upgrade to latest dependencies (#3972)

bumping golang.org/x/net 9e7fdbf...b8f09f6:
  > b8f09f6 go.mod: update golang.org/x dependencies
  > f05f21b idna: reject all-ASCII xn-- labels on all Go versions
  > 0f748cf internal/http3: clean up stream I/O methods usages in tests
  > 0bb961e internal/http3: add net/http.ResponseController support
  > 0ca694d webdav: document Dir's lack of defense against filesystem modification
  > bd5f1dc http2: initialize Transport on NewClientConn
  > 488ff63 bpf: add security considerations to package docs
  > 93d1f25 xsrftoken: avoid token collisions
  > 5a3baee internal/http3: prevent panic in QPACK decoder due to overflow
bumping google.golang.org/protobuf 96a1791...f2248ac:
  > f2248ac reflect/protodesc: add missing IsProto3Optional initialization
  > 86e4605 compiler/protogen: document --go_opt in addition to --go_out
  > 8c4c4ae internal/descfmt: replace uses of MethodByName with direct calls when possible
  > 9b1c943 types: regenerate using latest protobuf v33.3 release
  > 8b39a84 encoding/protojson: fix google.protobuf.Empty serialization
  > 20262ed encoding/prototext: implement recursion limit
  > e9def1a encoding/protodelim: error out when size exceeds math.MaxInt
  > cb6ac5a internal/descfmt: fix dce with Go 1.26 by not calling MethodByName for Methods
  > 232b109 encoding/protojson: reject non-numeric ints/floats
  > 60bc867 compiler/protogen: introduce and expose feature resoluton to protogen
  > f10681a all: start v1.36.11-devel
bumping go.yaml.in/yaml/v3 c3552c1...e16c7af:
  > e16c7af Remove empty go.sum file
  > 6abcd01 Fix unhandled nil-errors in tests
  > 9481db7 Remove suite_test.go and gopkg.in/check.v1
  > 485f5fc Use standard testing library for limit_test.go
  > 3e00046 Use standard testing library for node_test.go
  > f612058 Use standard testing library for decode_test.go
  > 078f958 Use standard testing library encode_test.go
  > 3847ac0 [v3] backport CodeQL workflow
  > 1666663 Revert incorrect gofmt changes
  > 73290cb Retract v3 tags that cannot be installed
bumping github.com/klauspost/compress c5e0077...2602f4a:
  > 2602f4a Update changelog for version 1.19.0
  > 983acec add defensive checks
  > 9960386 zstd: Validate SnappyConverter literal copies (# 1170)
  > e29d4d3 flate: use `Peek` instead of `ReadByte` for the `bufio.Reader` decode path (# 1169)
  > c0bbc84 zstd: bump avo pin, regenerate arm64 asm (# 1167)
  > efdb6ed build(deps): bump the github-actions group with 6 updates (# 1166)
  > f0953f9 flate: fix buffer formatting in tests (# 1165)
  > ab2e3cc zstd: Add arm64 decoder asm (# 1160)
  > bb2723d Merge commit from fork
  > 539243b s2sx: Clean symlink targets (# 1163)
  > bd9228c Apply go fix and check in CI (# 1158)
  > 4cc176c zstd: Add true concurrent stream encoding (# 1136)
  > 4705fcb build(deps): bump the github-actions group with 3 updates (# 1157)
  > e9c2e56 huff0: Allow building table from oversized histogram. (# 1156)
  > ecdb779 huff0: Allow building tables from histogram. (# 1155)
  > 38efa45 zip: add NameDecoder callback for legacy encoding rewrite (# 1150)
  > 5b9abed flate: Add inflate checkpoints (# 1154)
  > dba8e6f gzhttp: match qvalue parameter case-insensitively (RFC 7231) (# 1149)
  > 0434480 snappy/s2: Limit length of varint in `decodedLen` (# 1148)
  > fdcc9b6 zstd: avoid unused BuildDict encoder allocation (# 1147)
  > 28ae503 build(deps): bump the github-actions group with 2 updates (# 1146)
  > ac2f5e8 docs: use unix line-endings for markdown files (# 1144)
  > 620d7b5 s2: Fix amd64 stack frame corruption (# 1145)
  > 1b63f2f build(deps): bump the github-actions group with 2 updates (# 1141)
  > 3d86b89 s2: pool hash tables in Go encode paths to reduce allocations (# 1143)
  > 15967de gzhttp: Canonicalize ETag header (# 1139)
bumping golang.org/x/crypto 45460e0...cdce021:
  > cdce021 go.mod: update golang.org/x dependencies
  > d9474cc openpgp: make the deprecation message more explicit
  > 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
  > 0471e79 ssh/agent: enforce strict limits on DSA key parameters
  > 6435c37 ssh: sanitize client disconnect messages
  > 7d695da ssh/agent: drain channel stderr in agent forwarders
  > 5b7f841 acme/autocert: fix data race in Manager.createCert
  > 0b316e7 argon2: update RFC 9106 parameter recommendations
  > 55aec0a x509roots/fallback: update bundle
  > 5f2de1a internal: remove wycheproof tests
bumping knative.dev/client/pkg cc108d6...00c078d:
  > 00c078d upgrade to latest dependencies (# 2252)
bumping k8s.io/apiextensions-apiserver 020c736...226e148:
  > 226e148 Update dependencies to v0.35.7 tag
  > b00b157 Merge pull request # 140030 from kmala/release-1.35
  > a88ac37 Merge pull request # 139666 from kmala/automated-cherry-pick-of-# 137451-upstream-release-1.35
  > 293632b Fix vet error
  > 5663d3e Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
bumping github.com/prometheus/client_golang 8179a56...d6087ee:
  > d6087ee release: cut v1.24.1 (# 2076)
  > 48dd383 Cut v1.24.0 (# 2061)
  > a725305 Cut v1.24.0-rc.0 (# 2058)
  > 77c584f build(deps): update all Go dependencies in all go.mod files (# 2059)
  > 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather calls (# 1969)
  > 34e9a7f Merge pull request # 2055 from prombot/repo_sync
  > de19217 examples: improve simple main.go example (# 1999)
  > 43749bc Update common Prometheus files
  > 20355eb fix: correct typos in comments and test error messages (# 2049)
  > 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased drift) (# 2050)
  > b0d896b Replace deprecated model.NameValidationScheme with explicit UTF8Validation (# 2051)
  > e0b7a44 promhttp: don't panic when instrumenting with non-exemplar observers (# 2005)
  > 2c6e6c1 Merge pull request # 2047 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.19.0
  > 0f73d8c Merge pull request # 2048 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.19.0
  > f794d60 build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0
  > f63424d Merge pull request # 2046 from prometheus/superq/update_dependabot
  > c769884 build(deps): bump github.com/klauspost/compress in /exp
  > 832cec7 chores: remove example Dockerfile and container_description.yaml (# 2044)
  > 2ad3d55 Update dependabot config
  > 7dc915d build(deps): bump the github-actions group across 1 directory with 5 updates (# 2043)
  > cee63a1 Merge pull request # 2042 from prometheus/dependabot/go_modules/tutorials/whatsup/golang.org/x/net-0.55.0
  > 92e7bbd fix(api): fall back to GET on forbidden POSTs (# 2030)
  > 4165860 build(deps): bump golang.org/x/net in /tutorials/whatsup
  > 7d30a88 Update common Prometheus files (# 2041)
  > a2061d5 Merge pull request # 2038 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.18.7
  > a97b0bc Merge pull request # 2035 from prometheus/dependabot/go_modules/github.com/prometheus/procfs-0.21.1
  > 869b52c build(deps): bump github.com/klauspost/compress in /exp
  > e42eb67 Merge pull request # 2036 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.7
  > b134d1b build(deps): bump github.com/prometheus/procfs from 0.21.0 to 0.21.1
  > b60fbc2 Merge pull request # 2033 from prometheus/dependabot/go_modules/github.com/prometheus/procfs-0.21.0
  > e6d1b75 build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7
  > 28914d0 Update common Prometheus files (# 2028)
  > 913041f build(deps): bump github.com/prometheus/procfs from 0.20.1 to 0.21.0
  > 0bc3864 Merge pull request # 2026 from prometheus/dependabot/go_modules/golang.org/x/sys-0.46.0
  > 45d1ee3 Merge pull request # 2027 from prometheus/dependabot/go_modules/exp/github.com/prometheus/common-0.69.0
  > 8976f37 build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0
  > 41943db Merge pull request # 2025 from prometheus/dependabot/go_modules/github.com/prometheus/common-0.69.0
  > bd96974 build(deps): bump github.com/prometheus/common in /exp
  > e34f51c Update common Prometheus files (# 2013)
  > aa7b6f3 build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0
  > 7456005 refactor: replace interface{} with any (Go 1.18+) (# 2021)
  > 6601282 Merge pull request # 2012 from immanuwell/fix/unkeyed-samplepair-struct-literals
  > 443f1ce Merge pull request # 2023 from s3onghyun/docs-fix-exemplar-grammar
  > b65f296 fix: use keyed fields in SamplePair struct literals in api_test.go
  > 3537b20 Merge pull request # 2017 from prometheus/dependabot/go_modules/exp/github.com/prometheus/common-0.68.0
  > 17425b5 promhttp: fix grammar in exemplar option doc comments
  > 02eaf49 Merge pull request # 2011 from roidelapluie/roidelapluie/gh-token-migrate
  > c8f27d6 Merge pull request # 2014 from prometheus/dependabot/go_modules/golang.org/x/sys-0.45.0
  > dac39bc build(deps): bump github.com/prometheus/common in /exp
  > d61fb3f docs: fix typos and godoc example indentation in timer.go and wrap.go (# 2009)
  > 0c2bb5d ci: harden actions/checkout with persist-credentials: false
  > 79920b9 Merge pull request # 2016 from prometheus/dependabot/github_actions/github-actions-a7568dddb0
  > 44eaaf8 build(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0
  > c9d5bc4 Merge pull request # 2003 from arpitjain099/ci/add-permissions
  > 6576eae Merge pull request # 2015 from prometheus/dependabot/go_modules/github.com/prometheus/common-0.68.0
  > 55fba5e build(deps): bump the github-actions group with 2 updates
  > e839fba build(deps): bump the github-actions group across 1 directory with 4 updates (# 1994)
  > fdf5437 ci(update-go-versions): declare contents: write + pull-requests: write
  > 7f85956 promhttp: add regression test for concurrent map writes (# 1274) (# 2000)
  > 58820a1 build(deps): bump github.com/prometheus/common
  > 99805a2 Merge pull request # 2001 from prometheus/repo_sync
  > 6dd4625 Merge pull request # 2008 from prombot/repo_sync
  > 0ac87e1 Merge pull request # 1996 from roidelapluie/roidelapluie/remote-write-io-limiter
  > 8255910 Update common Prometheus files
  > 5654a21 Merge pull request # 2010 from ProjectMutilation/fix-handle-leak
  > 951d1bb Update common Prometheus files
  > f695195 Merge pull request # 1995 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.18.6
  > 0b88ca2 exp/api/remote: limit request body size in SnappyDecodeMiddleware
  > 08baa43 fix(registry): prevent file descriptor leak in WriteToTextfile
  > 8d6cc52 Merge pull request # 1992 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.6
  > eb21b3a build(deps): bump github.com/klauspost/compress in /exp
  > df048ad Merge pull request # 1993 from prometheus/dependabot/go_modules/golang.org/x/sys-0.43.0
  > b31e5ee build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6
  > 79042c6 Fix bug unit cpu-seconds not a suffix of metric go_cpu_classes_gc_mark_assist_cpu_seconds (# 1991)
  > 5048e61 build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0
  > 773db0a Merge pull request # 1988 from prometheus/repo_sync
  > 066715b Merge pull request # 1863 from tie/main
  > 2726199 Update common Prometheus files
  > 9f0fd78 Merge pull request # 1985 from prometheus/repo_sync
  > bef13f1 Merge branch 'main' into main
  > 42dc83b Merge pull request # 1984 from prometheus/repo_sync
  > 613bbf1 Update common Prometheus files
  > 70db6c8 promhttp: implement WithXFromContext in terms of WithXFromRequest
  > 3b25349 Merge pull request # 1966 from Retr0-XD/fix/processcollector-pidfn-1960
  > 75516ac Update common Prometheus files
  > bf37be4 Merge pull request # 1947 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.18.3
  > 71e2e02 Merge pull request # 1968 from kakkoyun/kakkoyun/ci_multios
  > e31ff12 Merge branch 'main' into fix/processcollector-pidfn-1960
  > e330c7f Merge pull request # 1945 from prometheus/dependabot/go_modules/golang.org/x/sys-0.40.0
  > 6e8513a build(deps): bump github.com/klauspost/compress in /exp
  > 5f35560 Merge pull request # 1981 from thegdsks/examples/native-histogram
  > 1f77272 Merge branch 'main' into kakkoyun/ci_multios
  > 419d80d Merge branch 'main' into fix/processcollector-pidfn-1960
  > fd608b1 Merge pull request # 1944 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.3
  > 8b1d72f Merge branch 'main' into dependabot/go_modules/golang.org/x/sys-0.40.0
  > 32d05ff Merge pull request # 1980 from prometheus/repo_sync
  > 9442b41 examples: add native histogram usage example
  > 734f49c Update prometheus/process_collector_darwin_test.go
  > d0d5921 prometheus: clarify darwin unsupported pid error reason
  > d8591d0 prometheus: clarify MetricVec delete semantics in godoc (# 1967)
  > 9351edd Merge pull request # 1946 from prometheus/dependabot/github_actions/github-actions-10f98d0e93
  > f323ac8 Merge branch 'main' into dependabot/go_modules/github.com/klauspost/compress-1.18.3
  > 7aa741a build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0
  > 1b72664 feat(collector): add Go 1.26 new runtime metrics (# 1942)
  > c270356 Merge pull request # 1977 from prometheus/repo_sync
  > 9de1176 Update common Prometheus files
  > 4980c0f Merge branch 'main' into kakkoyun/ci_multios
  > 4a736c2 prometheus: honor PidFn on windows and darwin
  > 8f78afd fix: recover from collector panic and return error in Gather (# 1961)
  > 8806ac2 Merge pull request # 1948 from prometheus/dependabot/go_modules/exp/github.com/prometheus/common-0.67.5
  > 6821feb Merge branch 'main' into dependabot/github_actions/github-actions-10f98d0e93
  > 28ecd6b build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3
  > fb0838f promhttp/zstd: add unit tests for zstd writer registration (# 1929)
  > a498428 Merge pull request # 1978 from prometheus/dependabot/go_modules/tutorials/whatsup/go.opentelemetry.io/otel/sdk-1.43.0
  > 1335b60 Update common Prometheus files
  > 1bbcff3 Merge branch 'main' into kakkoyun/ci_multios
  > b7f72b4 fix: respect context cancellation in httpClient.Do (# 1971)
  > 2163552 Merge pull request # 1965 from prometheus/dependabot/go_modules/tutorials/whatsup/google.golang.org/grpc-1.79.3
  > 8951891 Merge branch 'main' into dependabot/go_modules/exp/github.com/prometheus/common-0.67.5
  > 523aee0 build(deps): bump the github-actions group with 4 updates
  > 9d1490b build(deps): bump the github-actions group with 5 updates (# 1934)
  > 6cc4d42 build(deps): bump go.opentelemetry.io/otel/sdk in /tutorials/whatsup
  > d9092ce ci: add Linux arm64 test runner
  > f23aad5 add optional, explicit OM unit support  (# 1392)
  > da7ec92 Update api/client_test.go
  > 167edc1 Remove Arthur from the list of maintainers (# 1964)
  > b5ce672 build(deps): bump google.golang.org/grpc in /tutorials/whatsup
  > 60754c5 build(deps): bump github.com/prometheus/common in /exp
  > 2cd067e Merge pull request # 1935 from prometheus/dependabot/go_modules/exp/google.golang.org/protobuf-1.36.11
  > 1544594 refactor(test): use filename-based OS constraints for process collector tests
  > af7f59c Merge pull request # 1976 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.18.5
  > 4ad42f2 Merge branch 'main' into fix/context-cancellation-do
  > 6fa6b1b chore(collectors/go): generate the tests after new metric (# 1962)
  > 2e460e1 Merge pull request # 1933 from prometheus/dependabot/go_modules/golang.org/x/sys-0.39.0
  > 0e58833 build(deps): bump google.golang.org/protobuf in /exp
  > f2f578d fix(test): fix uint64 underflow in TestMemStatsEquivalence
  > 55f61a9 Merge pull request # 1974 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.5
  > ab17e7a build(deps): bump github.com/klauspost/compress in /exp
  > 9887f55 fix: respect context cancellation in httpClient.Do
  > 48a6770 build(deps): bump the github-actions group with 2 updates (# 1958)
  > f728215 Merge pull request # 1932 from prometheus/dependabot/go_modules/google.golang.org/protobuf-1.36.11
  > 360c42e build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0
  > c010fd6 ci: unify test workflow across platforms with Go version matrix
  > 64e87af Merge pull request # 1973 from prometheus/dependabot/go_modules/golang.org/x/sys-0.42.0
  > 110d080 build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5
  > 4b86739 Merge pull request # 1956 from prometheus/dependabot/go_modules/github.com/prometheus/common-0.67.5
  > 7ba246a Ensure remote write v2 headers cannot be returned on v1 requests (# 1927)
  > c89a2b5 build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11
  > e4a9fb5 fix(test): use t.Cleanup for temp file in WriteToTextfile test
  > adead89 build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0
  > 419fc96 Merge pull request # 1959 from prometheus/dependabot/go_modules/tutorials/whatsup/go.opentelemetry.io/otel/sdk-1.40.0
  > 16e5762 build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5
  > 8d46898 Prevent OOM from malformed snappy payloads by validating decoded length (# 1917)
  > d29ea26 fix(test): use [1-9] for start_time_seconds regex on Windows
  > 886616e Merge pull request # 1955 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.4
  > 40b45cc build(deps): bump go.opentelemetry.io/otel/sdk in /tutorials/whatsup
  > 572ca3a Allow `/metrics` handler output filtering via `name[]` query param (# 1925)
  > ef80579 fix(test): mock timestamps in histogram exemplar first batch too
  > 7baa439 Merge pull request # 1957 from prometheus/dependabot/go_modules/golang.org/x/sys-0.41.0
  > a699b3c build(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4
  > b3886a6 feat: expose Desc error through public Err() method (# 1902)
  > b8801a7 fix(test): close temp file before WriteToTextfile on Windows
  > 62caa50 Merge pull request # 1954 from prometheus/dependabot/go_modules/github.com/prometheus/procfs-0.20.1
  > 3ba4f6a build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0
  > 54a0d19 Merge pull request # 1950 from manute/main
  > 9050000 build(deps): bump the github-actions group with 4 updates (# 1919)
  > db24503 fix(test): use mock timestamps in histogram exemplar test
  > 12e1f25 build(deps): bump github.com/prometheus/procfs from 0.19.2 to 0.20.1
  > 2f81ba4 chore(lint): style changes for satisfy ci
  > f340171 Merge pull request # 1924 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.18.2
  > e9c7cd9 fix(test): accept zero GC pause increment on Windows
  > d93620f chore(test): synctesting for timer and check panic
  > 2cc6786 Merge pull request # 1923 from prometheus/dependabot/go_modules/exp/github.com/prometheus/common-0.67.4
  > 86da9a2 build(deps): bump github.com/klauspost/compress in /exp
  > 2fca029 ci: add macOS and Windows test runners
  > eab20c4 chore(version): bump go version 1.25
  > 3bdeb68 Merge pull request # 1922 from prometheus/dependabot/go_modules/golang.org/x/sys-0.38.0
  > e4ac2e9 build(deps): bump github.com/prometheus/common in /exp
  > 498a707 Merge pull request # 1921 from prometheus/dependabot/go_modules/github.com/prometheus/common-0.67.4
  > b52eafb build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0
  > 22991df Merge pull request # 1920 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.2
  > f8b36bc build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4
  > 5d937cd chore(ci): Use stable names for CI steps (# 1914)
  > 7cfbea7 build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2
  > c316de0 chore(ci): Add CRLF detection and fix targets to prevent CRLF contamination (# 1898)
  > a5ae203 build(deps): bump the github-actions group with 2 updates (# 1908)
  > b7eec20 Merge pull request # 1910 from prometheus/dependabot/go_modules/exp/github.com/prometheus/common-0.67.2
  > 6a1fbd5 Merge pull request # 1909 from prometheus/dependabot/go_modules/exp/google.golang.org/protobuf-1.36.10
  > 1a6cf45 build(deps): bump github.com/prometheus/common in /exp
  > 8a44ef5 Merge pull request # 1911 from prometheus/dependabot/go_modules/exp/github.com/klauspost/compress-1.18.1
  > 2d8361c build(deps): bump google.golang.org/protobuf in /exp
  > 35511c7 Merge pull request # 1907 from prometheus/dependabot/go_modules/github.com/prometheus/common-0.67.2
  > c164b1f build(deps): bump github.com/klauspost/compress in /exp
  > 11101f9 Merge pull request # 1904 from prometheus/dependabot/go_modules/golang.org/x/sys-0.37.0
  > 851efb7 build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2
  > 1179bc1 Merge pull request # 1906 from prometheus/dependabot/go_modules/github.com/klauspost/compress-1.18.1
  > e9ec562 build(deps): bump golang.org/x/sys from 0.35.0 to 0.37.0
  > 25d189d Merge pull request # 1903 from prometheus/dependabot/go_modules/github.com/prometheus/procfs-0.19.2
  > ff1c34b build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1
  > 23c8ee1 minor refactor of replaceInvalidRune() in bridge.go (# 1897)
  > 212fc83 build(deps): bump github.com/prometheus/procfs from 0.17.0 to 0.19.2
  > fa8da34 feat: add support for `/status/tsdb/blocks` endpoint (# 1896)
  > 9358c16 Clarify exp library stability (# 1894)
  > ddad4f3 Public backoff config to allow usage of WithAPIBackoff (# 1895)
  > 187cb02 Use cloned http.DefaultTransport. issue-1857 (# 1885)
  > 343ae65 fix bug (# 1892)
  > c5900a1 Change RetryCallBack initialized (# 1890)
  > 6886445 bug(remote_write): Fix compression buffer pooling (# 1889)
  > 3d13af1 Add RetryCallBack to remote_api.go  (# 1888)
  > 8b3bc2d Update Go Collector metrics for new Go version (# 1864)
  > c454ad5 Fix typo in remote api err msg (# 1878)
  > 14becd6 build(deps): bump the github-actions group with 4 updates (# 1881)
  > f962e7f Merge pull request # 1883 from prometheus/dependabot/go_modules/exp/github.com/prometheus/common-0.66.1
  > f5ad14f Merge pull request # 1882 from prometheus/dependabot/go_modules/exp/google.golang.org/protobuf-1.36.9
  > 44d7ce5 build(deps): bump github.com/prometheus/common in /exp
  > 245fdbd Merge pull request # 1880 from prometheus/dependabot/go_modules/google.golang.org/protobuf-1.36.9
  > cbecf5e build(deps): bump google.golang.org/protobuf in /exp
  > a974e0d chore: clean up golangci-lint configuration (# 1802)
  > 28a4dfd build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9
  > 54b80c0 Merge pull request # 1871 from prometheus/arve/sync-main
  > cebd7d5 Sync release-1.23 into main (# 1868)
  > 48f1e34 Merge remote-tracking branch 'origin/release-1.23' into arve/sync-main
  > 5860547 build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 (# 1865)
  > 2650293 Merge remote-tracking branch 'origin/release-1.23' into arve/sync-release
  > 84a4734 collectors/version: Allow for custom label (# 1860)
  > 493c96a chore: Drop support for <go-1.22 (# 1862)
  > 3692d7f Merge pull request # 1861 from prometheus/arve/merge-release
  > 2d1f151 Use prometheus/common.expfmt.NewTextParser (# 1859)
  > 14a55d2 Merge remote-tracking branch 'origin/release-1.23' into arve/merge-release
  > 4ae032f Support matchers in rules API (# 1843)
  > 1f3a904 feat(api): add FormatQuery method to Prometheus v1 API (# 1856)
  > 40dd084 feat(api/prometheus): add format_query endpoint for query formatting (# 1846)
  > e77101d remote: simplified Store interface; renamed Handler to WriteHandler; encapsulated write response (# 1855)
  > f48ff67 ✨ (prometheus): refactor LabelNames to return model.LabelNames type for consistency (# 1850)
  > 14ccb93 Merge pull request # 1852 from prometheus/dependabot/github_actions/github-actions-12d2e1d0cf
  > 8a8eff5 Merge release-1.23 into main (# 1851)
  > 1e4db56 build(deps): bump github/codeql-action in the github-actions group
  > a4af5c8 Fix doc typo (# 1849)
  > 83a9730 prometheus/collectors: use godoc link for runtime/metrics supported metrics (# 1844)
  > 8dfb355 Merge pull request # 1838 from prometheus/dependabot/go_modules/golang.org/x/sys-0.34.0
  > 259235d Merge pull request # 1839 from prometheus/dependabot/go_modules/github.com/prometheus/procfs-0.17.0
  > 47e6039 build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0
  > 77fa321 build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0
bumping golang.org/x/sys d58dcfa...9e7e939:
  > 9e7e939 cpu: handle vendor suffixes in parseRelease
  > f6fb8a1 unix: use epoll_pwait rather than epoll_wait
  > f3eeabf windows: avoid length overflow in NewNTString
  > 3cb6647 unix: update glibc to 2.43
  > c507910 windows: document safe usage of TrusteeValue
bumping k8s.io/apiserver 540abe3...8e159d6:
  > 8e159d6 Update dependencies to v0.35.7 tag
  > 9633d58 Merge pull request # 140030 from kmala/release-1.35
  > 1254cd7 Merge pull request # 139666 from kmala/automated-cherry-pick-of-# 137451-upstream-release-1.35
  > 1b141c3 Fix vet error
  > 1ed8098 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
bumping golang.org/x/sync 5071ed6...1eb64d4:
  > 1eb64d4 semaphore: panic on negative weights
bumping k8s.io/apimachinery 5e12da0...3e341b5:
  > 3e341b5 Merge pull request # 139666 from kmala/automated-cherry-pick-of-# 137451-upstream-release-1.35
  > 539f8c5 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
bumping k8s.io/client-go ad0b54e...d2a9618:
  > d2a9618 Update dependencies to v0.35.7 tag
  > c9748d3 Merge pull request # 140030 from kmala/release-1.35
  > 74724a2 Merge pull request # 139666 from kmala/automated-cherry-pick-of-# 137451-upstream-release-1.35
  > 7b15567 Fix vet error
  > e7f41b7 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
bumping golang.org/x/text f4bb632...724af9c:
  > 724af9c go.mod: update golang.org/x dependencies
  > bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
  > b326f3d go.mod: update golang.org/x dependencies
  > 5ae8e57 unicode/norm: avoid infinite loop on invalid input
  > 0dc94a2 all: fix some comments
bumping knative.dev/pkg 39ebae2...76601dd:
  > 76601dd Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (# 3376)
  > 82b6757 upgrade to latest dependencies (# 3378)
  > 1202cec Bump the k8s group with 5 updates (# 3375)
  > c27fe87 Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (# 3377)
bumping github.com/prometheus/procfs b380dd4...3c943fd:
  > 3c943fd Fix invalid format strings (# 832)
  > 95dd8b8 sysfs: add NVMeSubsystemClass for NVMe-oF subsystem parsing (# 797)
  > 824ed41 feat: support  sysfs.Mdraids with Intel VROC (# 777)
  > 1fbd898 Fix crypto parsing panic (# 830)
  > 68b70b4 mountinfo: read the full file instead of capping at 1 MiB (# 817)
  > 0155712 nvme: Fix namespace parsing (# 821)
  > 5853145 Add support for cpuinfo_avg_freq (# 829)
  > 1244442 Update common Prometheus files (# 828)
  > 1c5657d Update common Prometheus files (# 827)
  > 2c1667a build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 (# 825)
  > e95ebac build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 (# 826)
  > 7684231 build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (# 802)
  > fe02e56 Add support for `/sys/class/mei/mei0` (# 792)
  > 653e173 feat(xfs): add Linux 7.0 XFS statistics fields (# 810)
  > 26fc3ed Update common Prometheus files (# 820)
  > 6a4e4a3 build(deps): bump golang.org/x/sys from 0.42.0 to 0.45.0 (# 818)
  > e0a040f build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (# 819)
  > 63e4d76 fix some fc-hba are missing the statistics/* (# 664)
  > 66a9e6e blockdevice: add SysBlockDeviceRotational for targeted rotational reads (# 824)
  > 1082e3d Update common Prometheus files (# 816)
  > eb15125 Update common Prometheus files
  > f05f8fc Update common Prometheus files (# 813)
  > 4a18b4e Merge pull request # 796 from sradco/add-dmmultipath-sysfs-parsing
  > 506a32c Update common Prometheus files (# 809)
  > 8ab5753 blockdevice: add DMMultipathDevices for DM-multipath sysfs parsing
  > fb3e36a Update common Prometheus files (# 808)
  > 465fd94 Refactor class thermal error handling (# 794)
  > a9a7c56 Update common Prometheus files (# 807)
  > 39a1eee Update common Prometheus files (# 806)
  > c065f63 Update common Prometheus files (# 805)
  > 8b1d4c1 Update common Prometheus files (# 804)
  > 9e34617 Merge pull request # 803 from prometheus/superq/cleanup_circleci
  > 27d86b8 build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 (# 801)
  > abf0af3 Cleanup CI
  > 2cd08a8 build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 (# 800)
  > 6f2b42a Update common Prometheus files (# 798)
  > 10941fa Merge pull request # 790 from prometheus/dependabot/github_actions/actions/setup-go-6.3.0
  > 2fc0fc0 build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
bumping golang.org/x/term 3b43943...9f69229:
  > 9f69229 go.mod: update golang.org/x dependencies
bumping k8s.io/api 3f662f3...cfdecb5:
  > cfdecb5 Update dependencies to v0.35.7 tag
  > 42f2945 Merge pull request # 139666 from kmala/automated-cherry-pick-of-# 137451-upstream-release-1.35
  > 9a35aac Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af

Signed-off-by: Knative Automation <automation@knative.team>

Author: knative-automation

go.mod

@@ -55,25 +55,25 @@ require (
 	github.com/tektoncd/pipeline v1.10.0
 	gitlab.com/gitlab-org/api/client-go v0.150.0
 	go.podman.io/image/v5 v5.39.2-0.20260306124909-d48bc74146d6
-	golang.org/x/crypto v0.53.0
+	golang.org/x/crypto v0.54.0
 	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
+	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.21.0
-	golang.org/x/sys v0.46.0
-	golang.org/x/term v0.44.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
-	k8s.io/api v0.35.6
-	k8s.io/apimachinery v0.35.6
-	k8s.io/client-go v0.35.6
+	k8s.io/api v0.35.7
+	k8s.io/apimachinery v0.35.7
+	k8s.io/client-go v0.35.7
 	k8s.io/klog/v2 v2.140.0
 	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
-	knative.dev/client/pkg v0.0.0-20260724023130-cc108d6d70e8
+	knative.dev/client/pkg v0.0.0-20260727023356-00c078d88aff
 	knative.dev/eventing v0.49.1-0.20260724130631-defbb5343203
 	knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b
-	knative.dev/pkg v0.0.0-20260622140654-39ebae2ee2dc
+	knative.dev/pkg v0.0.0-20260727095757-76601dd085d0
 	knative.dev/serving v0.49.1-0.20260724135632-cef8d7e092bf
 	sigs.k8s.io/controller-runtime v0.23.3
 )
@@ -203,7 +203,7 @@ require (
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
@@ -247,11 +247,11 @@ require (
 	github.com/pjbgf/sha1cd v0.5.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_golang v1.24.1 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v1.20.99 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/rickb777/date v1.20.2 // indirect
 	github.com/rickb777/plural v1.4.1 // indirect
 	github.com/rivo/tview v0.42.0 // indirect
@@ -301,21 +301,21 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.28.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/grpc v1.82.1 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/apiextensions-apiserver v0.35.6 // indirect
-	k8s.io/apiserver v0.35.6 // indirect
+	k8s.io/apiextensions-apiserver v0.35.7 // indirect
+	k8s.io/apiserver v0.35.7 // indirect
 	k8s.io/cli-runtime v0.34.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
 	knative.dev/networking v0.0.0-20260616021346-d4e13b76b133 // indirect