Skip to content

build(deps): Bump github.com/prometheus/common from 0.69.0 to 0.70.1 - #1399

Closed
dependabot[bot] wants to merge 1 commit into
v1.6-devfrom
dependabot/go_modules/github.com/prometheus/common-0.70.1
Closed

build(deps): Bump github.com/prometheus/common from 0.69.0 to 0.70.1#1399
dependabot[bot] wants to merge 1 commit into
v1.6-devfrom
dependabot/go_modules/github.com/prometheus/common-0.70.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/prometheus/common from 0.69.0 to 0.70.1.

Release notes

Sourced from github.com/prometheus/common's releases.

v0.70.1

What's Changed

Full Changelog: prometheus/common@v0.70.0...v0.70.1

v0.70.0

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.69.0...v0.70.0

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

v0.70.0 / 2026-07-10

Enhancements

  • route: add support for the QUERY HTTP method. #932

Bugfixes

  • config: fix TLSVersion.String() printing a pointer address instead of the numeric version for unknown TLS versions. #929

Internal

  • expfmt: add BenchmarkConvertMetricFamily comparing the Prometheus text and OpenMetrics 1.0 encoders. #943
  • Update Go dependencies. #933 #934
  • Synchronize common files from prometheus/prometheus. #923 #927 #930 #937
  • Update GitHub Actions. #938 #939 #940 #941 #942

Full Changelog: prometheus/common@v0.69.0...v0.70.0

Commits
  • b63d8c0 build(deps): bump golang.org/x/net (#947)
  • 4109c3e build(deps): bump the codeql group with 4 updates (#948)
  • 5270b62 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#949)
  • 1167ca3 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#950)
  • d28d382 Update common Prometheus files (#946)
  • f915876 Merge pull request #924 from roidelapluie/roidelapluie/redirect-header-comment
  • dfbebd0 Merge pull request #945 from roidelapluie/roidelapluie/changelog-0.70.0
  • c8a0019 Update CHANGELOG for v0.70.0
  • 5eff7a8 Merge pull request #941 from prometheus/dependabot/github_actions/actions/che...
  • a23c5b3 Merge pull request #939 from prometheus/dependabot/github_actions/ossf/scorec...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 28, 2026
@dependabot dependabot Bot mentioned this pull request Jul 28, 2026
Closed
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/prometheus/common-0.70.1 branch from 0d8c585 to a3268ea Compare July 28, 2026 17:14
@lklimek

lklimek commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Dependency Security Review — github.com/prometheus/common 0.69.0 → 0.70.1

Verdict: SAFE. No CRITICAL / HIGH / MEDIUM / LOW security findings. Not merged yet — blocked purely on a mechanical merge conflict (see the end).

Scope

go.mod + go.sum only. No source, build, CI, or codegen changes. go.sum churn is exactly 18 insertions / 18 deletions — 9 modules replaced two lines apiece, meaning zero net-new modules. This bump adds no new supply-chain entrants, only version moves.

Modules moved

Module From To Why
github.com/prometheus/common 0.69.0 0.70.1 the named bump
github.com/prometheus/procfs 0.19.2 0.21.0 indirect — required by common@0.70.1
golang.org/x/net 0.56.0 0.57.0 required by common@0.70.1
golang.org/x/text 0.38.0 0.40.0 required by common@0.70.1
golang.org/x/sys 0.46.0 0.47.0 required by common@0.70.1
golang.org/x/crypto 0.53.0 0.54.0 MVS via x/net
golang.org/x/term 0.44.0 0.45.0 MVS via x/net
golang.org/x/tools 0.46.0 0.47.0 MVS via x/net
golang.org/x/sync 0.21.0 0.22.0 already on v1.6-dev via #1387 — collapses to a no-op after rebase

A prometheus/common bump dragging seven golang.org/x/* modules with it deserves scrutiny, so I checked it against the module proxy rather than assuming. common@0.70.1's own go.mod directly requires golang.org/x/net v0.57.0, golang.org/x/sys v0.47.0, golang.org/x/text v0.40.0, and prometheus/procfs v0.21.0 (0.69.0 required x/net v0.55.0, x/sys v0.45.0, x/text v0.37.0, procfs v0.15.1). Every transitive move is legitimate minimum-version selection. Nothing was smuggled in under cover of the headline bump.

Vulnerabilities

GitHub Advisory Database — 0 known vulnerabilities across prometheus/common@0.70.1, procfs@0.21.0, x/net@0.57.0, x/crypto@0.54.0, x/text@0.40.0, client_golang@1.23.2. CI govulncheck is ✅ green.

Reachability — the part that actually matters

tenderdash's entire consumption of prometheus/common is two imports in one dev-tooling file:

scripts/metricsgen/metricsdiff/metricsdiff.go:17: "github.com/prometheus/common/expfmt"
scripts/metricsgen/metricsdiff/metricsdiff.go:18: "github.com/prometheus/common/model"

go mod why confirms expfmt and model are reachable only through scripts/metricsgen/metricsdiff, and that the main module needs no prometheus/common package at all in the node runtime path.

This matters for the one upstream change with any security flavour — "config: clarify sensitive redirect headers match net/http" (prometheus/common#924), covering which headers get stripped on cross-origin redirects. go mod why github.com/prometheus/common/config returns "main module does not need package" — that package is not reachable from tenderdash at all. Zero behavioural exposure.

The genuinely runtime-reachable change here is golang.org/x/net 0.56→0.57 (its http2 transport sits under gRPC), and moving that forward is a net security improvement, not a risk.

Upstream v0.70.0/v0.70.1 are otherwise routine maintenance and dependency-sync releases authored by the usual Prometheus maintainers and bots (roidelapluie, prombot, dependabot) — no maintainer/ownership change, no new install hooks, no build-time codegen.

Re: the superseded #1386 — its failures were not this dependency's fault

Worth recording, since #1386 died red on the same bump. Its blocker was GO-2026-6061 — xDS RBAC + HTTP/2 transport vulnerabilities in google.golang.org/grpc@v1.82.0, inherited verbatim from v1.6-dev, not introduced by the prometheus bump. The fix was #1392 (grpc → 1.82.1), which has since merged to v1.6-dev (2e12505).

That prediction held. On this PR govulncheck is green, and the two checks flagged as suspect — Build (amd64, linux) and tests (04) — both pass. All 16 checks are COMPLETED / SUCCESS, including the full tests (00–05) matrix, both e2e jobs, golangci-lint, check-mocks, and check-proto. Nothing environmental recurred.

Blocker

mergeable: CONFLICTING / mergeStateStatus: DIRTY — a routine dependabot lockfile collision in go.mod + go.sum, caused by #1381, #1387, and #1392 landing on v1.6-dev after this branch was cut. No semantic disagreement, just overlapping edits to the same require blocks.

Holding the merge and requesting a rebase in the next comment. The audit verdict above is independent of the rebase and stands: safe to merge once green on a conflict-free head.

🤖 Co-authored by Claudius the Magnificent AI Agent

@lklimek

lklimek commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with v1.6-dev! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@lklimek

lklimek commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Addendum — post-rebase re-verification, and a correction that upgrades the verdict

The rebase landed (0d8c585f2 → a3268eae6, parent cd27f3cd4 = current v1.6-dev). mergeable: MERGEABLE, conflict cleared. Re-derived everything at the real head rather than assuming it carried over.

Delta shrank exactly as predicted — 9 modules → 7. The x/sync and x/text… sorry, x/sync 0.21→0.22 and x/sys 0.46→0.47 rows collapsed to no-ops (already on base via #1387/#1384). go.sum is now 14 added / 14 removed — clean 1:1 replacement, no orphans, still zero net-new modules.

Correction: this bump fixes a CVE. My first comment understated it.

My original review reported "0 known vulnerabilities" based on the GitHub Advisory Database. That was a false negative — GitHub's DB has not ingested this advisory yet. Querying OSV directly:

GO-2026-5970 / CVE-2026-56852 — "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
golang.org/x/text, introduced 0, fixed in 0.39.0

v1.6-dev currently pins x/text v0.38.0 — vulnerable. This PR moves it to 0.40.0, crossing the fix boundary. So the security effect is not neutral, it is net positive: an unauthenticated malformed-UTF-8 DoS vector is retired.

Worth flagging for future dependency reviews on this repo: GitHub's advisory API returned clean for x/text@0.38.0 while OSV flagged it. Anyone auditing via the GitHub API alone will miss this class of finding. (Reachability of norm.Iter is a separate question — govulncheck, which is reachability-aware, is the arbiter there and runs in CI on this PR.)

Supply-chain verification (independently re-run at a3268eae6)

  • 7/7 bumped modules match the Go checksum transparency log at sum.golang.org exactly — common@0.70.1, procfs@0.21.0, x/net@0.57.0, x/crypto@0.54.0, x/term@0.45.0, x/text@0.40.0, x/tools@0.47.0.
  • go mod verify → all modules verified.
  • Reachability conclusion from the first comment re-confirmed at the real head: only expfmt and model link in; prometheus/common/config — the package carrying the sensitive-redirect-headers change — is in no build graph.

CI: the e2e failure was infrastructure, not this PR

e2e-test (dashcore) went red on the first post-rebase run. It died in Set up Docker Buildx, ~10s in, before any tenderdash code compiled or ran:

#1 pulling image moby/buildkit:buildx-stable-1
#1 ERROR: Head "https://registry-1.docker.io/v2/moby/buildkit/manifests/buildx-stable-1":
    read tcp ...->104.18.43.178:443: read: connection reset by peer

Docker Hub reset the connection while booting buildkit. e2e-test (rotate) was cancelled as matrix collateral. Neither outcome is attributable to a go.mod change — I have re-run both jobs and am waiting on the result plus govulncheck.

Pre-existing issues found in passing (NOT introduced here, NOT merge blockers)

Recording these so they don't stay invisible; they deserve their own issues:

  1. test/fuzz/oss-fuzz-build.sh:17 hard-pins github.com/prometheus/common/expfmt@v0.32.1 — 38 minor versions behind, so the fuzz harness would exercise 2022-era parser code and will silently nullify this and every future prometheus/common bump. Mitigating: line 6 sets FUZZ_ROOT="github.com/tendermint/tendermint", not dashpay/tenderdash, so the harness likely doesn't run against this fork at all — a dead security control rather than a wrong one. Both halves are worth fixing.
  2. test/fuzz/oss-fuzz-build.sh:12,16 — go run …@latest executes third-party code resolved from a mutable ref at build time. The checksum DB protects the bytes, not which version gets selected.
  3. .github/dependabot.yml:17-23 — no groups: for the gomod ecosystem, so each module gets its own PR dragging the same golang.org/x/* cascade. That is precisely what produced the overlapping build(deps): Bump golang.org/x/sys from 0.46.0 to 0.47.0 #1384/build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0 #1387/build(deps): Bump github.com/prometheus/common from 0.69.0 to 0.70.1 #1399 sequence and the go.mod conflict this PR just had to rebase out of.

Verdict: unchanged and strengthened — SAFE, approve

Diff integrity clean, supply chain verified end-to-end against the transparency log, upstream source changes land in packages this repo does not compile, and the change removes a live x/text DoS advisory. Merging as soon as the re-run e2e jobs and govulncheck come back green.

🤖 Co-authored by Claudius the Magnificent AI Agent

@dependabot
build(deps): Bump github.com/prometheus/common from 0.69.0 to 0.70.1
c248b8a 
Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.69.0 to 0.70.1.
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)
- [Commits](prometheus/common@v0.69.0...v0.70.1)

---
updated-dependencies:
- dependency-name: github.com/prometheus/common
  dependency-version: 0.70.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/prometheus/common-0.70.1 branch from a3268ea to c248b8a Compare July 28, 2026 17:48
@lklimek

lklimek commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Correction + status — my CVE claim is now stale, and the e2e failure is a Docker Hub outage

Dependabot rebased a second time while CI was running: a3268eae6 → c248b8ae8 (parent 5a2ac4b83 = current v1.6-dev). Re-derived at the new head.

Retracting the CVE-fix claim from my previous comment

I wrote that this PR fixes GO-2026-5970 / CVE-2026-56852 by moving x/text 0.38.0 → 0.40.0. That was accurate when posted and is no longer true. #1383 (x/crypto 0.53→0.54) has since merged to v1.6-dev and pulled x/text to 0.40.0 transitively. The advisory is already fixed on base, independent of this PR.

Net effect: this PR is now security-neutral rather than security-positive. Still safe — just no longer carrying that benefit. Correcting it rather than leaving a favourable-but-wrong claim in the record.

The methodological point from that comment does stand and is worth keeping: GitHub's Advisory API reported x/text@0.38.0 clean while OSV flagged it. Dependency reviews on this repo should query OSV directly rather than trusting the GitHub advisory API alone.

The diff keeps shrinking — down to 3 modules

Each rebase absorbs more of the cascade into the base:

Head Modules in delta
0d8c585f2 9
a3268eae6 7
c248b8ae8 3 — prometheus/common 0.69.0→0.70.1, procfs 0.19.2→0.21.0, x/net 0.56.0→0.57.0

go.sum is now 6 added / 6 removed. mergeable: MERGEABLE. This is the cleanest the change has looked; the audit verdict (SAFE) holds, with supply-chain checksums previously verified against sum.golang.org for all of these.

govulncheck passed at the prior head a3268eae6 and is re-running here.

e2e-test (dashcore) — infrastructure outage, not this PR

Failed twice, both times in Set up Docker Buildx, in 10s and 9s respectively — before any tenderdash code is fetched, compiled, or executed:

#1 pulling image moby/buildkit:buildx-stable-1
#1 ERROR: Head "https://registry-1.docker.io/v2/moby/buildkit/manifests/buildx-stable-1"
    ... read: connection reset by peer

Different Cloudflare edge IPs each time (104.18.43.178, then 172.64.144.78), same reset. That is Docker Hub refusing connections to the GitHub runners, not a repo problem. e2e-test (rotate) is cancelled as matrix collateral both times, so its red is not independent signal.

I have re-run the failed jobs again. A go.mod-only change cannot influence a failure that occurs before the checkout is even built — but I am deliberately not merging around a red required check.

Status: NOT merged, holding

Verdict remains SAFE to merge on green. Blocked solely on Docker Hub cooperating long enough for the e2e matrix to boot buildkit. If it stays red, this needs either a retry once Docker Hub recovers or a maintainer decision to merge past a demonstrably external failure — that call belongs to a human, not to me.

Related: the repeated rebases here are the ungrouped-gomod-dependabot issue I flagged earlier (.github/dependabot.yml has no groups:). #1399 has now been rebased twice in ~40 minutes by unrelated dependency PRs landing on base, each time discarding a full CI run.

🤖 Co-authored by Claudius the Magnificent AI Agent

@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like github.com/prometheus/common is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 28, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/prometheus/common-0.70.1 branch July 28, 2026 18:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@QuantumExplorer QuantumExplorer Awaiting requested review from QuantumExplorer QuantumExplorer is a code owner
@lklimek lklimek Awaiting requested review from lklimek lklimek is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lklimek