build(deps): bump the gomod-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the gomod-dependencies group with 4 updates in the / directory: github.com/prometheus/client_golang, google.golang.org/grpc, k8s.io/api and k8s.io/apiextensions-apiserver.

Updates github.com/prometheus/client_golang from 1.24.0 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

• [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Commits

• d6087ee release: cut v1.24.1 (#2076)
• See full diff in compare view

Updates github.com/prometheus/common from 0.70.0 to 0.70.1

Release notes

Sourced from github.com/prometheus/common's releases.

v0.70.1

What's Changed

• Update CHANGELOG for v0.70.0 by @​roidelapluie in prometheus/common#945
• config: clarify sensitive redirect headers match net/http by @​roidelapluie in prometheus/common#924
• Synchronize common files from prometheus/prometheus by @​prombot in prometheus/common#946
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in prometheus/common#950
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in prometheus/common#949
• build(deps): bump the codeql group with 4 updates by @​dependabot[bot] in prometheus/common#948
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 in the golang-org-x group across 1 directory by @​dependabot[bot] in prometheus/common#947

Full Changelog: prometheus/common@v0.70.0...v0.70.1

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

Commits

• b63d8c0 build(deps): bump golang.org/x/net (#947)
• 4109c3e build(deps): bump the codeql group with 4 updates (#948)
• 5270b62 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#949)
• 1167ca3 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#950)
• d28d382 Update common Prometheus files (#946)
• f915876 Merge pull request #924 from roidelapluie/roidelapluie/redirect-header-comment
• dfbebd0 Merge pull request #945 from roidelapluie/roidelapluie/changelog-0.70.0
• c8a0019 Update CHANGELOG for v0.70.0
• See full diff in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.83.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

Commits

• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279)
• 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
• e393849 Cherry-pick recent changes from master (#9240)
• 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
• 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
• 26ffdb3 [tls] Add safety check in custom cert verification that peer cert chain is no...
• 5013974 internal/grpcsync: add ScheduleAndWait to CallbackSerializer (#9162)
• bd58bc0 internal/transport: increase test timeout locally in TestAccountCheckWindowSi...
• 484f150 httpfilter/extproc: add check to ensure that response trailer mode must be SE...
• Additional commits viewable in compare view

Updates k8s.io/api from 0.36.2 to 0.36.3

Commits

• 3fde3c4 Update dependencies to v0.36.3 tag
• 53c47b9 Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 1831886 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.36.2 to 0.36.3

Commits

• 2e78d6f Update dependencies to v0.36.3 tag
• 4b2f007 Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• c8a9346 Add e2e test for setting maps and slices to null via SSA
• b387965 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.2 to 0.36.3

Commits

• 40bf4b2 Update dependencies to v0.36.3 tag
• 34d46be Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 66a3724 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/client-go from 0.36.2 to 0.36.3

Commits

• 44a8af2 Update dependencies to v0.36.3 tag
• f501ada Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• a43e1d7 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/streaming from 0.36.2 to 0.36.3

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[netlify]

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	746a3f9
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/6a70fb8e00b0840007165b84

[kubernetes-prow]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

This Dependabot PR updates the root Go module dependencies for agent-sandbox, primarily bumping Prometheus, gRPC, and Kubernetes library versions to their latest patch/minor releases and refreshing the module checksum set.

Changes:

• Bump github.com/prometheus/client_golang to v1.24.1 and github.com/prometheus/common to v0.70.1.
• Bump google.golang.org/grpc to v1.83.0.
• Bump Kubernetes deps k8s.io/{api,apiextensions-apiserver,apimachinery,client-go,streaming} to v0.36.3 (and update related transitive sums, incl. structured-merge-diff).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Updates direct module requirements for Prometheus, gRPC, and Kubernetes deps.
go.sum	Updates checksums to match the new module versions and transitive dependency shifts.

[aditya-shantanu]

Reviewed at 746a3f9. Consistent group bump: all k8s.io modules move together to v0.36.3 (patch line, still compatible with controller-runtime v0.24.1), and the prometheus/grpc bumps carry their matching transitive updates in go.sum.

[aditya-shantanu]

/lgtm
/ok-to-test

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: aditya-shantanu, dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign barney-s for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.