mirror of
https://gitea.com/gitea/act_runner.git
synced 2026-07-27 01:47:31 +00:00
main
1730 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Renovate Bot
|
8c519ce318 |
fix(deps): update module github.com/prometheus/client_golang to v1.24.0 (#1113)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `v1.23.2` → `v1.24.0` |  |  | --- ### Release Notes <details> <summary>prometheus/client_golang (github.com/prometheus/client_golang)</summary> ### [`v1.24.0`](https://github.com/prometheus/client_golang/releases/tag/v1.24.0): - 2026-07-20 [Compare Source](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0) ##### Changes - \[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. [#​1862](https://github.com/prometheus/client_golang/issues/1862) - \[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated `model.NameValidationScheme` global. Default behavior is unchanged; code that set `NameValidationScheme = LegacyValidation` no longer gets legacy enforcement at metric, label, and push-grouping construction. [#​2051](https://github.com/prometheus/client_golang/issues/2051) - \[CHANGE] api/prometheus/v1: Support matchers (`matches[]` parameter) in `Rules` method (`Rules(ctx context.Context, matches []string) (RulesResult, error)`). [#​1843](https://github.com/prometheus/client_golang/issues/1843) - \[CHANGE] api/prometheus/v1: Refactor `LabelNames` method to return `model.LabelNames` instead of `[]string` for consistency across the API. [#​1850](https://github.com/prometheus/client_golang/issues/1850) - \[CHANGE] exp/api/remote: Simplify `Store` interface, rename `Handler` to `WriteHandler`, and encapsulate write response handling. [#​1855](https://github.com/prometheus/client_golang/issues/1855) - \[FEATURE] prometheus: Add new Go 1.26 runtime metrics (`/sched/goroutines-created:goroutines`, `/sched/goroutines/not-in-go:goroutines`, `/sched/goroutines/runnable:goroutines`, `/sched/goroutines/running:goroutines`, `/sched/goroutines/waiting:goroutines`, `/sched/threads/total:threads`). [#​1942](https://github.com/prometheus/client_golang/issues/1942) - \[FEATURE] prometheus: Add `WithUnit(unit string)` option and explicit OpenMetrics unit support in `CounterOpts`, `GaugeOpts`, `SummaryOpts`, and `HistogramOpts`. [#​1392](https://github.com/prometheus/client_golang/issues/1392) - \[FEATURE] prometheus: Expose descriptor construction error through public `Err()` method on `Desc`. [#​1902](https://github.com/prometheus/client_golang/issues/1902) - \[FEATURE] promhttp: Add opt-in `HandlerOpts.CoalesceGather` to deduplicate concurrent `Gather` calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. [#​1969](https://github.com/prometheus/client_golang/issues/1969) - \[FEATURE] promhttp: HTTP handlers created by `promhttp` package now support metrics filtering by providing one or more `name[]` query parameters. The default behavior when none are provided remains the same, returning all metrics. [#​1925](https://github.com/prometheus/client_golang/issues/1925) - \[FEATURE] api/prometheus/v1: Add query formatting endpoint support (`/format_query`) and `FormatQuery(ctx context.Context, query string) (string, error)` method. [#​1846](https://github.com/prometheus/client_golang/issues/1846), [#​1856](https://github.com/prometheus/client_golang/issues/1856) - \[FEATURE] api/prometheus/v1: Add support for `/status/tsdb/blocks` endpoint via `TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)` method. [#​1896](https://github.com/prometheus/client_golang/issues/1896) - \[FEATURE] exp/api/remote: Export `BackoffConfig` to allow customization when using `WithAPIBackoff`. [#​1895](https://github.com/prometheus/client_golang/issues/1895) - \[FEATURE] exp/api/remote: Add `RetryCallBack` to allow custom logging or handling on retry attempts in the remote write client. [#​1888](https://github.com/prometheus/client_golang/issues/1888), [#​1890](https://github.com/prometheus/client_golang/issues/1890) - \[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. [#​1860](https://github.com/prometheus/client_golang/issues/1860) - \[ENHANCEMENT] api: Use cloned `http.DefaultTransport` when constructing default HTTP clients to prevent accidental mutations of shared global transport state. [#​1885](https://github.com/prometheus/client_golang/issues/1885) - \[BUGFIX] prometheus: Recover from collector panics during `Gather()` and return an error instead of crashing the process. [#​1961](https://github.com/prometheus/client_golang/issues/1961) - \[BUGFIX] prometheus: Fix `cpu-seconds` unit suffix handling for metric `go_cpu_classes_gc_mark_assist_cpu_seconds`. [#​1991](https://github.com/prometheus/client_golang/issues/1991) - \[BUGFIX] promhttp: `InstrumentHandlerDuration` and `InstrumentHandlerCounter` no longer panic when given an observer/counter that does not implement `ExemplarObserver`/`ExemplarAdder` (e.g. a `SummaryVec`). The exemplar is dropped and the value is recorded via the plain `Observe`/`Add` path, matching the safe-cast already used by `Timer.ObserveDurationWithExemplar`. [#​2005](https://github.com/prometheus/client_golang/issues/2005) - \[BUGFIX] api/prometheus/v1: Fall back to `GET` requests when `POST` requests return `403 Forbidden` or method not allowed. [#​2030](https://github.com/prometheus/client_golang/issues/2030) - \[BUGFIX] api: Respect context cancellation inside `httpClient.Do`. [#​1971](https://github.com/prometheus/client_golang/issues/1971) - \[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. [#​1889](https://github.com/prometheus/client_golang/issues/1889) - \[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. [#​1917](https://github.com/prometheus/client_golang/issues/1917) - \[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. [#​1927](https://github.com/prometheus/client_golang/issues/1927) <details> <summary> All commits </summary> - build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1839](https://github.com/prometheus/client_golang/pull/1839) - build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1838](https://github.com/prometheus/client_golang/pull/1838) - prometheus/collectors: use godoc link for runtime/metrics supported metrics by [@​xieyuschen](https://github.com/xieyuschen) in [#​1844](https://github.com/prometheus/client_golang/pull/1844) - Fix doc typo by [@​torrca](https://github.com/torrca) in [#​1849](https://github.com/prometheus/client_golang/pull/1849) - Merge release-1.23 into main by [@​vesari](https://github.com/vesari) in [#​1851](https://github.com/prometheus/client_golang/pull/1851) - build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1852](https://github.com/prometheus/client_golang/pull/1852) - Refactor LabelNames to return model.LabelNames type for consistency by [@​yshngg](https://github.com/yshngg) in [#​1850](https://github.com/prometheus/client_golang/pull/1850) - remote: simplified Store interface; renamed Handler to WriteHandler by [@​bwplotka](https://github.com/bwplotka) in [#​1855](https://github.com/prometheus/client_golang/pull/1855) - feat(api/prometheus): add format\_query endpoint for query formatting by [@​yshngg](https://github.com/yshngg) in [#​1846](https://github.com/prometheus/client_golang/pull/1846) - feat(api): add FormatQuery method to Prometheus v1 API by [@​yshngg](https://github.com/yshngg) in [#​1856](https://github.com/prometheus/client_golang/pull/1856) - Support matchers in rules API by [@​jotak](https://github.com/jotak) in [#​1843](https://github.com/prometheus/client_golang/pull/1843) - Use prometheus/common.expfmt.NewTextParser by [@​aknuds1](https://github.com/aknuds1) in [#​1859](https://github.com/prometheus/client_golang/pull/1859) - Merge release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1861](https://github.com/prometheus/client_golang/pull/1861) - chore: Drop support for \<go1.22 by [@​mrueg](https://github.com/mrueg) in [#​1862](https://github.com/prometheus/client_golang/pull/1862) - collectors/version: Allow custom additional labels by [@​mrueg](https://github.com/mrueg) in [#​1860](https://github.com/prometheus/client_golang/pull/1860) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by [@​ywwg](https://github.com/ywwg) in [#​1865](https://github.com/prometheus/client_golang/pull/1865) - Sync release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1868](https://github.com/prometheus/client_golang/pull/1868) - Sync main with release-1.23 by [@​aknuds1](https://github.com/aknuds1) in [#​1871](https://github.com/prometheus/client_golang/pull/1871) - chore: clean up golangci-lint configuration by [@​mmorel-35](https://github.com/mmorel-35) in [#​1802](https://github.com/prometheus/client_golang/pull/1802) - build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1880](https://github.com/prometheus/client_golang/pull/1880) - build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1882](https://github.com/prometheus/client_golang/pull/1882) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1883](https://github.com/prometheus/client_golang/pull/1883) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1881](https://github.com/prometheus/client_golang/pull/1881) - Fix typo in remote api err msg by [@​SungJin1212](https://github.com/SungJin1212) in [#​1878](https://github.com/prometheus/client_golang/pull/1878) - chore: Update metrics for new Go version by [@​github-actions](https://github.com/github-actions)\[bot] in [#​1864](https://github.com/prometheus/client_golang/pull/1864) - Add RetryCallBack to remote\_api.go by [@​pipiland2612](https://github.com/pipiland2612) in [#​1888](https://github.com/prometheus/client_golang/pull/1888) - bug(remote\_write): Fix compression buffer pooling by [@​fpetkovski](https://github.com/fpetkovski) in [#​1889](https://github.com/prometheus/client_golang/pull/1889) - Change RetryCallBack initialized by [@​pipiland2612](https://github.com/pipiland2612) in [#​1890](https://github.com/prometheus/client_golang/pull/1890) - Fix CI bug by [@​pipiland2612](https://github.com/pipiland2612) in [#​1892](https://github.com/prometheus/client_golang/pull/1892) - Use cloned http.DefaultTransport. issue-1857 by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1885](https://github.com/prometheus/client_golang/pull/1885) - Public backoff config to allow usage of WithAPIBackoff by [@​pipiland2612](https://github.com/pipiland2612) in [#​1895](https://github.com/prometheus/client_golang/pull/1895) - Clarify exp library stability by [@​pipiland2612](https://github.com/pipiland2612) in [#​1894](https://github.com/prometheus/client_golang/pull/1894) - feat: add support for `/status/tsdb/blocks` endpoint by [@​tjhop](https://github.com/tjhop) in [#​1896](https://github.com/prometheus/client_golang/pull/1896) - minor refactor of replaceInvalidRune() in bridge.go by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1897](https://github.com/prometheus/client_golang/pull/1897) - build(deps): bump github.com/prometheus/procfs from 0.17.0 to 0.19.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1903](https://github.com/prometheus/client_golang/pull/1903) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1906](https://github.com/prometheus/client_golang/pull/1906) - build(deps): bump golang.org/x/sys from 0.35.0 to 0.37.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1904](https://github.com/prometheus/client_golang/pull/1904) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1907](https://github.com/prometheus/client_golang/pull/1907) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1911](https://github.com/prometheus/client_golang/pull/1911) - build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1909](https://github.com/prometheus/client_golang/pull/1909) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1910](https://github.com/prometheus/client_golang/pull/1910) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1908](https://github.com/prometheus/client_golang/pull/1908) - chore(ci): Add CRLF detection and fix targets to prevent CRLF contamination by [@​kakkoyun](https://github.com/kakkoyun) in [#​1898](https://github.com/prometheus/client_golang/pull/1898) - chore(ci): Use stable names for CI steps by [@​kakkoyun](https://github.com/kakkoyun) in [#​1914](https://github.com/prometheus/client_golang/pull/1914) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1920](https://github.com/prometheus/client_golang/pull/1920) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1921](https://github.com/prometheus/client_golang/pull/1921) - build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1922](https://github.com/prometheus/client_golang/pull/1922) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1923](https://github.com/prometheus/client_golang/pull/1923) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1924](https://github.com/prometheus/client_golang/pull/1924) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1919](https://github.com/prometheus/client_golang/pull/1919) - feat: expose Desc error through public Err() method by [@​duricanikolic](https://github.com/duricanikolic) in [#​1902](https://github.com/prometheus/client_golang/pull/1902) - Allow `/metrics` handler output filtering via `name[]` query param by [@​colega](https://github.com/colega) in [#​1925](https://github.com/prometheus/client_golang/pull/1925) - Prevent OOM from malformed snappy payloads by validating decoded length by [@​makasim](https://github.com/makasim) in [#​1917](https://github.com/prometheus/client_golang/pull/1917) - Ensure remote write v2 headers cannot be returned on v1 requests by [@​kgeckhart](https://github.com/kgeckhart) in [#​1927](https://github.com/prometheus/client_golang/pull/1927) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1932](https://github.com/prometheus/client_golang/pull/1932) - build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1933](https://github.com/prometheus/client_golang/pull/1933) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1935](https://github.com/prometheus/client_golang/pull/1935) - build(deps): bump the github-actions group with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1934](https://github.com/prometheus/client_golang/pull/1934) - promhttp/zstd: add unit tests for zstd writer registration by [@​90ashish](https://github.com/90ashish) in [#​1929](https://github.com/prometheus/client_golang/pull/1929) - feat(collector): add Go 1.26 new runtime metrics by [@​kakkoyun](https://github.com/kakkoyun) in [#​1942](https://github.com/prometheus/client_golang/pull/1942) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1948](https://github.com/prometheus/client_golang/pull/1948) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1946](https://github.com/prometheus/client_golang/pull/1946) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1944](https://github.com/prometheus/client_golang/pull/1944) - build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1945](https://github.com/prometheus/client_golang/pull/1945) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1947](https://github.com/prometheus/client_golang/pull/1947) - chore(test): bump 1.25, tests with synctest and check not panic by [@​manute](https://github.com/manute) in [#​1950](https://github.com/prometheus/client_golang/pull/1950) - build(deps): bump github.com/prometheus/procfs from 0.19.2 to 0.20.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1954](https://github.com/prometheus/client_golang/pull/1954) - build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1957](https://github.com/prometheus/client_golang/pull/1957) - build(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1955](https://github.com/prometheus/client_golang/pull/1955) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.34.0 to 1.40.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1959](https://github.com/prometheus/client_golang/pull/1959) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1956](https://github.com/prometheus/client_golang/pull/1956) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1958](https://github.com/prometheus/client_golang/pull/1958) - chore(collectors/go): generate the tests after new metric by [@​kakkoyun](https://github.com/kakkoyun) in [#​1962](https://github.com/prometheus/client_golang/pull/1962) - Remove Arthur from the list of maintainers by [@​ArthurSens](https://github.com/ArthurSens) in [#​1964](https://github.com/prometheus/client_golang/pull/1964) - build(deps): bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1965](https://github.com/prometheus/client_golang/pull/1965) - fix: recover from collector panic and return error in Gather by [@​Saflaski](https://github.com/Saflaski) in [#​1961](https://github.com/prometheus/client_golang/pull/1961) - prometheus: clarify MetricVec delete semantics in godoc by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1967](https://github.com/prometheus/client_golang/pull/1967) - build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1973](https://github.com/prometheus/client_golang/pull/1973) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1974](https://github.com/prometheus/client_golang/pull/1974) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1976](https://github.com/prometheus/client_golang/pull/1976) - Optionally add OM unit by [@​vesari](https://github.com/vesari) in [#​1392](https://github.com/prometheus/client_golang/pull/1392) - fix: respect context cancellation in httpClient.Do by [@​pedrampdd](https://github.com/pedrampdd) in [#​1971](https://github.com/prometheus/client_golang/pull/1971) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1978](https://github.com/prometheus/client_golang/pull/1978) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1977](https://github.com/prometheus/client_golang/pull/1977) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1980](https://github.com/prometheus/client_golang/pull/1980) - examples: add native histogram usage example by [@​thegdsks](https://github.com/thegdsks) in [#​1981](https://github.com/prometheus/client_golang/pull/1981) - chore(ci): add macOS, Windows and arm64 test runners by [@​kakkoyun](https://github.com/kakkoyun) in [#​1968](https://github.com/prometheus/client_golang/pull/1968) - prometheus: honor PidFn on windows and darwin by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1966](https://github.com/prometheus/client_golang/pull/1966) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1984](https://github.com/prometheus/client_golang/pull/1984) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1985](https://github.com/prometheus/client_golang/pull/1985) - promhttp: implement WithXFromContext in terms of WithXFromRequest by [@​tie](https://github.com/tie) in [#​1863](https://github.com/prometheus/client_golang/pull/1863) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1988](https://github.com/prometheus/client_golang/pull/1988) - Fix bug unit cpu-seconds not a suffix of metric go\_cpu\_classes\_gc\_mark\_assist\_cpu\_seconds by [@​vesari](https://github.com/vesari) in [#​1991](https://github.com/prometheus/client_golang/pull/1991) - build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1993](https://github.com/prometheus/client_golang/pull/1993) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1992](https://github.com/prometheus/client_golang/pull/1992) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1995](https://github.com/prometheus/client_golang/pull/1995) - exp/api/remote: limit request body size in SnappyDecodeMiddleware by [@​roidelapluie](https://github.com/roidelapluie) in [#​1996](https://github.com/prometheus/client_golang/pull/1996) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2001](https://github.com/prometheus/client_golang/pull/2001) - build(deps): bump the github-actions group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1994](https://github.com/prometheus/client_golang/pull/1994) - ci(update-go-versions): declare permissions for the monthly chore PR by [@​arpitjain099](https://github.com/arpitjain099) in [#​2003](https://github.com/prometheus/client_golang/pull/2003) - docs: fix godoc indentation and typos in timer.go and wrap.go by [@​immanuwell](https://github.com/immanuwell) in [#​2009](https://github.com/prometheus/client_golang/pull/2009) - ci: harden actions/checkout with persist-credentials: false by [@​roidelapluie](https://github.com/roidelapluie) in [#​2011](https://github.com/prometheus/client_golang/pull/2011) - fix(registry): prevent file descriptor leak in WriteToTextfile by [@​ProjectMutilation](https://github.com/ProjectMutilation) in [#​2010](https://github.com/prometheus/client_golang/pull/2010) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2008](https://github.com/prometheus/client_golang/pull/2008) - promhttp: add regression test for concurrent map writes ([#​1274](https://github.com/prometheus/client_golang/issues/1274)) by [@​pedrampdd](https://github.com/pedrampdd) in [#​2000](https://github.com/prometheus/client_golang/pull/2000) - build(deps): bump github.com/prometheus/common from 0.67.6-0.20260224092343-e4c38a0aea47 to 0.68.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2015](https://github.com/prometheus/client_golang/pull/2015) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2016](https://github.com/prometheus/client_golang/pull/2016) - build(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2014](https://github.com/prometheus/client_golang/pull/2014) - build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2017](https://github.com/prometheus/client_golang/pull/2017) - promhttp: fix grammar in exemplar option doc comments by [@​s3onghyun](https://github.com/s3onghyun) in [#​2023](https://github.com/prometheus/client_golang/pull/2023) - fix: use keyed fields in SamplePair struct literals in api\_test.go by [@​immanuwell](https://github.com/immanuwell) in [#​2012](https://github.com/prometheus/client_golang/pull/2012) - refactor: replace interface{} with any (Go 1.18+) by [@​MD-Mushfiqur123](https://github.com/MD-Mushfiqur123) in [#​2021](https://github.com/prometheus/client_golang/pull/2021) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2013](https://github.com/prometheus/client_golang/pull/2013) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2025](https://github.com/prometheus/client_golang/pull/2025) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2027](https://github.com/prometheus/client_golang/pull/2027) - build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2026](https://github.com/prometheus/client_golang/pull/2026) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2028](https://github.com/prometheus/client_golang/pull/2028) - build(deps): bump github.com/prometheus/procfs from 0.20.1 to 0.21.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2033](https://github.com/prometheus/client_golang/pull/2033) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2036](https://github.com/prometheus/client_golang/pull/2036) - build(deps): bump github.com/prometheus/procfs from 0.21.0 to 0.21.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2035](https://github.com/prometheus/client_golang/pull/2035) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2038](https://github.com/prometheus/client_golang/pull/2038) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2041](https://github.com/prometheus/client_golang/pull/2041) - fix(api): fall back to GET on forbidden POSTs by [@​immanuwell](https://github.com/immanuwell) in [#​2030](https://github.com/prometheus/client_golang/pull/2030) - build(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2042](https://github.com/prometheus/client_golang/pull/2042) - build(deps): bump the github-actions group across 1 directory with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2043](https://github.com/prometheus/client_golang/pull/2043) - chores: remove example Dockerfile and container\_description.yaml by [@​bwplotka](https://github.com/bwplotka) in [#​2044](https://github.com/prometheus/client_golang/pull/2044) - Update dependabot config by [@​SuperQ](https://github.com/SuperQ) in [#​2046](https://github.com/prometheus/client_golang/pull/2046) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2048](https://github.com/prometheus/client_golang/pull/2048) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2047](https://github.com/prometheus/client_golang/pull/2047) - promhttp: don't panic when instrumenting with non-exemplar observers by [@​spor3006](https://github.com/spor3006) in [#​2005](https://github.com/prometheus/client_golang/pull/2005) - Replace deprecated model.NameValidationScheme with explicit UTF8Validation by [@​kakkoyun](https://github.com/kakkoyun) in [#​2051](https://github.com/prometheus/client_golang/pull/2051) - test: fix two flaky tests (darwin start\_time regex, memstats HeapReleased drift) by [@​kakkoyun](https://github.com/kakkoyun) in [#​2050](https://github.com/prometheus/client_golang/pull/2050) - fix: correct typos in comments and test error messages by [@​maxtaran2010](https://github.com/maxtaran2010) in [#​2049](https://github.com/prometheus/client_golang/pull/2049) - examples: improve simple main.go example by [@​dhanudhanushree](https://github.com/dhanudhanushree) in [#​1999](https://github.com/prometheus/client_golang/pull/1999) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2055](https://github.com/prometheus/client_golang/pull/2055) - feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather calls by [@​kakkoyun](https://github.com/kakkoyun) in [#​1969](https://github.com/prometheus/client_golang/pull/1969) - build(deps): update all Go dependencies in all go.mod files by [@​bwplotka](https://github.com/bwplotka) in [#​2059](https://github.com/prometheus/client_golang/pull/2059) - Cut v1.24.0-rc.0 by [@​bwplotka](https://github.com/bwplotka) in [#​2058](https://github.com/prometheus/client_golang/pull/2058) </details> #### New Contributors * @​xieyuschen made their first contribution in https://github.com/prometheus/client_golang/pull/1844 * @​torrca made their first contribution in https://github.com/prometheus/client_golang/pull/1849 * @​yshngg made their first contribution in https://github.com/prometheus/client_golang/pull/1850 * @​jotak made their first contribution in https://github.com/prometheus/client_golang/pull/1843 * @​SungJin1212 made their first contribution in https://github.com/prometheus/client_golang/pull/1878 * @​github-actions[bot] made their first contribution in https://github.com/prometheus/client_golang/pull/1864 * @​pipiland2612 made their first contribution in https://github.com/prometheus/client_golang/pull/1888 * @​fpetkovski made their first contribution in https://github.com/prometheus/client_golang/pull/1889 * @​karthikkondapally made their first contribution in https://github.com/prometheus/client_golang/pull/1885 * @​tjhop made their first contribution in https://github.com/prometheus/client_golang/pull/1896 * @​duricanikolic made their first contribution in https://github.com/prometheus/client_golang/pull/1902 * @​makasim made their first contribution in https://github.com/prometheus/client_golang/pull/1917 * @​kgeckhart made their first contribution in https://github.com/prometheus/client_golang/pull/1927 * @​90ashish made their first contribution in https://github.com/prometheus/client_golang/pull/1929 * @​manute made their first contribution in https://github.com/prometheus/client_golang/pull/1950 * @​Saflaski made their first contribution in https://github.com/prometheus/client_golang/pull/1961 * @​Retr0-XD made their first contribution in https://github.com/prometheus/client_golang/pull/1967 * @​pedrampdd made their first contribution in https://github.com/prometheus/client_golang/pull/1971 * @​thegdsks made their first contribution in https://github.com/prometheus/client_golang/pull/1981 * @​tie made their first contribution in https://github.com/prometheus/client_golang/pull/1863 * @​arpitjain099 made their first contribution in https://github.com/prometheus/client_golang/pull/2003 * @​immanuwell made their first contribution in https://github.com/prometheus/client_golang/pull/2009 * @​ProjectMutilation made their first contribution in https://github.com/prometheus/client_golang/pull/2010 * @​s3onghyun made their first contribution in https://github.com/prometheus/client_golang/pull/2023 * @​MD-Mushfiqur123 made their first contribution in https://github.com/prometheus/client_golang/pull/2021 * @​spor3006 made their first contribution in https://github.com/prometheus/client_golang/pull/2005 * @​maxtaran2010 made their first contribution in https://github.com/prometheus/client_golang/pull/2049 * @​dhanudhanushree made their first contribution in https://github.com/prometheus/client_golang/pull/1999 **Full Changelog**: <https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1113 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
de43c84203 |
fix(deps): update module go.opentelemetry.io/otel to v1.44.0 [security] (#1115)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `v1.43.0` → `v1.44.0` |  |  | --- ### Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel [CVE-2026-41178](https://nvd.nist.gov/vuln/detail/CVE-2026-41178) / [GHSA-5wrp-cwcj-q835](https://github.com/advisories/GHSA-5wrp-cwcj-q835) / [GO-2026-5158](https://pkg.go.dev/vuln/GO-2026-5158) <details> <summary>More information</summary> #### Details Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel #### Severity Unknown #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835) - [https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://github.com/open-telemetry/opentelemetry-go/pull/7880) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5158) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.44.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.44.0): /v0.66.0/v0.20.0/v0.0.17 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0) ##### Added - Add `ByteSlice` and `ByteSliceValue` functions for new `BYTESLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​7948](https://github.com/open-telemetry/opentelemetry-go/issues/7948)) - Apply attribute value limit to the `KindBytes` attribute type in `go.opentelemetry.io/otel/sdk/log`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Apply attribute value limit to the `BYTESLICE` attribute type in `go.opentelemetry.io/otel/sdk/trace`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/trace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Add `String` method for `Value` type in `go.opentelemetry.io/otel/attribute`. ([#​8142](https://github.com/open-telemetry/opentelemetry-go/issues/8142)) - Add `Slice` and `SliceValue` functions for new `SLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​8166](https://github.com/open-telemetry/opentelemetry-go/issues/8166)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Apply `AttributeValueLengthLimit` to `attribute.SLICE` type attribute values in `go.opentelemetry.io/otel/sdk/trace`, recursively truncating contained string values. ([#​8217](https://github.com/open-telemetry/opentelemetry-go/issues/8217)) - Add `Error` field on `Record` type in `go.opentelemetry.io/otel/log/logtest`. ([#​8148](https://github.com/open-telemetry/opentelemetry-go/issues/8148)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `Settable` to `go.opentelemetry.io/otel/metric/x` to allow reusing attribute options. ([#​8178](https://github.com/open-telemetry/opentelemetry-go/issues/8178)) - Add experimental support for splitting metric data across multiple batches in `go.opentelemetry.io/otel/sdk/metric`. Set `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size>` to enable for all periodic readers. See `go.opentelemetry.io/otel/sdk/metric/internal/x` for feature documentation. ([#​8071](https://github.com/open-telemetry/opentelemetry-go/issues/8071)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x` for feature documentation. ([#​8192](https://github.com/open-telemetry/opentelemetry-go/issues/8192)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x` for feature documentation. ([#​8194](https://github.com/open-telemetry/opentelemetry-go/issues/8194)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/stdout/stdoutlog/internal/x` for feature documentation. ([#​8263](https://github.com/open-telemetry/opentelemetry-go/issues/8263)) - Add `WithDefaultAttributes` to `go.opentelemetry.io/otel/metric/x` to support setting default attributes on instruments. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Add `go.opentelemetry.io/otel/semconv/v1.41.0` package. The package contains semantic conventions from the `v1.41.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.41.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.40.0`. ([#​8324](https://github.com/open-telemetry/opentelemetry-go/issues/8324)) - Add Observable variants of instruments to `go.opentelemetry.io/otel/semconv/v1.41.0` package. ([#​8350](https://github.com/open-telemetry/opentelemetry-go/issues/8350)) - Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#​8002](https://github.com/open-telemetry/opentelemetry-go/issues/8002)) ##### Changed - ⚠️ **Breaking Change:** `go.opentelemetry.io/otel/sdk/metric` now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing `attribute.Bool("otel.metric.overflow", true)`. This can break users who relied on the previous unlimited default. Set `WithCardinalityLimit(0)` or the deprecated `OTEL_GO_X_CARDINALITY_LIMIT=0` environment variable to preserve unlimited cardinality. Note that support for `OTEL_GO_X_CARDINALITY_LIMIT` may be removed in a future release. ([#​8247](https://github.com/open-telemetry/opentelemetry-go/issues/8247)) - `ErrorType` in `go.opentelemetry.io/otel/semconv` now unwraps errors created with `fmt.Errorf` when deriving the `error.type` attribute. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `go.opentelemetry.io/otel/sdk/log` now unwraps error chains created with `fmt.Errorf` when deriving the `error.type` attribute from errors on log records. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `Set.MarshalLog` method in `go.opentelemetry.io/otel/attribute` now uses `Value.String` formatting following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8169](https://github.com/open-telemetry/opentelemetry-go/issues/8169)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir and short-circuit `Offer` calls to the exemplar reservoir when `exemplar.AlwaysOffFilter` is configured. ([#​8211](https://github.com/open-telemetry/opentelemetry-go/issues/8211)) ([#​8267](https://github.com/open-telemetry/opentelemetry-go/issues/8267)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir for asynchronous instruments when `exemplar.TraceBasedFilter` is configured. ([#​8286](https://github.com/open-telemetry/opentelemetry-go/issues/8286)) ##### Deprecated - Deprecate `Value.Emit` method in `go.opentelemetry.io/otel/attribute`. Use `Value.String` instead. ([#​8176](https://github.com/open-telemetry/opentelemetry-go/issues/8176)) ##### Fixed - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8152](https://github.com/open-telemetry/opentelemetry-go/issues/8152)) - `go.opentelemetry.io/otel/exporters/prometheus` now uses `Value.String` formatting for label values following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8170](https://github.com/open-telemetry/opentelemetry-go/issues/8170)) - Propagate errors from the exporter when calling `Shutdown` on `BatchSpanProcessor` in `go.opentelemetry.io/otel/sdk/trace`. ([#​8197](https://github.com/open-telemetry/opentelemetry-go/issues/8197)) - Fix stale status code reporting on self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8226](https://github.com/open-telemetry/opentelemetry-go/issues/8226)) - Fix a concurrent `Collect` data race and potential panic in `go.opentelemetry.io/otel/exporters/prometheus` when `WithResourceAsConstantLabels` option is used. ([#​8227](https://github.com/open-telemetry/opentelemetry-go/issues/8227)) - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting [#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447). ([#​8249](https://github.com/open-telemetry/opentelemetry-go/issues/8249)) - Fix `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` to safely handle zero size. A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in `Offer()` and `Collect()` ensure no-op behavior. ([#​8295](https://github.com/open-telemetry/opentelemetry-go/issues/8295)) - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8254](https://github.com/open-telemetry/opentelemetry-go/issues/8254)) - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. ([#​8264](https://github.com/open-telemetry/opentelemetry-go/issues/8264)) - Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m)) - Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ([#​8222](https://github.com/open-telemetry/opentelemetry-go/issues/8222)) - Fix `go.opentelemetry.io/otel/semconv/v1.41.0` to include `Attr*` helper methods for required attributes on observable instruments. ([#​8361](https://github.com/open-telemetry/opentelemetry-go/issues/8361)) - Limit baggage extraction error reporting in `go.opentelemetry.io/otel/propagation` to prevent malformed or oversized baggage headers from flooding logs. ([GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835)) #### What's Changed - Document how to implement experimental features by [@​dashpole](https://github.com/dashpole) in [#​8124](https://github.com/open-telemetry/opentelemetry-go/pull/8124) - Add support for experimental options in the metrics API by [@​dashpole](https://github.com/dashpole) in [#​8111](https://github.com/open-telemetry/opentelemetry-go/pull/8111) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`e5db982`](https://github.com/open-telemetry/opentelemetry-go/commit/e5db982) by [@​renovate](https://github.com/renovate)\[bot] in [#​8136](https://github.com/open-telemetry/opentelemetry-go/pull/8136) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`32cd848`](https://github.com/open-telemetry/opentelemetry-go/commit/32cd848) by [@​renovate](https://github.com/renovate)\[bot] in [#​8141](https://github.com/open-telemetry/opentelemetry-go/pull/8141) - fix(deps): update googleapis to [`6f92a3b`](https://github.com/open-telemetry/opentelemetry-go/commit/6f92a3b) by [@​renovate](https://github.com/renovate)\[bot] in [#​8140](https://github.com/open-telemetry/opentelemetry-go/pull/8140) - chore(deps): update module github.com/jgautheron/goconst to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8134](https://github.com/open-telemetry/opentelemetry-go/pull/8134) - attribute: add BYTESLICE type support by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7948](https://github.com/open-telemetry/opentelemetry-go/pull/7948) - unwrap error chains created with fmt.Errorf by [@​pellared](https://github.com/pellared) in [#​8133](https://github.com/open-telemetry/opentelemetry-go/pull/8133) - log/logtest: add Error field to Record type by [@​pellared](https://github.com/pellared) in [#​8148](https://github.com/open-telemetry/opentelemetry-go/pull/8148) - attribute: add String method for Value type by [@​pellared](https://github.com/pellared) in [#​8142](https://github.com/open-telemetry/opentelemetry-go/pull/8142) - fix(deps): update module golang.org/x/sys to v0.43.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8156](https://github.com/open-telemetry/opentelemetry-go/pull/8156) - chore(deps): update codspeedhq/action action to v4.13.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8155](https://github.com/open-telemetry/opentelemetry-go/pull/8155) - fix(otlploghttp): replay gzipped bodies on redirect by [@​MrAlias](https://github.com/MrAlias) in [#​8152](https://github.com/open-telemetry/opentelemetry-go/pull/8152) - Improve test coverage for exponential histogram edge cases by [@​dashpole](https://github.com/dashpole) in [#​8129](https://github.com/open-telemetry/opentelemetry-go/pull/8129) - Add example test for the prometheus exporter by [@​dashpole](https://github.com/dashpole) in [#​8137](https://github.com/open-telemetry/opentelemetry-go/pull/8137) - chore(deps): update golang.org/x/telemetry digest to [`93c7c8a`](https://github.com/open-telemetry/opentelemetry-go/commit/93c7c8a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8158](https://github.com/open-telemetry/opentelemetry-go/pull/8158) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by [@​renovate](https://github.com/renovate)\[bot] in [#​8161](https://github.com/open-telemetry/opentelemetry-go/pull/8161) - chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8159](https://github.com/open-telemetry/opentelemetry-go/pull/8159) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`6b4d2bc`](https://github.com/open-telemetry/opentelemetry-go/commit/6b4d2bc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8160](https://github.com/open-telemetry/opentelemetry-go/pull/8160) - Add experimental support for batching in periodic reader by [@​dashpole](https://github.com/dashpole) in [#​8071](https://github.com/open-telemetry/opentelemetry-go/pull/8071) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8165](https://github.com/open-telemetry/opentelemetry-go/pull/8165) - Support `BYTESLICE` attributes across trace and exporter paths by [@​MrAlias](https://github.com/MrAlias) in [#​8153](https://github.com/open-telemetry/opentelemetry-go/pull/8153) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8171](https://github.com/open-telemetry/opentelemetry-go/pull/8171) - fix(deps): update module golang.org/x/tools to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8173](https://github.com/open-telemetry/opentelemetry-go/pull/8173) - metricdatatest: support BYTESLICE attribute comparisons by [@​pellared](https://github.com/pellared) in [#​8167](https://github.com/open-telemetry/opentelemetry-go/pull/8167) - test: add test case for ByteSlice in TestValueFromAttribute by [@​pellared](https://github.com/pellared) in [#​8168](https://github.com/open-telemetry/opentelemetry-go/pull/8168) - attribute: Set.MarshalLog to use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8169](https://github.com/open-telemetry/opentelemetry-go/pull/8169) - prometheus: use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8170](https://github.com/open-telemetry/opentelemetry-go/pull/8170) - fix(deps): update golang.org/x to [`746e56f`](https://github.com/open-telemetry/opentelemetry-go/commit/746e56f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8175](https://github.com/open-telemetry/opentelemetry-go/pull/8175) - Add support for the development attributes advisory parameter by [@​dashpole](https://github.com/dashpole) in [#​8135](https://github.com/open-telemetry/opentelemetry-go/pull/8135) - chore(deps): update actions/upload-artifact action to v7.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8177](https://github.com/open-telemetry/opentelemetry-go/pull/8177) - attribute: deprecate Value.Emit by [@​pellared](https://github.com/pellared) in [#​8176](https://github.com/open-telemetry/opentelemetry-go/pull/8176) - chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8181](https://github.com/open-telemetry/opentelemetry-go/pull/8181) - chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8180](https://github.com/open-telemetry/opentelemetry-go/pull/8180) - chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8182](https://github.com/open-telemetry/opentelemetry-go/pull/8182) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.56.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8184](https://github.com/open-telemetry/opentelemetry-go/pull/8184) - Update semconv template and 1.40.0 to use Enabled for metrics by [@​dashpole](https://github.com/dashpole) in [#​8172](https://github.com/open-telemetry/opentelemetry-go/pull/8172) - Add x.Settable to allow reusing attribute options by [@​dashpole](https://github.com/dashpole) in [#​8178](https://github.com/open-telemetry/opentelemetry-go/pull/8178) - chore(deps): update actions/cache action to v5.0.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8187](https://github.com/open-telemetry/opentelemetry-go/pull/8187) - fix(deps): update googleapis to [`3e5c5a5`](https://github.com/open-telemetry/opentelemetry-go/commit/3e5c5a5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8190](https://github.com/open-telemetry/opentelemetry-go/pull/8190) - fix(otlpmetrichttp): replay gzipped bodies on redirect by [@​pellared](https://github.com/pellared) in [#​8185](https://github.com/open-telemetry/opentelemetry-go/pull/8185) - fix(deps): update module golang.org/x/vuln to v1.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8193](https://github.com/open-telemetry/opentelemetry-go/pull/8193) - fix(deps): update googleapis to [`afd174a`](https://github.com/open-telemetry/opentelemetry-go/commit/afd174a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8195](https://github.com/open-telemetry/opentelemetry-go/pull/8195) - chore(deps): update module github.com/dave/dst to v0.27.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8198](https://github.com/open-telemetry/opentelemetry-go/pull/8198) - Fix exemplar tests in containerized environments by [@​dashpole](https://github.com/dashpole) in [#​8188](https://github.com/open-telemetry/opentelemetry-go/pull/8188) - Update contributing to recommend using Enabled by [@​dashpole](https://github.com/dashpole) in [#​8189](https://github.com/open-telemetry/opentelemetry-go/pull/8189) - otlptracehttp: reset pooled gzip writer before reuse by [@​pellared](https://github.com/pellared) in [#​8196](https://github.com/open-telemetry/opentelemetry-go/pull/8196) - chore(deps): update golang.org/x/telemetry digest to [`fac6e1c`](https://github.com/open-telemetry/opentelemetry-go/commit/fac6e1c) by [@​renovate](https://github.com/renovate)\[bot] in [#​8202](https://github.com/open-telemetry/opentelemetry-go/pull/8202) - fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8207](https://github.com/open-telemetry/opentelemetry-go/pull/8207) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`07c9668`](https://github.com/open-telemetry/opentelemetry-go/commit/07c9668) by [@​renovate](https://github.com/renovate)\[bot] in [#​8206](https://github.com/open-telemetry/opentelemetry-go/pull/8206) - attribute: make TestHashKVs linear-time by [@​pellared](https://github.com/pellared) in [#​8204](https://github.com/open-telemetry/opentelemetry-go/pull/8204) - chore(deps): update github/codeql-action action to v4.35.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8208](https://github.com/open-telemetry/opentelemetry-go/pull/8208) - sdk/trace: propagate SpanExporter.Shutdown error from BatchSpanProcessor by [@​alliasgher](https://github.com/alliasgher) in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - add GitHub Copilot code review instructions by [@​pellared](https://github.com/pellared) in [#​8212](https://github.com/open-telemetry/opentelemetry-go/pull/8212) - chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.29.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8214](https://github.com/open-telemetry/opentelemetry-go/pull/8214) - attribute: add SLICE type support by [@​pellared](https://github.com/pellared) in [#​8166](https://github.com/open-telemetry/opentelemetry-go/pull/8166) - Fix typos found by copilot by [@​dashpole](https://github.com/dashpole) in [#​8221](https://github.com/open-telemetry/opentelemetry-go/pull/8221) - chore(deps): update module github.com/go-git/go-git/v5 to v5.18.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8223](https://github.com/open-telemetry/opentelemetry-go/pull/8223) - docs: add agent guide for autonomous coding agents by [@​pellared](https://github.com/pellared) in [#​8215](https://github.com/open-telemetry/opentelemetry-go/pull/8215) - test: truncate attribute string values using Unicode rune count by [@​pellared](https://github.com/pellared) in [#​8219](https://github.com/open-telemetry/opentelemetry-go/pull/8219) - sdk/trace: apply AttributeValueLengthLimit to attribute.SLICE by [@​pellared](https://github.com/pellared) in [#​8217](https://github.com/open-telemetry/opentelemetry-go/pull/8217) - chore(deps): update module github.com/dlclark/regexp2 to v1.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8229](https://github.com/open-telemetry/opentelemetry-go/pull/8229) - prometheus: fix Collect data race for constant resource labels by [@​pellared](https://github.com/pellared) in [#​8227](https://github.com/open-telemetry/opentelemetry-go/pull/8227) - exporters: support SLICE attributes by [@​pellared](https://github.com/pellared) in [#​8216](https://github.com/open-telemetry/opentelemetry-go/pull/8216) - chore(deps): update codspeedhq/action action to v4.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8234](https://github.com/open-telemetry/opentelemetry-go/pull/8234) - Fix stale status code reporting on self-observability metrics by [@​dashpole](https://github.com/dashpole) in [#​8226](https://github.com/open-telemetry/opentelemetry-go/pull/8226) - fix(deps): update googleapis to [`e10c466`](https://github.com/open-telemetry/opentelemetry-go/commit/e10c466) by [@​renovate](https://github.com/renovate)\[bot] in [#​8241](https://github.com/open-telemetry/opentelemetry-go/pull/8241) - fix(deps): update build-tools to v0.30.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8244](https://github.com/open-telemetry/opentelemetry-go/pull/8244) - \[chore] changelog: re-run workflow on PR title edits by [@​cijothomas](https://github.com/cijothomas) in [#​8246](https://github.com/open-telemetry/opentelemetry-go/pull/8246) - stdlog observ: remove partial success handling by [@​yumosx](https://github.com/yumosx) in [#​8174](https://github.com/open-telemetry/opentelemetry-go/pull/8174) - feat: add self-observability metrics to otlpmetrichttp metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8194](https://github.com/open-telemetry/opentelemetry-go/pull/8194) - chore(deps): update golang.org/x/telemetry digest to [`392afab`](https://github.com/open-telemetry/opentelemetry-go/commit/392afab) by [@​renovate](https://github.com/renovate)\[bot] in [#​8248](https://github.com/open-telemetry/opentelemetry-go/pull/8248) - Use a DropReservoir when an exemplar.AlwaysOffFilter is provided by [@​dashpole](https://github.com/dashpole) in [#​8211](https://github.com/open-telemetry/opentelemetry-go/pull/8211) - metric: clarify sync vs observable Gauge in package godoc by [@​alliasgher](https://github.com/alliasgher) in [#​8225](https://github.com/open-telemetry/opentelemetry-go/pull/8225) - sdk/metric: apply default cardinality limit of 2000 by [@​pellared](https://github.com/pellared) in [#​8247](https://github.com/open-telemetry/opentelemetry-go/pull/8247) - Revert "Optimize fixedsize reservoir ([#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447))" by [@​dashpole](https://github.com/dashpole) in [#​8249](https://github.com/open-telemetry/opentelemetry-go/pull/8249) - fix(deps): update module golang.org/x/vuln to v1.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8256](https://github.com/open-telemetry/opentelemetry-go/pull/8256) - chore(deps): update otel/weaver docker tag to v0.23.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8255](https://github.com/open-telemetry/opentelemetry-go/pull/8255) - Run benchmarks using Settable for more accurate comparrisons by [@​dashpole](https://github.com/dashpole) in [#​8252](https://github.com/open-telemetry/opentelemetry-go/pull/8252) - Add MaxRequestSize option to OTLP exporters by [@​pellared](https://github.com/pellared) in [#​8157](https://github.com/open-telemetry/opentelemetry-go/pull/8157) - fix counting of spans/logs in self-observability metrics in otlp trace and log exporters by [@​dashpole](https://github.com/dashpole) in [#​8254](https://github.com/open-telemetry/opentelemetry-go/pull/8254) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`2f88a58`](https://github.com/open-telemetry/opentelemetry-go/commit/2f88a58) by [@​renovate](https://github.com/renovate)\[bot] in [#​8260](https://github.com/open-telemetry/opentelemetry-go/pull/8260) - chore(deps): update golang.org/x/telemetry digest to [`329d219`](https://github.com/open-telemetry/opentelemetry-go/commit/329d219) by [@​renovate](https://github.com/renovate)\[bot] in [#​8259](https://github.com/open-telemetry/opentelemetry-go/pull/8259) - chore(deps): update module github.com/sourcegraph/go-diff to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8262](https://github.com/open-telemetry/opentelemetry-go/pull/8262) - chore(deps): update module github.com/mattn/go-isatty to v0.0.22 by [@​renovate](https://github.com/renovate)\[bot] in [#​8265](https://github.com/open-telemetry/opentelemetry-go/pull/8265) - chore(deps): update module go.uber.org/zap to v1.28.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8269](https://github.com/open-telemetry/opentelemetry-go/pull/8269) - fix(deps): update googleapis to [`7cedc36`](https://github.com/open-telemetry/opentelemetry-go/commit/7cedc36) by [@​renovate](https://github.com/renovate)\[bot] in [#​8266](https://github.com/open-telemetry/opentelemetry-go/pull/8266) - chore(deps): update module github.com/securego/gosec/v2 to v2.26.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8270](https://github.com/open-telemetry/opentelemetry-go/pull/8270) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.57.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8275](https://github.com/open-telemetry/opentelemetry-go/pull/8275) - chore(deps): update codspeedhq/action action to v4.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8272](https://github.com/open-telemetry/opentelemetry-go/pull/8272) - chore(deps): update golang.org/x/telemetry digest to [`76f71b9`](https://github.com/open-telemetry/opentelemetry-go/commit/76f71b9) by [@​renovate](https://github.com/renovate)\[bot] in [#​8271](https://github.com/open-telemetry/opentelemetry-go/pull/8271) - Apply attribute value limit for BYTESLICE and KindBytes by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7990](https://github.com/open-telemetry/opentelemetry-go/pull/7990) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8277](https://github.com/open-telemetry/opentelemetry-go/pull/8277) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8280](https://github.com/open-telemetry/opentelemetry-go/pull/8280) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8281](https://github.com/open-telemetry/opentelemetry-go/pull/8281) - Prometheus Exporter: Drop Scope attributes name, version and schema\_url by [@​ArthurSens](https://github.com/ArthurSens) in [#​8264](https://github.com/open-telemetry/opentelemetry-go/pull/8264) - attribute: split HashKVs benchmark by value type by [@​pellared](https://github.com/pellared) in [#​8268](https://github.com/open-telemetry/opentelemetry-go/pull/8268) - \[chore] metric: document Enabled and WithAttributeSet in package docs by [@​cijothomas](https://github.com/cijothomas) in [#​8245](https://github.com/open-telemetry/opentelemetry-go/pull/8245) - chore(deps): update module github.com/bombsimon/wsl/v5 to v5.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8287](https://github.com/open-telemetry/opentelemetry-go/pull/8287) - fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8283](https://github.com/open-telemetry/opentelemetry-go/pull/8283) - chore(deps): update module github.com/pjbgf/sha1cd to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8288](https://github.com/open-telemetry/opentelemetry-go/pull/8288) - Optimize metrics sdk measurement with AlwaysOff exemplar filter by [@​dashpole](https://github.com/dashpole) in [#​8267](https://github.com/open-telemetry/opentelemetry-go/pull/8267) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8290](https://github.com/open-telemetry/opentelemetry-go/pull/8290) - chore(deps): update github/codeql-action action to v4.35.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8289](https://github.com/open-telemetry/opentelemetry-go/pull/8289) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6603726`](https://github.com/open-telemetry/opentelemetry-go/commit/6603726) by [@​renovate](https://github.com/renovate)\[bot] in [#​8291](https://github.com/open-telemetry/opentelemetry-go/pull/8291) - chore(deps): update github.com/golangci/rowserrcheck digest to [`8d53bbc`](https://github.com/open-telemetry/opentelemetry-go/commit/8d53bbc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8292](https://github.com/open-telemetry/opentelemetry-go/pull/8292) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8293](https://github.com/open-telemetry/opentelemetry-go/pull/8293) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8294](https://github.com/open-telemetry/opentelemetry-go/pull/8294) - chore(deps): update module github.com/ryancurrah/gomodguard/v2 to v2.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8296](https://github.com/open-telemetry/opentelemetry-go/pull/8296) - fix(deps): update module google.golang.org/grpc to v1.81.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8298](https://github.com/open-telemetry/opentelemetry-go/pull/8298) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8300](https://github.com/open-telemetry/opentelemetry-go/pull/8300) - chore(deps): update module github.com/uudashr/iface to v1.4.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8301](https://github.com/open-telemetry/opentelemetry-go/pull/8301) - fix(deps): update googleapis to [`60b97b3`](https://github.com/open-telemetry/opentelemetry-go/commit/60b97b3) by [@​renovate](https://github.com/renovate)\[bot] in [#​8303](https://github.com/open-telemetry/opentelemetry-go/pull/8303) - chore(deps): update codspeedhq/action action to v4.15.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8307](https://github.com/open-telemetry/opentelemetry-go/pull/8307) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8308](https://github.com/open-telemetry/opentelemetry-go/pull/8308) - chore(deps): update golang.org/x/telemetry digest to [`5a0966d`](https://github.com/open-telemetry/opentelemetry-go/commit/5a0966d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8310](https://github.com/open-telemetry/opentelemetry-go/pull/8310) - chore(deps): update module github.com/ghostiam/protogetter to v0.3.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8311](https://github.com/open-telemetry/opentelemetry-go/pull/8311) - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8312](https://github.com/open-telemetry/opentelemetry-go/pull/8312) - chore(deps): update module github.com/jgautheron/goconst to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8315](https://github.com/open-telemetry/opentelemetry-go/pull/8315) - chore(deps): update github/codeql-action action to v4.35.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8318](https://github.com/open-telemetry/opentelemetry-go/pull/8318) - chore(deps): update golang.org/x/telemetry digest to [`e88f59f`](https://github.com/open-telemetry/opentelemetry-go/commit/e88f59f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8317](https://github.com/open-telemetry/opentelemetry-go/pull/8317) - chore(deps): update module github.com/raeperd/recvcheck to v0.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8314](https://github.com/open-telemetry/opentelemetry-go/pull/8314) - fix(deps): update module golang.org/x/sys to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8322](https://github.com/open-telemetry/opentelemetry-go/pull/8322) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8313](https://github.com/open-telemetry/opentelemetry-go/pull/8313) - chore(deps): update module github.com/abirdcfly/dupword to v0.1.8 by [@​renovate](https://github.com/renovate)\[bot] in [#​8316](https://github.com/open-telemetry/opentelemetry-go/pull/8316) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8323](https://github.com/open-telemetry/opentelemetry-go/pull/8323) - docs: Expand SIG meeting welcoming language by [@​cijothomas](https://github.com/cijothomas) in [#​8319](https://github.com/open-telemetry/opentelemetry-go/pull/8319) - chore(deps): update module mvdan.cc/gofumpt to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8304](https://github.com/open-telemetry/opentelemetry-go/pull/8304) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8325](https://github.com/open-telemetry/opentelemetry-go/pull/8325) - chore(deps): update golang.org/x/telemetry digest to [`42602be`](https://github.com/open-telemetry/opentelemetry-go/commit/42602be) by [@​renovate](https://github.com/renovate)\[bot] in [#​8326](https://github.com/open-telemetry/opentelemetry-go/pull/8326) - Fix benchmark ci by [@​XSAM](https://github.com/XSAM) in [#​8282](https://github.com/open-telemetry/opentelemetry-go/pull/8282) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8327](https://github.com/open-telemetry/opentelemetry-go/pull/8327) - chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8328](https://github.com/open-telemetry/opentelemetry-go/pull/8328) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8329](https://github.com/open-telemetry/opentelemetry-go/pull/8329) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`c840852`](https://github.com/open-telemetry/opentelemetry-go/commit/c840852) by [@​renovate](https://github.com/renovate)\[bot] in [#​8331](https://github.com/open-telemetry/opentelemetry-go/pull/8331) - fix(deps): update googleapis to [`3700d41`](https://github.com/open-telemetry/opentelemetry-go/commit/3700d41) by [@​renovate](https://github.com/renovate)\[bot] in [#​8332](https://github.com/open-telemetry/opentelemetry-go/pull/8332) - fix: clear cached objects to enable GC by [@​ash2k](https://github.com/ash2k) in [#​8233](https://github.com/open-telemetry/opentelemetry-go/pull/8233) - Generate and upgrade to `semconv/v1.41.0` by [@​MrAlias](https://github.com/MrAlias) in [#​8324](https://github.com/open-telemetry/opentelemetry-go/pull/8324) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8345](https://github.com/open-telemetry/opentelemetry-go/pull/8345) - chore: Skip benchmark workflow when only non-Go files change by [@​cijothomas](https://github.com/cijothomas) in [#​8346](https://github.com/open-telemetry/opentelemetry-go/pull/8346) - chore(deps): update github/codeql-action action to v4.35.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8341](https://github.com/open-telemetry/opentelemetry-go/pull/8341) - Add max baggage length as limitation by [@​XSAM](https://github.com/XSAM) in [#​8222](https://github.com/open-telemetry/opentelemetry-go/pull/8222) - Generating histogram boundaries from weaver.yaml by [@​itssaharsh](https://github.com/itssaharsh) in [#​8015](https://github.com/open-telemetry/opentelemetry-go/pull/8015) - chore(deps): update codecov/codecov-action action to v6.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8342](https://github.com/open-telemetry/opentelemetry-go/pull/8342) - chore(deps): update module github.com/kisielk/errcheck to v1.20.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8333](https://github.com/open-telemetry/opentelemetry-go/pull/8333) - Add observable instrument variants to semconv v1.41.0 by [@​dashpole](https://github.com/dashpole) in [#​8350](https://github.com/open-telemetry/opentelemetry-go/pull/8350) - fix(semconv): clear pooled slices to enable GC by [@​pellared](https://github.com/pellared) in [#​8352](https://github.com/open-telemetry/opentelemetry-go/pull/8352) - chore(deps): update actions/stale action to v10.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8355](https://github.com/open-telemetry/opentelemetry-go/pull/8355) - chore(deps): update module github.com/uudashr/iface to v1.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8335](https://github.com/open-telemetry/opentelemetry-go/pull/8335) - fix(deps): update module google.golang.org/grpc to v1.81.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8340](https://github.com/open-telemetry/opentelemetry-go/pull/8340) - chore(deps): update module 4d63.com/gocheckcompilerdirectives to v1.4.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8334](https://github.com/open-telemetry/opentelemetry-go/pull/8334) - chore(deps): update golang.org/x/telemetry digest to [`eab6ae5`](https://github.com/open-telemetry/opentelemetry-go/commit/eab6ae5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8348](https://github.com/open-telemetry/opentelemetry-go/pull/8348) - fix(deps): update googleapis to [`aa98bba`](https://github.com/open-telemetry/opentelemetry-go/commit/aa98bba) by [@​renovate](https://github.com/renovate)\[bot] in [#​8344](https://github.com/open-telemetry/opentelemetry-go/pull/8344) - Fix semconv generation to include Attr helpers for required attributes on observable instruments by [@​dashpole](https://github.com/dashpole) in [#​8361](https://github.com/open-telemetry/opentelemetry-go/pull/8361) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8363](https://github.com/open-telemetry/opentelemetry-go/pull/8363) - chore(deps): update module github.com/antonboom/nilnil to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8360](https://github.com/open-telemetry/opentelemetry-go/pull/8360) - chore(deps): update module github.com/antonboom/errname to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8359](https://github.com/open-telemetry/opentelemetry-go/pull/8359) - chore(deps): update module github.com/uudashr/iface to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8362](https://github.com/open-telemetry/opentelemetry-go/pull/8362) - Fix Extrema failure test by [@​mujib77](https://github.com/mujib77) in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - Fix receiver-naming issues from revive by [@​mmorel-35](https://github.com/mmorel-35) in [#​8093](https://github.com/open-telemetry/opentelemetry-go/pull/8093) - docs: clarify that View attribute filters do not apply to Exemplars by [@​Dipanshusinghh](https://github.com/Dipanshusinghh) in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - Disable exemplar reservoir for asynchronous instruments by default by [@​dashpole](https://github.com/dashpole) in [#​8286](https://github.com/open-telemetry/opentelemetry-go/pull/8286) - fix: handle FixedSizeReservoir size=0 without panic by [@​muskiteer](https://github.com/muskiteer) in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.59.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8373](https://github.com/open-telemetry/opentelemetry-go/pull/8373) - chore(deps): update github/codeql-action action to v4.36.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8367](https://github.com/open-telemetry/opentelemetry-go/pull/8367) - chore(deps): update module github.com/clickhouse/clickhouse-go-linter to v1.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8366](https://github.com/open-telemetry/opentelemetry-go/pull/8366) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`948f455`](https://github.com/open-telemetry/opentelemetry-go/commit/948f455) by [@​renovate](https://github.com/renovate)\[bot] in [#​8374](https://github.com/open-telemetry/opentelemetry-go/pull/8374) - fix(deps): update googleapis to [`0a33c5d`](https://github.com/open-telemetry/opentelemetry-go/commit/0a33c5d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8369](https://github.com/open-telemetry/opentelemetry-go/pull/8369) - add self observability for stdout exporter by [@​yumosx](https://github.com/yumosx) in [#​8263](https://github.com/open-telemetry/opentelemetry-go/pull/8263) - sdk/metric: document unit-sensitivity of DefaultAggregationSelector by [@​alliasgher](https://github.com/alliasgher) in [#​8224](https://github.com/open-telemetry/opentelemetry-go/pull/8224) - semconvkit: add invariant test for histogram-exclusion rule by [@​thealpha93](https://github.com/thealpha93) in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) - exporters/otlp: default max request size to 64 MiB by [@​pellared](https://github.com/pellared) in [#​8365](https://github.com/open-telemetry/opentelemetry-go/pull/8365) - fix(deps): update googleapis to [`3dc84a4`](https://github.com/open-telemetry/opentelemetry-go/commit/3dc84a4) by [@​renovate](https://github.com/renovate)\[bot] in [#​8375](https://github.com/open-telemetry/opentelemetry-go/pull/8375) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8377](https://github.com/open-telemetry/opentelemetry-go/pull/8377) - feat: add self-observability metrics to otlpmetricgrpc metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8192](https://github.com/open-telemetry/opentelemetry-go/pull/8192) - chore(deps): update golang.org/x/telemetry digest to [`5997936`](https://github.com/open-telemetry/opentelemetry-go/commit/5997936) by [@​renovate](https://github.com/renovate)\[bot] in [#​8379](https://github.com/open-telemetry/opentelemetry-go/pull/8379) - Release 1.44.0 by [@​pellared](https://github.com/pellared) in [#​8376](https://github.com/open-telemetry/opentelemetry-go/pull/8376) #### New Contributors - [@​alliasgher](https://github.com/alliasgher) made their first contribution in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - [@​mujib77](https://github.com/mujib77) made their first contribution in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - [@​Dipanshusinghh](https://github.com/Dipanshusinghh) made their first contribution in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - [@​muskiteer](https://github.com/muskiteer) made their first contribution in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - [@​thealpha93](https://github.com/thealpha93) made their first contribution in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1115 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
3c5ef1721a |
fix(deps): update module golang.org/x/net to v0.56.0 [security] (#1116)
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.56.0) |  |  |
---
### Go Net HTML parser is vulnerable to denial of service
[CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GHSA-5cv4-jp36-h3mw](https://github.com/advisories/GHSA-5cv4-jp36-h3mw) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028)
<details>
<summary>More information</summary>
#### Details
In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680)
- [https://go.dev/cl/781702](https://go.dev/cl/781702)
- [https://go.dev/issue/79573](https://go.dev/issue/79573)
- [
|
||
Lunny Xiao
|
94ab020204 |
ci: mirror release artifacts to Cloudflare R2 (#1114)
Mirrors every release artifact into Cloudflare R2 alongside the existing AWS S3 upload, so both buckets carry the same objects during a parallel period. S3 is untouched and stays authoritative for now; once R2 is confirmed complete it can be dropped by deleting the `blobs:` block and pointing this at R2 alone. ### Why `publishers:` and not a second `blobs:` entry goreleaser's blob pipe authenticates from the global `AWS_*` environment and has no per-entry credential fields, so two different credential sets (AWS S3 and Cloudflare R2) cannot coexist in `blobs:`. Custom publishers do support per-entry `env:`, which is the supported way to isolate the two. ### Why `curl --aws-sigv4` and not `aws`/`rclone` The CI image `docker.gitea.com/runner-images:ubuntu-latest` ships none of `aws`, `rclone`, `s3cmd` or `mc`, but does ship curl 8.5 with `--aws-sigv4`. This keeps the change zero-install. Credentials are fed to curl through a config file on stdin rather than argv, so they never appear in the process list. ### Behaviour - Object layout is identical to S3 (`gitea-runner/<version>/<artifact>`), so migrating consumers later means changing only the host, not the path. - Nightly gets R2 too, matching the existing nightly-to-S3 behaviour. - Missing R2 configuration fails the build. Because custom publishers run as the very last step of the publish pipeline, a preflight `--check-config` step runs right after checkout so the failure happens before anything is built or published rather than after the release already exists. - Verified against a local MinIO instance (site region `auto`, matching R2): successful upload byte-compared after download, plus the missing-variable, wrong-credentials, missing-file and bad-argument paths. ### Required repository secrets These must be configured before the next release run, otherwise the new preflight step will fail the workflow: - `R2_ENDPOINT` (full base URL, e.g. `https://<account>.r2.cloudflarestorage.com`) - `R2_BUCKET` - `R2_ACCESS_KEY_ID` - `R2_SECRET_ACCESS_KEY` ### Known, deliberate wart The publisher runs 109 times for 73 distinct object keys: goreleaser's release pipe already registers `release.extra_files` as `UploadableFile` artifacts, and `internal/exec` appends the publisher's own `extra_files` on top with no de-duplication. It cannot be globbed away because `gobwas/glob` has no substring-exclusion matcher, so `./**.sha256` cannot be narrowed to exclude `*.xz.sha256`. It is harmless since PUT is idempotent, and the redundant `./**.xz` glob is kept on purpose so the publisher declares its own complete file set instead of implicitly depending on the `release:` block's globs. This is documented in a comment above the block. Reviewed-on: https://gitea.com/gitea/runner/pulls/1114 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
silverwind
|
b4a64b97dd |
feat: support --platform and --pull in container.options (#1104)
Fixes https://gitea.com/gitea/runner/issues/667 Fixes https://gitea.com/gitea/runner/pulls/1103 `container.options` is parsed with docker/cli's `addFlags`, which omits the flags docker/cli registers on the `create` and `run` commands themselves. Those were rejected as unknown — most visibly `--platform`. | Flag | Behavior | Why | | --- | --- | --- | | `--platform` | overrides the runner-wide container architecture | the only way to pick an image architecture per job, e.g. across a matrix | | `--pull always\|missing\|never` | `always` forces a pull, `never` skips it | `force_pull` is runner-wide config today, with no per-job control | Both are resolved in `NewContainer` because the image pull runs before the container is created and the two have to agree. `--name`, `--quiet` and `--disable-content-trust` are now accepted and ignored, and `--use-api-socket` is rejected pointing at `container.docker_host`, so a valid `docker create` line no longer fails outright. <sub>Written by Claude (Opus 4.8).</sub> --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1104 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
bircni
|
26f9fb12af |
fix: clean service containers after failed job setup (#1066)
Fixes https://gitea.com/gitea/runner/issues/659 Docker teardown was chained with `Then`, which stops on the previous step's error and on a cancelled context, so the first failure orphaned everything downstream. A volume that is still in use, or a flaky daemon, left the service containers and the job network behind — matching the reports in the issue, where the leaks show up after failed or overloaded jobs. Cleanup is now straight-line and best-effort: every step runs regardless of what failed before it, and the errors are joined. Two things follow from that: - Service containers are removed before the job volumes, since a service can hold one via `--volumes-from` in its options. The network stays last, once every container has detached. - Only job container and volume errors are returned. Service and network errors are logged, as before, because `stopJobContainer()` also runs as the pre-flight step of job start, where a network cleanup error must not abort the job. The nil check on `rc.JobContainer` is kept, but it is not the leak reporters are hitting: `container.NewContainer` never returns nil in the docker build, so cleanup with no job container is only reachable in the `WITHOUT_DOCKER` stub. Addresses https://gitea.com/gitea/runner/pulls/1066#issuecomment-1239073. Not covered here: the `buildx_buildkit_*` volumes reported in the issue are created by buildx inside the job, not by the runner, so no runner-side teardown removes them. --------- Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1066 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
Zettat123
|
c9c4957e38 |
feat: support reading cache.external_secret from a file (#1100)
This PR adds a new `cache.external_secret_file` config, which points at a file holding the secret. So the secret can come from a mounted Kubernetes/Docker secret while the rest of the config stays plain text. ```yaml cache: external_server: "http://cache-host:8088/" external_secret_file: /path/to/cache_external_secret ``` --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1100 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: Zettat123 <zettat123@gmail.com> |
||
|
Renovate Bot
|
b1a02cdd5d |
chore(deps): update docker docker tag to v29.6.2 (#1101)
Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
0fd8602ac3 |
chore(deps): update actions/setup-go action to v7 (#1102)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](https://github.com/actions/setup-go/compare/v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](https://github.com/actions/setup-go/pull/763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](https://github.com/actions/setup-go/pull/771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](https://github.com/actions/setup-go/pull/771) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v7.0.0> ### [`v7`](https://github.com/actions/setup-go/compare/v6.5.0...v7.0.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-go/releases/tag/v6.5.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.4.0...v6.5.0) ##### What's Changed ##### Dependency update - Upgrade actions dependencies by [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) in [#​744](https://github.com/actions/setup-go/pull/744) - Upgrade [@​types/node](https://github.com/types/node) and typescript-eslint dependencies to resolve npm audit findings by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​755](https://github.com/actions/setup-go/pull/755) - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​758](https://github.com/actions/setup-go/pull/758) - Upgrade version to 6.5.0 in package.json and package-lock.json by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​762](https://github.com/actions/setup-go/pull/762) ##### New Contributors - [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) made their first contribution in [#​744](https://github.com/actions/setup-go/pull/744) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​758](https://github.com/actions/setup-go/pull/758) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-go/releases/tag/v6.4.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.3.0...v6.4.0) ##### What's Changed ##### Enhancement - Add go-download-base-url input for custom Go distributions by [@​gdams](https://github.com/gdams) in [#​721](https://github.com/actions/setup-go/pull/721) ##### Dependency update - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​727](https://github.com/actions/setup-go/pull/727) ##### Documentation update - Rearrange README.md, add advanced-usage.md by [@​priyagupta108](https://github.com/priyagupta108) in [#​724](https://github.com/actions/setup-go/pull/724) - Fix Microsoft build of Go link by [@​gdams](https://github.com/gdams) in [#​734](https://github.com/actions/setup-go/pull/734) ##### New Contributors - [@​gdams](https://github.com/gdams) made their first contribution in [#​721](https://github.com/actions/setup-go/pull/721) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-go/releases/tag/v6.3.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.2.0...v6.3.0) ##### What's Changed - Update default Go module caching to use go.mod by [@​priyagupta108](https://github.com/priyagupta108) in [#​705](https://github.com/actions/setup-go/pull/705) - Fix golang download url to go.dev by [@​178inaba](https://github.com/178inaba) in [#​469](https://github.com/actions/setup-go/pull/469) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-go/releases/tag/v6.2.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.1.0...v6.2.0) ##### What's Changed ##### Enhancements - Example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​696](https://github.com/actions/setup-go/pull/696) - Update Node.js version in action.yml by [@​ccoVeille](https://github.com/ccoVeille) in [#​691](https://github.com/actions/setup-go/pull/691) - Documentation update of actions/checkout by [@​deining](https://github.com/deining) in [#​683](https://github.com/actions/setup-go/pull/683) ##### Dependency updates - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot) in [#​682](https://github.com/actions/setup-go/pull/682) - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5 by [@​salmanmkc](https://github.com/salmanmkc) in [#​695](https://github.com/actions/setup-go/pull/695) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot) in [#​686](https://github.com/actions/setup-go/pull/686) - Upgrade qs from 6.14.0 to 6.14.1 by [@​dependabot](https://github.com/dependabot) in [#​703](https://github.com/actions/setup-go/pull/703) ##### New Contributors - [@​ccoVeille](https://github.com/ccoVeille) made their first contribution in [#​691](https://github.com/actions/setup-go/pull/691) - [@​deining](https://github.com/deining) made their first contribution in [#​683](https://github.com/actions/setup-go/pull/683) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-go/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/setup-go/compare/v6...v6.1.0) ##### What's Changed ##### Enhancements - Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by [@​nicholasngai](https://github.com/nicholasngai) in [#​665](https://github.com/actions/setup-go/pull/665) - Add support for .tool-versions file and update workflow by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​673](https://github.com/actions/setup-go/pull/673) - Add comprehensive breaking changes documentation for v6 by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​674](https://github.com/actions/setup-go/pull/674) ##### Dependency updates - Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by [@​dependabot](https://github.com/dependabot) in [#​617](https://github.com/actions/setup-go/pull/617) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@​dependabot](https://github.com/dependabot) in [#​641](https://github.com/actions/setup-go/pull/641) - Upgrade semver and [@​types/semver](https://github.com/types/semver) by [@​dependabot](https://github.com/dependabot) in [#​652](https://github.com/actions/setup-go/pull/652) ##### New Contributors - [@​nicholasngai](https://github.com/nicholasngai) made their first contribution in [#​665](https://github.com/actions/setup-go/pull/665) - [@​priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#​673](https://github.com/actions/setup-go/pull/673) - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​674](https://github.com/actions/setup-go/pull/674) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1102 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
silverwind
|
6133d64270 |
fix: repair free-disk-space build on FreeBSD (#1098)
`Statfs_t.Bavail` is unsigned on Linux but signed on FreeBSD, so `Bavail * uint64(Bsize)` in `internal/app/run/disk_unix.go` fails to compile for the freebsd targets goreleaser cross-builds, breaking the nightly release (introduced in https://gitea.com/gitea/runner/pulls/1090). The `checks` workflow only builds for the host, so it never cross-compiles freebsd and stayed green. Casting both operands to `uint64` makes the arithmetic signedness-agnostic across all unix variants. Reviewed-on: https://gitea.com/gitea/runner/pulls/1098 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io>v2.2.0 |
||
|
bircni
|
c43cbe87ca |
feat: add runner health admission checks (#1090)
Opt-in local task-admission checks under a `health_check` config section (disabled by default): - pause new task fetching when free disk space on the workspace volume is below the configured minimum - optional executable health-check script — a non-zero exit, timeout, or start failure marks the runner unavailable - checks run only while the runner is idle; the last result is reused while a job is active, and polling resumes automatically on recovery - `/readyz` reports task-admission readiness (reusing the poll loop's last check); `/healthz` stays a process-liveness endpoint --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1090 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
bircni
|
7bec310002 |
fix: stop host-mode jobs from leaking processes on Windows (#1080)
## Problem On host-mode Windows runners, a job can leave processes running after it finishes, and those leftovers hold file handles that block deletion of the workspace. Today a step's tree is only torn down when the step is *cancelled* (`process.Killer`). A step that completes leaves whatever it spawned alive, and the existing workspace scan in `terminateRunningProcesses` misses two shapes of leftover: orphans whose parent already exited (no tree to walk, and their executable often lives outside the workspace), and processes that merely *run in* the workspace but reference no path from it — `Win32_Process` exposes no working directory, so the scan cannot match them. ## Solution Two additions in `internal/pkg/process`, both no-ops outside Windows: - **`process.Group`** — a job-scoped Windows Job Object created with `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`. Step processes are assigned to it before they get their own `Killer`, so the step's job nests inside the job's: cancellation still kills exactly the step's tree, while `Remove` closing the group makes the kernel terminate everything still assigned, whatever its parentage. The kernel also drops the handle when the runner exits, so a crashed runner cannot strand processes. - **`process.KillProcessesWithCWDUnder`** — a best-effort net for processes that never joined the job (started via a service or scheduled task). It reads each process's working directory from its PEB and terminates those under a workspace dir. Processes it cannot open are skipped. --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1080 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
bircni
|
8af385d147 |
enhance: report a GitHub-style "Set up job" section (#1089)
Reshapes the job log's "Set up job" section to mirror `actions/runner`: - runner name/version, then `Runner Information` (labels, task, job, repository, event) and `Operating System` groups - every required action downloaded up front under `Prepare all required actions`, each as `Download action repository '<action>@<ref>' (SHA:<sha>)` - `Complete job name` closes the section Downloading up front is the one behavioral change: the same set was already fetched during the pre stage regardless of a step's `if`, now just before the first pre step, so a download failure is reported against the job rather than a step. --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1089 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
Renovate Bot
|
46f22c78d2 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.23 (#1097)
Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
068afc3996 |
fix(deps): update module github.com/docker/cli to v29.6.2+incompatible (#1096)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.1+incompatible` → `v29.6.2+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.2+incompatible`](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) [Compare Source](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1096 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
silverwind
|
0e8896c52a |
fix: classify a cancelled step as an interruption, not a failure (#1095)
`reportStepError` reported every step error as FAILURE, including a `context.Canceled` from a docker file-command read cancelled at job finalization — non-deterministic red CI. Classify `context.Canceled` as an interruption instead (deferring to the job context), so a genuine cancel reports cancelled and a stray teardown cancellation is ignored, never a failure. --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1095 Reviewed-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
89467c9dd0 |
fix: stop racing the daemon when removing containers (#1093)
Containers set `HostConfig.AutoRemove` but act also removes them explicitly, so the two removers race and the loser logs a 409 `removal of container X is already in progress` — seen at the end of nearly every `uses: docker://` step. The explicit remove is redundant for `docker://` steps and docker actions (`Start(true)` already awaited exit), so it's skipped. Job and service containers keep both removers — their `sleep` entrypoint needs `AutoRemove` as a fallback reaper — so there the race is inherent and `remove()` now treats `NotFound` and `Conflict` as success. --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1093 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
0c08b0f2da |
chore(deps): update actions/setup-node action to v7 (#1094)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v7.0.0...v7.0.0) #### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@​gowridurgad](https://github.com/gowridurgad) in [#​1577](https://github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@​gowridurgad](https://github.com/gowridurgad) in [#​1574](https://github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@​gowridurgad](https://github.com/gowridurgad) in [#​1558](https://github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@​deiga](https://github.com/deiga) in [#​1548](https://github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@​chiranjib-swain](https://github.com/chiranjib-swain) in [#​1536](https://github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1550](https://github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@​chiranjib-swain](https://github.com/chiranjib-swain) in [#​1567](https://github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​1569](https://github.com/actions/setup-node/pull/1569) #### New Contributors - [@​chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#​1536](https://github.com/actions/setup-node/pull/1536) - [@​deiga](https://github.com/deiga) made their first contribution in [#​1548](https://github.com/actions/setup-node/pull/1548) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​1569](https://github.com/actions/setup-node/pull/1569) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v7.0.0> ### [`v7`](https://github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0) #### What's Changed - Update [@​actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​1579](https://github.com/actions/setup-node/pull/1579) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.3.0...v6.4.0) #### What's Changed ##### Dependency updates: - Upgrade [@​actions](https://github.com/actions) dependencies by [@​Copilot](https://github.com/Copilot) in [#​1525](https://github.com/actions/setup-node/pull/1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1533](https://github.com/actions/setup-node/pull/1533) #### New Contributors - [@​Copilot](https://github.com/Copilot) made their first contribution in [#​1525](https://github.com/actions/setup-node/pull/1525) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@​susnux](https://github.com/susnux) in [#​1283](https://github.com/actions/setup-node/pull/1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@​gowridurgad](https://github.com/gowridurgad) in [#​1491](https://github.com/actions/setup-node/pull/1491) - Replace uuid with crypto.randomUUID() by [@​trivikr](https://github.com/trivikr) in [#​1378](https://github.com/actions/setup-node/pull/1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​1498](https://github.com/actions/setup-node/pull/1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@​marco-ippolito](https://github.com/marco-ippolito) in [#​1467](https://github.com/actions/setup-node/pull/1467) - Scope test lockfiles by package manager and update cache tests by [@​gowridurgad](https://github.com/gowridurgad) in [#​1495](https://github.com/actions/setup-node/pull/1495) #### New Contributors - [@​susnux](https://github.com/susnux) made their first contribution in [#​1283](https://github.com/actions/setup-node/pull/1283) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.1.0...v6.2.0) #### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​1454](https://github.com/actions/setup-node/pull/1454) - Correct mirror option typos by [@​MikeMcC399](https://github.com/MikeMcC399) in [#​1442](https://github.com/actions/setup-node/pull/1442) - Readme update on checkout version v6 by [@​deining](https://github.com/deining) in [#​1446](https://github.com/actions/setup-node/pull/1446) - Readme typo fixes [@​munyari](https://github.com/munyari) in [#​1226](https://github.com/actions/setup-node/pull/1226) - Advanced document update on checkout version v6 by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1468](https://github.com/actions/setup-node/pull/1468) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5.0.1 by [@​salmanmkc](https://github.com/salmanmkc) in [#​1449](https://github.com/actions/setup-node/pull/1449) #### New Contributors - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​1454](https://github.com/actions/setup-node/pull/1454) - [@​MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#​1442](https://github.com/actions/setup-node/pull/1442) - [@​deining](https://github.com/deining) made their first contribution in [#​1446](https://github.com/actions/setup-node/pull/1446) - [@​munyari](https://github.com/munyari) made their first contribution in [#​1226](https://github.com/actions/setup-node/pull/1226) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/setup-node/compare/v6...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@​priyagupta108](https://github.com/priyagupta108) in [#​1436](https://github.com/actions/setup-node/pull/1436) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1384](https://github.com/actions/setup-node/pull/1384) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1439](https://github.com/actions/setup-node/pull/1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1435](https://github.com/actions/setup-node/pull/1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1419](https://github.com/actions/setup-node/pull/1419) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1094 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
bircni
|
aa7a29a157 |
fix: guard status-check functions against a nil job context (#1092)
The `cancelled()`, `success()` and `failure()` expression functions dereferenced `Job.Status` unconditionally, so a nil `Job` context panicked the interpreter — which is why Gitea currently hands the runner a non-nil (empty) `JobContext` as a workaround. This routes all three through a `jobStatus()` helper that treats a nil `Job` as an empty status, keeping existing behaviour identical while removing the panic. Includes a regression test that panics on the old code and passes with the fix. Related: https://github.com/go-gitea/gitea/pull/38495 Reviewed-on: https://gitea.com/gitea/runner/pulls/1092 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
Renovate Bot
|
ad967330a8 |
fix(deps): update module golang.org/x/text to v0.40.0 (#1091)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.37.0` → `v0.40.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.37.0...refs/tags/v0.40.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1091 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>v2.1.0 |
||
|
bircni
|
60177008a5 |
fix: ignore blank lines and decode UTF-16 in the runner env files (#1084)
Fixes #496 Fixes #552 Reviewed-on: https://gitea.com/gitea/runner/pulls/1084 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
bircni
|
58c5eb8d21 |
feat: honour GITEA_RUNNER_LABELS on daemon start and accept labels containing a colon (#1085)
Fixes #648 Fixes #656 Fixes #664 --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1085 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> |
||
|
bircni
|
d6882b3df5 |
docs: explain labels, the docker image cache volume, and the dind-rootless UID (#1086)
Fixes #106 Fixes #570 Fixes #627 Reviewed-on: https://gitea.com/gitea/runner/pulls/1086 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
bircni
|
7e7e3ef1a6 |
fix: stop service containers from clobbering the job container's credentials (#1083)
Fixes #835 Fixes #643 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1083 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
Nicolas
|
16357a34b2 |
fix: accept natively typed boolean workflow inputs (#1087)
Gitea 1.27 resolves `workflow_call` inputs server-side and sends natively typed JSON values in `github.event.inputs`, so a `type: boolean` input now arrives as a real JSON boolean. The runner coerced booleans by comparing the `any` value against the string `"true"`, which a native bool never matches, so every boolean input evaluated to `false` — including when the callee relied on its default, since the server pre-fills defaults into the event payload and the string fallback is never reached. This accepts a native bool and keeps the string comparison as a fallback, since `workflow_dispatch` inputs are still strings and YAML defaults decode to strings; servers before 1.27 never put a native bool in the payload, so they take the exact same code path as before.
The same coercion is applied to `setupWorkflowInputs` (locally-called reusable workflows, `uses: ./.gitea/workflows/x.yml`), where a `type: boolean` input was previously a native bool when passed as `with: { flag: true }` but a string when interpolated or taken from `default:`. It is now always a bool, matching GitHub, whose `inputs` context "preserves Boolean values as Booleans instead of converting them to strings". **This is potentially breaking**: `inputs.flag == 'true'` now evaluates to `false` and must become `inputs.flag == true`. That pattern is already false on GitHub (a bool compared to a string coerces to `1 == NaN`), but it works on Gitea today, so I am happy to split this hunk into its own PR if you would rather keep this one backport-safe.
Fixes #1082
Reviewed-on: https://gitea.com/gitea/runner/pulls/1087
Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>
Co-authored-by: Nicolas <bircni@icloud.com>
|
||
|
Nicolas
|
d53538ac38 |
fix: drop action outputs whose value exceeds the size limit (#1070)
`SetOutputs` logged "ignore output because the value is too long" for values larger than 1 MiB but then fell through and stored the value anyway, sending it upstream via `UpdateTask`. The key-too-long branch directly above correctly skips oversized keys with `continue`; this adds the same `continue` to the value branch so the size guard is actually enforced and the log message matches the behavior. Adds regression coverage in `TestReporter_SetOutputs` for an oversized value (dropped) and a value at exactly the 1 MiB limit (retained). --------- Co-authored-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1070 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
Renovate Bot
|
554b3b7671 |
fix(deps): update module golang.org/x/term to v0.45.0 (#1081)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.44.0` → `v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1081 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
65756d60b3 |
fix: Minor fixes (#1075)
A batch of small, self-contained fixes and docs/example additions. Fixes #625 - align the example config's `force_pull` with the actual default (`false`) Fixes #804 - return an error instead of discarding `os.UserHomeDir()` when defaulting `cache.dir`/`host.workdir_parent` Fixes #571 - send a `gitea-runner/<version>` User-Agent on API requests Fixes #650 - detect an `Unauthenticated` fetch response and exit the daemon with an error instead of retrying forever Fixes #766 - add `exec --eventpath` to supply a JSON event payload file Fixes #256 - add a `bug-report` subcommand that prints version/Go/OS-arch/CPU info Fixes #617 - add `runner.set_act_env` (default `true`) to optionally omit the `ACT=true` env var Fixes #635 - record a failure result (and guard a nil reusable-workflow caller) when the job `if`-expression fails to evaluate Fixes #1005 - remove README docs for config env-var overrides that were already removed from the code Fixes #448 - clarify in `exec --job` help that `--workflows` may be needed to disambiguate Fixes #209 - note that `host`-labelled runners still need Docker for `docker://` actions and service containers Fixes #757 - add a systemd service example with automatic restart Fixes #474 - add a Kubernetes StatefulSet example that persists the `.runner` registration across reschedules Fixes #776 - build the basic (non-dind) docker image for `linux/riscv64` Fixes #628 - build the basic (non-dind) docker image for `linux/s390x`Reviewed-on: https://gitea.com/gitea/runner/pulls/1075 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
h7x4
|
be9b4502d6 |
enhance: add --token-file flag to register command (#1076)
Continuation of #362. In addition to fixing merge conflicts and the `fmt.Errorf` issue from the previous version, I've also added a set of tests to cover some basic usage of `initInputs` --------- Co-authored-by: Félix Baylac Jacqué <felix@alternativebit.fr> Reviewed-on: https://gitea.com/gitea/runner/pulls/1076 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: h7x4 <h7x4@nani.wtf> |
||
|
silverwind
|
1d74ae636a |
fix: skip service containers with an empty image (#1074)
GitHub Actions skips services whose image evaluates to an empty string, enabling conditional services via expressions like `image: ${{ matrix.image || '' }}`. Here such a service failed the job at `docker create`. Skip them before container creation, using GitHub's log message verbatim, and add a regression test.
Reviewed-on: https://gitea.com/gitea/runner/pulls/1074
Reviewed-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
v2.0.1
|
||
|
Renovate Bot
|
b12d02c25f |
fix(deps): update module golang.org/x/sys to v0.47.0 (#1073)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | [`v0.46.0` → `v0.47.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.46.0...refs/tags/v0.47.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1073 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
bircni
|
f2e0cf9131 |
docs: clarify cache reachability for dockerized runners (#1069)
Refs https://gitea.com/gitea/runner/issues/155 The remaining failure mode described in the issue comments is the job container timing out when it tries to reach ACTIONS_CACHE_URL. The generated config now explains that cache.host/cache.port must be reachable from job containers, and calls out dockerized runners with auto-created per-job networks as a case that may need a fixed published cache endpoint or a shared Docker network Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
0ee4643d4a |
fix: install nftables in dind images to silence nft cleanup errors (#1064)
Fixes: https://gitea.com/gitea/runner/issues/1061 Related: https://github.com/moby/moby/pull/52886 Docker 29.6.0 changed `dockerd` to shell out to the external `nft` binary for firewall-rule cleanup instead of linking `libnftables` (release note: *"Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the `nft` command instead."*). The upstream `docker:dind` image only ships `iptables`/`ip6tables`, so `dockerd` logs `failed to find nft tool` on startup and shutdown. Networking is unaffected (default firewall backend is still iptables), but the errors are noisy. Install `nftables` in both dind variants to provide the binary. *PR authored by Claude (Opus 4.8).*Reviewed-on: https://gitea.com/gitea/runner/pulls/1064 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
e774003c18 |
chore(deps): update docker docker tag to v29.6.1 (#1063)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | docker | stage | patch | `29.6.0-dind-rootless` → `29.6.1-dind-rootless` | | docker | stage | patch | `29.6.0-dind` → `29.6.1-dind` | Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
eeb479ea89 |
fix: prevent exponential growth of RunContext masks in composite actions (#1059)
A composite action's `RunContext` is **seeded with its parent's `Masks` slice** in `newCompositeRunContext`. After the composite finished running, the *entire* `compositeRC.Masks` (the seeded parent masks plus any added during the run) was appended straight back into the parent: ```go rc.Masks = append(rc.Masks, compositeRC.Masks...) ``` Because the composite already contained the parent's masks, every composite action roughly **doubled** the parent's `Masks` length. With many nested/repeated composite actions this grows exponentially: ``` before=1152 after=2304 compositeLen=1152 before=2304 after=4608 compositeLen=2304 before=4608 after=9216 compositeLen=4608 ... ``` ### Impact The bloated `Masks` slice made per-log-line secret redaction (`strings.makeGenericReplacer`, rebuilt per line since #1001) extremely slow. Log writes fell behind enough to keep subprocess pipes open after the process had already exited, surfacing as seemingly random CI failures — most often in later steps of mask-heavy workflows: ``` Error: exec: WaitDelay expired before I/O complete ``` The split of `cmd.Run()` into `cmd.Start()` + `cmd.Wait()` (#883) is what turned this long-standing latency into a hard failure. ### Fix Only append masks that aren't already present in the parent, via a small `appendUniqueMasks` helper. This keeps the mask count bounded by the number of *distinct* secrets instead of growing exponentially. I kept `Masks` as a `[]string` rather than switching to a set type, since it's passed by pointer to loggers across `logger.go`, `run_context.go`, and `runner.go` — a type change would be a much wider, riskier refactor. The `O(n·m)` dedup is harmless precisely because `n` now stays small. Fixes #1054Reviewed-on: https://gitea.com/gitea/runner/pulls/1059 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
Renovate Bot
|
eba33e178d |
fix(deps): update module github.com/docker/cli to v29.6.1+incompatible (#1060)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.0+incompatible` → `v29.6.1+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.1+incompatible`](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) [Compare Source](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1060 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
bircni
|
3396021e0f |
test: Enhance Coverage + CI (#1055)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1055 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
bircni
|
745b0ab6e4 |
fix: attach task token when cloning actions from self-hosted instance on a different host (#1056)
When `DEFAULT_ACTIONS_URL=self`, action clone URLs (`uses: owner/repo@ref`) are built from the Gitea **AppURL** (`gitea_default_actions_url`), but `shouldCloneURLUseToken` compared the clone URL host only against the runner's **registered address** (`GitHubInstance`). When the runner registers with a different hostname than AppURL — same instance, different DNS (e.g. `gitea.local` vs `gitea.my-nas.lan`, internal vs external) — the strict `u1.Host == u2.Host` check returns false, so the task token is **not** attached and the action clone goes out anonymously. Against an instance with `REQUIRE_SIGNIN_VIEW=true` this fails with: ``` Unable to clone https://gitea.example/owner/action refs/heads/v1: authentication required ``` The current workaround is to make the runner's registered host exactly match `AppURL`. This PR removes the need for that. Refs: https://github.com/go-gitea/gitea/issues/27933 ## Change - `shouldCloneURLUseToken` now trusts the clone URL when its host matches **either** the registered instance (`GitHubInstance`) **or** the self-hosted default-actions instance (`DefaultActionInstance`). Embedded basic auth is still rejected, and the empty-host cases are unchanged. - A new `Config.DefaultActionInstanceIsSelfHosted` flag gates the second candidate. It is set in the daemon layer (`run/runner.go`, `exec.go`), where `github.com` and a configured `GithubMirror` are distinguishable, so the token is **never** attached for off-instance hosts.Reviewed-on: https://gitea.com/gitea/runner/pulls/1056 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: bircni <bircni@icloud.com> |
||
Christian Heim
|
b7f6b6d90a |
fix: composite nested uses clone token (#1041)
## Summary A nested `uses:` action inside a **local composite action** fails to clone with a bare `authentication required: Unauthorized` (401) when the instance resolves host-less action references against itself (`DEFAULT_ACTIONS_URL = self`). The job fails at the composite **main→post boundary**, even though the composite's own steps and all post-steps report success. ## Root cause `newCompositeRunContext` nils `Config.Secrets` so composite steps do not see job secrets. But the action-clone path in `prepareActionExecutor` sourced its token via `getGitCloneToken` → `Config.GetToken()` → `Config.Secrets`, which is empty inside a composite RunContext. The nested action is therefore cloned anonymously → 401 against the authenticated instance. Two details explain the exact symptom: - It surfaces at the composite **main→post boundary** because the swallowed nested-step error is re-emitted by `common.JobError` at the end of the composite main pipeline. - It carries **no clone URL** because, on a warm action cache, only `r.Fetch` runs (not `PlainClone`), and the go-git fetch error is returned verbatim. ## Fix Source the clone token from `github.Token` instead of `Config.Secrets`. It is preserved across the composite config copy (`Config.Token` / `PresetGitHubContext`) and is identical to `Config.GetToken()` at the top level, so top-level and `act exec` behaviour is unchanged. The `shouldCloneURLUseToken` host gate is kept so the token is never sent to a foreign host. This also aligns the git-clone path with the ActionCache fetch path, which already uses `github.Token`. Reusable workflows are unaffected — their RunContext keeps `Config.Secrets`. ## Before / after Local composite action with a nested `uses:` (+ post step), followed by a marker step. Same workflow, same runner host — only the runner fix differs. | Job step | Before fix | After fix | | --- | --- | --- | | `Run actions/checkout@v6` | ✅ success | ✅ success | | `Run ./.gitea/actions/probe-composite` (nested `uses:` + post) | ❌ **failure** — bare 401 at the main→post boundary | ✅ success | | `Step after composite` | ⊘ **skipped** | ✅ **ran** | | Job result | ❌ **failed** | ✅ **succeeded** | ### Before — boundary log ```text ::endgroup:: ##[error]authentication required: Unauthorized ← bare 401, no clone target Run Post ./.gitea/actions/probe-composite Success - Post ./.gitea/actions/probe-composite ← post steps run and succeed Success - Post actions/checkout@v6 Job failed ``` The composite's own steps and both post-steps report `Success`; the job fails solely on the bare 401 emitted at the main→post boundary, and the next step is skipped. ### After — boundary log ```text Run ./.gitea/actions/probe-composite ...composite steps... Success - ./.gitea/actions/probe-composite Run Marker after composite PASSED composite boundary — no 401 (runner fix confirmed) Success - Marker after composite Job succeeded ``` ## Reproduction `.gitea/actions/probe-composite/action.yml`: ```yaml name: probe-composite runs: using: composite steps: - uses: actions/setup-node@v6 # nested uses → has a post step with: { node-version: 22 } - run: echo "composite inner step OK" shell: bash ``` `.gitea/workflows/probe.yaml`: ```yaml on: [push] jobs: composite-boundary: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - uses: ./.gitea/actions/probe-composite - run: echo "step after composite" # skipped before the fix; runs after ``` ## Verification - **Before:** bare 401 at the boundary, reproduced with a `delay=0` tail — rules out a token-TTL / expiry effect; it is a missing credential. - **After:** the composite step succeeds, the step after the composite runs, the job succeeds, and there is no `authentication required` in the log. - A reusable workflow (`workflow_call`) with the same nested `uses:` + post step never hit the 401, which isolated the bug to the composite main/post path. ## Tests Adds `TestStepActionRemoteCloneTokenSurvivesNilSecrets` (`act/runner`): asserts the clone token is forwarded when the RunContext mirrors a composite (`Secrets == nil`, token via `Config.Token`), and that the host gate still withholds the token for a foreign host. Verified to fail without the fix and pass with it. --------- Reviewed-on: https://gitea.com/gitea/runner/pulls/1041 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: Christian Heim <christian@heimdaheim.de> Co-committed-by: Christian Heim <christian@heimdaheim.de>v2.0.0 |
||
|
bircni
|
cdcea87a45 |
fix: namespace local docker action image tags per repository (#1051)
Fixes #1039 — local docker actions referenced with `uses: ./` are incorrectly served from a cached image built for a *different* repository. ## Root cause For a local docker action, the built image tag is derived from `actionName`, which is the **workspace-relative** path of the action. For a self-referencing action that is always `"./"`, regardless of which repository it lives in. In `execAsDocker` this collapsed to the constant tag `act-dockeraction:latest` for *every* repository. Before building, the runner checks `ContainerImageExistsLocally` and skips the rebuild if a matching tag is present. On a shared docker daemon, once repository A built its image, repository B's `uses: ./` found the same tag, skipped its rebuild, and **ran repository A's action image** — the reported "the first action is run again, because the path is cached", including the cross-repository concern raised in the issue. ## Fix Extracted the tag computation into a small, testable `dockerActionImageTag(repository, actionName, localAction)` function. For local actions the tag is now namespaced with the repository (`path.Join(repository, actionName)`): - different repositories no longer collide (`act-owner-repo-a-dockeraction:latest` vs `act-owner-repo-b-dockeraction:latest`); - image caching is preserved within a repository (tag stays stable); - remote actions are unchanged — they already carry a unique, ref-scoped `actionName` (the uses hash). --------- Co-authored-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1051 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: bircni <bircni@icloud.com> Co-committed-by: bircni <bircni@icloud.com> |
||
|
Nicolas
|
3c4bcf3ebf |
build: cover Windows Go files (#1052)
- fix Windows-only golangci-lint findings in `lp_windows.go` and process killer handle cleanup - add a `lint-go-windows` target that runs golangci-lint with `GOOS=windows` - include the Windows lint pass in `make lint` so Ubuntu CI covers `_windows.go` files Reviewed-on: https://gitea.com/gitea/runner/pulls/1052 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
Nicolas
|
e22d3fa263 |
fix: run always()/cancelled() and post steps correctly on cancellation (#1043)
## Problem
When a workflow run is **cancelled**, the runner diverged from GitHub Actions:
- Main-stage `if: ${{ always() }}` / `if: ${{ cancelled() }}` steps **did not run** at all (unlike a *failed* run, where they do).
- `if: ${{ cancelled() }}` was **structurally impossible** to satisfy — it could never be true.
GitHub Actions runs `always()`/`cancelled()` steps (and post cleanup) even when a job is cancelled. This runner only honored that for action *post* steps (since #1016), leaving main-stage cleanup steps silently skipped.
## Root causes (both in `act/`)
1. **`getJobContext()`** derived the job status purely from step conclusions, so it could only ever return `"success"` or `"failure"`. Since `cancelled()` checks `Job.Status == "cancelled"`, it was impossible — and `success()` stayed *true* on a cancelled run, so the wrong `if` branch was taken everywhere.
2. **The main step pipeline** is chained with `Executor.Then()`, which short-circuits the moment `ctx.Err() != nil`. Once the server cancelled, every not-yet-started main step (including `always()` ones) was abandoned.
## Fix
- Add a per-`RunContext` `jobCancelled` flag + `markCancelled()`. `getJobContext()` now reports `"cancelled"` (taking precedence over success/failure), so `cancelled()`/`always()` are true and `success()`/`failure()` are false — matching GitHub's "only always()/cancelled() run on cancel" semantics.
- Replace the plain main-steps pipeline with `newMainStepsExecutor`. On interruption (`context.Canceled` from a server cancel, or `context.DeadlineExceeded` from the job timeout) it marks the job cancelled and runs the **remaining** steps under a fresh context (`context.WithoutCancel` + bounded timeout) so `always()`/`cancelled()` steps run for cleanup, while default-`success()` steps skip themselves. The original interrupt error is still propagated upward.
- Backstop `markCancelled()` in the post-step `Finally` so cancellations landing outside the main loop still surface the cancelled status to post steps.
Pre-steps keep normal short-circuit behavior, and reporting (`RESULT_CANCELLED`) is untouched — that remains handled by #1016.
## Reporting semantics (unchanged by this PR)
| Run state | failing post/`always()` step reported as |
| --------- | --------------------------------------------------------------------------------------------- |
| Normal | **FAILURE** |
| Timeout | **FAILURE** (deadline path preserves the job-error container) |
| Cancelled | **CANCELLED** — cancellation wins; the failing step is logged but doesn't flip the conclusion |
The new `always()` path runs under `context.WithoutCancel`, so the job-error container is preserved — a failing `always()` step records its failure at step level and does not panic in `SetJobError`.
Fixes #657
Reviewed-on: https://gitea.com/gitea/runner/pulls/1043
Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>
|
||
|
Zettat123
|
99bc50d538 |
feat: shallow clone action repositories (#1053)
## Summary When a workflow references a remote action (e.g. `uses: actions/checkout@v4`) the runner clones that repository during job setup. Previously this was always a full clone(every branch and the complete history) even though only a single ref is needed. This PR makes the runner shallow-clone the requested ref by default (`--depth=1`, single branch), falling back to a full clone when a shallow clone fails. Notes: - Existing on-disk caches are reused as-is; there is no forced re-clone on upgrade. ## Changes - A new `runner.action_shallow_clone` option (default `true`) lets operators opt back into full clones. - `cloneAtDepth`: attempt a shallow clone; fall back to a full clone when shallow clone fails. - Keep a shallow cache cheap on update: fetch the single requested ref at depth 1 and skip `pull`. --------- Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1053 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-committed-by: Zettat123 <zettat123@gmail.com> |
||
|
bircni
|
8f72c60afa |
fix: guard SetJobError against missing job-error container (#1050)
Fixes https://gitea.com/gitea/runner/issues/1047 The runner panics during shutdown when jobs are interrupted: ``` panic in executor: interface conversion: interface {} is nil, not map[string]error ... gitea.com/gitea/runner/act/common.SetJobError(...) /data/gitea/runner/act/common/job_error.go:27 gitea.com/gitea/runner/act/runner.reportStepError(...) /data/gitea/runner/act/runner/job_executor.go:62 ``` `SetJobError` did an unchecked type assertion on the job-error container stored in the context: ```go ctx.Value(jobErrorContextKeyVal).(map[string]error)["error"] = err ``` When the container is absent — e.g. on shutdown, when a job is interrupted and `reportStepError` → `SetJobError` runs on a context where `WithJobErrorContainer` was never called — `ctx.Value` returns `nil` and asserting `nil.(map[string]error)` panics. ## Fix Use the comma-ok form so a missing container is a no-op, matching the safe pattern already used in the sibling `JobError` function. If there's no container, there's nowhere to record the error anyway, so skipping is correct. ```go func SetJobError(ctx context.Context, err error) { if container, ok := ctx.Value(jobErrorContextKeyVal).(map[string]error); ok { container["error"] = err } } ``` Reviewed-on: https://gitea.com/gitea/runner/pulls/1050 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: bircni <bircni@icloud.com> Co-committed-by: bircni <bircni@icloud.com> |
||
|
Renovate Bot
|
4e7fd1c68a |
fix(deps): update module github.com/moby/moby/client to v0.5.0 (#1049)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/moby/moby/client](https://github.com/moby/moby) | `v0.4.1` → `v0.5.0` |  |  | --- ### Release Notes <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.5.0`](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) [Compare Source](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1049 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
bd41a367fe |
fix(deps): update module github.com/docker/cli to v29.6.0+incompatible (#1045)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.5.3+incompatible` → `v29.6.0+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.0+incompatible`](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) [Compare Source](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1045 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
c566013db4 |
chore(deps): update docker docker tag to v29.6.0 (#1044)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | docker | stage | minor | `29.5.3-dind-rootless` → `29.6.0-dind-rootless` | | docker | stage | minor | `29.5.3-dind` → `29.6.0-dind` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1044 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
40e021309a |
chore(deps): update actions/checkout action to v7 (#1042)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1042 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
d3b3519dea |
fix(deps): update module go.etcd.io/bbolt to v1.5.0 (#1040)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) | `v1.4.3` → `v1.5.0` |  |  | --- ### Release Notes <details> <summary>etcd-io/bbolt (go.etcd.io/bbolt)</summary> ### [`v1.5.0`](https://github.com/etcd-io/bbolt/releases/tag/v1.5.0): v0.5.0 [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.4.3...v1.5.0) See the [CHANGELOG/v1.5.0](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.5.md#v1502026-06-21) for more details. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1040 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
6bdcb54828 |
feat: Enable jobs.<job_id>.timeout-minutes and jobs.<job_id>.continue-on-error (#1032)
Two `jobs.<job_id>` workflow syntax fields were parsed from YAML but silently ignored. This PR implements both:
- **`jobs.<job_id>.timeout-minutes`** — applies a context deadline around the entire job execution (container start, pre-steps, main steps, post-steps). Mirrors the existing step-level `evaluateStepTimeout`. Supports expression interpolation (e.g. `${{ env.MY_TIMEOUT }}`).
- **`jobs.<job_id>.continue-on-error`** — evaluates the expression when a job fails. If all failing matrix combinations had `continue-on-error: true`, the job does not cause the workflow run to fail (`handleFailure` skips it), and the tolerated failure reports `success` to dependent jobs through the `needs` context so jobs gated on the default `if: success()` still run (matching GitHub). The "any firm failure wins" rule is serialised under the existing per-job lock, so parallel matrix combinations are safe.
Both features follow the same patterns already used at the step level (`evaluateStepTimeout` / `isContinueOnError` in `act/runner/step.go`).
## Version compatibility
These changes are backward compatible. With mismatched versions the feature degrades silently to the previous behaviour (field ignored) — no errors on either side.
- `timeout-minutes`: runner-only, no server dependency.
- `continue-on-error`: requires both this runner PR and the matching Gitea server PR to take full effect. With only one side updated, the field continues to be ignored.
Related: [Github](https://github.com/go-gitea/gitea/pull/38100)
---------
Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1032
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>
|