build(deps): Bump github.com/prometheus/common from 0.70.1 to 0.71.0

[dependabot]

Bumps github.com/prometheus/common from 0.70.1 to 0.71.0.

Release notes

Sourced from github.com/prometheus/common's releases.

v0.71.0

What's Changed

• Synchronize common files from prometheus/prometheus by @​prombot in prometheus/common#957
• build(deps): bump the codeql group across 1 directory with 4 updates by @​dependabot[bot] in prometheus/common#955
• Synchronize common files from prometheus/prometheus by @​prombot in prometheus/common#958
• fix: use slog.DiscardHandler in promslog.NopLogger by @​FUSAKLA in prometheus/common#960
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in prometheus/common#956
• Synchronize common files from prometheus/prometheus by @​prombot in prometheus/common#959
• Synchronize common files from prometheus/prometheus by @​prombot in prometheus/common#961
• feat: implement gauge and counter support for OpenMetrics 2.0 by @​dashpole in prometheus/common#894
• fix: support exemplars with empty label sets in OpenMetrics 2.0 by @​dashpole in prometheus/common#965
• model: sort label names without boxing them into sort.Interface by @​SoloJacobs in prometheus/common#963
• expfmt: fix wildcard content negotiation regression for Negotiate and NegotiateIncludingOpenMetrics by @​dashpole in prometheus/common#966
• expfmt: precompute parsed goautoneg.Accept for well-known Format constants by @​dashpole in prometheus/common#967
• expfmt: format OpenMetrics 2.0 float values and validate units by @​dashpole in prometheus/common#969
• fix: drop invalid OpenMetrics 2.0 exemplars instead of failing exposition by @​dashpole in prometheus/common#970
• model: add Duration unit constants and conversion methods by @​locker95 in prometheus/common#952
• expfmt: prevent st@ leaking to Gauge and Untyped samples in OpenMetrics 2.0 by @​dashpole in prometheus/common#971
• expfmt: fix OpenMetrics 2.0 decoder error, format docs, and encoder version dispatch by @​dashpole in prometheus/common#968
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @​dependabot[bot] in prometheus/common#977
• build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @​dependabot[bot] in prometheus/common#976
• build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 in the golang-org-x group across 1 directory by @​dependabot[bot] in prometheus/common#975
• Update dependabot config by @​SuperQ in prometheus/common#978
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in /assets by @​dependabot[bot] in prometheus/common#979

New Contributors

• @​SoloJacobs made their first contribution in prometheus/common#963
• @​locker95 made their first contribution in prometheus/common#952

Full Changelog: prometheus/common@v0.70.1...v0.71.0

Commits

• 9a4aff0 build(deps): bump github.com/stretchr/testify in /assets (#979)
• 483bb89 Update dependabot config (#978)
• d29e1ea build(deps): bump golang.org/x/net (#975)
• e531bd2 build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#976)
• bc3fc3a build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#977)
• 15e9f45 expfmt: fix OpenMetrics 2.0 decoder error, format docs, and encoder version d...
• 0acfdb3 expfmt: prevent st@ leaking to Gauge and Untyped samples in OpenMetrics 2.0 (...
• eb72e27 model: add Duration unit constants and conversion methods (#952)
• 67b7d90 fix: drop invalid OpenMetrics 2.0 exemplars instead of failing exposition (#970)
• 715ac36 expfmt: format OpenMetrics 2.0 float values and validate units (#969)
• Additional commits viewable in compare view

[Claudius-Maginificent]

🔒 Security Audit — Dependency Bump

Verdict: SAFE to merge. No security findings. Audited per the review-dependency methodology; a green CI run was treated as insufficient evidence on its own, so the upstream source diff was read directly.

1. What actually changed (the title undersells it)

The PR advertises one bump. The commit contains two version changes plus a 331-line reshuffle of go.mod:

Module	From	To	Declared in PR?
github.com/prometheus/common	0.70.1	0.71.0	Yes
google.golang.org/protobuf	1.36.11	1.36.12	No — undeclared

The undeclared protobuf bump is explained and legitimate: prometheus/common bumped its own protobuf dependency upstream (prometheus/common#976), and go mod tidy propagated it into this module graph. It is not an injected change.

I normalised both manifests and diffed them ignoring ordering. Result: exactly those two versions changed — nothing else. The remaining ~331 lines of go.mod churn is pure go mod tidy require-block regrouping (direct/indirect), with zero other version movement. Verified via:

git show HEAD~1:go.mod | grep -oE '<module> v<ver>' | sort -u   # vs HEAD

2. Supply-chain integrity ✅

• Checksum-DB verified. Both go.sum entries match sum.golang.org (the public transparency log) byte-for-byte:
  • prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8= ✅
  • protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= ✅
• Anomaly investigated and cleared. protobuf's /go.mod hash is byte-identical across 1.36.11 → 1.36.12. Confirmed benign: the go.mod files are genuinely identical (sha256 a75c105a… for both) because the release changed no dependencies. Not a moved tag, not tampering.
• Tag integrity. v0.71.0 resolves to commit 9a4aff03c12e71d3fc29e32a4581deb8e456d88e, consistent with the published release.
• No install/lifecycle hooks, no obfuscation, no new outbound network calls, no new env/credential reads in the upstream diff. CI workflow changes are GitHub Actions version bumps, all pinned by full commit SHA.

3. Known vulnerabilities

Source	prometheus/common 0.71.0	protobuf 1.36.12
OSV.dev	None	None
GitHub Advisory DB	None	None
NVD / web search	None applicable	None applicable

Both the old and new versions are clean, so this is a hygiene bump, not a security fix. protobuf 1.36.12 is a maintenance release (regenerated types, doc updates).

Adjacent check (due diligence): GHSA-cg3q-j54f-5p7p (High, uncontrolled resource consumption in promhttp) affects client_golang < 1.11.1. This repo pins 1.24.1 — not affected.

4. Upstream code review — prometheus/common v0.70.1..v0.71.0

22 commits, 1812 insertions. I read every non-test source change. The bulk is new OpenMetrics 2.0 encode-only support, plus a content-negotiation refactor. Findings:

• Content negotiation rewrite (expfmt/encode.go) — the security-relevant one, since Accept is attacker-influenced on an exposed /metrics endpoint. Negotiate/NegotiateIncludingOpenMetrics become wrappers over a new NegotiateAccept(h, accepted...). No header-injection risk (CWE-113): the client-supplied escaping parameter is whitelist-validated against four known constants before it can reach the Content-Type value; unknown values are ignored, not echoed. Wildcard (*/*) handling still resolves to the text format, preserving prior behaviour. A client can only select formats the server explicitly lists.
• New OpenMetrics 2.0 encoder (openmetrics_2_0_create.go, 425 lines) — defensively written: explicit validateLabels20, validateExemplar20, validateNativeHistogram, validateSpansAndBuckets, and a containsRawNewline guard that blocks \n/\r injection into the exposition format. Contains no unsafe, reflect, exec, filesystem, or network usage. Bounds checked: writeNanos' pad := 9 - len(*bp) cannot go negative because timestamppb.CheckValid() constrains nanos to [0, 1e9); a negative for range is a no-op in any case.
• Reachability: the 2.0 encoder is gated behind the unexported fmtOpenMetrics_2_0_0 and is absent from the NegotiateIncludingOpenMetrics list — it is unreachable via content negotiation and requires an explicit opt-in this repo does not make.
• Decoder hardening (expfmt/decode.go) — now explicitly rejects OpenMetrics 2.0 rather than silently mis-parsing it as legacy text. A fail-closed improvement.
• sort.Sort(LabelNames) → slices.Sort (model/signature.go) — scrutinised because a changed ordering would silently alter fingerprint hashes. LabelNames.Less was l[i] < l[j], i.e. plain lexicographic, so the two are semantically identical. No fingerprint/signature change.
• Remainder (model/time.go duration constants, promslog slog.DiscardHandler, doc typo fixes) is inert.

5. Blast radius in this repo

• Only direct import site: scripts/metricsgen/metricsdiff/metricsdiff.go:17-18, using expfmt.NewTextParser(model.UTF8Validation) on local files passed as CLI args — developer tooling, not the node runtime, and not attacker-controlled input.
• That API lives in expfmt/text_parse.go, which this release does not modify at all — proven by identical git blob hashes across the two tags (text_parse.go = 4ce1f40b…, model/labels.go = 29688a13… in both v0.70.1 and v0.71.0). The code path this repo calls directly is byte-for-byte unchanged.
• The changed negotiation code is reachable only transitively via client_golang's promhttp handler, where the behaviour is preserved and input is whitelist-validated as above.

Given tenderdash is a consensus-critical node, I specifically checked for consensus-affecting behaviour: this library touches metrics/observability only, no crypto, no consensus, no P2P serialisation. The one change with hashing implications (label sorting) was verified order-preserving.

6. Corroboration from parallel reviewers

A project-consistency pass was run independently and reproduced the version delta exactly:

• go mod tidy -diff → exit 0, zero differences — this go.mod is already the canonical tidy output.
• go mod verify → all modules verified.
• Zero direct/indirect reclassifications, zero modules added or removed, exactly two version changes — matching my independent normalised diff.
• No leftover go.sum entries for the superseded versions; no duplicate prometheus/protobuf pins in Dockerfiles, Makefile, tools.go, or .golangci.yml.
• go build ./scripts/metricsgen/... (the only package consuming this library) → exit 0, no API breakage.

The 331-line churn is the base branch's pre-existing go.mod drift being normalised — the base was not tidy-clean, and Dependabot tidied it in passing.

Non-blocking observations for follow-up (not defects in this PR):

1. No CI gate enforces go mod tidy, which is how the base drifted far enough for a one-line bump to produce a 331-line diff. A go mod tidy -diff step (Go 1.23+; this repo is on 1.27.1) would prevent recurrence — and, from a review-integrity standpoint, remove a large noise channel in which a genuine change could pass unnoticed.
2. test/fuzz/oss-fuzz-build.sh:17 hard-pins github.com/prometheus/common/expfmt@v0.32.1, now far behind. Risk is nil — the script is referenced by no workflow and has been broken since 2022 (its FUZZ_ROOT still points at github.com/tendermint/tendermint) — but it is stale and worth deleting or fixing separately.
3. Worth one line in the PR body noting the transitive protobuf bump, so a reviewer reading only the title knows it moved.

7. Verification performed

govulncheck in CI was confirmed to have genuinely executed rather than silently skipped (No vulnerabilities found. in the job log), and all 16 checks pass on the audited SHA fd57e90. Per the review methodology, that scan is treated as corroboration only — the verdict rests on the source review above.

8. Risk assessment

Overall: Safe. Clean transparency-log provenance, no advisories against either version, no undocumented or suspicious content in the upstream diff, and the directly-consumed API surface is untouched. The single undeclared change (protobuf) is accounted for upstream.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[Claudius-Maginificent]

Addendum — runtime verification

Follow-up evidence from an independent adversarial pass, completed after the audit above. It does not change the Safe verdict; it strengthens it.

• Built for real, not assumed. Full CGO build with the BLS submodule initialised: make build-binary → exit 0, and the resulting binary executes (tenderdash version reports the PR SHA). go build -tags 'tenderdash netgo osusergo' ./... → exit 0.
• govulncheck run locally as well as in CI → 0 vulnerabilities in called code and in imported packages. (Toolchain note for anyone reproducing: install it with GOTOOLCHAIN=go1.27.1 from inside the module, or the binary resolves against the wrong toolchain and emits spurious cross-version errors.)
• google.golang.org/protobuf has zero direct call sites in this repo. Consensus/ABCI/P2P wire (de)serialisation goes through github.com/cosmos/gogoproto (confirmed in the generated .pb.go import blocks); google.golang.org/protobuf is purely // indirect. The v1.36.12 changes live in encoding/protojson, encoding/prototext, and protodesc — none of which this codebase calls. Blast radius on the consensus-critical path: nil.
• The metrics endpoint is disabled by default (config/config.go, DefaultInstrumentationConfig() sets Prometheus: false; binds :26660 only when explicitly enabled) and is served by promhttp.HandlerFor — an encode path emitting the node's own metrics, not a parser of untrusted input. This further narrows the already-small exposure of the changed expfmt negotiation code.
• Pre-existing, unrelated: go vet reports 4 findings (test/e2e/pkg/testnet.go:385,450,468; dash/quorum/nodeid_resolver.go:40). Confirmed not caused by this PR — its diff touches only go.mod/go.sum, and the branch is cut from a base predating the fix commit 789158d15. Flagged so nobody later misattributes them to this bump.

Separately, and out of scope for this PR: govulncheck reports three advisories against golang.org/x/crypto@v0.55.0 (GO-2026-6355, GO-2026-6354 — SSH DoS; GO-2026-5932 — unmaintained openpgp). All are in required-but-uncalled modules, so there is no reachable exposure today, and none relate to this bump. Worth a separate ticket rather than blocking a metrics-library update.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase