mirror of
https://gitea.com/gitea/act_runner.git
synced 2026-07-27 09:57:30 +00:00
renovate/dependencies
411 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Renovate Bot
|
4ee3417fa6 | chore(deps): pin dependencies | ||
|
Renovate Bot
|
8c519ce318 |
fix(deps): update module github.com/prometheus/client_golang to v1.24.0 (#1113)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `v1.23.2` → `v1.24.0` |  |  | --- ### Release Notes <details> <summary>prometheus/client_golang (github.com/prometheus/client_golang)</summary> ### [`v1.24.0`](https://github.com/prometheus/client_golang/releases/tag/v1.24.0): - 2026-07-20 [Compare Source](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0) ##### Changes - \[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. [#​1862](https://github.com/prometheus/client_golang/issues/1862) - \[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated `model.NameValidationScheme` global. Default behavior is unchanged; code that set `NameValidationScheme = LegacyValidation` no longer gets legacy enforcement at metric, label, and push-grouping construction. [#​2051](https://github.com/prometheus/client_golang/issues/2051) - \[CHANGE] api/prometheus/v1: Support matchers (`matches[]` parameter) in `Rules` method (`Rules(ctx context.Context, matches []string) (RulesResult, error)`). [#​1843](https://github.com/prometheus/client_golang/issues/1843) - \[CHANGE] api/prometheus/v1: Refactor `LabelNames` method to return `model.LabelNames` instead of `[]string` for consistency across the API. [#​1850](https://github.com/prometheus/client_golang/issues/1850) - \[CHANGE] exp/api/remote: Simplify `Store` interface, rename `Handler` to `WriteHandler`, and encapsulate write response handling. [#​1855](https://github.com/prometheus/client_golang/issues/1855) - \[FEATURE] prometheus: Add new Go 1.26 runtime metrics (`/sched/goroutines-created:goroutines`, `/sched/goroutines/not-in-go:goroutines`, `/sched/goroutines/runnable:goroutines`, `/sched/goroutines/running:goroutines`, `/sched/goroutines/waiting:goroutines`, `/sched/threads/total:threads`). [#​1942](https://github.com/prometheus/client_golang/issues/1942) - \[FEATURE] prometheus: Add `WithUnit(unit string)` option and explicit OpenMetrics unit support in `CounterOpts`, `GaugeOpts`, `SummaryOpts`, and `HistogramOpts`. [#​1392](https://github.com/prometheus/client_golang/issues/1392) - \[FEATURE] prometheus: Expose descriptor construction error through public `Err()` method on `Desc`. [#​1902](https://github.com/prometheus/client_golang/issues/1902) - \[FEATURE] promhttp: Add opt-in `HandlerOpts.CoalesceGather` to deduplicate concurrent `Gather` calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. [#​1969](https://github.com/prometheus/client_golang/issues/1969) - \[FEATURE] promhttp: HTTP handlers created by `promhttp` package now support metrics filtering by providing one or more `name[]` query parameters. The default behavior when none are provided remains the same, returning all metrics. [#​1925](https://github.com/prometheus/client_golang/issues/1925) - \[FEATURE] api/prometheus/v1: Add query formatting endpoint support (`/format_query`) and `FormatQuery(ctx context.Context, query string) (string, error)` method. [#​1846](https://github.com/prometheus/client_golang/issues/1846), [#​1856](https://github.com/prometheus/client_golang/issues/1856) - \[FEATURE] api/prometheus/v1: Add support for `/status/tsdb/blocks` endpoint via `TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)` method. [#​1896](https://github.com/prometheus/client_golang/issues/1896) - \[FEATURE] exp/api/remote: Export `BackoffConfig` to allow customization when using `WithAPIBackoff`. [#​1895](https://github.com/prometheus/client_golang/issues/1895) - \[FEATURE] exp/api/remote: Add `RetryCallBack` to allow custom logging or handling on retry attempts in the remote write client. [#​1888](https://github.com/prometheus/client_golang/issues/1888), [#​1890](https://github.com/prometheus/client_golang/issues/1890) - \[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. [#​1860](https://github.com/prometheus/client_golang/issues/1860) - \[ENHANCEMENT] api: Use cloned `http.DefaultTransport` when constructing default HTTP clients to prevent accidental mutations of shared global transport state. [#​1885](https://github.com/prometheus/client_golang/issues/1885) - \[BUGFIX] prometheus: Recover from collector panics during `Gather()` and return an error instead of crashing the process. [#​1961](https://github.com/prometheus/client_golang/issues/1961) - \[BUGFIX] prometheus: Fix `cpu-seconds` unit suffix handling for metric `go_cpu_classes_gc_mark_assist_cpu_seconds`. [#​1991](https://github.com/prometheus/client_golang/issues/1991) - \[BUGFIX] promhttp: `InstrumentHandlerDuration` and `InstrumentHandlerCounter` no longer panic when given an observer/counter that does not implement `ExemplarObserver`/`ExemplarAdder` (e.g. a `SummaryVec`). The exemplar is dropped and the value is recorded via the plain `Observe`/`Add` path, matching the safe-cast already used by `Timer.ObserveDurationWithExemplar`. [#​2005](https://github.com/prometheus/client_golang/issues/2005) - \[BUGFIX] api/prometheus/v1: Fall back to `GET` requests when `POST` requests return `403 Forbidden` or method not allowed. [#​2030](https://github.com/prometheus/client_golang/issues/2030) - \[BUGFIX] api: Respect context cancellation inside `httpClient.Do`. [#​1971](https://github.com/prometheus/client_golang/issues/1971) - \[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. [#​1889](https://github.com/prometheus/client_golang/issues/1889) - \[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. [#​1917](https://github.com/prometheus/client_golang/issues/1917) - \[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. [#​1927](https://github.com/prometheus/client_golang/issues/1927) <details> <summary> All commits </summary> - build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1839](https://github.com/prometheus/client_golang/pull/1839) - build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1838](https://github.com/prometheus/client_golang/pull/1838) - prometheus/collectors: use godoc link for runtime/metrics supported metrics by [@​xieyuschen](https://github.com/xieyuschen) in [#​1844](https://github.com/prometheus/client_golang/pull/1844) - Fix doc typo by [@​torrca](https://github.com/torrca) in [#​1849](https://github.com/prometheus/client_golang/pull/1849) - Merge release-1.23 into main by [@​vesari](https://github.com/vesari) in [#​1851](https://github.com/prometheus/client_golang/pull/1851) - build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1852](https://github.com/prometheus/client_golang/pull/1852) - Refactor LabelNames to return model.LabelNames type for consistency by [@​yshngg](https://github.com/yshngg) in [#​1850](https://github.com/prometheus/client_golang/pull/1850) - remote: simplified Store interface; renamed Handler to WriteHandler by [@​bwplotka](https://github.com/bwplotka) in [#​1855](https://github.com/prometheus/client_golang/pull/1855) - feat(api/prometheus): add format\_query endpoint for query formatting by [@​yshngg](https://github.com/yshngg) in [#​1846](https://github.com/prometheus/client_golang/pull/1846) - feat(api): add FormatQuery method to Prometheus v1 API by [@​yshngg](https://github.com/yshngg) in [#​1856](https://github.com/prometheus/client_golang/pull/1856) - Support matchers in rules API by [@​jotak](https://github.com/jotak) in [#​1843](https://github.com/prometheus/client_golang/pull/1843) - Use prometheus/common.expfmt.NewTextParser by [@​aknuds1](https://github.com/aknuds1) in [#​1859](https://github.com/prometheus/client_golang/pull/1859) - Merge release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1861](https://github.com/prometheus/client_golang/pull/1861) - chore: Drop support for \<go1.22 by [@​mrueg](https://github.com/mrueg) in [#​1862](https://github.com/prometheus/client_golang/pull/1862) - collectors/version: Allow custom additional labels by [@​mrueg](https://github.com/mrueg) in [#​1860](https://github.com/prometheus/client_golang/pull/1860) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by [@​ywwg](https://github.com/ywwg) in [#​1865](https://github.com/prometheus/client_golang/pull/1865) - Sync release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1868](https://github.com/prometheus/client_golang/pull/1868) - Sync main with release-1.23 by [@​aknuds1](https://github.com/aknuds1) in [#​1871](https://github.com/prometheus/client_golang/pull/1871) - chore: clean up golangci-lint configuration by [@​mmorel-35](https://github.com/mmorel-35) in [#​1802](https://github.com/prometheus/client_golang/pull/1802) - build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1880](https://github.com/prometheus/client_golang/pull/1880) - build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1882](https://github.com/prometheus/client_golang/pull/1882) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1883](https://github.com/prometheus/client_golang/pull/1883) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1881](https://github.com/prometheus/client_golang/pull/1881) - Fix typo in remote api err msg by [@​SungJin1212](https://github.com/SungJin1212) in [#​1878](https://github.com/prometheus/client_golang/pull/1878) - chore: Update metrics for new Go version by [@​github-actions](https://github.com/github-actions)\[bot] in [#​1864](https://github.com/prometheus/client_golang/pull/1864) - Add RetryCallBack to remote\_api.go by [@​pipiland2612](https://github.com/pipiland2612) in [#​1888](https://github.com/prometheus/client_golang/pull/1888) - bug(remote\_write): Fix compression buffer pooling by [@​fpetkovski](https://github.com/fpetkovski) in [#​1889](https://github.com/prometheus/client_golang/pull/1889) - Change RetryCallBack initialized by [@​pipiland2612](https://github.com/pipiland2612) in [#​1890](https://github.com/prometheus/client_golang/pull/1890) - Fix CI bug by [@​pipiland2612](https://github.com/pipiland2612) in [#​1892](https://github.com/prometheus/client_golang/pull/1892) - Use cloned http.DefaultTransport. issue-1857 by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1885](https://github.com/prometheus/client_golang/pull/1885) - Public backoff config to allow usage of WithAPIBackoff by [@​pipiland2612](https://github.com/pipiland2612) in [#​1895](https://github.com/prometheus/client_golang/pull/1895) - Clarify exp library stability by [@​pipiland2612](https://github.com/pipiland2612) in [#​1894](https://github.com/prometheus/client_golang/pull/1894) - feat: add support for `/status/tsdb/blocks` endpoint by [@​tjhop](https://github.com/tjhop) in [#​1896](https://github.com/prometheus/client_golang/pull/1896) - minor refactor of replaceInvalidRune() in bridge.go by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1897](https://github.com/prometheus/client_golang/pull/1897) - build(deps): bump github.com/prometheus/procfs from 0.17.0 to 0.19.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1903](https://github.com/prometheus/client_golang/pull/1903) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1906](https://github.com/prometheus/client_golang/pull/1906) - build(deps): bump golang.org/x/sys from 0.35.0 to 0.37.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1904](https://github.com/prometheus/client_golang/pull/1904) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1907](https://github.com/prometheus/client_golang/pull/1907) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1911](https://github.com/prometheus/client_golang/pull/1911) - build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1909](https://github.com/prometheus/client_golang/pull/1909) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1910](https://github.com/prometheus/client_golang/pull/1910) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1908](https://github.com/prometheus/client_golang/pull/1908) - chore(ci): Add CRLF detection and fix targets to prevent CRLF contamination by [@​kakkoyun](https://github.com/kakkoyun) in [#​1898](https://github.com/prometheus/client_golang/pull/1898) - chore(ci): Use stable names for CI steps by [@​kakkoyun](https://github.com/kakkoyun) in [#​1914](https://github.com/prometheus/client_golang/pull/1914) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1920](https://github.com/prometheus/client_golang/pull/1920) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1921](https://github.com/prometheus/client_golang/pull/1921) - build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1922](https://github.com/prometheus/client_golang/pull/1922) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1923](https://github.com/prometheus/client_golang/pull/1923) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1924](https://github.com/prometheus/client_golang/pull/1924) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1919](https://github.com/prometheus/client_golang/pull/1919) - feat: expose Desc error through public Err() method by [@​duricanikolic](https://github.com/duricanikolic) in [#​1902](https://github.com/prometheus/client_golang/pull/1902) - Allow `/metrics` handler output filtering via `name[]` query param by [@​colega](https://github.com/colega) in [#​1925](https://github.com/prometheus/client_golang/pull/1925) - Prevent OOM from malformed snappy payloads by validating decoded length by [@​makasim](https://github.com/makasim) in [#​1917](https://github.com/prometheus/client_golang/pull/1917) - Ensure remote write v2 headers cannot be returned on v1 requests by [@​kgeckhart](https://github.com/kgeckhart) in [#​1927](https://github.com/prometheus/client_golang/pull/1927) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1932](https://github.com/prometheus/client_golang/pull/1932) - build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1933](https://github.com/prometheus/client_golang/pull/1933) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1935](https://github.com/prometheus/client_golang/pull/1935) - build(deps): bump the github-actions group with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1934](https://github.com/prometheus/client_golang/pull/1934) - promhttp/zstd: add unit tests for zstd writer registration by [@​90ashish](https://github.com/90ashish) in [#​1929](https://github.com/prometheus/client_golang/pull/1929) - feat(collector): add Go 1.26 new runtime metrics by [@​kakkoyun](https://github.com/kakkoyun) in [#​1942](https://github.com/prometheus/client_golang/pull/1942) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1948](https://github.com/prometheus/client_golang/pull/1948) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1946](https://github.com/prometheus/client_golang/pull/1946) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1944](https://github.com/prometheus/client_golang/pull/1944) - build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1945](https://github.com/prometheus/client_golang/pull/1945) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1947](https://github.com/prometheus/client_golang/pull/1947) - chore(test): bump 1.25, tests with synctest and check not panic by [@​manute](https://github.com/manute) in [#​1950](https://github.com/prometheus/client_golang/pull/1950) - build(deps): bump github.com/prometheus/procfs from 0.19.2 to 0.20.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1954](https://github.com/prometheus/client_golang/pull/1954) - build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1957](https://github.com/prometheus/client_golang/pull/1957) - build(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1955](https://github.com/prometheus/client_golang/pull/1955) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.34.0 to 1.40.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1959](https://github.com/prometheus/client_golang/pull/1959) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1956](https://github.com/prometheus/client_golang/pull/1956) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1958](https://github.com/prometheus/client_golang/pull/1958) - chore(collectors/go): generate the tests after new metric by [@​kakkoyun](https://github.com/kakkoyun) in [#​1962](https://github.com/prometheus/client_golang/pull/1962) - Remove Arthur from the list of maintainers by [@​ArthurSens](https://github.com/ArthurSens) in [#​1964](https://github.com/prometheus/client_golang/pull/1964) - build(deps): bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1965](https://github.com/prometheus/client_golang/pull/1965) - fix: recover from collector panic and return error in Gather by [@​Saflaski](https://github.com/Saflaski) in [#​1961](https://github.com/prometheus/client_golang/pull/1961) - prometheus: clarify MetricVec delete semantics in godoc by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1967](https://github.com/prometheus/client_golang/pull/1967) - build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1973](https://github.com/prometheus/client_golang/pull/1973) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1974](https://github.com/prometheus/client_golang/pull/1974) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1976](https://github.com/prometheus/client_golang/pull/1976) - Optionally add OM unit by [@​vesari](https://github.com/vesari) in [#​1392](https://github.com/prometheus/client_golang/pull/1392) - fix: respect context cancellation in httpClient.Do by [@​pedrampdd](https://github.com/pedrampdd) in [#​1971](https://github.com/prometheus/client_golang/pull/1971) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1978](https://github.com/prometheus/client_golang/pull/1978) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1977](https://github.com/prometheus/client_golang/pull/1977) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1980](https://github.com/prometheus/client_golang/pull/1980) - examples: add native histogram usage example by [@​thegdsks](https://github.com/thegdsks) in [#​1981](https://github.com/prometheus/client_golang/pull/1981) - chore(ci): add macOS, Windows and arm64 test runners by [@​kakkoyun](https://github.com/kakkoyun) in [#​1968](https://github.com/prometheus/client_golang/pull/1968) - prometheus: honor PidFn on windows and darwin by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1966](https://github.com/prometheus/client_golang/pull/1966) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1984](https://github.com/prometheus/client_golang/pull/1984) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1985](https://github.com/prometheus/client_golang/pull/1985) - promhttp: implement WithXFromContext in terms of WithXFromRequest by [@​tie](https://github.com/tie) in [#​1863](https://github.com/prometheus/client_golang/pull/1863) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1988](https://github.com/prometheus/client_golang/pull/1988) - Fix bug unit cpu-seconds not a suffix of metric go\_cpu\_classes\_gc\_mark\_assist\_cpu\_seconds by [@​vesari](https://github.com/vesari) in [#​1991](https://github.com/prometheus/client_golang/pull/1991) - build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1993](https://github.com/prometheus/client_golang/pull/1993) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1992](https://github.com/prometheus/client_golang/pull/1992) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1995](https://github.com/prometheus/client_golang/pull/1995) - exp/api/remote: limit request body size in SnappyDecodeMiddleware by [@​roidelapluie](https://github.com/roidelapluie) in [#​1996](https://github.com/prometheus/client_golang/pull/1996) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2001](https://github.com/prometheus/client_golang/pull/2001) - build(deps): bump the github-actions group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1994](https://github.com/prometheus/client_golang/pull/1994) - ci(update-go-versions): declare permissions for the monthly chore PR by [@​arpitjain099](https://github.com/arpitjain099) in [#​2003](https://github.com/prometheus/client_golang/pull/2003) - docs: fix godoc indentation and typos in timer.go and wrap.go by [@​immanuwell](https://github.com/immanuwell) in [#​2009](https://github.com/prometheus/client_golang/pull/2009) - ci: harden actions/checkout with persist-credentials: false by [@​roidelapluie](https://github.com/roidelapluie) in [#​2011](https://github.com/prometheus/client_golang/pull/2011) - fix(registry): prevent file descriptor leak in WriteToTextfile by [@​ProjectMutilation](https://github.com/ProjectMutilation) in [#​2010](https://github.com/prometheus/client_golang/pull/2010) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2008](https://github.com/prometheus/client_golang/pull/2008) - promhttp: add regression test for concurrent map writes ([#​1274](https://github.com/prometheus/client_golang/issues/1274)) by [@​pedrampdd](https://github.com/pedrampdd) in [#​2000](https://github.com/prometheus/client_golang/pull/2000) - build(deps): bump github.com/prometheus/common from 0.67.6-0.20260224092343-e4c38a0aea47 to 0.68.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2015](https://github.com/prometheus/client_golang/pull/2015) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2016](https://github.com/prometheus/client_golang/pull/2016) - build(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2014](https://github.com/prometheus/client_golang/pull/2014) - build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2017](https://github.com/prometheus/client_golang/pull/2017) - promhttp: fix grammar in exemplar option doc comments by [@​s3onghyun](https://github.com/s3onghyun) in [#​2023](https://github.com/prometheus/client_golang/pull/2023) - fix: use keyed fields in SamplePair struct literals in api\_test.go by [@​immanuwell](https://github.com/immanuwell) in [#​2012](https://github.com/prometheus/client_golang/pull/2012) - refactor: replace interface{} with any (Go 1.18+) by [@​MD-Mushfiqur123](https://github.com/MD-Mushfiqur123) in [#​2021](https://github.com/prometheus/client_golang/pull/2021) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2013](https://github.com/prometheus/client_golang/pull/2013) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2025](https://github.com/prometheus/client_golang/pull/2025) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2027](https://github.com/prometheus/client_golang/pull/2027) - build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2026](https://github.com/prometheus/client_golang/pull/2026) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2028](https://github.com/prometheus/client_golang/pull/2028) - build(deps): bump github.com/prometheus/procfs from 0.20.1 to 0.21.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2033](https://github.com/prometheus/client_golang/pull/2033) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2036](https://github.com/prometheus/client_golang/pull/2036) - build(deps): bump github.com/prometheus/procfs from 0.21.0 to 0.21.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2035](https://github.com/prometheus/client_golang/pull/2035) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2038](https://github.com/prometheus/client_golang/pull/2038) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2041](https://github.com/prometheus/client_golang/pull/2041) - fix(api): fall back to GET on forbidden POSTs by [@​immanuwell](https://github.com/immanuwell) in [#​2030](https://github.com/prometheus/client_golang/pull/2030) - build(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2042](https://github.com/prometheus/client_golang/pull/2042) - build(deps): bump the github-actions group across 1 directory with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2043](https://github.com/prometheus/client_golang/pull/2043) - chores: remove example Dockerfile and container\_description.yaml by [@​bwplotka](https://github.com/bwplotka) in [#​2044](https://github.com/prometheus/client_golang/pull/2044) - Update dependabot config by [@​SuperQ](https://github.com/SuperQ) in [#​2046](https://github.com/prometheus/client_golang/pull/2046) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2048](https://github.com/prometheus/client_golang/pull/2048) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2047](https://github.com/prometheus/client_golang/pull/2047) - promhttp: don't panic when instrumenting with non-exemplar observers by [@​spor3006](https://github.com/spor3006) in [#​2005](https://github.com/prometheus/client_golang/pull/2005) - Replace deprecated model.NameValidationScheme with explicit UTF8Validation by [@​kakkoyun](https://github.com/kakkoyun) in [#​2051](https://github.com/prometheus/client_golang/pull/2051) - test: fix two flaky tests (darwin start\_time regex, memstats HeapReleased drift) by [@​kakkoyun](https://github.com/kakkoyun) in [#​2050](https://github.com/prometheus/client_golang/pull/2050) - fix: correct typos in comments and test error messages by [@​maxtaran2010](https://github.com/maxtaran2010) in [#​2049](https://github.com/prometheus/client_golang/pull/2049) - examples: improve simple main.go example by [@​dhanudhanushree](https://github.com/dhanudhanushree) in [#​1999](https://github.com/prometheus/client_golang/pull/1999) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2055](https://github.com/prometheus/client_golang/pull/2055) - feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather calls by [@​kakkoyun](https://github.com/kakkoyun) in [#​1969](https://github.com/prometheus/client_golang/pull/1969) - build(deps): update all Go dependencies in all go.mod files by [@​bwplotka](https://github.com/bwplotka) in [#​2059](https://github.com/prometheus/client_golang/pull/2059) - Cut v1.24.0-rc.0 by [@​bwplotka](https://github.com/bwplotka) in [#​2058](https://github.com/prometheus/client_golang/pull/2058) </details> #### New Contributors * @​xieyuschen made their first contribution in https://github.com/prometheus/client_golang/pull/1844 * @​torrca made their first contribution in https://github.com/prometheus/client_golang/pull/1849 * @​yshngg made their first contribution in https://github.com/prometheus/client_golang/pull/1850 * @​jotak made their first contribution in https://github.com/prometheus/client_golang/pull/1843 * @​SungJin1212 made their first contribution in https://github.com/prometheus/client_golang/pull/1878 * @​github-actions[bot] made their first contribution in https://github.com/prometheus/client_golang/pull/1864 * @​pipiland2612 made their first contribution in https://github.com/prometheus/client_golang/pull/1888 * @​fpetkovski made their first contribution in https://github.com/prometheus/client_golang/pull/1889 * @​karthikkondapally made their first contribution in https://github.com/prometheus/client_golang/pull/1885 * @​tjhop made their first contribution in https://github.com/prometheus/client_golang/pull/1896 * @​duricanikolic made their first contribution in https://github.com/prometheus/client_golang/pull/1902 * @​makasim made their first contribution in https://github.com/prometheus/client_golang/pull/1917 * @​kgeckhart made their first contribution in https://github.com/prometheus/client_golang/pull/1927 * @​90ashish made their first contribution in https://github.com/prometheus/client_golang/pull/1929 * @​manute made their first contribution in https://github.com/prometheus/client_golang/pull/1950 * @​Saflaski made their first contribution in https://github.com/prometheus/client_golang/pull/1961 * @​Retr0-XD made their first contribution in https://github.com/prometheus/client_golang/pull/1967 * @​pedrampdd made their first contribution in https://github.com/prometheus/client_golang/pull/1971 * @​thegdsks made their first contribution in https://github.com/prometheus/client_golang/pull/1981 * @​tie made their first contribution in https://github.com/prometheus/client_golang/pull/1863 * @​arpitjain099 made their first contribution in https://github.com/prometheus/client_golang/pull/2003 * @​immanuwell made their first contribution in https://github.com/prometheus/client_golang/pull/2009 * @​ProjectMutilation made their first contribution in https://github.com/prometheus/client_golang/pull/2010 * @​s3onghyun made their first contribution in https://github.com/prometheus/client_golang/pull/2023 * @​MD-Mushfiqur123 made their first contribution in https://github.com/prometheus/client_golang/pull/2021 * @​spor3006 made their first contribution in https://github.com/prometheus/client_golang/pull/2005 * @​maxtaran2010 made their first contribution in https://github.com/prometheus/client_golang/pull/2049 * @​dhanudhanushree made their first contribution in https://github.com/prometheus/client_golang/pull/1999 **Full Changelog**: <https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1113 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
de43c84203 |
fix(deps): update module go.opentelemetry.io/otel to v1.44.0 [security] (#1115)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `v1.43.0` → `v1.44.0` |  |  | --- ### Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel [CVE-2026-41178](https://nvd.nist.gov/vuln/detail/CVE-2026-41178) / [GHSA-5wrp-cwcj-q835](https://github.com/advisories/GHSA-5wrp-cwcj-q835) / [GO-2026-5158](https://pkg.go.dev/vuln/GO-2026-5158) <details> <summary>More information</summary> #### Details Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel #### Severity Unknown #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835) - [https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://github.com/open-telemetry/opentelemetry-go/pull/7880) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5158) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.44.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.44.0): /v0.66.0/v0.20.0/v0.0.17 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0) ##### Added - Add `ByteSlice` and `ByteSliceValue` functions for new `BYTESLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​7948](https://github.com/open-telemetry/opentelemetry-go/issues/7948)) - Apply attribute value limit to the `KindBytes` attribute type in `go.opentelemetry.io/otel/sdk/log`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Apply attribute value limit to the `BYTESLICE` attribute type in `go.opentelemetry.io/otel/sdk/trace`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/trace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Add `String` method for `Value` type in `go.opentelemetry.io/otel/attribute`. ([#​8142](https://github.com/open-telemetry/opentelemetry-go/issues/8142)) - Add `Slice` and `SliceValue` functions for new `SLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​8166](https://github.com/open-telemetry/opentelemetry-go/issues/8166)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Apply `AttributeValueLengthLimit` to `attribute.SLICE` type attribute values in `go.opentelemetry.io/otel/sdk/trace`, recursively truncating contained string values. ([#​8217](https://github.com/open-telemetry/opentelemetry-go/issues/8217)) - Add `Error` field on `Record` type in `go.opentelemetry.io/otel/log/logtest`. ([#​8148](https://github.com/open-telemetry/opentelemetry-go/issues/8148)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `Settable` to `go.opentelemetry.io/otel/metric/x` to allow reusing attribute options. ([#​8178](https://github.com/open-telemetry/opentelemetry-go/issues/8178)) - Add experimental support for splitting metric data across multiple batches in `go.opentelemetry.io/otel/sdk/metric`. Set `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size>` to enable for all periodic readers. See `go.opentelemetry.io/otel/sdk/metric/internal/x` for feature documentation. ([#​8071](https://github.com/open-telemetry/opentelemetry-go/issues/8071)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x` for feature documentation. ([#​8192](https://github.com/open-telemetry/opentelemetry-go/issues/8192)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x` for feature documentation. ([#​8194](https://github.com/open-telemetry/opentelemetry-go/issues/8194)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/stdout/stdoutlog/internal/x` for feature documentation. ([#​8263](https://github.com/open-telemetry/opentelemetry-go/issues/8263)) - Add `WithDefaultAttributes` to `go.opentelemetry.io/otel/metric/x` to support setting default attributes on instruments. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Add `go.opentelemetry.io/otel/semconv/v1.41.0` package. The package contains semantic conventions from the `v1.41.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.41.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.40.0`. ([#​8324](https://github.com/open-telemetry/opentelemetry-go/issues/8324)) - Add Observable variants of instruments to `go.opentelemetry.io/otel/semconv/v1.41.0` package. ([#​8350](https://github.com/open-telemetry/opentelemetry-go/issues/8350)) - Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#​8002](https://github.com/open-telemetry/opentelemetry-go/issues/8002)) ##### Changed - ⚠️ **Breaking Change:** `go.opentelemetry.io/otel/sdk/metric` now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing `attribute.Bool("otel.metric.overflow", true)`. This can break users who relied on the previous unlimited default. Set `WithCardinalityLimit(0)` or the deprecated `OTEL_GO_X_CARDINALITY_LIMIT=0` environment variable to preserve unlimited cardinality. Note that support for `OTEL_GO_X_CARDINALITY_LIMIT` may be removed in a future release. ([#​8247](https://github.com/open-telemetry/opentelemetry-go/issues/8247)) - `ErrorType` in `go.opentelemetry.io/otel/semconv` now unwraps errors created with `fmt.Errorf` when deriving the `error.type` attribute. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `go.opentelemetry.io/otel/sdk/log` now unwraps error chains created with `fmt.Errorf` when deriving the `error.type` attribute from errors on log records. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `Set.MarshalLog` method in `go.opentelemetry.io/otel/attribute` now uses `Value.String` formatting following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8169](https://github.com/open-telemetry/opentelemetry-go/issues/8169)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir and short-circuit `Offer` calls to the exemplar reservoir when `exemplar.AlwaysOffFilter` is configured. ([#​8211](https://github.com/open-telemetry/opentelemetry-go/issues/8211)) ([#​8267](https://github.com/open-telemetry/opentelemetry-go/issues/8267)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir for asynchronous instruments when `exemplar.TraceBasedFilter` is configured. ([#​8286](https://github.com/open-telemetry/opentelemetry-go/issues/8286)) ##### Deprecated - Deprecate `Value.Emit` method in `go.opentelemetry.io/otel/attribute`. Use `Value.String` instead. ([#​8176](https://github.com/open-telemetry/opentelemetry-go/issues/8176)) ##### Fixed - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8152](https://github.com/open-telemetry/opentelemetry-go/issues/8152)) - `go.opentelemetry.io/otel/exporters/prometheus` now uses `Value.String` formatting for label values following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8170](https://github.com/open-telemetry/opentelemetry-go/issues/8170)) - Propagate errors from the exporter when calling `Shutdown` on `BatchSpanProcessor` in `go.opentelemetry.io/otel/sdk/trace`. ([#​8197](https://github.com/open-telemetry/opentelemetry-go/issues/8197)) - Fix stale status code reporting on self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8226](https://github.com/open-telemetry/opentelemetry-go/issues/8226)) - Fix a concurrent `Collect` data race and potential panic in `go.opentelemetry.io/otel/exporters/prometheus` when `WithResourceAsConstantLabels` option is used. ([#​8227](https://github.com/open-telemetry/opentelemetry-go/issues/8227)) - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting [#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447). ([#​8249](https://github.com/open-telemetry/opentelemetry-go/issues/8249)) - Fix `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` to safely handle zero size. A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in `Offer()` and `Collect()` ensure no-op behavior. ([#​8295](https://github.com/open-telemetry/opentelemetry-go/issues/8295)) - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8254](https://github.com/open-telemetry/opentelemetry-go/issues/8254)) - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. ([#​8264](https://github.com/open-telemetry/opentelemetry-go/issues/8264)) - Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m)) - Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ([#​8222](https://github.com/open-telemetry/opentelemetry-go/issues/8222)) - Fix `go.opentelemetry.io/otel/semconv/v1.41.0` to include `Attr*` helper methods for required attributes on observable instruments. ([#​8361](https://github.com/open-telemetry/opentelemetry-go/issues/8361)) - Limit baggage extraction error reporting in `go.opentelemetry.io/otel/propagation` to prevent malformed or oversized baggage headers from flooding logs. ([GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835)) #### What's Changed - Document how to implement experimental features by [@​dashpole](https://github.com/dashpole) in [#​8124](https://github.com/open-telemetry/opentelemetry-go/pull/8124) - Add support for experimental options in the metrics API by [@​dashpole](https://github.com/dashpole) in [#​8111](https://github.com/open-telemetry/opentelemetry-go/pull/8111) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`e5db982`](https://github.com/open-telemetry/opentelemetry-go/commit/e5db982) by [@​renovate](https://github.com/renovate)\[bot] in [#​8136](https://github.com/open-telemetry/opentelemetry-go/pull/8136) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`32cd848`](https://github.com/open-telemetry/opentelemetry-go/commit/32cd848) by [@​renovate](https://github.com/renovate)\[bot] in [#​8141](https://github.com/open-telemetry/opentelemetry-go/pull/8141) - fix(deps): update googleapis to [`6f92a3b`](https://github.com/open-telemetry/opentelemetry-go/commit/6f92a3b) by [@​renovate](https://github.com/renovate)\[bot] in [#​8140](https://github.com/open-telemetry/opentelemetry-go/pull/8140) - chore(deps): update module github.com/jgautheron/goconst to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8134](https://github.com/open-telemetry/opentelemetry-go/pull/8134) - attribute: add BYTESLICE type support by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7948](https://github.com/open-telemetry/opentelemetry-go/pull/7948) - unwrap error chains created with fmt.Errorf by [@​pellared](https://github.com/pellared) in [#​8133](https://github.com/open-telemetry/opentelemetry-go/pull/8133) - log/logtest: add Error field to Record type by [@​pellared](https://github.com/pellared) in [#​8148](https://github.com/open-telemetry/opentelemetry-go/pull/8148) - attribute: add String method for Value type by [@​pellared](https://github.com/pellared) in [#​8142](https://github.com/open-telemetry/opentelemetry-go/pull/8142) - fix(deps): update module golang.org/x/sys to v0.43.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8156](https://github.com/open-telemetry/opentelemetry-go/pull/8156) - chore(deps): update codspeedhq/action action to v4.13.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8155](https://github.com/open-telemetry/opentelemetry-go/pull/8155) - fix(otlploghttp): replay gzipped bodies on redirect by [@​MrAlias](https://github.com/MrAlias) in [#​8152](https://github.com/open-telemetry/opentelemetry-go/pull/8152) - Improve test coverage for exponential histogram edge cases by [@​dashpole](https://github.com/dashpole) in [#​8129](https://github.com/open-telemetry/opentelemetry-go/pull/8129) - Add example test for the prometheus exporter by [@​dashpole](https://github.com/dashpole) in [#​8137](https://github.com/open-telemetry/opentelemetry-go/pull/8137) - chore(deps): update golang.org/x/telemetry digest to [`93c7c8a`](https://github.com/open-telemetry/opentelemetry-go/commit/93c7c8a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8158](https://github.com/open-telemetry/opentelemetry-go/pull/8158) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by [@​renovate](https://github.com/renovate)\[bot] in [#​8161](https://github.com/open-telemetry/opentelemetry-go/pull/8161) - chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8159](https://github.com/open-telemetry/opentelemetry-go/pull/8159) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`6b4d2bc`](https://github.com/open-telemetry/opentelemetry-go/commit/6b4d2bc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8160](https://github.com/open-telemetry/opentelemetry-go/pull/8160) - Add experimental support for batching in periodic reader by [@​dashpole](https://github.com/dashpole) in [#​8071](https://github.com/open-telemetry/opentelemetry-go/pull/8071) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8165](https://github.com/open-telemetry/opentelemetry-go/pull/8165) - Support `BYTESLICE` attributes across trace and exporter paths by [@​MrAlias](https://github.com/MrAlias) in [#​8153](https://github.com/open-telemetry/opentelemetry-go/pull/8153) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8171](https://github.com/open-telemetry/opentelemetry-go/pull/8171) - fix(deps): update module golang.org/x/tools to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8173](https://github.com/open-telemetry/opentelemetry-go/pull/8173) - metricdatatest: support BYTESLICE attribute comparisons by [@​pellared](https://github.com/pellared) in [#​8167](https://github.com/open-telemetry/opentelemetry-go/pull/8167) - test: add test case for ByteSlice in TestValueFromAttribute by [@​pellared](https://github.com/pellared) in [#​8168](https://github.com/open-telemetry/opentelemetry-go/pull/8168) - attribute: Set.MarshalLog to use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8169](https://github.com/open-telemetry/opentelemetry-go/pull/8169) - prometheus: use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8170](https://github.com/open-telemetry/opentelemetry-go/pull/8170) - fix(deps): update golang.org/x to [`746e56f`](https://github.com/open-telemetry/opentelemetry-go/commit/746e56f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8175](https://github.com/open-telemetry/opentelemetry-go/pull/8175) - Add support for the development attributes advisory parameter by [@​dashpole](https://github.com/dashpole) in [#​8135](https://github.com/open-telemetry/opentelemetry-go/pull/8135) - chore(deps): update actions/upload-artifact action to v7.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8177](https://github.com/open-telemetry/opentelemetry-go/pull/8177) - attribute: deprecate Value.Emit by [@​pellared](https://github.com/pellared) in [#​8176](https://github.com/open-telemetry/opentelemetry-go/pull/8176) - chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8181](https://github.com/open-telemetry/opentelemetry-go/pull/8181) - chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8180](https://github.com/open-telemetry/opentelemetry-go/pull/8180) - chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8182](https://github.com/open-telemetry/opentelemetry-go/pull/8182) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.56.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8184](https://github.com/open-telemetry/opentelemetry-go/pull/8184) - Update semconv template and 1.40.0 to use Enabled for metrics by [@​dashpole](https://github.com/dashpole) in [#​8172](https://github.com/open-telemetry/opentelemetry-go/pull/8172) - Add x.Settable to allow reusing attribute options by [@​dashpole](https://github.com/dashpole) in [#​8178](https://github.com/open-telemetry/opentelemetry-go/pull/8178) - chore(deps): update actions/cache action to v5.0.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8187](https://github.com/open-telemetry/opentelemetry-go/pull/8187) - fix(deps): update googleapis to [`3e5c5a5`](https://github.com/open-telemetry/opentelemetry-go/commit/3e5c5a5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8190](https://github.com/open-telemetry/opentelemetry-go/pull/8190) - fix(otlpmetrichttp): replay gzipped bodies on redirect by [@​pellared](https://github.com/pellared) in [#​8185](https://github.com/open-telemetry/opentelemetry-go/pull/8185) - fix(deps): update module golang.org/x/vuln to v1.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8193](https://github.com/open-telemetry/opentelemetry-go/pull/8193) - fix(deps): update googleapis to [`afd174a`](https://github.com/open-telemetry/opentelemetry-go/commit/afd174a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8195](https://github.com/open-telemetry/opentelemetry-go/pull/8195) - chore(deps): update module github.com/dave/dst to v0.27.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8198](https://github.com/open-telemetry/opentelemetry-go/pull/8198) - Fix exemplar tests in containerized environments by [@​dashpole](https://github.com/dashpole) in [#​8188](https://github.com/open-telemetry/opentelemetry-go/pull/8188) - Update contributing to recommend using Enabled by [@​dashpole](https://github.com/dashpole) in [#​8189](https://github.com/open-telemetry/opentelemetry-go/pull/8189) - otlptracehttp: reset pooled gzip writer before reuse by [@​pellared](https://github.com/pellared) in [#​8196](https://github.com/open-telemetry/opentelemetry-go/pull/8196) - chore(deps): update golang.org/x/telemetry digest to [`fac6e1c`](https://github.com/open-telemetry/opentelemetry-go/commit/fac6e1c) by [@​renovate](https://github.com/renovate)\[bot] in [#​8202](https://github.com/open-telemetry/opentelemetry-go/pull/8202) - fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8207](https://github.com/open-telemetry/opentelemetry-go/pull/8207) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`07c9668`](https://github.com/open-telemetry/opentelemetry-go/commit/07c9668) by [@​renovate](https://github.com/renovate)\[bot] in [#​8206](https://github.com/open-telemetry/opentelemetry-go/pull/8206) - attribute: make TestHashKVs linear-time by [@​pellared](https://github.com/pellared) in [#​8204](https://github.com/open-telemetry/opentelemetry-go/pull/8204) - chore(deps): update github/codeql-action action to v4.35.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8208](https://github.com/open-telemetry/opentelemetry-go/pull/8208) - sdk/trace: propagate SpanExporter.Shutdown error from BatchSpanProcessor by [@​alliasgher](https://github.com/alliasgher) in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - add GitHub Copilot code review instructions by [@​pellared](https://github.com/pellared) in [#​8212](https://github.com/open-telemetry/opentelemetry-go/pull/8212) - chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.29.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8214](https://github.com/open-telemetry/opentelemetry-go/pull/8214) - attribute: add SLICE type support by [@​pellared](https://github.com/pellared) in [#​8166](https://github.com/open-telemetry/opentelemetry-go/pull/8166) - Fix typos found by copilot by [@​dashpole](https://github.com/dashpole) in [#​8221](https://github.com/open-telemetry/opentelemetry-go/pull/8221) - chore(deps): update module github.com/go-git/go-git/v5 to v5.18.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8223](https://github.com/open-telemetry/opentelemetry-go/pull/8223) - docs: add agent guide for autonomous coding agents by [@​pellared](https://github.com/pellared) in [#​8215](https://github.com/open-telemetry/opentelemetry-go/pull/8215) - test: truncate attribute string values using Unicode rune count by [@​pellared](https://github.com/pellared) in [#​8219](https://github.com/open-telemetry/opentelemetry-go/pull/8219) - sdk/trace: apply AttributeValueLengthLimit to attribute.SLICE by [@​pellared](https://github.com/pellared) in [#​8217](https://github.com/open-telemetry/opentelemetry-go/pull/8217) - chore(deps): update module github.com/dlclark/regexp2 to v1.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8229](https://github.com/open-telemetry/opentelemetry-go/pull/8229) - prometheus: fix Collect data race for constant resource labels by [@​pellared](https://github.com/pellared) in [#​8227](https://github.com/open-telemetry/opentelemetry-go/pull/8227) - exporters: support SLICE attributes by [@​pellared](https://github.com/pellared) in [#​8216](https://github.com/open-telemetry/opentelemetry-go/pull/8216) - chore(deps): update codspeedhq/action action to v4.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8234](https://github.com/open-telemetry/opentelemetry-go/pull/8234) - Fix stale status code reporting on self-observability metrics by [@​dashpole](https://github.com/dashpole) in [#​8226](https://github.com/open-telemetry/opentelemetry-go/pull/8226) - fix(deps): update googleapis to [`e10c466`](https://github.com/open-telemetry/opentelemetry-go/commit/e10c466) by [@​renovate](https://github.com/renovate)\[bot] in [#​8241](https://github.com/open-telemetry/opentelemetry-go/pull/8241) - fix(deps): update build-tools to v0.30.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8244](https://github.com/open-telemetry/opentelemetry-go/pull/8244) - \[chore] changelog: re-run workflow on PR title edits by [@​cijothomas](https://github.com/cijothomas) in [#​8246](https://github.com/open-telemetry/opentelemetry-go/pull/8246) - stdlog observ: remove partial success handling by [@​yumosx](https://github.com/yumosx) in [#​8174](https://github.com/open-telemetry/opentelemetry-go/pull/8174) - feat: add self-observability metrics to otlpmetrichttp metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8194](https://github.com/open-telemetry/opentelemetry-go/pull/8194) - chore(deps): update golang.org/x/telemetry digest to [`392afab`](https://github.com/open-telemetry/opentelemetry-go/commit/392afab) by [@​renovate](https://github.com/renovate)\[bot] in [#​8248](https://github.com/open-telemetry/opentelemetry-go/pull/8248) - Use a DropReservoir when an exemplar.AlwaysOffFilter is provided by [@​dashpole](https://github.com/dashpole) in [#​8211](https://github.com/open-telemetry/opentelemetry-go/pull/8211) - metric: clarify sync vs observable Gauge in package godoc by [@​alliasgher](https://github.com/alliasgher) in [#​8225](https://github.com/open-telemetry/opentelemetry-go/pull/8225) - sdk/metric: apply default cardinality limit of 2000 by [@​pellared](https://github.com/pellared) in [#​8247](https://github.com/open-telemetry/opentelemetry-go/pull/8247) - Revert "Optimize fixedsize reservoir ([#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447))" by [@​dashpole](https://github.com/dashpole) in [#​8249](https://github.com/open-telemetry/opentelemetry-go/pull/8249) - fix(deps): update module golang.org/x/vuln to v1.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8256](https://github.com/open-telemetry/opentelemetry-go/pull/8256) - chore(deps): update otel/weaver docker tag to v0.23.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8255](https://github.com/open-telemetry/opentelemetry-go/pull/8255) - Run benchmarks using Settable for more accurate comparrisons by [@​dashpole](https://github.com/dashpole) in [#​8252](https://github.com/open-telemetry/opentelemetry-go/pull/8252) - Add MaxRequestSize option to OTLP exporters by [@​pellared](https://github.com/pellared) in [#​8157](https://github.com/open-telemetry/opentelemetry-go/pull/8157) - fix counting of spans/logs in self-observability metrics in otlp trace and log exporters by [@​dashpole](https://github.com/dashpole) in [#​8254](https://github.com/open-telemetry/opentelemetry-go/pull/8254) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`2f88a58`](https://github.com/open-telemetry/opentelemetry-go/commit/2f88a58) by [@​renovate](https://github.com/renovate)\[bot] in [#​8260](https://github.com/open-telemetry/opentelemetry-go/pull/8260) - chore(deps): update golang.org/x/telemetry digest to [`329d219`](https://github.com/open-telemetry/opentelemetry-go/commit/329d219) by [@​renovate](https://github.com/renovate)\[bot] in [#​8259](https://github.com/open-telemetry/opentelemetry-go/pull/8259) - chore(deps): update module github.com/sourcegraph/go-diff to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8262](https://github.com/open-telemetry/opentelemetry-go/pull/8262) - chore(deps): update module github.com/mattn/go-isatty to v0.0.22 by [@​renovate](https://github.com/renovate)\[bot] in [#​8265](https://github.com/open-telemetry/opentelemetry-go/pull/8265) - chore(deps): update module go.uber.org/zap to v1.28.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8269](https://github.com/open-telemetry/opentelemetry-go/pull/8269) - fix(deps): update googleapis to [`7cedc36`](https://github.com/open-telemetry/opentelemetry-go/commit/7cedc36) by [@​renovate](https://github.com/renovate)\[bot] in [#​8266](https://github.com/open-telemetry/opentelemetry-go/pull/8266) - chore(deps): update module github.com/securego/gosec/v2 to v2.26.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8270](https://github.com/open-telemetry/opentelemetry-go/pull/8270) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.57.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8275](https://github.com/open-telemetry/opentelemetry-go/pull/8275) - chore(deps): update codspeedhq/action action to v4.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8272](https://github.com/open-telemetry/opentelemetry-go/pull/8272) - chore(deps): update golang.org/x/telemetry digest to [`76f71b9`](https://github.com/open-telemetry/opentelemetry-go/commit/76f71b9) by [@​renovate](https://github.com/renovate)\[bot] in [#​8271](https://github.com/open-telemetry/opentelemetry-go/pull/8271) - Apply attribute value limit for BYTESLICE and KindBytes by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7990](https://github.com/open-telemetry/opentelemetry-go/pull/7990) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8277](https://github.com/open-telemetry/opentelemetry-go/pull/8277) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8280](https://github.com/open-telemetry/opentelemetry-go/pull/8280) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8281](https://github.com/open-telemetry/opentelemetry-go/pull/8281) - Prometheus Exporter: Drop Scope attributes name, version and schema\_url by [@​ArthurSens](https://github.com/ArthurSens) in [#​8264](https://github.com/open-telemetry/opentelemetry-go/pull/8264) - attribute: split HashKVs benchmark by value type by [@​pellared](https://github.com/pellared) in [#​8268](https://github.com/open-telemetry/opentelemetry-go/pull/8268) - \[chore] metric: document Enabled and WithAttributeSet in package docs by [@​cijothomas](https://github.com/cijothomas) in [#​8245](https://github.com/open-telemetry/opentelemetry-go/pull/8245) - chore(deps): update module github.com/bombsimon/wsl/v5 to v5.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8287](https://github.com/open-telemetry/opentelemetry-go/pull/8287) - fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8283](https://github.com/open-telemetry/opentelemetry-go/pull/8283) - chore(deps): update module github.com/pjbgf/sha1cd to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8288](https://github.com/open-telemetry/opentelemetry-go/pull/8288) - Optimize metrics sdk measurement with AlwaysOff exemplar filter by [@​dashpole](https://github.com/dashpole) in [#​8267](https://github.com/open-telemetry/opentelemetry-go/pull/8267) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8290](https://github.com/open-telemetry/opentelemetry-go/pull/8290) - chore(deps): update github/codeql-action action to v4.35.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8289](https://github.com/open-telemetry/opentelemetry-go/pull/8289) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6603726`](https://github.com/open-telemetry/opentelemetry-go/commit/6603726) by [@​renovate](https://github.com/renovate)\[bot] in [#​8291](https://github.com/open-telemetry/opentelemetry-go/pull/8291) - chore(deps): update github.com/golangci/rowserrcheck digest to [`8d53bbc`](https://github.com/open-telemetry/opentelemetry-go/commit/8d53bbc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8292](https://github.com/open-telemetry/opentelemetry-go/pull/8292) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8293](https://github.com/open-telemetry/opentelemetry-go/pull/8293) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8294](https://github.com/open-telemetry/opentelemetry-go/pull/8294) - chore(deps): update module github.com/ryancurrah/gomodguard/v2 to v2.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8296](https://github.com/open-telemetry/opentelemetry-go/pull/8296) - fix(deps): update module google.golang.org/grpc to v1.81.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8298](https://github.com/open-telemetry/opentelemetry-go/pull/8298) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8300](https://github.com/open-telemetry/opentelemetry-go/pull/8300) - chore(deps): update module github.com/uudashr/iface to v1.4.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8301](https://github.com/open-telemetry/opentelemetry-go/pull/8301) - fix(deps): update googleapis to [`60b97b3`](https://github.com/open-telemetry/opentelemetry-go/commit/60b97b3) by [@​renovate](https://github.com/renovate)\[bot] in [#​8303](https://github.com/open-telemetry/opentelemetry-go/pull/8303) - chore(deps): update codspeedhq/action action to v4.15.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8307](https://github.com/open-telemetry/opentelemetry-go/pull/8307) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8308](https://github.com/open-telemetry/opentelemetry-go/pull/8308) - chore(deps): update golang.org/x/telemetry digest to [`5a0966d`](https://github.com/open-telemetry/opentelemetry-go/commit/5a0966d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8310](https://github.com/open-telemetry/opentelemetry-go/pull/8310) - chore(deps): update module github.com/ghostiam/protogetter to v0.3.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8311](https://github.com/open-telemetry/opentelemetry-go/pull/8311) - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8312](https://github.com/open-telemetry/opentelemetry-go/pull/8312) - chore(deps): update module github.com/jgautheron/goconst to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8315](https://github.com/open-telemetry/opentelemetry-go/pull/8315) - chore(deps): update github/codeql-action action to v4.35.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8318](https://github.com/open-telemetry/opentelemetry-go/pull/8318) - chore(deps): update golang.org/x/telemetry digest to [`e88f59f`](https://github.com/open-telemetry/opentelemetry-go/commit/e88f59f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8317](https://github.com/open-telemetry/opentelemetry-go/pull/8317) - chore(deps): update module github.com/raeperd/recvcheck to v0.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8314](https://github.com/open-telemetry/opentelemetry-go/pull/8314) - fix(deps): update module golang.org/x/sys to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8322](https://github.com/open-telemetry/opentelemetry-go/pull/8322) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8313](https://github.com/open-telemetry/opentelemetry-go/pull/8313) - chore(deps): update module github.com/abirdcfly/dupword to v0.1.8 by [@​renovate](https://github.com/renovate)\[bot] in [#​8316](https://github.com/open-telemetry/opentelemetry-go/pull/8316) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8323](https://github.com/open-telemetry/opentelemetry-go/pull/8323) - docs: Expand SIG meeting welcoming language by [@​cijothomas](https://github.com/cijothomas) in [#​8319](https://github.com/open-telemetry/opentelemetry-go/pull/8319) - chore(deps): update module mvdan.cc/gofumpt to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8304](https://github.com/open-telemetry/opentelemetry-go/pull/8304) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8325](https://github.com/open-telemetry/opentelemetry-go/pull/8325) - chore(deps): update golang.org/x/telemetry digest to [`42602be`](https://github.com/open-telemetry/opentelemetry-go/commit/42602be) by [@​renovate](https://github.com/renovate)\[bot] in [#​8326](https://github.com/open-telemetry/opentelemetry-go/pull/8326) - Fix benchmark ci by [@​XSAM](https://github.com/XSAM) in [#​8282](https://github.com/open-telemetry/opentelemetry-go/pull/8282) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8327](https://github.com/open-telemetry/opentelemetry-go/pull/8327) - chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8328](https://github.com/open-telemetry/opentelemetry-go/pull/8328) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8329](https://github.com/open-telemetry/opentelemetry-go/pull/8329) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`c840852`](https://github.com/open-telemetry/opentelemetry-go/commit/c840852) by [@​renovate](https://github.com/renovate)\[bot] in [#​8331](https://github.com/open-telemetry/opentelemetry-go/pull/8331) - fix(deps): update googleapis to [`3700d41`](https://github.com/open-telemetry/opentelemetry-go/commit/3700d41) by [@​renovate](https://github.com/renovate)\[bot] in [#​8332](https://github.com/open-telemetry/opentelemetry-go/pull/8332) - fix: clear cached objects to enable GC by [@​ash2k](https://github.com/ash2k) in [#​8233](https://github.com/open-telemetry/opentelemetry-go/pull/8233) - Generate and upgrade to `semconv/v1.41.0` by [@​MrAlias](https://github.com/MrAlias) in [#​8324](https://github.com/open-telemetry/opentelemetry-go/pull/8324) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8345](https://github.com/open-telemetry/opentelemetry-go/pull/8345) - chore: Skip benchmark workflow when only non-Go files change by [@​cijothomas](https://github.com/cijothomas) in [#​8346](https://github.com/open-telemetry/opentelemetry-go/pull/8346) - chore(deps): update github/codeql-action action to v4.35.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8341](https://github.com/open-telemetry/opentelemetry-go/pull/8341) - Add max baggage length as limitation by [@​XSAM](https://github.com/XSAM) in [#​8222](https://github.com/open-telemetry/opentelemetry-go/pull/8222) - Generating histogram boundaries from weaver.yaml by [@​itssaharsh](https://github.com/itssaharsh) in [#​8015](https://github.com/open-telemetry/opentelemetry-go/pull/8015) - chore(deps): update codecov/codecov-action action to v6.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8342](https://github.com/open-telemetry/opentelemetry-go/pull/8342) - chore(deps): update module github.com/kisielk/errcheck to v1.20.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8333](https://github.com/open-telemetry/opentelemetry-go/pull/8333) - Add observable instrument variants to semconv v1.41.0 by [@​dashpole](https://github.com/dashpole) in [#​8350](https://github.com/open-telemetry/opentelemetry-go/pull/8350) - fix(semconv): clear pooled slices to enable GC by [@​pellared](https://github.com/pellared) in [#​8352](https://github.com/open-telemetry/opentelemetry-go/pull/8352) - chore(deps): update actions/stale action to v10.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8355](https://github.com/open-telemetry/opentelemetry-go/pull/8355) - chore(deps): update module github.com/uudashr/iface to v1.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8335](https://github.com/open-telemetry/opentelemetry-go/pull/8335) - fix(deps): update module google.golang.org/grpc to v1.81.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8340](https://github.com/open-telemetry/opentelemetry-go/pull/8340) - chore(deps): update module 4d63.com/gocheckcompilerdirectives to v1.4.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8334](https://github.com/open-telemetry/opentelemetry-go/pull/8334) - chore(deps): update golang.org/x/telemetry digest to [`eab6ae5`](https://github.com/open-telemetry/opentelemetry-go/commit/eab6ae5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8348](https://github.com/open-telemetry/opentelemetry-go/pull/8348) - fix(deps): update googleapis to [`aa98bba`](https://github.com/open-telemetry/opentelemetry-go/commit/aa98bba) by [@​renovate](https://github.com/renovate)\[bot] in [#​8344](https://github.com/open-telemetry/opentelemetry-go/pull/8344) - Fix semconv generation to include Attr helpers for required attributes on observable instruments by [@​dashpole](https://github.com/dashpole) in [#​8361](https://github.com/open-telemetry/opentelemetry-go/pull/8361) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8363](https://github.com/open-telemetry/opentelemetry-go/pull/8363) - chore(deps): update module github.com/antonboom/nilnil to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8360](https://github.com/open-telemetry/opentelemetry-go/pull/8360) - chore(deps): update module github.com/antonboom/errname to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8359](https://github.com/open-telemetry/opentelemetry-go/pull/8359) - chore(deps): update module github.com/uudashr/iface to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8362](https://github.com/open-telemetry/opentelemetry-go/pull/8362) - Fix Extrema failure test by [@​mujib77](https://github.com/mujib77) in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - Fix receiver-naming issues from revive by [@​mmorel-35](https://github.com/mmorel-35) in [#​8093](https://github.com/open-telemetry/opentelemetry-go/pull/8093) - docs: clarify that View attribute filters do not apply to Exemplars by [@​Dipanshusinghh](https://github.com/Dipanshusinghh) in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - Disable exemplar reservoir for asynchronous instruments by default by [@​dashpole](https://github.com/dashpole) in [#​8286](https://github.com/open-telemetry/opentelemetry-go/pull/8286) - fix: handle FixedSizeReservoir size=0 without panic by [@​muskiteer](https://github.com/muskiteer) in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.59.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8373](https://github.com/open-telemetry/opentelemetry-go/pull/8373) - chore(deps): update github/codeql-action action to v4.36.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8367](https://github.com/open-telemetry/opentelemetry-go/pull/8367) - chore(deps): update module github.com/clickhouse/clickhouse-go-linter to v1.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8366](https://github.com/open-telemetry/opentelemetry-go/pull/8366) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`948f455`](https://github.com/open-telemetry/opentelemetry-go/commit/948f455) by [@​renovate](https://github.com/renovate)\[bot] in [#​8374](https://github.com/open-telemetry/opentelemetry-go/pull/8374) - fix(deps): update googleapis to [`0a33c5d`](https://github.com/open-telemetry/opentelemetry-go/commit/0a33c5d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8369](https://github.com/open-telemetry/opentelemetry-go/pull/8369) - add self observability for stdout exporter by [@​yumosx](https://github.com/yumosx) in [#​8263](https://github.com/open-telemetry/opentelemetry-go/pull/8263) - sdk/metric: document unit-sensitivity of DefaultAggregationSelector by [@​alliasgher](https://github.com/alliasgher) in [#​8224](https://github.com/open-telemetry/opentelemetry-go/pull/8224) - semconvkit: add invariant test for histogram-exclusion rule by [@​thealpha93](https://github.com/thealpha93) in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) - exporters/otlp: default max request size to 64 MiB by [@​pellared](https://github.com/pellared) in [#​8365](https://github.com/open-telemetry/opentelemetry-go/pull/8365) - fix(deps): update googleapis to [`3dc84a4`](https://github.com/open-telemetry/opentelemetry-go/commit/3dc84a4) by [@​renovate](https://github.com/renovate)\[bot] in [#​8375](https://github.com/open-telemetry/opentelemetry-go/pull/8375) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8377](https://github.com/open-telemetry/opentelemetry-go/pull/8377) - feat: add self-observability metrics to otlpmetricgrpc metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8192](https://github.com/open-telemetry/opentelemetry-go/pull/8192) - chore(deps): update golang.org/x/telemetry digest to [`5997936`](https://github.com/open-telemetry/opentelemetry-go/commit/5997936) by [@​renovate](https://github.com/renovate)\[bot] in [#​8379](https://github.com/open-telemetry/opentelemetry-go/pull/8379) - Release 1.44.0 by [@​pellared](https://github.com/pellared) in [#​8376](https://github.com/open-telemetry/opentelemetry-go/pull/8376) #### New Contributors - [@​alliasgher](https://github.com/alliasgher) made their first contribution in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - [@​mujib77](https://github.com/mujib77) made their first contribution in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - [@​Dipanshusinghh](https://github.com/Dipanshusinghh) made their first contribution in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - [@​muskiteer](https://github.com/muskiteer) made their first contribution in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - [@​thealpha93](https://github.com/thealpha93) made their first contribution in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1115 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
3c5ef1721a |
fix(deps): update module golang.org/x/net to v0.56.0 [security] (#1116)
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.56.0) |  |  |
---
### Go Net HTML parser is vulnerable to denial of service
[CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GHSA-5cv4-jp36-h3mw](https://github.com/advisories/GHSA-5cv4-jp36-h3mw) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028)
<details>
<summary>More information</summary>
#### Details
In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680)
- [https://go.dev/cl/781702](https://go.dev/cl/781702)
- [https://go.dev/issue/79573](https://go.dev/issue/79573)
- [
|
||
|
Renovate Bot
|
46f22c78d2 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.23 (#1097)
Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
068afc3996 |
fix(deps): update module github.com/docker/cli to v29.6.2+incompatible (#1096)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.1+incompatible` → `v29.6.2+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.2+incompatible`](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) [Compare Source](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1096 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
ad967330a8 |
fix(deps): update module golang.org/x/text to v0.40.0 (#1091)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.37.0` → `v0.40.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.37.0...refs/tags/v0.40.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1091 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
bircni
|
60177008a5 |
fix: ignore blank lines and decode UTF-16 in the runner env files (#1084)
Fixes #496 Fixes #552 Reviewed-on: https://gitea.com/gitea/runner/pulls/1084 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
Renovate Bot
|
554b3b7671 |
fix(deps): update module golang.org/x/term to v0.45.0 (#1081)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.44.0` → `v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1081 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
b12d02c25f |
fix(deps): update module golang.org/x/sys to v0.47.0 (#1073)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | [`v0.46.0` → `v0.47.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.46.0...refs/tags/v0.47.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1073 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
eba33e178d |
fix(deps): update module github.com/docker/cli to v29.6.1+incompatible (#1060)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.0+incompatible` → `v29.6.1+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.1+incompatible`](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) [Compare Source](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1060 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
4e7fd1c68a |
fix(deps): update module github.com/moby/moby/client to v0.5.0 (#1049)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/moby/moby/client](https://github.com/moby/moby) | `v0.4.1` → `v0.5.0` |  |  | --- ### Release Notes <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.5.0`](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) [Compare Source](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1049 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
bd41a367fe |
fix(deps): update module github.com/docker/cli to v29.6.0+incompatible (#1045)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.5.3+incompatible` → `v29.6.0+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.0+incompatible`](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) [Compare Source](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1045 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
d3b3519dea |
fix(deps): update module go.etcd.io/bbolt to v1.5.0 (#1040)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) | `v1.4.3` → `v1.5.0` |  |  | --- ### Release Notes <details> <summary>etcd-io/bbolt (go.etcd.io/bbolt)</summary> ### [`v1.5.0`](https://github.com/etcd-io/bbolt/releases/tag/v1.5.0): v0.5.0 [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.4.3...v1.5.0) See the [CHANGELOG/v1.5.0](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.5.md#v1502026-06-21) for more details. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1040 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
007717956a |
feat: Add optional runner.post_task_script hook after task cleanup (#1026)
- Adds `runner.post_task_script` and `runner.post_task_script_timeout` (default `5m`) to run a host executable after each task’s built-in cleanup (post-steps, container teardown, bind-workdir removal). - Stops task heartbeats via `Reporter.StopHeartbeats()` while the script runs so Gitea won’t assign overlapping work; the final task acknowledgement still happens in `reporter.Close()`. - Script output goes to the runner process log; non-zero exits are warned only and do not change the job result. - Documents lifecycle, offline behavior, timeouts, and Windows limits (`.ps1` not supported yet) in `docs/post-task-script.md`. Reviewed-on: https://gitea.com/gitea/runner/pulls/1026 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> |
||
|
Renovate Bot
|
56979e6ab8 |
fix(deps): update module golang.org/x/term to v0.44.0 (#1031)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1031 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
740a3d4db4 |
chore(deps): update golang.org/x/crypto to v0.52.0 (#1027)
Updates `golang.org/x/crypto` from `v0.50.0` to `v0.52.0` (and `golang.org/x/net` from `v0.53.0` to `v0.54.0` as a transitive bump). ## Why `make security-check` (govulncheck) reported **7 vulnerabilities**, all in `golang.org/x/crypto/ssh` at `v0.50.0`, reachable through the git action cache fetch path (`act/runner/action_cache.go` → `git.Remote.FetchContext`): | ID | Issue | | --- | --- | | GO-2026-5013 | Byte arithmetic underflow/panic in `ssh` | | GO-2026-5015 | Server panic during `CheckHostKey`/`Authenticate` | | GO-2026-5017 | Client can cause server deadlock on unexpected responses | | GO-2026-5018 | Pathological RSA/DSA parameters may cause DoS | | GO-2026-5019 | Bypass of FIDO/U2F physical interaction | | GO-2026-5020 | Infinite loop on large channel writes | | GO-2026-5021 | Auth bypass via unenforced `@revoked` status in `knownhosts` | All are fixed in `v0.52.0`. Reviewed-on: https://gitea.com/gitea/runner/pulls/1027 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> |
||
|
Nicolas
|
822af5029f |
feat: complete runner-side cancellation handling (#1016)
Completes the runner side of the cancellation flow, superseding #825. Two parts: ### 1. Report cancellations correctly (`fix`) When `Reporter.Close` ran with the state still `UNSPECIFIED` and the reporter's context had been cancelled, the synthesised final state attributed the job to `RESULT_FAILURE` with an "Early termination" log row — misreporting a cancellation as a generic failure. `Close` now detects the cancelled context and finalizes the task as `RESULT_CANCELLED`. ### 2. Advertise the `cancelling` capability (`feat`) [actions-proto-go v0.6.0](https://gitea.com/gitea/actions-proto-go) adds a `capabilities` field to `RegisterRequest`/`DeclareRequest`, so the runner can now tell the server it understands the transitional cancelling state: - Bumps `gitea.dev/actions-proto-go` to `v0.6.0`. - Adds a single `RunnerCapabilities()` source of truth exposing `CapabilityCancelling`. - Sends `Capabilities` on both register and declare. With this the server records `HasCancellingSupport` and can rely on the runner running post-step cleanup before a task is finalized as `RESULT_CANCELLED`. ## Compatibility Wire-compatible against older servers: the new field uses a previously unused field number (8 on `RegisterRequest`, 3 on `DeclareRequest`) and the client uses the binary protobuf codec, so a server predating the field silently ignores it — registration and declaration succeed and the feature simply stays off. It activates only once both runner and server are on v0.6.0. ## Server side The matching Gitea change (read `GetCapabilities()`, persist `HasCancellingSupport`) is a separate PR against `gitea/gitea`. Supersedes #825. Reviewed-on: https://gitea.com/gitea/runner/pulls/1016 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Reviewed-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com> |
||
|
Renovate Bot
|
e583b0706b |
fix(deps): update module golang.org/x/sys to v0.46.0 (#1019)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1019 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
8ad84cd96a |
fix(deps): update module github.com/docker/cli to v29.5.3+incompatible (#1018)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1018 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
443b0e336c |
fix(deps): update module github.com/opencontainers/selinux to v1.15.1 (#1017)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.15.0` → `v1.15.1` |  |  | --- ### Release Notes <details> <summary>opencontainers/selinux (github.com/opencontainers/selinux)</summary> ### [`v1.15.1`](https://github.com/opencontainers/selinux/releases/tag/v1.15.1) [Compare Source](https://github.com/opencontainers/selinux/compare/v1.15.0...v1.15.1) #### What's Changed - ReserveLabelV2: ignore labels without MCS by [@​kolyshkin](https://github.com/kolyshkin) in [#​272](https://github.com/opencontainers/selinux/pull/272) **Full Changelog**: <https://github.com/opencontainers/selinux/compare/v1.15.0...v1.15.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Nicolas <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1017 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
ff7d9ca8d0 |
fix(deps): update module golang.org/x/sys to v0.45.0 (#1012)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1012 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
984b47c716 |
fix(deps): update module code.gitea.io/actions-proto-go to gitea.dev/actions-proto-go v0.5.0 (#1009)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | code.gitea.io/actions-proto-go | `v0.4.1` → `v0.5.0` |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Nicolas <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1009 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
c749e52bb7 |
fix(cleanup): kill Windows step process tree on cancel to avoid hang (#1011)
## Problem Cancelling a job on a Windows host runner can leave the spawned process tree running and hang the runner. When a step launches a shell that starts a child which in turn spawns further GUI/background processes, cancelling the job kills only the direct child (the default `exec.CommandContext` behaviour). The surviving descendants inherited the step's stdout/stderr pipe, so the read end never hit EOF and `cmd.Wait()` blocked forever. Because the step executor never returned: - the orphaned processes kept running (the cancelled work was not actually stopped), and - end-of-job cleanup (`Remove` → `terminateRunningProcesses`) was never reached, so the runner appeared to go offline / stop picking up jobs. `CREATE_NEW_PROCESS_GROUP` does not help here — it affects Ctrl-C signal delivery, not handle inheritance or tree termination. ## Fix - Assign each Windows step process to a **Job Object** immediately after `cmd.Start()`. Descendants created afterwards are automatically part of the job. - Override `cmd.Cancel` to `TerminateJobObject`, so cancellation kills the **entire descendant tree** atomically. This also closes the inherited pipe handles, so `cmd.Wait()` can return. - Set `cmd.WaitDelay` (10s) as a safety net: once the process has exited, Wait force-closes the pipes and returns rather than blocking forever — covering the case where the job-object setup fails (e.g. nested-job restrictions), in which we fall back to the previous single-process kill. - The Job Object is created **without** `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`, so closing the handle on normal completion does not kill legitimate background processes; the tree is only torn down on explicit cancel. Implemented behind `runtime.GOOS == "windows"` with a Windows-only `processKiller` (Job Object) and no-op stubs elsewhere, so non-Windows behaviour (default cancellation + `Setpgid`) is unchanged. ## Changes - `act/container/process_windows.go` — Job Object `processKiller` (create / assign / terminate). - `act/container/process_other.go` — no-op stubs (`//go:build !windows`). - `act/container/host_environment.go` — wire `cmd.Cancel` (tree kill) and `cmd.WaitDelay` into `exec()`. - `go.mod` / `go.sum` — promote `golang.org/x/sys` to a direct dependency. ## Testing I fully tested it already ## Notes Follow-up to the Windows leftover-process reaping in #996: that sweep now actually runs on cancellation because the step no longer hangs before reaching it. Reviewed-on: https://gitea.com/gitea/runner/pulls/1011 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> |
||
|
Renovate Bot
|
47ee45412a |
fix(deps): update module github.com/opencontainers/selinux to v1.15.0 (#990)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.14.1` → `v1.15.0` |  |  | --- ### Release Notes <details> <summary>opencontainers/selinux (github.com/opencontainers/selinux)</summary> ### [`v1.15.0`](https://github.com/opencontainers/selinux/releases/tag/v1.15.0) [Compare Source](https://github.com/opencontainers/selinux/compare/v1.14.1...v1.15.0) This release adds a new function, SetProcessKind, which is to be used instead of KVMProcessLabel\[s] and InitProcessLabel\[s] in case the user only wants to change the type of the existing label, not generate a new one. It also fixes an CI issue and optimizes label.InitLabels for a few common cases. #### What's Changed - ci: set timeout for vm jobs by [@​kolyshkin](https://github.com/kolyshkin) in [#​270](https://github.com/opencontainers/selinux/pull/270) - label.InitLabels: optimize by [@​kolyshkin](https://github.com/kolyshkin) in [#​269](https://github.com/opencontainers/selinux/pull/269) - Add SetProcessKind by [@​kolyshkin](https://github.com/kolyshkin) in [#​271](https://github.com/opencontainers/selinux/pull/271) **Full Changelog**: <https://github.com/opencontainers/selinux/compare/v1.14.1...v1.15.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/990 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
7b5ebe9618 |
fix(deps): update module connectrpc.com/connect to v1.20.0 (#985)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.19.2` → `v1.20.0` |  |  | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.20.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.20.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0) #### What's Changed ##### Other changes - Bump minimum supported Go version to 1.25 by [@​jonbodner-buf](https://github.com/jonbodner-buf) in [#​922](https://github.com/connectrpc/connect-go/issues/922) - Update Unary-Get query parameter order to match spec recommendation by [@​oliversun9](https://github.com/oliversun9) in [#​926](https://github.com/connectrpc/connect-go/issues/926) #### New Contributors - [@​jonbodner-buf](https://github.com/jonbodner-buf) made their first contribution in [#​922](https://github.com/connectrpc/connect-go/issues/922) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Ni4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/985 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Nicolas
|
4317662a38 |
update docker cli to v29.5.2 (#984)
Fixes #981 Reviewed-on: https://gitea.com/gitea/runner/pulls/984 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-committed-by: Nicolas <bircni@icloud.com> |
||
|
Renovate Bot
|
10475db58a |
fix(deps): update module github.com/docker/cli to v29.5.1+incompatible (#979)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.5.0+incompatible` → `v29.5.1+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.5.1+incompatible`](https://github.com/docker/cli/compare/v29.5.0...v29.5.1) [Compare Source](https://github.com/docker/cli/compare/v29.5.0...v29.5.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/979 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
9e738c203c |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 (#980)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.19.0` → `v5.19.1` |  |  | --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.19.1`](https://github.com/go-git/go-git/releases/tag/v5.19.1) [Compare Source](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1) #### What's Changed - v5: plumbing: transport/ssh, Shell-quote path by [@​hiddeco](https://github.com/hiddeco) in [#​2068](https://github.com/go-git/go-git/pull/2068) - v5: git: submodule, Fix relative URL resolution by [@​hiddeco](https://github.com/hiddeco) in [#​2070](https://github.com/go-git/go-git/pull/2070) - v5: git: submodule, canonical remote for relative URLs by [@​hiddeco](https://github.com/hiddeco) in [#​2074](https://github.com/go-git/go-git/pull/2074) - v5: git: submodule, error on remote without URLs by [@​hiddeco](https://github.com/hiddeco) in [#​2078](https://github.com/go-git/go-git/pull/2078) - v5: plumbing: format/idxfile, Validate offset64 indices by [@​hiddeco](https://github.com/hiddeco) in [#​2084](https://github.com/go-git/go-git/pull/2084) - v5: \*: Reject malformed variable-length integers by [@​hiddeco](https://github.com/hiddeco) in [#​2092](https://github.com/go-git/go-git/pull/2092) - v5: plumbing: format/packfile, Tighten delta validation by [@​hiddeco](https://github.com/hiddeco) in [#​2091](https://github.com/go-git/go-git/pull/2091) - v5: Add `worktreeFilesystem` wrapper for worktree and hardening by [@​hiddeco](https://github.com/hiddeco) in [#​2100](https://github.com/go-git/go-git/pull/2100) - v5: config: validate submodule names by [@​hiddeco](https://github.com/hiddeco) in [#​2082](https://github.com/go-git/go-git/pull/2082) - build: Update module github.com/go-git/go-git/v5 to v5.19.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2111](https://github.com/go-git/go-git/pull/2111) - v5: git: Allow MkdirAll on worktree-root paths by [@​hiddeco](https://github.com/hiddeco) in [#​2117](https://github.com/go-git/go-git/pull/2117) - v5: git: Stop validating symlink target paths by [@​pjbgf](https://github.com/pjbgf) in [#​2116](https://github.com/go-git/go-git/pull/2116) - v5: plumbing: format decoder input bounds and contracts by [@​hiddeco](https://github.com/hiddeco) in [#​2125](https://github.com/go-git/go-git/pull/2125) - plumbing: format/packfile, cap delta chain depth in parser by [@​pjbgf](https://github.com/pjbgf) in [#​2137](https://github.com/go-git/go-git/pull/2137) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/980 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
8d7cf48a6f |
fix(deps): update module github.com/docker/cli to v29.5.0+incompatible (#969)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.4.3+incompatible` → `v29.5.0+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.5.0+incompatible`](https://github.com/docker/cli/compare/v29.4.3...v29.5.0) [Compare Source](https://github.com/docker/cli/compare/v29.4.3...v29.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/969 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
silverwind
|
dda5841af8 |
chore(deps): bump retry-go, golangci-lint, govulncheck (#965)
Bumps `github.com/avast/retry-go` v4.7.0 -> v5.0.0, `golangci-lint` v2.11.4 -> v2.12.2 (aligns with gitea/gitea), and pins `govulncheck` to v1.3.0. - `retry-go` v5 replaces the package-level `retry.Do(fn, opts...)` with a builder API `retry.New(opts...).Do(fn)`. The single call site in `internal/pkg/report/reporter.go` was migrated. - `golangci-lint` v2.12.2 surfaces three new findings in `act/` (modernize/slicesbackward, govet/inline): one backward loop now uses `slices.Backward`, and the deprecated `reflect.Ptr` alias is replaced with `reflect.Pointer`. - `go.mod`: the two direct-`require` blocks are merged into one, and a stray `gopkg.in/yaml.v3 // indirect` is moved into the indirect block. Purely cosmetic; `go.sum` is unchanged. --- This PR was written with the help of Claude Opus 4.7 Reviewed-on: https://gitea.com/gitea/runner/pulls/965 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-committed-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
32bed52686 |
fix(deps): bump docker deps, switch to moby/moby (#943)
Fixes: https://gitea.com/gitea/runner/issues/859 Migration approach mirrors [actions-oss/act-cli#154](https://github.com/actions-oss/act-cli/pull/154). ### Dependency changes - `github.com/docker/docker` v25.0.15 → **removed** (v29 doesn't exist as docker/docker; the project moved to moby/moby) - `github.com/docker/cli` v25.0.7 → v29.4.3 - `github.com/docker/go-connections` v0.6.0 → v0.7.0 - `github.com/docker/docker-credential-helpers` v0.9.5 → v0.9.6 - `github.com/moby/go-archive` added at v0.2.0 - `github.com/moby/moby/api` added at v1.54.2 - `github.com/moby/moby/client` added at v0.4.1 - `github.com/moby/buildkit` removed (only used `dockerignore.ReadAll`, swapped for `moby/patternmatcher/ignorefile.ReadAll` directly) - `github.com/containerd/errdefs` v0.3.0 → v1.0.0 ### Migration - v28: type aliases moved to their subpackages (`types.{Container,Image,Network,Exec}*` → `container/image/network/...`); deprecated APIs replaced (`ImageInspectWithRaw`, `client.IsErrNotFound`, `archive.CanonicalTarNameForPath`, `opts.ValidateMACAddress`, `ListOpts.GetAll`) - v29: structural client redesign — every `cli.X(ctx, ...)` call switched to options-everywhere/Result-typed signatures, `ContainerExec*` → `Exec*`, `ContainerWait` returns a struct with `Result`/`Error` channels, `Tty`→`TTY`, `Copy*Container` takes options struct, `client.NewClientWithOpts` → `client.New`. `pkg/stdcopy` moved to `moby/moby/api/pkg/stdcopy`. The vendored copy of `cli/command/container/opts.go` was refreshed from cli v29 (now uses `netip.Addr` for IPs, port-set conversion helpers). A small local `parsePlatform` helper centralises the `os/arch[/variant]` parsing previously inlined into multiple call sites. ### Behaviour preservation The migration introduced several behavioural shifts vs the v25 client; all were caught in review and reverted/fixed in follow-up commits: - `GetDockerClient`: cli v29's `Ping(NegotiateAPIVersion: true)` returns errors that the old `NegotiateAPIVersion` silently swallowed. Restored best-effort behaviour (warn-log + continue) so daemons with blocked `_ping` or API < 1.40 keep working. The SSH-helper `client.New` call no longer inherits `client.FromEnv`, matching the old `NewClientWithOpts(WithHost, WithDialContext)` so `DOCKER_API_VERSION`/`DOCKER_TLS_VERIFY` don't leak into the SSH-tunneled client - `parsePlatform`: malformed input now returns an explicit error instead of silently dropping to "no platform constraint" and pulling the host-default architecture. Single-segment (`"linux"`), 4+-segment (`"linux/arm/v7/extra"`), and trailing-slash (`"linux/arm/"`) inputs are all rejected - `LoadDockerAuthConfig`/`LoadDockerAuthConfigs`: `config.LoadDefaultConfigFile(nil)` panics on a malformed config file (it does `fmt.Fprintln` on the nil `io.Writer`). Switched to `config.Load(config.Dir())` so load errors reach the logger and the panic path is gone. Restored the old behaviour of returning `config.Load` and `GetAuthConfig` errors to the caller (the v29 refactor had silently downgraded them to warn-only). A `reference.ParseNormalizedNamed` failure on the image string falls through to the `docker.io` default rather than aborting, since the old string-based hostname extraction was infallible Test assertions also updated for two upstream error-message string shifts (`go-connections` port-range parser; `cli/opts` envfile BOM check). Added unit-test coverage for the new `parsePlatform` helper, locking in the intentional limits (single-segment, 4+-segment, and trailing-slash platforms rejected). --- This PR was written with the help of Claude Opus 4.7 Reviewed-on: https://gitea.com/gitea/runner/pulls/943 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-committed-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
a1f13cb970 |
fix(deps): update module github.com/opencontainers/selinux to v1.14.1 (#955)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.14.0` → `v1.14.1` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://gitea.com/gitea/runner/pulls/955 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
silverwind
|
1e3ab0c40a |
fix(deps): update mergo to v1.0.2 (now dario.cat/mergo) (#954)
At v1.0.0 the `github.com/imdario/mergo` module was relocated to `dario.cat/mergo`, so a plain version bump (as in https://gitea.com/gitea/runner/pulls/951) leaves the import path pointing at the old, unmaintained location. This PR updates the import in `act/container/docker_run.go` and adjusts `go.mod` accordingly. The public API (`mergo.Merge`, `mergo.WithOverride`, `mergo.WithAppendSlice`) is unchanged. Supersedes https://gitea.com/gitea/runner/pulls/951. --- This PR was written with the help of Claude Opus 4.7 Reviewed-on: https://gitea.com/gitea/runner/pulls/954 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-committed-by: silverwind <me@silverwind.io> |
||
|
Renovate Bot
|
8088df52b9 |
fix(deps): update module golang.org/x/term to v0.43.0 (#948)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.42.0` → `v0.43.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.42.0...refs/tags/v0.43.0) |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE2OS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/948 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
dff63b3ecc |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.0 (#934)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.18.0` → `v5.19.0` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/934 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
a5d9fe9651 |
fix(deps): update module github.com/opencontainers/selinux to v1.14.0 (#928)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.13.1` → `v1.14.0` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjMuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE2My4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/928 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
d1434237c2 |
fix(deps): update module golang.org/x/term to v0.42.0 (#920)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.41.0` → `v0.42.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.41.0...refs/tags/v0.42.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [x] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/920 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
1d6e7879c8 |
fix(deps): update module github.com/rhysd/actionlint to v1.7.12 (#873)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.7.11` → `v1.7.12` |  |  | --- ### Release Notes <details> <summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary> ### [`v1.7.12`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v1712---2026-03-30) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.11...v1.7.12) - Support the [`timezone` configuration in `on.schedule`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onschedule) with checks for IANA timezone string. See the [documentation](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-cron-syntax-and-timezone) for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. ([#​641](https://github.com/rhysd/actionlint/issues/641), thanks [@​martincostello](https://github.com/martincostello)) ```yaml on: schedule: # ERROR: The timezone is not a valid IANA timezone string - cron: '*/5 * * * *' timezone: 'Asia/Somewhere' ``` - Support the [`jobs.<job_name>.environment.deployment` configuration](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments). ([#​639](https://github.com/rhysd/actionlint/issues/639), thanks [@​springmeyer](https://github.com/springmeyer)) - Support the [`macos-26-intel` runner label](https://github.blog/changelog/2026-02-26-macos-26-is-now-generally-available-for-github-hosted-runners/). ([#​629](https://github.com/rhysd/actionlint/issues/629), thanks [@​hugovk](https://github.com/hugovk)) - Fix the [table of webhook activity types](https://github.com/rhysd/actionlint/blob/main/all_webhooks.go) are outdated by rebuilding the [script to scrape the table](https://github.com/rhysd/actionlint/tree/main/scripts/generate-webhook-events) from scratch. - Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26. - Tests are run on arm64 Windows in CI. - Update the popular actions data set to the latest. \[Changes]\[v1.7.12] <a id="v1.7.11"></a> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE1MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/873 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
35834bf817 |
fix(deps): update module github.com/moby/patternmatcher to v0.6.1 (#868)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/moby/patternmatcher](https://github.com/moby/patternmatcher) | `v0.6.0` → `v0.6.1` |  |  | --- ### Release Notes <details> <summary>moby/patternmatcher (github.com/moby/patternmatcher)</summary> ### [`v0.6.1`](https://github.com/moby/patternmatcher/releases/tag/v0.6.1) [Compare Source](https://github.com/moby/patternmatcher/compare/v0.6.0...v0.6.1) #### What's Changed - fix panic / nil pointer dereference on invalid patterns [#​9](https://github.com/moby/patternmatcher/pull/9) - ci: update actions and test against "oldest", "oldstable" and "stable" [#​8](https://github.com/moby/patternmatcher/pull/8) **Full Changelog**: <https://github.com/moby/patternmatcher/compare/v0.6.0...v0.6.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE0NS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/868 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
11a5dc8936 |
fix(deps): update module github.com/docker/docker to v25.0.15+incompatible (#867)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v25.0.14+incompatible` → `v25.0.15+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/docker (github.com/docker/docker)</summary> ### [`v25.0.15+incompatible`](https://github.com/docker/docker/compare/v25.0.14...v25.0.15) [Compare Source](https://github.com/docker/docker/compare/v25.0.14...v25.0.15) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE0NS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/867 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
3f05040438 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.22 (#863)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) | `v0.0.20` → `v0.0.22` |  |  | --- ### Release Notes <details> <summary>mattn/go-isatty (github.com/mattn/go-isatty)</summary> ### [`v0.0.22`](https://github.com/mattn/go-isatty/compare/v0.0.21...v0.0.22) [Compare Source](https://github.com/mattn/go-isatty/compare/v0.0.21...v0.0.22) ### [`v0.0.21`](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21) [Compare Source](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/863 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
59d90bff26 |
fix(deps): update module github.com/docker/docker to v25.0.14+incompatible (#862)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v25.0.13+incompatible` → `v25.0.14+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/docker (github.com/docker/docker)</summary> ### [`v25.0.14+incompatible`](https://github.com/docker/docker/compare/v25.0.13...v25.0.14) [Compare Source](https://github.com/docker/docker/compare/v25.0.13...v25.0.14) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/862 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
silverwind
|
bad4239d18 |
chore(deps): drop unused distribution/reference replace directive (#858)
The `replace github.com/distribution/reference v0.6.0 => v0.5.0` was added defensively in [ |
||
|
Renovate Bot
|
589db33e70 |
fix(deps): update module github.com/docker/cli to v25.0.7+incompatible (#855)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v25.0.3+incompatible` → `v25.0.7+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v25.0.7+incompatible`](https://github.com/docker/cli/compare/v25.0.6...v25.0.7) [Compare Source](https://github.com/docker/cli/compare/v25.0.6...v25.0.7) ### [`v25.0.6+incompatible`](https://github.com/docker/cli/compare/v25.0.5...v25.0.6) [Compare Source](https://github.com/docker/cli/compare/v25.0.5...v25.0.6) ### [`v25.0.5+incompatible`](https://github.com/docker/cli/compare/v25.0.4...v25.0.5) [Compare Source](https://github.com/docker/cli/compare/v25.0.4...v25.0.5) ### [`v25.0.4+incompatible`](https://github.com/docker/cli/compare/v25.0.3...v25.0.4) [Compare Source](https://github.com/docker/cli/compare/v25.0.3...v25.0.4) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/855 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
|
Renovate Bot
|
1032f857a1 |
fix(deps): update module connectrpc.com/connect to v1.19.2 (#854)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.19.1` → `v1.19.2` |  |  | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.19.2`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.2) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.1...v1.19.2) #### What's Changed ##### Governance - Add [@​timostamm](https://github.com/timostamm) as a maintainer in [#​905](https://github.com/connectrpc/connect-go/pull/905) 🎉 ##### Bugfixes - Use 'deadline\_exceeded' instead of 'canceled' on HTTP/2 cancelation when appropriate by [@​jhump](https://github.com/jhump) in [#​904](https://github.com/connectrpc/connect-go/pull/904) - Fix nil pointer deref in duplexHTTPCall under concurrent Send + CloseAndReceive by [@​simonferquel](https://github.com/simonferquel) in [#​919](https://github.com/connectrpc/connect-go/pull/919) ##### Other changes - Refactor memhttptest to work with Go 1.25 synctest by [@​codefromthecrypt](https://github.com/codefromthecrypt) in [#​881](https://github.com/connectrpc/connect-go/pull/881) - Doc clarifications by [@​emcfarlane](https://github.com/emcfarlane) ([#​911](https://github.com/connectrpc/connect-go/issues/911), [#​912](https://github.com/connectrpc/connect-go/issues/912)) and [@​stefanvanburen](https://github.com/stefanvanburen) ([#​906](https://github.com/connectrpc/connect-go/issues/906)) #### New Contributors - [@​codefromthecrypt](https://github.com/codefromthecrypt) made their first contribution in [#​881](https://github.com/connectrpc/connect-go/pull/881) - [@​simonferquel](https://github.com/simonferquel) made their first contribution in [#​919](https://github.com/connectrpc/connect-go/pull/919) **Full Changelog**: </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/854 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com> |
||
Lunny Xiao
|
b5c50bb3ab | upgrade go git | ||
|
silverwind
|
fab2d6ae04 |
Merge gitea/act into act/
Merges the `gitea.com/gitea/act` fork into this repository as the `act/` directory and consumes it as a local package. The `replace github.com/nektos/act => gitea.com/gitea/act` directive is removed; act's dependencies are merged into the root `go.mod`. - Imports rewritten: `github.com/nektos/act/pkg/...` → `gitea.com/gitea/act_runner/act/...` (flattened — `pkg/` boundary dropped to match the layout forgejo-runner adopted). - Dropped act's CLI (`cmd/`, `main.go`) and all upstream project files; kept the library tree + `LICENSE`. - Added `// Copyright <year> The Gitea Authors ...` / `// Copyright <year> nektos` headers to 104 `.go` files. - Pre-existing act lint violations annotated inline with `//nolint:<linter> // pre-existing issue from nektos/act`. `.golangci.yml` is unchanged vs `main`. - Makefile test target: `-race -short` (matches forgejo-runner). - Pre-existing integration test failures fixed: race in parallel executor (atomic counters); TestSetupEnv / command_test / expression_test / run_context_test updated to match gitea fork runtime; TestJobExecutor and TestActionCache gated on `testing.Short()`. Full `gitea/act` commit history is reachable via the second parent. Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com> |
||
|
silverwind
|
48944e136c |
Use golangci-lint fmt to format code (#823)
Use `golangci-lint fmt` to format code, replacing the previous gofumpt-based formatter. https://github.com/daixiang0/gci is used to order the imports. Also drops the `gitea-vet` dependency since `gci` now handles import ordering. Mirrors https://github.com/go-gitea/gitea/pull/37194. --- This PR was written with the help of Claude Opus 4.7 Reviewed-on: https://gitea.com/gitea/act_runner/pulls/823 Reviewed-by: Nicolas <173651+bircni@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io> Co-committed-by: silverwind <me@silverwind.io> |
||
Bo-Yi Wu
|
f33e5a6245 |
feat: add Prometheus metrics endpoint for runner observability (#820)
## What
Add an optional Prometheus `/metrics` HTTP endpoint to `act_runner` so operators can observe runner health, polling behavior, job outcomes, and RPC latency without scraping logs.
New surface:
- `internal/pkg/metrics/metrics.go` — metric definitions, custom `Registry`, static Go/process collectors, label constants, `ResultToStatusLabel` helper.
- `internal/pkg/metrics/server.go` — hardened `http.Server` serving `/metrics` and `/healthz` with Slowloris-safe timeouts (`ReadHeaderTimeout` 5s, `ReadTimeout`/`WriteTimeout` 10s, `IdleTimeout` 60s) and a 5s graceful shutdown.
- `daemon.go` wires it up behind `cfg.Metrics.Enabled` (disabled by default).
- `poller.go` / `reporter.go` / `runner.go` instrument their existing hot paths with counters/histograms/gauges — no behavior change.
Metrics exported (namespace `act_runner_`):
| Subsystem | Metric | Type | Labels |
|---|---|---|---|
| — | `info` | Gauge | `version`, `name` |
| — | `capacity`, `uptime_seconds` | Gauge | — |
| `poll` | `fetch_total`, `client_errors_total` | Counter | `result` / `method` |
| `poll` | `fetch_duration_seconds`, `backoff_seconds` | Histogram / Gauge | — |
| `job` | `total` | Counter | `status` |
| `job` | `duration_seconds`, `running`, `capacity_utilization_ratio` | Histogram / GaugeFunc | — |
| `report` | `log_total`, `state_total` | Counter | `result` |
| `report` | `log_duration_seconds`, `state_duration_seconds` | Histogram | — |
| `report` | `log_buffer_rows` | Gauge | — |
| — | `go_*`, `process_*` | standard collectors | — |
All label values are predefined constants — **no high-cardinality labels** (no task IDs, repo URLs, branches, tokens, or secrets) so scraping is safe and bounded.
## Why
Teams self-hosting Gitea + `act_runner` at scale need to answer basic SRE questions that are currently invisible:
- How often are RPCs failing? Which RPC? (`act_runner_client_errors_total`)
- Are runners saturated? (`act_runner_job_capacity_utilization_ratio`, `act_runner_job_running`)
- How long do jobs take? (`act_runner_job_duration_seconds`)
- Is polling backing off? (`act_runner_poll_backoff_seconds`, `act_runner_poll_fetch_total{result=\"error\"}`)
- Are log/state reports slow? (`act_runner_report_{log,state}_duration_seconds`)
- Is the log buffer draining? (`act_runner_report_log_buffer_rows`)
Today operators have to grep logs. This PR makes all of the above first-class metrics so they can feed dashboards and alerts (`rate(act_runner_client_errors_total[5m]) > 0.1`, capacity saturation alerts, etc.).
The endpoint is **disabled by default** and binds to `127.0.0.1:9101` when enabled, so it's opt-in and safe for existing deployments.
## How
### Config
```yaml
metrics:
enabled: false # opt-in
addr: 127.0.0.1:9101 # change to 0.0.0.0:9101 only behind a reverse proxy
```
`config.example.yaml` documents both fields plus a security note about binding externally without auth.
### Wiring
1. `daemon.go` calls `metrics.Init()` (guarded by `sync.Once`), sets `act_runner_info`, `act_runner_capacity`, registers uptime + running-jobs GaugeFuncs, then starts the server goroutine with the daemon context — it shuts down cleanly on `ctx.Done()`.
2. `poller.fetchTask` observes RPC latency / result / error counters. `DeadlineExceeded` (long-poll idle) is treated as an empty result and **not** observed into the histogram so the 5s timeout doesn't swamp the buckets.
3. `poller.pollOnce` reports `poll_backoff_seconds` using the pre-jitter base interval (the true backoff level), and only when it changes — prevents noisy no-op gauge updates at the `FetchIntervalMax` plateau.
4. `reporter.ReportLog` / `ReportState` record duration histograms and success/error counters; `log_buffer_rows` is updated only when the value changes, guarded by the already-held `clientM`.
5. `runner.Run` observes `job_duration_seconds` and increments `job_total` by outcome via `metrics.ResultToStatusLabel`.
### Safety / security review
- All timeouts set; Slowloris-safe.
- Custom `prometheus.NewRegistry()` — no global registration side-effects.
- No sensitive data in labels (reviewed every instrumentation site).
- Single new dependency: `github.com/prometheus/client_golang v1.23.2`.
- Endpoint is unauthenticated by design and documented as such; default localhost bind mitigates exposure. Operators exposing externally should front it with a reverse proxy.
## Verification
### Unit tests
\`\`\`bash
go build ./...
go vet ./...
go test ./...
\`\`\`
### Manual smoke test
1. Enable metrics in `config.yaml`:
\`\`\`yaml
metrics:
enabled: true
addr: 127.0.0.1:9101
\`\`\`
2. Start the runner against a Gitea instance: \`./act_runner daemon\`.
3. Scrape the endpoint:
\`\`\`bash
curl -s http://127.0.0.1:9101/metrics | grep '^act_runner_'
curl -s http://127.0.0.1:9101/healthz # → ok
\`\`\`
4. Confirm the static series appear immediately: \`act_runner_info\`, \`act_runner_capacity\`, \`act_runner_uptime_seconds\`, \`act_runner_job_running\`, \`act_runner_job_capacity_utilization_ratio\`.
5. Trigger a workflow and confirm counters increment: \`act_runner_poll_fetch_total{result=\"task\"}\`, \`act_runner_job_total{status=\"success\"}\`, \`act_runner_report_log_total{result=\"success\"}\`.
6. Leave the runner idle and confirm \`act_runner_poll_backoff_seconds\` settles (and does **not** churn on every poll).
7. Ctrl-C and confirm a clean \"metrics server shutdown\" log line (no port-in-use error on restart within 5s).
### Prometheus integration
Add to \`prometheus.yml\`:
\`\`\`yaml
scrape_configs:
- job_name: act_runner
static_configs:
- targets: ['127.0.0.1:9101']
\`\`\`
Sample alert to try:
\`\`\`
sum(rate(act_runner_client_errors_total[5m])) by (method) > 0.1
\`\`\`
## Out of scope (follow-ups)
- TLS and auth on the metrics endpoint (mitigated today by localhost default; add when operators need external scraping).
- Per-task labels (intentionally avoided for cardinality safety).
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.com/gitea/act_runner/pulls/820
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
Co-committed-by: Bo-Yi Wu <appleboy.tw@gmail.com>
|