chore(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 - #11
Closed
dependabot[bot] wants to merge 400 commits into
Closed
dependabot[bot] wants to merge 400 commits into
dependabot[bot] wants to merge 400 commits into
Conversation
…s (Disk, Network) and associated unit tests. Added robust data transformation logic for all metrics (CPU, Memory, Disk, Network). Updated README with detailed Data Processing Pipeline architecture.
…ng rendering errors
… and enable dynamic scrape updates
…onal monitoring aesthetics
handleMustChangePassword was invoked from both page load and every 403 API response, spawning overlapping prompt() dialogs, and it recursed on failure (so a wrong current password or a weak new password looped forever). - add a mustChangeActive guard so only one flow runs at a time - validate new-password policy in the browser before sending - stop auto-re-prompting on failure (reload the page to retry)
Go marshals nil slices to JSON null, which broke the frontend (Cannot read properties of null for .forEach/.map in populateGroupFilter/loadAlertRules). - ListServers/ListServices/ListAlerts/ListUsers/ListAPIKeys/ListAudit/Metrics/ backups now return empty slices instead of nil - /servers/history emits [] for servers without points - regression test TestEmptyListsAreArrays
- SMTP: fall back to AUTH LOGIN when the server advertises it (Exchange only supports LOGIN/NTLM and hangs on PLAIN); bound the whole SMTP conversation with a 30s deadline so a stalled server can't block the request forever. - Telegram: escape title/message HTML entities so special chars in server names or messages can't break the markup. - Email: escape HTML entities in the HTML body. - Add tests for LOGIN/PLAIN auth and Telegram escaping.
Security: - WebSocket CheckOrigin rejects cross-site origins (CSWSH); same-origin and PYMON_ALLOWED_ORIGINS pass (non-browser clients with no Origin allowed) - SPA session moved from localStorage JWT to an HttpOnly SameSite=Strict cookie; API clients still use Bearer/API-key; WebSocket accepts the cookie - Notification secrets (SMTP password, bot tokens, webhook URLs) are encrypted at rest with a key derived from the JWT secret; legacy rows read fine, wrong key fails loudly - Content-Security-Policy header added (script-src 'self', connect-src ws) - Rate limiting extended to change-password and API-key creation (30/min/IP) - IP rate limiter now prunes stale entries (unbounded map growth under DDoS) Reliability: - Fix TOCTOU race in alert-rule evaluation (state mutated under lock) - Service flapping detection: >=5 transitions/10min suppresses alert spam and emits one combined notice - VACUUM runs weekly regardless of wall-clock hour (was: only at 3 AM) - DNS lookups for SSRF checks are cached (5 min TTL) - parseDurationSeconds rejects malformed values like "5xyzs" - RestoreFrom streams the backup and swaps it in atomically instead of loading it fully into memory Cleanup: - Generated one-time admin_password.txt is deleted after first login - Docs (ARCHITECTURE/TROUBLESHOOTING) updated from Python/FastAPI to Go Tests: cookie session, WS origin check, strict duration parsing, notification encryption round-trip (all passing under -race).
The CMD runs 'pymon server --config /config/config.yml' but the image only contained config.example.yml, so every container exited immediately (log.Fatalf on missing config). This had broken the CI docker smoke test for several commits; copy the example as the default config.
…ction, rate-limit, timestamps - CSP: allow-list Chart.js/Lucide/fonts CDNs so the dashboard renders again - report page: per-response nonce CSP so the inline chart script works - config export: deep-copy before redaction (no longer kills live notifications) and redact webhook URLs - /metrics: validate push metric names/help/labels and cap registry at 5000 series (prometheus injection + DoS) - rate limit: ignore spoofed X-Forwarded-For from non-local peers; per-app limiters - SQLite: compare cutoffs in the stored T-separated format (fixes history/retention day-boundary bug) - services: strip URL userinfo before SSRF host check - PUT /servers: safe type assertions + validation (no panics) - version 3.0.3; bump Dockerfile/compose/README/sw cache; remove dead code - regression tests for all of the above
- install.sh: Ubuntu/Debian only (remove darwin) - remove Windows scripts (install.ps1, install_exporter.ps1, run.bat) - ci(release): build linux amd64/arm64 only - Dockerfile: switch base to ubuntu:24.04 - README/docs: document Ubuntu as target platform
…telegraf volume; sync version to 3.0.4
…does not exist); bump to 3.0.5
…eck/golangci-lint/Dependabot in CI; bump to 3.0.6
…(3.1.0) - Add install.ps1 (idempotent install/update, checksum-verified download, Windows Service registration, health-check) alongside install.sh, matching the Ubuntu installer's install/update UX. - Add pymon "service" subcommand (cmd/pymon/service_windows.go) implementing the SCM protocol via golang.org/x/sys/windows/svc so New-Service/sc.exe can manage the process like a systemd unit; no-op alias on other platforms (service_other.go). Refactor runServer into a shared startApp helper reused by both entry points. - release.yml now builds and publishes pymon-windows-amd64.exe/arm64.exe alongside the Linux binaries. - Bump Version 3.0.7 -> 3.1.0 (code was behind the already-published v3.0.8 tag) and document the Windows installer in README.md/CHANGELOG.md. - README: drop the stale "source repo" banner (Monitoring-source is just the old name of this same repository, per GitHub's rename redirect) and point the CI badge directly at ajjs1ajjs/Monitoring.
…older commit) v3.1.0 was already tagged historically (pointing at the pre-Ubuntu-only Windows removal commit), so reusing it would require moving/deleting an existing tag, which is not allowed. Use the next free version, 3.1.1, everywhere instead.
Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model) from 0.6.2 to 0.6.3. - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.2...v0.6.3) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/go_modules/github.com/prometheus/client_model-0.6.3
branch
September 5, 2026 11:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/prometheus/client_model from 0.6.2 to 0.6.3.
Release notes
Sourced from github.com/prometheus/client_model's releases.
... (truncated)
Commits
a834711Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#149)07078d2Update common Prometheus files (#148)6ab4937Update common Prometheus files (#146)10dc9dfdocs: Explained current state of the repo (#143)abfdc7eMerge pull request #144 from prombot/repo_syncc99203fUpdate common Prometheus files46d9cfbUpdate common Prometheus files (#141)6d9be57Update common Prometheus files2d24e7eMerge pull request #138 from prometheus/repo_sync1a0f082Update common Prometheus filesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)