chore(deps): bump the go-weekly-rollup group across 1 directory with 3 updates by dependabot[bot] · Pull Request #27 · ogulcanaydogan/Prompt-Injection-Firewall

dependabot · 2026-08-19T04:13:26Z

Bumps the go-weekly-rollup group with 3 updates in the / directory: github.com/knights-analytics/hugot, github.com/prometheus/client_golang and github.com/stretchr/testify.

Updates github.com/knights-analytics/hugot from 0.7.4 to 0.7.7

Release notes

Sourced from github.com/knights-analytics/hugot's releases.

v0.7.7

[0.7.7] - 2026-08-04

Changed

Upgraded to CUDA 13

Upgraded to ORT v1.28.0

Upgraded to ORT GenAI v0.15.0

Upgraded to GoMLX v0.28.2

Fixes go tokenizer FIRST/MAX/AVERAGE aggregation (thanks @luanlorenzo)

v0.7.6

[0.7.6] - 2026-07-24

Changed

Upgraded to GoMLX v0.28.0

Includes experimental SIMD for significant performance improvements for the Go backend

Refactor/simplification of pipeline management and lifecycle

Token Classification pipeline correctly handles unknown tokens (thanks @ohhmkar)

Fixes tokenizer timings reporting per pipeline

v0.7.5

[0.7.5] - 2026-06-05

Changed

Upgraded to ORT v1.26.0

Upgraded to ORT GenAI v0.14.0

Changelog

Sourced from github.com/knights-analytics/hugot's changelog.

[0.7.7] - 2026-08-03

Changed

Upgraded to CUDA 13

Upgraded to ORT v1.28.0

Upgraded to ORT GenAI v0.15.0

Upgraded to GoMLX v0.28.2

Fixes go tokenizer FIRST/MAX/AVERAGE aggregation (thanks @luanlorenzo)

[0.7.6] - 2026-07-24

Changed

Upgraded to GoMLX v0.28.0

Includes experimental SIMD for significant performance improvements for the Go backend

Refactor/simplification of pipeline management and lifecycle

Token Classification pipeline correctly handles unknown tokens (thanks @ohhmkar)

Fixes tokenizer timings reporting per pipeline

[0.7.5] - 2026-06-05

Changed

Upgraded to ORT v1.26.0

Upgraded to ORT GenAI v0.14.0

Commits

e085914 upgrade to CUDA 13, ORT 1.28.0, ORT genAI 0.15.0
62d6da0 fix token aggregation with go tokenizer
1f65d64 update changelog
c00eba2 upgrade to goMLX v0.28
a9cb6e9 change: cleanup internal api to use a register and no same name pipelines acr...
53a8a55 feat: check for unknown token in token classification pipeline
afbc369 move tokenizer timings to pipeline struct
c30aa0f ORT 1.26.0 and ORT genai 0.14.0
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @dependabot[bot] in prometheus/client_golang#1852

Refactor LabelNames to return model.LabelNames type for consistency by @yshngg in prometheus/client_golang#1850

remote: simplified Store interface; renamed Handler to WriteHandler by @bwplotka in prometheus/client_golang#1855

feat(api/prometheus): add format_query endpoint for query formatting by @yshngg in prometheus/client_golang#1846

feat(api): add FormatQuery method to Prometheus v1 API by @yshngg in prometheus/client_golang#1856

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

Commits

d6087ee release: cut v1.24.1 (#2076)
48dd383 Cut v1.24.0 (#2061)
a725305 Cut v1.24.0-rc.0 (#2058)
77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
34e9a7f Merge pull request #2055 from prombot/repo_sync
43749bc Update common Prometheus files
de19217 examples: improve simple main.go example (#1999)
20355eb fix: correct typos in comments and test error messages (#2049)
4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

assert: make *AssertionFunc types just aliases by @dolmen in stretchr/testify#1563

Fixes

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in stretchr/testify#1775

mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in stretchr/testify#1786

suite: validate method signatures and continue execution for valid tests by @vyas-git in stretchr/testify#1665

assert.PanicsWithError: report error message by @olivergondza in stretchr/testify#1400

assert: IsIncreasing et al can return false w/out failing by @brackendawson in stretchr/testify#1787

add type to error message of assert.Same by @egawata in stretchr/testify#1792

mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in stretchr/testify#1795

assert: truncate very long objects in test failure messages by @brackendawson in stretchr/testify#1646

assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in stretchr/testify#1888

suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

CI: test also with Go 1.23 by @dolmen in stretchr/testify#1783

Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in stretchr/testify#1708

Promote ccoVeille to maintainer by @brackendawson in stretchr/testify#1784

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in stretchr/testify#1790

assert.YAMLEq: Document mutlidoc behavior by @brackendawson in stretchr/testify#1791

_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in stretchr/testify#1782

doc: remove ineffective inline code blocks by @brackendawson in stretchr/testify#1714

Tag generated assertions as non-generated in new .gitattributes by @ubunatic in stretchr/testify#1815

chore: vendor go-spew from https://github.com/davecgh/go-spew by @ccoVeille in stretchr/testify#1827

require: fix godoc generation for assertions returning a bool by @Baxromumarov in stretchr/testify#1850

docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @a2not in stretchr/testify#1821

docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @a2not in stretchr/testify#1842

EMERITUS.md: add @tylerb by @dolmen in stretchr/testify#1812

CI: test also with Go 1.24 by @alexandear in stretchr/testify#1856

deps: bump objx to v0.5.3 and remove dependency cycle issue by @ccoVeille in stretchr/testify#1823

CI: upgrade GitHub Actions and pin hashes by @SuperQ in stretchr/testify#1883

CI: add _readme-gofmt tool to reformat Go code in README by @dolmen in stretchr/testify#1889

CI: add check of GitHub Action pinned hashes against tag by @dolmen in stretchr/testify#1885

_codegen: modernize by @dolmen in stretchr/testify#1890

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in stretchr/testify#1906

mock: Mock.Return does not exist anymore by @Kentzo in stretchr/testify#1905

New Contributors

@mutaiib made their first contribution in stretchr/testify#1775

@vyas-git made their first contribution in stretchr/testify#1665

@olivergondza made their first contribution in stretchr/testify#1400

@egawata made their first contribution in stretchr/testify#1792

@ubunatic made their first contribution in stretchr/testify#1815

@Baxromumarov made their first contribution in stretchr/testify#1850

@a2not made their first contribution in stretchr/testify#1821

... (truncated)

Commits

001eb79 Merge pull request #1905 from Kentzo/patch-1
ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
f8c01f3 mock: Mock.Return does not exist anymore
12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
a11649e assert: make *AssertionFunc type just aliases
dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
098f8d7 _codegen: use strings.Builder
d2699be _codegen: modernize
a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…3 updates Bumps the go-weekly-rollup group with 3 updates in the / directory: [github.com/knights-analytics/hugot](https://github.com/knights-analytics/hugot), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) and [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/knights-analytics/hugot` from 0.7.4 to 0.7.7 - [Release notes](https://github.com/knights-analytics/hugot/releases) - [Changelog](https://github.com/knights-analytics/hugot/blob/main/CHANGELOG.md) - [Commits](knights-analytics/hugot@v0.7.4...v0.7.7) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) --- updated-dependencies: - dependency-name: github.com/knights-analytics/hugot dependency-version: 0.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-weekly-rollup - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-weekly-rollup - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-weekly-rollup ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-19T04:13:27Z

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Navigation Menu

chore(deps): bump the go-weekly-rollup group across 1 directory with 3 updates - #27

chore(deps): bump the go-weekly-rollup group across 1 directory with 3 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-weekly-rollup-b3124d02e1

dependabot Bot commented on behalf of github Aug 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.7.7

[0.7.7] - 2026-08-04

Changed

v0.7.6

[0.7.6] - 2026-07-24

Changed

v0.7.5

[0.7.5] - 2026-06-05

Changed

[0.7.7] - 2026-08-03

Changed

[0.7.6] - 2026-07-24

Changed

[0.7.5] - 2026-06-05

Changed

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

1.24.1 / 2026-07-23

1.24.0 / 2026-07-20

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

Uh oh!

dependabot Bot commented on behalf of github Aug 19, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 19, 2026 •

edited

Loading