You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
This Renovate dependency bump updates github.com/prometheus/client_golang v1.23.2 → v1.24.0 (plus transitive prometheus/common, prometheus/procfs, go.yaml.in/yaml/v2, and google.golang.org/protobuf). Only go.mod / go.sum changed.
Usage reviewed: Semaphore exposes metrics only through pkg/metrics/metrics.go via promhttp.HandlerFor with a dedicated registry and static metric names/labels. The /api/metrics route is restricted to GET/HEAD and protected by metricsAuthMiddleware (HTTP Basic Auth with constant-time credential comparison).
Dependency changes: v1.24.0 security-relevant fixes (snappy decoded-size limits, remote-write buffer pooling, collector panic recovery) apply to code paths this project does not use (exp/api/remote, api/prometheus/v1 client). No new attacker-controlled inputs reach prometheus sinks. Task status label values are bounded enums, not free-form user input.
No prior automation findings required re-reporting.
renovateBot
changed the title
fix(deps): update module github.com/prometheus/client_golang to v1.24.0
fix(deps): update module github.com/prometheus/client_golang to v1.24.1
Jul 24, 2026
The reason will be displayed to describe this comment to others. Learn more.
Security review
Outcome: No medium, high, or critical vulnerabilities identified in this PR.
This Renovate dependency bump updates github.com/prometheus/client_golang v1.23.2 → v1.24.1 (plus transitive prometheus/common, prometheus/procfs, go.yaml.in/yaml/v2, and google.golang.org/protobuf). Only go.mod / go.sum changed.
Usage reviewed: Semaphore exposes metrics only through pkg/metrics/metrics.go via promhttp.HandlerFor with a dedicated registry and static metric names/labels. The /api/metrics route is restricted to GET/HEAD and protected by metricsAuthMiddleware (HTTP Basic Auth with constant-time credential comparison).
Dependency changes: v1.24.x security-relevant fixes (snappy decoded-size limits, remote-write header/buffer hardening, collector panic recovery, nil-URL panic fix in promhttp) apply to code paths this project does not use (exp/api/remote, api/prometheus/v1 client) or are hardening-only. The new optional name[] metrics filter is behind the same authenticated endpoint and does not expand unauthenticated exposure. Task status label values are bounded enums, not free-form user input.
No prior automation findings required re-reporting.
Sent by Cursor Automation: Find vulnerabilities
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This PR contains the following updates:
v1.23.2→v1.24.1Release Notes
prometheus/client_golang (github.com/prometheus/client_golang)
v1.24.1Compare Source
v1.24.0: - 2026-07-20Compare Source
Changes
model.NameValidationSchemeglobal. Default behavior is unchanged; code that setNameValidationScheme = LegacyValidationno longer gets legacy enforcement at metric, label, and push-grouping construction. #2051matches[]parameter) inRulesmethod (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843LabelNamesmethod to returnmodel.LabelNamesinstead of[]stringfor consistency across the API. #1850Storeinterface, renameHandlertoWriteHandler, and encapsulate write response handling. #1855/sched/goroutines-created:goroutines,/sched/goroutines/not-in-go:goroutines,/sched/goroutines/runnable:goroutines,/sched/goroutines/running:goroutines,/sched/goroutines/waiting:goroutines,/sched/threads/total:threads). #1942WithUnit(unit string)option and explicit OpenMetrics unit support inCounterOpts,GaugeOpts,SummaryOpts, andHistogramOpts. #1392Err()method onDesc. #1902HandlerOpts.CoalesceGatherto deduplicate concurrentGathercalls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969promhttppackage now support metrics filtering by providing one or morename[]query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925/format_query) andFormatQuery(ctx context.Context, query string) (string, error)method. #1846, #1856/status/tsdb/blocksendpoint viaTSDBBlocks(ctx context.Context) ([]TSDBBlock, error)method. #1896BackoffConfigto allow customization when usingWithAPIBackoff. #1895RetryCallBackto allow custom logging or handling on retry attempts in the remote write client. #1888, #1890http.DefaultTransportwhen constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885Gather()and return an error instead of crashing the process. #1961cpu-secondsunit suffix handling for metricgo_cpu_classes_gc_mark_assist_cpu_seconds. #1991InstrumentHandlerDurationandInstrumentHandlerCounterno longer panic when given an observer/counter that does not implementExemplarObserver/ExemplarAdder(e.g. aSummaryVec). The exemplar is dropped and the value is recorded via the plainObserve/Addpath, matching the safe-cast already used byTimer.ObserveDurationWithExemplar. #2005GETrequests whenPOSTrequests return403 Forbiddenor method not allowed. #2030httpClient.Do. #1971All commits
/status/tsdb/blocksendpoint by @tjhop in #1896/metricshandler output filtering vianame[]query param by @colega in #1925New Contributors
Full Changelog: prometheus/client_golang@v1.23.2...v1.24.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.