.github/dependabot.yml

@@ -4,3 +4,19 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+  - package-ecosystem: "gomod"
+    directory: "/examples/middleware"
+    schedule:
+      interval: "monthly"
+  - package-ecosystem: "gomod"
+    directory: "/tutorial/whatsup"
+    schedule:
+      interval: "monthly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/automerge-dependabot.yml

@@ -0,0 +1,23 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/codeql-analysis.yml

@@ -20,6 +20,10 @@ on:
   schedule:
     - cron: '31 21 * * 6'
 
+# Minimal permissions to be inherited by any job that don't declare it's own permissions
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -38,11 +42,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +57,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -67,4 +71,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2

.github/workflows/go.yml

@@ -5,7 +5,11 @@ on:
   push:
     branches:
       - main
-      - 'release-*'
+      - "release-*"
+
+# Minimal permissions to be inherited by any job that don't declare it's own permissions
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -14,20 +18,20 @@ jobs:
 
     strategy:
       matrix:
-        go_version: ["1.18", "1.19", "1.20"]
+        go_version: ["1.20", "1.21", "1.22"]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.1
 
       - name: Set up Go ${{ matrix.go_version }}
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5.0.0
         with:
           go-version: ${{ matrix.go_version }}
 
       - name: Cache Go modules
         id: cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/go/pkg/mod
           key: v1-go${{ matrix.go_version }}
@@ -39,4 +43,4 @@ jobs:
 
       - name: Run style and unused
         if: ${{ matrix.go_version == '1.20' }}
-        run: make style unused
+        run: make style unused

.github/workflows/golangci-lint.yml

@@ -1,3 +1,5 @@
+---
+# This action is synced from https://github.com/prometheus/prometheus
 name: golangci-lint
 on:
   push:
@@ -10,29 +12,27 @@ on:
       - ".golangci.yml"
   pull_request:
 
-permissions:
-  contents: read  # to fetch code (actions/checkout)
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
 
 jobs:
   golangci:
     permissions:
-      contents: read  # to fetch code (actions/checkout)
-      pull-requests: read  # to fetch pull requests (golangci/golangci-lint-action)
-
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
     name: lint
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: 1.18.x
+          go-version: 1.20.x
       - name: Install snmp_exporter/generator dependencies
         run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
         if: github.repository == 'prometheus/snmp_exporter'
       - name: Lint
-        uses: golangci/golangci-lint-action@v3.4.0
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
-          args: --verbose
-          version: v1.51.2
+          version: v1.54.2

.golangci.yml

@@ -1,14 +1,15 @@
 ---
-
 run:
   deadline: 5m
+  skip-files:
+    # Skip autogenerated files.
+    - ^.*\.(pb|y)\.go$
 
 output:
   sort-results: true
 
 linters:
   enable:
-    - deadcode
     - depguard
     - durationcheck
     - errorlint
@@ -23,10 +24,8 @@ linters:
     - predeclared
     - revive
     - staticcheck
-    - structcheck
     - unconvert
     - unused
-    - varcheck
     - wastedassign
 
 issues:
@@ -39,9 +38,33 @@ issues:
         - structcheck
 
 linters-settings:
+  depguard:
+    rules:
+      main:
+        deny:
+        #- pkg: "sync/atomic"
+        #  desc: "Use go.uber.org/atomic instead of sync/atomic"
+        - pkg: "github.com/stretchr/testify/assert"
+          desc: "Use github.com/stretchr/testify/require instead of github.com/stretchr/testify/assert"
+        - pkg: "github.com/go-kit/kit/log"
+          desc: "Use github.com/go-kit/log instead of github.com/go-kit/kit/log"
+        - pkg: "io/ioutil"
+          desc: "Use corresponding 'os' or 'io' functions instead."
+        #- pkg: "regexp"
+        #  desc: "Use github.com/grafana/regexp instead of regexp"
   errcheck:
-    exclude: scripts/errcheck_excludes.txt
+    exclude-functions:
+      # The following 2 methods always return nil as the error
+      - (*github.com/cespare/xxhash/v2.Digest).Write
+      - (*github.com/cespare/xxhash/v2.Digest).WriteString
+      - (*bufio.Writer).WriteRune
   goimports:
     local-prefixes: github.com/prometheus/client_golang
   gofumpt:
     extra-rules: true
+  revive:
+    rules:
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter
+      - name: unused-parameter
+        severity: warning
+        disabled: true

CHANGELOG.md

@@ -1,5 +1,26 @@
 ## Unreleased
 
+## 1.19.0 / 2023-02-27
+
+The module `prometheus/common v0.48.0` introduced an incompatibility when used together with client_golang (See https://github.com/prometheus/client_golang/pull/1448 for more details). If your project uses client_golang and you want to use `prometheus/common v0.48.0` or higher, please update client_golang to v1.19.0.
+
+* [CHANGE] Minimum required go version is now 1.20 (we also test client_golang against new 1.22 version). #1445 #1449
+* [FEATURE] collectors: Add version collector. #1422 #1427
+
+## 1.18.0 / 2023-12-22
+
+* [FEATURE] promlint: Allow creation of custom metric validations. #1311
+* [FEATURE] Go programs using client_golang can be built in wasip1 OS. #1350
+* [BUGFIX] histograms: Add timer to reset ASAP after bucket limiting has happened. #1367
+* [BUGFIX] testutil: Fix comparison of metrics with empty Help strings. #1378
+* [ENHANCEMENT] Improved performance of `MetricVec.WithLabelValues(...)`. #1360
+
+## 1.17.0 / 2023-09-27
+
+* [CHANGE] Minimum required go version is now 1.19 (we also test client_golang against new 1.21 version). #1325
+* [FEATURE] Add support for Created Timestamps in Counters, Summaries and Historams. #1313
+* [ENHANCEMENT] Enable detection of a native histogram without observations. #1314
+
 ## 1.16.0 / 2023-06-15
 
 * [BUGFIX] api: Switch to POST for LabelNames, Series, and QueryExemplars. #1252
@@ -295,7 +316,7 @@ _This release removes all previously deprecated features, resulting in the break
 * [BUGFIX] Fixed goroutine leaks. #236 #472
 * [BUGFIX] Fixed an error message for exponential histogram buckets. #467
 * [BUGFIX] Fixed data race writing to the metric map. #401
-* [BUGFIX] API client: Decode JSON on a 4xx respons but do not on 204
+* [BUGFIX] API client: Decode JSON on a 4xx response but do not on 204
   responses. #476 #414
 
 ## 0.8.0 / 2016-08-17

MAINTAINERS.md

@@ -1,2 +1,3 @@
+* Arthur Silva Sens <arthursens2005@gmail.com> @ArthurSens
 * Bartłomiej Płotka <bwplotka@gmail.com> @bwplotka
 * Kemal Akkoyun <kakkoyun@gmail.com> @kakkoyun

Makefile

@@ -21,14 +21,18 @@ test: deps common-test
 test-short: deps common-test-short
 
 .PHONY: generate-go-collector-test-files
-VERSIONS := 1.17 1.18 1.19 1.20
+VERSIONS := 1.20 1.21 1.22
 generate-go-collector-test-files:
 	for GO_VERSION in $(VERSIONS); do \
-    	docker run --rm -v $(PWD):/workspace -w /workspace golang:$$GO_VERSION go run prometheus/gen_go_collector_metrics_set.go; \
-		mv -f go_collector_metrics* prometheus; \
-    done
+		docker run \
+			--platform linux/amd64 \
+			--rm -v $(PWD):/workspace \
+			-w /workspace \
+			golang:$$GO_VERSION \
+			bash ./generate-go-collector.bash; \
+	done; \
+	go mod tidy
 
 .PHONY: fmt
 fmt: common-format
 	$(GOIMPORTS) -local github.com/prometheus/client_golang -w .
-

Makefile.common

@@ -49,19 +49,19 @@ endif
 GOTEST := $(GO) test
 GOTEST_DIR :=
 ifneq ($(CIRCLE_JOB),)
-ifneq ($(shell which gotestsum),)
+ifneq ($(shell command -v gotestsum > /dev/null),)
 	GOTEST_DIR := test-results
 	GOTEST := gotestsum --junitfile $(GOTEST_DIR)/unit-tests.xml --
 endif
 endif
 
-PROMU_VERSION ?= 0.14.0
+PROMU_VERSION ?= 0.15.0
 PROMU_URL     := https://github.com/prometheus/promu/releases/download/v$(PROMU_VERSION)/promu-$(PROMU_VERSION).$(GO_BUILD_PLATFORM).tar.gz
 
 SKIP_GOLANGCI_LINT :=
 GOLANGCI_LINT :=
 GOLANGCI_LINT_OPTS ?=
-GOLANGCI_LINT_VERSION ?= v1.51.2
+GOLANGCI_LINT_VERSION ?= v1.54.2
 # golangci-lint only supports linux, darwin and windows platforms on i386/amd64.
 # windows isn't included here because of the path separator being different.
 ifeq ($(GOHOSTOS),$(filter $(GOHOSTOS),linux darwin))
@@ -178,7 +178,7 @@ endif
 .PHONY: common-yamllint
 common-yamllint:
 	@echo ">> running yamllint on all YAML files in the repository"
-ifeq (, $(shell which yamllint))
+ifeq (, $(shell command -v yamllint > /dev/null))
 	@echo "yamllint not installed so skipping"
 else
 	yamllint .

README.md

@@ -10,13 +10,14 @@ This is the [Go](http://golang.org) client library for
 instrumenting application code, and one for creating clients that talk to the
 Prometheus HTTP API.
 
-__This library requires Go1.18 or later.__
+**This library requires Go1.20 or later.**
+> The library mandates the use of Go1.20 or subsequent versions. While it has demonstrated functionality with versions as old as Go 1.17, our commitment remains to offer support and rectifications for only the most recent three major releases.
 
 ## Important note about releases and stability
 
 This repository generally follows [Semantic
 Versioning](https://semver.org/). However, the API client in
-prometheus/client_golang/api/… is still considered experimental. Breaking
+`prometheus/client_golang/api/…` is still considered experimental. Breaking
 changes of the API client will _not_ trigger a new major release. The same is
 true for selected other new features explicitly marked as **EXPERIMENTAL** in
 CHANGELOG.md.
@@ -83,7 +84,7 @@ To cut a minor version:
 7. Announce on the prometheus-announce mailing list, slack and Twitter.
 8. Merge the release branch back to the `main` using the "merge without squashing" approach (!).
 
-> NOTE: In case of merge conflicts, you can checkout the release branch in a new branch, e.g. <yourname>/resolve-conflicts`, fix the merge problems there, and then do a PR into main from the new branch. In that way, you still get all the commits in the release branch back into `main`, but leave the release branch alone.
+> NOTE: In case of merge conflicts, you can checkout the release branch in a new branch, e.g. `<yourname>/resolve-conflicts`, fix the merge problems there, and then do a PR into main from the new branch. In that way, you still get all the commits in the release branch back into `main`, but leave the release branch alone.
 
 To cut the patch version:
 

VERSION

@@ -1 +1 @@
-1.16.0
+1.19.1

api/prometheus/v1/api_test.go

@@ -1441,7 +1441,7 @@ func TestAPIClientDo(t *testing.T) {
 				}
 			} else {
 				if warnings != nil {
-					t.Fatalf("unexpexted warnings: %v", warnings)
+					t.Fatalf("unexpected warnings: %v", warnings)
 				}
 			}
 

api/prometheus/v1/example_test.go

@@ -135,7 +135,7 @@ func ExampleAPI_queryRangeWithBasicAuth() {
 	client, err := api.NewClient(api.Config{
 		Address: "http://demo.robustperception.io:9090",
 		// We can use amazing github.com/prometheus/common/config helper!
-		RoundTripper: config.NewBasicAuthRoundTripper("me", "defintely_me", "", api.DefaultRoundTripper),
+		RoundTripper: config.NewBasicAuthRoundTripper("me", "definitely_me", "", "", api.DefaultRoundTripper),
 	})
 	if err != nil {
 		fmt.Printf("Error creating client: %v\n", err)