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - Disable exemplar reservoir for asynchronous instruments by default by [@​dashpole](https://github.com/dashpole) in [#​8286](https://github.com/open-telemetry/opentelemetry-go/pull/8286) - fix: handle FixedSizeReservoir size=0 without panic by [@​muskiteer](https://github.com/muskiteer) in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.59.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8373](https://github.com/open-telemetry/opentelemetry-go/pull/8373) - chore(deps): update github/codeql-action action to v4.36.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8367](https://github.com/open-telemetry/opentelemetry-go/pull/8367) - chore(deps): update module github.com/clickhouse/clickhouse-go-linter to v1.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8366](https://github.com/open-telemetry/opentelemetry-go/pull/8366) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`948f455`](https://github.com/open-telemetry/opentelemetry-go/commit/948f455) by [@​renovate](https://github.com/renovate)\[bot] in [#​8374](https://github.com/open-telemetry/opentelemetry-go/pull/8374) - fix(deps): update googleapis to [`0a33c5d`](https://github.com/open-telemetry/opentelemetry-go/commit/0a33c5d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8369](https://github.com/open-telemetry/opentelemetry-go/pull/8369) - add self observability for stdout exporter by [@​yumosx](https://github.com/yumosx) in [#​8263](https://github.com/open-telemetry/opentelemetry-go/pull/8263) - sdk/metric: document unit-sensitivity of DefaultAggregationSelector by [@​alliasgher](https://github.com/alliasgher) in [#​8224](https://github.com/open-telemetry/opentelemetry-go/pull/8224) - semconvkit: add invariant test for histogram-exclusion rule by [@​thealpha93](https://github.com/thealpha93) in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) - exporters/otlp: default max request size to 64 MiB by [@​pellared](https://github.com/pellared) in [#​8365](https://github.com/open-telemetry/opentelemetry-go/pull/8365) - fix(deps): update googleapis to [`3dc84a4`](https://github.com/open-telemetry/opentelemetry-go/commit/3dc84a4) by [@​renovate](https://github.com/renovate)\[bot] in [#​8375](https://github.com/open-telemetry/opentelemetry-go/pull/8375) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8377](https://github.com/open-telemetry/opentelemetry-go/pull/8377) - feat: add self-observability metrics to otlpmetricgrpc metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8192](https://github.com/open-telemetry/opentelemetry-go/pull/8192) - chore(deps): update golang.org/x/telemetry digest to [`5997936`](https://github.com/open-telemetry/opentelemetry-go/commit/5997936) by [@​renovate](https://github.com/renovate)\[bot] in [#​8379](https://github.com/open-telemetry/opentelemetry-go/pull/8379) - Release 1.44.0 by [@​pellared](https://github.com/pellared) in [#​8376](https://github.com/open-telemetry/opentelemetry-go/pull/8376) #### New Contributors - [@​alliasgher](https://github.com/alliasgher) made their first contribution in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - [@​mujib77](https://github.com/mujib77) made their first contribution in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - [@​Dipanshusinghh](https://github.com/Dipanshusinghh) made their first contribution in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - [@​muskiteer](https://github.com/muskiteer) made their first contribution in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - [@​thealpha93](https://github.com/thealpha93) made their first contribution in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1115 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
3c5ef1721a |
fix(deps): update module golang.org/x/net to v0.56.0 [security] (#1116)
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.56.0) |  |  |
---
### Go Net HTML parser is vulnerable to denial of service
[CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GHSA-5cv4-jp36-h3mw](https://github.com/advisories/GHSA-5cv4-jp36-h3mw) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028)
<details>
<summary>More information</summary>
#### Details
In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680)
- [https://go.dev/cl/781702](https://go.dev/cl/781702)
- [https://go.dev/issue/79573](https://go.dev/issue/79573)
- [
|
||
|
Renovate Bot
|
46f22c78d2 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.23 (#1097)
Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
068afc3996 |
fix(deps): update module github.com/docker/cli to v29.6.2+incompatible (#1096)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.1+incompatible` → `v29.6.2+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.2+incompatible`](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) [Compare Source](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1096 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
ad967330a8 |
fix(deps): update module golang.org/x/text to v0.40.0 (#1091)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.37.0` → `v0.40.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.37.0...refs/tags/v0.40.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1091 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
bircni
|
60177008a5 |
fix: ignore blank lines and decode UTF-16 in the runner env files (#1084)
Fixes #496 Fixes #552 Reviewed-on: https://gitea.com/gitea/runner/pulls/1084 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
Renovate Bot
|
554b3b7671 |
fix(deps): update module golang.org/x/term to v0.45.0 (#1081)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.44.0` → `v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1081 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
b12d02c25f |
fix(deps): update module golang.org/x/sys to v0.47.0 (#1073)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | [`v0.46.0` → `v0.47.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.46.0...refs/tags/v0.47.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1073 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
eba33e178d |
fix(deps): update module github.com/docker/cli to v29.6.1+incompatible (#1060)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.0+incompatible` → `v29.6.1+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.1+incompatible`](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) [Compare Source](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1060 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
4e7fd1c68a |
fix(deps): update module github.com/moby/moby/client to v0.5.0 (#1049)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/moby/moby/client](https://github.com/moby/moby) | `v0.4.1` → `v0.5.0` |  |  | --- ### Release Notes <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.5.0`](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) [Compare Source](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1049 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
bd41a367fe |
fix(deps): update module github.com/docker/cli to v29.6.0+incompatible (#1045)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.5.3+incompatible` → `v29.6.0+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.0+incompatible`](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) [Compare Source](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1045 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |