chore(deps): update module github.com/prometheus/common to v0.69.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/common	v0.67.5 → v0.69.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

prometheus/common (github.com/prometheus/common)

v0.69.0

Compare Source

Security / behavior changes

• config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #​901 #​920 #​921
• config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #​925

Bugfixes

• expfmt: fix nil pointer panic when parsing empty braces {}. #​922
• model: fix Time.UnmarshalJSON for larger negative numbers. #​918

Performance

• model: reduce allocations in Time.UnmarshalJSON. #​918

Internal

• Synchronize common files from prometheus/prometheus. #​917
• Modernize Go. #​919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.1

Compare Source

Security / behavior changes

• config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #​901 #​920 #​921
• config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #​925

Bugfixes

• expfmt: fix nil pointer panic when parsing empty braces {}. #​922
• model: fix Time.UnmarshalJSON for larger negative numbers. #​918

Performance

• model: reduce allocations in Time.UnmarshalJSON. #​918

Internal

• Synchronize common files from prometheus/prometheus. #​917
• Modernize Go. #​919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.0

Compare Source

What's Changed

• Synchronize common files from prometheus/prometheus by @​prombot in #​873
• Synchronize common files from prometheus/prometheus by @​prombot in #​874
• build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by @​dependabot[bot] in #​879
• build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @​dependabot[bot] in #​878
• Synchronize common files from prometheus/prometheus by @​prombot in #​875
• Synchronize common files from prometheus/prometheus by @​prombot in #​880
• Remove logic adding unit to metrics name by @​vesari in #​877
• Synchronize common files from prometheus/prometheus by @​prombot in #​881
• Update for Go 1.26 by @​SuperQ in #​883
• build(deps): bump golang.org/x/net from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​882
• version: Add a slog helper by @​SuperQ in #​886
• Remove Arthur from maintainers list by @​ArthurSens in #​885
• Synchronize common files from prometheus/prometheus by @​prombot in #​895
• Synchronize common files from prometheus/prometheus by @​prombot in #​896
• config: change NewOAuth2RoundTripper to accept variadic HTTPClientOption by @​alliasgher in #​898
• config: guard against nil oauth2 credential in RoundTrip by @​alliasgher in #​897
• build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​890
• build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​891
• build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 by @​dependabot[bot] in #​892
• Move interface assertions to a test file by @​msiegen in #​839
• fix(http_config): fix client cert rotation when no CA is configured by @​machine424 in #​908
• Remove CircleCI by @​ArthurSens in #​910
• Fix: apply DialContextFunc to OAuth2 token-fetch transport by @​yuri-tceretian in #​911

New Contributors

• @​alliasgher made their first contribution in #​898
• @​msiegen made their first contribution in #​839
• @​machine424 made their first contribution in #​908
• @​yuri-tceretian made their first contribution in #​911

Full Changelog: prometheus/common@v0.67.5...v0.68.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/sys	v0.44.0 -> v0.45.0
golang.org/x/net	v0.54.0 -> v0.55.0

[coderabbitai]

Walkthrough

Three Go module dependencies in go.mod are bumped: golang.org/x/sys to v0.45.0, github.com/prometheus/common to v0.69.0, and golang.org/x/net to v0.55.0.

Changes

Dependency Version Bumps

Layer / File(s)	Summary
go.mod version bumps go.mod	golang.org/x/sys bumped from v0.44.0 to v0.45.0, github.com/prometheus/common from v0.67.5 to v0.69.0, and golang.org/x/net from v0.54.0 to v0.55.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only bumps dependencies and vendored code; no *_test.go files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	PR only updates go.mod and vendored deps; no Ginkgo test files or test logic were changed.
Microshift Test Compatibility	✅ Passed	PR only bumps deps/vendor code; no *_test.go files or Ginkgo test additions were changed, so MicroShift compatibility isn’t impacted.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR only bumps go.mod/go.sum and vendored dependency code; no *_test.go files or new Ginkgo e2e tests were added, so no SNO-specific risk.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only updates go.mod/go.sum and vendored dependencies; no deployment manifests, controllers, or scheduling logic changed.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes were introduced; diff is dependency/vendor updates only, and the only init() found uses builtin print/debug output, not fmt/log stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Diff only updates go.mod/go.sum/vendor deps; no new Ginkgo e2e tests were added, so IPv4/external-connectivity checks are not applicable.
No-Weak-Crypto	✅ Passed	PASS: The patch is a dependency/vendor refresh; added lines show no MD5/SHA1/DES/RC4/Blowfish/ECB or secret-comparison changes.
Container-Privileges	✅ Passed	PR only updates Go deps and vendored code; no Kubernetes/container manifest changes with privileged settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	No added log statements or sensitive-data logging appeared in the patch; changes are dependency/vendor bumps only.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely matches the primary change: updating github.com/prometheus/common to v0.69.0.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/github.com-prometheus-common-0.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 1165e36 and 2 for PR HEAD 025e3a2 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 857149e and 1 for PR HEAD 025e3a2 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 6f7127b and 0 for PR HEAD 025e3a2 in total

[openshift-merge-bot]

/hold

Revision 025e3a2 was retested 3 times: holding

[openshift-ci]

New changes are detected. LGTM label has been removed.

[openshift-ci]

@red-hat-konflux[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp419-e2e-azure	feccc24	link	true	/test ocp419-e2e-azure
ci/prow/ocp418-e2e-azure	feccc24	link	true	/test ocp418-e2e-azure
ci/prow/ocp421-e2e-aws	feccc24	link	true	/test ocp421-e2e-aws
ci/prow/ocp422-e2e-aws	feccc24	link	true	/test ocp422-e2e-aws
ci/prow/ocp417-e2e-aws	feccc24	link	true	/test ocp417-e2e-aws
ci/prow/ocp420-e2e-aws	feccc24	link	true	/test ocp420-e2e-aws
ci/prow/ocp416-e2e-aws	feccc24	link	true	/test ocp416-e2e-aws
ci/prow/ocp50-e2e-aws	feccc24	link	true	/test ocp50-e2e-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.