Update Go module dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/common	v0.67.2 -> v0.67.3
google.golang.org/grpc	v1.76.0 -> v1.77.0

---

Release Notes

prometheus/common (github.com/prometheus/common)

v0.67.3: / 2025-11-18

Compare Source

What's Changed

• Support JWT Profile for Authorization Grant (RFC 7523 3.1) by @​JorTurFer in #​862
• Config: remove outdated comment about HTTP/2 issues by @​bboreham in #​863

New Contributors

• @​JorTurFer made their first contribution in #​862

Full Changelog: prometheus/common@v0.67.2...v0.67.3

grpc/grpc-go (google.golang.org/grpc)

v1.77.0: Release 1.77.0

Compare Source

API Changes

• mem: Replace the Reader interface with a struct for better performance and maintainability. (#​8669)

Behavior Changes

• balancer/pickfirst: Remove support for the old pick_first LB policy via the environment variable GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false. The new pick_first has been the default since v1.71.0. (#​8672)

Bug Fixes

• xdsclient: Fix a race condition in the ADS stream implementation that could result in resource-not-found errors, causing the gRPC client channel to move to TransientFailure. (#​8605)
• client: Ignore HTTP status header for gRPC streams. (#​8548)
• client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. (#​8534)
  • Special Thanks: @​jgold2-stripe
• client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy.
  • Setting environment variable GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false disables this change; please file a bug if any problems are encountered as we will remove this option soon. (#​8613)
• balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. (#​8611)
• server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. (#​8573)
  • Special Thanks: @​hugehoo
• balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to pick_first but don't set endpoints. (#​8610)
• mem: Clear large buffers before re-using. (#​8670)

Performance Improvements

• transport: Reduce heap allocations to reduce time spent in garbage collection. (#​8624, #​8630, #​8639, #​8668)
• transport: Avoid copies when reading and writing Data frames. (#​8657, #​8667)
• mem: Avoid clearing newly allocated buffers. (#​8670)

New Features

• outlierdetection: Add metrics specified in gRFC A91. (#​8644)
  • Special Thanks: @​davinci26, @​PardhuKonakanchi
• stats/opentelemetry: Add support for optional label grpc.lb.backend_service in per-call metrics (#​8637)
• xds: Add support for JWT Call Credentials as specified in gRFC A97. Set environment variable GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true to enable this feature. (#​8536)
  • Special Thanks: @​dimpavloff
• experimental/stats: Add support for up/down counters. (#​8581)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
github.com/cncf/xds/go	v0.0.0-20250501225837-2ac532fd4443 -> v0.0.0-20251022180443-0feb69152e9f
golang.org/x/net	v0.46.0 -> v0.46.1-0.20251013234738-63d1a5100f82
google.golang.org/genproto/googleapis/api	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8

File name: tests/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.46.0 -> v0.46.1-0.20251013234738-63d1a5100f82
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8
google.golang.org/grpc	v1.76.0 -> v1.77.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.08%. Comparing base (e3e7ae1) to head (fa2fbb2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4307      +/-   ##
==========================================
- Coverage   86.10%   86.08%   -0.03%     
==========================================
  Files         132      132              
  Lines       14342    14342              
  Branches       35       35              
==========================================
- Hits        12349    12346       -3     
- Misses       1790     1792       +2     
- Partials      203      204       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.