Bump github.com/prometheus/common from 0.67.5 to 0.68.0#88
Bump github.com/prometheus/common from 0.67.5 to 0.68.0#88dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.67.5 to 0.68.0. - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.67.5...v0.68.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
|
📝 WalkthroughWalkthroughThis PR bumps four Go dependencies with accompanying library-specific changes. JWT library adds a not-before claim requirement option and refactors signature handling. Prometheus common refactors OAuth2 round-tripper options and removes OpenMetrics unit encoding configuration. HTTP/2 library deprecates user-provided write schedulers and restricts retry logic for stream errors. ChangesDependency Updates with Library Enhancements
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 11: The go.mod currently pins golang.org/x/net at v0.52.0 which has known
advisories (GO-2026-4918, GO-2026-5025…5030 and CVE-2026-27141); update the
golang.org/x/net dependency to the first release that contains those fixes
(replace the existing golang.org/x/net v0.52.0 entry via `go get
golang.org/x/net@<fixed-release>` or `go get golang.org/x/net@latest`, then run
`go mod tidy` and commit the updated go.mod/go.sum), verify
github.com/prometheus/common and github.com/golang-jwt/jwt/v5 entries remain at
safe versions (they appear OK but re-run checks), and run `govulncheck` against
the full module graph to confirm no transitive vulnerabilities remain for
golang.org/x/net, golang.org/x/oauth2, github.com/prometheus/common, and
github.com/golang-jwt/jwt/v5.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 65394585-5467-4d16-bb70-2c498e67ae39
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (18)
go.modvendor/github.com/golang-jwt/jwt/v5/README.mdvendor/github.com/golang-jwt/jwt/v5/VERSION_HISTORY.mdvendor/github.com/golang-jwt/jwt/v5/parser.govendor/github.com/golang-jwt/jwt/v5/parser_option.govendor/github.com/golang-jwt/jwt/v5/token.govendor/github.com/golang-jwt/jwt/v5/validator.govendor/github.com/prometheus/common/config/http_config.govendor/github.com/prometheus/common/expfmt/openmetrics_create.govendor/github.com/prometheus/common/model/metric.govendor/github.com/prometheus/common/version/info.govendor/golang.org/x/net/http2/http2.govendor/golang.org/x/net/http2/server.govendor/golang.org/x/net/http2/transport.govendor/golang.org/x/net/http2/writesched.govendor/golang.org/x/net/http2/writesched_priority_rfc7540.govendor/golang.org/x/net/http2/writesched_random.govendor/modules.txt
💤 Files with no reviewable changes (2)
- vendor/github.com/prometheus/common/model/metric.go
- vendor/golang.org/x/net/http2/transport.go
| github.com/montanaflynn/stats v0.9.0 | ||
| github.com/prometheus/client_golang v1.23.2 | ||
| github.com/prometheus/common v0.67.5 | ||
| github.com/prometheus/common v0.68.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify Go module versions exist and check for security advisories
echo "=== Checking prometheus/common v0.68.0 ==="
gh api repos/prometheus/common/releases/tags/v0.68.0 --jq '.tag_name, .published_at' 2>/dev/null || echo "Release not found or API error"
echo -e "\n=== Checking golang-jwt/jwt v5.3.1 ==="
gh api repos/golang-jwt/jwt/releases/tags/v5.3.1 --jq '.tag_name, .published_at' 2>/dev/null || echo "Release not found or API error"
echo -e "\n=== Checking security advisories for all dependencies ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/prometheus/common") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/golang-jwt/jwt/v5") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: kubeservice-stack/node-metrics
Length of output: 611
🌐 Web query:
Are there any known security vulnerabilities in golang.org/x/net v0.52.0 or golang.org/x/oauth2 v0.36.0?
💡 Result:
As of May 29, 2026, both golang.org/x/net v0.52.0 and golang.org/x/oauth2 v0.36.0 have known security vulnerabilities associated with them [1][2]. Regarding golang.org/x/net v0.52.0: The pkg.go.dev page for this version explicitly lists several security advisories, including GO-2026-4918, GO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028, GO-2026-5029, and GO-2026-5030 [1]. Additionally, CVE-2026-27141 describes a vulnerability where sending certain HTTP/2 frames can cause a server to panic due to a missing nil check in golang.org/x/net/http2 [3][4]. Users are generally advised to consult the official Go vulnerability database for the most up-to-date status and remediation guidance for these identifiers [1]. Regarding golang.org/x/oauth2 v0.36.0: While specific, recent CVEs directly targeting version v0.36.0 were not identified in the search results, the package has a history of security issues, such as CVE-2025-22868 (a denial of service vulnerability in the jws package), which was addressed in version v0.27.0 [5][6][7]. Users should always verify their specific dependencies against the Go vulnerability database to identify any newly disclosed vulnerabilities that may affect their installed version [1][6]. Given the dynamic nature of security disclosures, it is strongly recommended that you regularly run govulncheck in your Go projects to identify if your specific usage of these modules is impacted by any known vulnerabilities [8].
Citations:
- 1: https://pkg.go.dev/golang.org/x/net@v0.52.0
- 2: https://pkg.go.dev/golang.org/x/oauth2@v0.36.0
- 3: https://osv.dev/vulnerability/CVE-2026-27141
- 4: https://cve.circl.lu/vuln/CVE-2026-27141
- 5: https://groups.google.com/g/golang-dev/c/9lIKDd3Ff1s
- 6: https://pkg.go.dev/vuln/GO-2025-3488
- 7: https://security.snyk.io/vuln/SNYK-DEBIAN13-GOLANGGOLANGXOAUTH2-8754530
- 8: https://news.ycombinator.com/item?id=48195698
Update go.mod security review: all releases resolve; golang.org/x/net needs attention
go.modlines 11/28/45-46:github.com/prometheus/commonv0.68.0 andgithub.com/golang-jwt/jwt/v5v5.3.1 have releases; GitHub’s security query returns no issues forprometheus/common, and the only surfacedjwt/v5advisory affects versions< 5.2.2(patched in 5.2.2) so v5.3.1 should be unaffected for that issue.golang.org/x/netv0.52.0 has known Go advisories (GO-2026-4918, GO-2026-5025…GO-2026-5030) and CVE-2026-27141 (http2 server panic) associated with the version → bump to the first fixedx/netrelease.golang.org/x/oauth2v0.36.0: no specific vulnerability targeting this exact version was found in the search results (there are older issues like CVE-2025-22868 fixed in v0.27.0), but rungovulncheckon your full dependency graph to ensure no transitive hits.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 11, The go.mod currently pins golang.org/x/net at v0.52.0
which has known advisories (GO-2026-4918, GO-2026-5025…5030 and CVE-2026-27141);
update the golang.org/x/net dependency to the first release that contains those
fixes (replace the existing golang.org/x/net v0.52.0 entry via `go get
golang.org/x/net@<fixed-release>` or `go get golang.org/x/net@latest`, then run
`go mod tidy` and commit the updated go.mod/go.sum), verify
github.com/prometheus/common and github.com/golang-jwt/jwt/v5 entries remain at
safe versions (they appear OK but re-run checks), and run `govulncheck` against
the full module graph to confirm no transitive vulnerabilities remain for
golang.org/x/net, golang.org/x/oauth2, github.com/prometheus/common, and
github.com/golang-jwt/jwt/v5.
1 participant
Bumps github.com/prometheus/common from 0.67.5 to 0.68.0.
Release notes
Sourced from github.com/prometheus/common's releases.
Commits
1e0ae83config: apply DialContextFunc to OAuth2 token-fetch transport (#911)b51d01bRemove CircleCI (#910)0f3c348Merge pull request #908 from machine424/ttlsco732a9cffix(http_config): fix client cert rotation when no CA is configuredce9215cMove interface assertions to a test file (#839)1ba5ed7build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 (#892)8f8ada6build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 (#891)5bf00a4build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 (#890)a4fac5cconfig: guard against nil oauth2 credential in RoundTrip (#897)9e28363Merge pull request #898 from alliasgher/fix/NewOAuth2RoundTripper-exported-op...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit
New Features
Bug Fixes
Documentation