chore: bump github.com/prometheus/common from 0.63.0 to 0.70.1 by dependabot[bot] · Pull Request #837 · officialmofabs/codeserver

dependabot · 2026-07-27T11:07:00Z

Bumps github.com/prometheus/common from 0.63.0 to 0.70.1.

Release notes

Sourced from github.com/prometheus/common's releases.

v0.70.1

What's Changed

Update CHANGELOG for v0.70.0 by @roidelapluie in prometheus/common#945

config: clarify sensitive redirect headers match net/http by @roidelapluie in prometheus/common#924

Synchronize common files from prometheus/prometheus by @prombot in prometheus/common#946

build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in prometheus/common#950

build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in prometheus/common#949

build(deps): bump the codeql group with 4 updates by @dependabot[bot] in prometheus/common#948

build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 in the golang-org-x group across 1 directory by @dependabot[bot] in prometheus/common#947

Full Changelog: prometheus/common@v0.70.0...v0.70.1

v0.70.0

What's Changed

config: fix TLSVersion.String() printing pointer address by @s3onghyun in prometheus/common#929

build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in prometheus/common#933

Manually go mod tidy by @SuperQ in prometheus/common#934

Synchronize common files from prometheus/prometheus by @prombot in prometheus/common#937

route: add support for the QUERY HTTP method by @roidelapluie in prometheus/common#932

Combine and extend Prometheus text and OpenMetrics 1.0 encoder benchmarks by @dashpole in prometheus/common#943

build(deps): bump the codeql group with 4 updates by @dependabot[bot] in prometheus/common#938

build(deps): bump actions/setup-go from 6.2.0 to 6.5.0 by @dependabot[bot] in prometheus/common#940

build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in prometheus/common#942

build(deps): bump ossf/scorecard-action from 2.1.2 to 2.4.3 by @dependabot[bot] in prometheus/common#939

build(deps): bump actions/checkout from 3.1.0 to 7.0.0 by @dependabot[bot] in prometheus/common#941

New Contributors

@s3onghyun made their first contribution in prometheus/common#929

Full Changelog: prometheus/common@v0.69.0...v0.70.0

v0.69.0

What's Changed

config: strip credentials on cross-host redirects by @roidelapluie in prometheus/common#901

Modernize Go by @SuperQ in prometheus/common#919

config: make isCrossHostRedirect sticky across the redirect chain by @roidelapluie in prometheus/common#920

config: check cross-host redirect before OAuth2 token fetch by @roidelapluie in prometheus/common#921

expfmt: fix nil pointer panic when parsing empty braces "{}" by @roidelapluie in prometheus/common#922

model: reduce allocations in Time.UnmarshalJSON by @bboreham in prometheus/common#918

config: resolve LoadHTTPConfigFile paths relative to the config file by @roidelapluie in prometheus/common#925

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.1

What's Changed

build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 by @dependabot[bot] in prometheus/common#903

build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 by @dependabot[bot] in prometheus/common#914

... (truncated)

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

v0.70.0 / 2026-07-10

Enhancements

route: add support for the QUERY HTTP method. #932

Bugfixes

config: fix TLSVersion.String() printing a pointer address instead of the numeric version for unknown TLS versions. #929

Internal

expfmt: add BenchmarkConvertMetricFamily comparing the Prometheus text and OpenMetrics 1.0 encoders. #943

Update Go dependencies. #933 #934

Synchronize common files from prometheus/prometheus. #923 #927 #930 #937

Update GitHub Actions. #938 #939 #940 #941 #942

Full Changelog: prometheus/common@v0.69.0...v0.70.0

v0.69.0 / 2026-06-17

Security / behavior changes

config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #901 #920 #921

config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #925

Bugfixes

expfmt: fix nil pointer panic when parsing empty braces {}. #922

model: fix Time.UnmarshalJSON for larger negative numbers. #918

Performance

model: reduce allocations in Time.UnmarshalJSON. #918

Internal

Synchronize common files from prometheus/prometheus. #917

Modernize Go. #919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.67.2 / 2025-10-28

... (truncated)

Commits

b63d8c0 build(deps): bump golang.org/x/net (#947)
4109c3e build(deps): bump the codeql group with 4 updates (#948)
5270b62 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#949)
1167ca3 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#950)
d28d382 Update common Prometheus files (#946)
f915876 Merge pull request #924 from roidelapluie/roidelapluie/redirect-header-comment
dfbebd0 Merge pull request #945 from roidelapluie/roidelapluie/changelog-0.70.0
c8a0019 Update CHANGELOG for v0.70.0
5eff7a8 Merge pull request #941 from prometheus/dependabot/github_actions/actions/che...
a23c5b3 Merge pull request #939 from prometheus/dependabot/github_actions/ossf/scorec...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.63.0 to 0.70.1. - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.63.0...v0.70.1) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-version: 0.70.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-27T11:07:57Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
golang/golang.org/x/oauth2@v0.29.0 ⏵ v0.36.0	⁺¹
golang/github.com/prometheus/client_golang@v1.22.0 ⏵ v1.23.2	⁺¹
golang/golang.org/x/crypto@v0.39.0 ⏵ v0.54.0	⁺¹	⁺⁷⁵
golang/golang.org/x/net@v0.41.0 ⏵ v0.57.0		⁺³
golang/golang.org/x/tools@v0.33.0 ⏵ v0.47.0
golang/google.golang.org/protobuf@v1.36.6 ⏵ v1.36.11	⁺¹
golang/golang.org/x/text@v0.26.0 ⏵ v0.40.0
golang/github.com/prometheus/client_model@v0.6.1 ⏵ v0.6.2
golang/github.com/prometheus/common@v0.63.0 ⏵ v0.70.1	^-1
golang/golang.org/x/sys@v0.33.0 ⏵ v0.47.0
golang/github.com/stretchr/testify@v1.10.0 ⏵ v1.11.1	⁺¹
golang/golang.org/x/mod@v0.25.0 ⏵ v0.37.0	⁺¹
golang/golang.org/x/sync@v0.15.0 ⏵ v0.22.0
golang/golang.org/x/term@v0.32.0 ⏵ v0.45.0	⁺¹

View full report

socket-security · 2026-07-27T11:07:59Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: golang `golang.org/x/tools` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/golang.org/x/tools@v0.47.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/tools@v0.47.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 27, 2026

dependabot Bot mentioned this pull request Jul 27, 2026

chore: bump github.com/prometheus/common from 0.63.0 to 0.70.0 #824

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump github.com/prometheus/common from 0.63.0 to 0.70.1 - #837

chore: bump github.com/prometheus/common from 0.63.0 to 0.70.1#837
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/prometheus/common-0.70.1

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v0.70.1

What's Changed

v0.70.0

What's Changed

New Contributors

v0.69.0

What's Changed

v0.68.1

What's Changed

Changelog

main / unreleased

What's Changed

v0.70.0 / 2026-07-10

Enhancements

Bugfixes

Internal

v0.69.0 / 2026-06-17

Security / behavior changes

Bugfixes

Performance

Internal

v0.67.2 / 2025-10-28

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants