Update module github.com/prometheus/common to v0.69.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/common	v0.66.1 → v0.69.0

---

Release Notes

prometheus/common (github.com/prometheus/common)

v0.69.0

Compare Source

Security / behavior changes

• config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #​901 #​920 #​921
• config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #​925

Bugfixes

• expfmt: fix nil pointer panic when parsing empty braces {}. #​922
• model: fix Time.UnmarshalJSON for larger negative numbers. #​918

Performance

• model: reduce allocations in Time.UnmarshalJSON. #​918

Internal

• Synchronize common files from prometheus/prometheus. #​917
• Modernize Go. #​919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.1

Compare Source

Security / behavior changes

• config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #​901 #​920 #​921
• config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #​925

Bugfixes

• expfmt: fix nil pointer panic when parsing empty braces {}. #​922
• model: fix Time.UnmarshalJSON for larger negative numbers. #​918

Performance

• model: reduce allocations in Time.UnmarshalJSON. #​918

Internal

• Synchronize common files from prometheus/prometheus. #​917
• Modernize Go. #​919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.0

Compare Source

What's Changed

• Synchronize common files from prometheus/prometheus by @​prombot in #​873
• Synchronize common files from prometheus/prometheus by @​prombot in #​874
• build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by @​dependabot[bot] in #​879
• build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @​dependabot[bot] in #​878
• Synchronize common files from prometheus/prometheus by @​prombot in #​875
• Synchronize common files from prometheus/prometheus by @​prombot in #​880
• Remove logic adding unit to metrics name by @​vesari in #​877
• Synchronize common files from prometheus/prometheus by @​prombot in #​881
• Update for Go 1.26 by @​SuperQ in #​883
• build(deps): bump golang.org/x/net from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​882
• version: Add a slog helper by @​SuperQ in #​886
• Remove Arthur from maintainers list by @​ArthurSens in #​885
• Synchronize common files from prometheus/prometheus by @​prombot in #​895
• Synchronize common files from prometheus/prometheus by @​prombot in #​896
• config: change NewOAuth2RoundTripper to accept variadic HTTPClientOption by @​alliasgher in #​898
• config: guard against nil oauth2 credential in RoundTrip by @​alliasgher in #​897
• build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​890
• build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​891
• build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 by @​dependabot[bot] in #​892
• Move interface assertions to a test file by @​msiegen in #​839
• fix(http_config): fix client cert rotation when no CA is configured by @​machine424 in #​908
• Remove CircleCI by @​ArthurSens in #​910
• Fix: apply DialContextFunc to OAuth2 token-fetch transport by @​yuri-tceretian in #​911

New Contributors

• @​alliasgher made their first contribution in #​898
• @​msiegen made their first contribution in #​839
• @​machine424 made their first contribution in #​908
• @​yuri-tceretian made their first contribution in #​911

Full Changelog: prometheus/common@v0.67.5...v0.68.0

v0.67.5

Compare Source

What's Changed

• build(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.34.0 by @​dependabot[bot] in #​871
• Synchronize common files from prometheus/prometheus by @​prombot in #​866
• build(deps): bump golang.org/x/net from 0.46.0 to 0.48.0 by @​dependabot[bot] in #​872
• build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 by @​dependabot[bot] in #​870

Full Changelog: prometheus/common@v0.67.4...v0.67.5

v0.67.4: / 2025-11-18

Compare Source

What's Changed

• chore: clean up golangci-lint configuration by @​mmorel-35 in #​782
• chore: 'omitempty' to Oauth2 fields with type Secret to avoid requiring them by @​JorTurFer in #​864
• chore: Add omitempty tag to all config fields by @​JorTurFer in #​865

Full Changelog: prometheus/common@v0.67.3...v0.67.4

v0.67.3: / 2025-11-18

Compare Source

What's Changed

• Support JWT Profile for Authorization Grant (RFC 7523 3.1) by @​JorTurFer in #​862
• Config: remove outdated comment about HTTP/2 issues by @​bboreham in #​863

New Contributors

• @​JorTurFer made their first contribution in #​862

Full Changelog: prometheus/common@v0.67.2...v0.67.3

v0.67.2

Compare Source

v0.67.1

Compare Source

v0.67.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated

Details:

Package	Change
github.com/prometheus/client_model	v0.6.1 -> v0.6.2
go.yaml.in/yaml/v2	v2.4.2 -> v2.4.3
golang.org/x/net	v0.38.0 -> v0.48.0
golang.org/x/oauth2	v0.27.0 -> v0.34.0
golang.org/x/sync	v0.12.0 -> v0.19.0
golang.org/x/sys	v0.31.0 -> v0.39.0
golang.org/x/term	v0.30.0 -> v0.38.0
golang.org/x/text	v0.23.0 -> v0.32.0
golang.org/x/tools	v0.26.0 -> v0.39.0
google.golang.org/protobuf	v1.36.5 -> v1.36.11

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
go.yaml.in/yaml/v2	v2.4.3 -> v2.4.4
golang.org/x/mod	v0.33.0 -> v0.35.0
golang.org/x/net	v0.52.0 -> v0.55.0
golang.org/x/oauth2	v0.35.0 -> v0.36.0
golang.org/x/sys	v0.42.0 -> v0.45.0
golang.org/x/term	v0.41.0 -> v0.43.0
golang.org/x/text	v0.35.0 -> v0.37.0
golang.org/x/tools	v0.42.0 -> v0.44.0