deps: update Go dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
github.com/google/go-tdx-guest	require	digest	ffb0869 -> 5ba7655
github.com/prometheus/common	require	patch	v0.67.2 -> v0.67.3
google.golang.org/grpc	require	minor	v1.76.0 -> v1.77.0

---

Release Notes

prometheus/common (github.com/prometheus/common)

v0.67.3: / 2025-11-18

Compare Source

What's Changed

• Support JWT Profile for Authorization Grant (RFC 7523 3.1) by @​JorTurFer in #​862
• Config: remove outdated comment about HTTP/2 issues by @​bboreham in #​863

New Contributors

• @​JorTurFer made their first contribution in #​862

Full Changelog: prometheus/common@v0.67.2...v0.67.3

grpc/grpc-go (google.golang.org/grpc)

v1.77.0: Release 1.77.0

Compare Source

API Changes

• mem: Replace the Reader interface with a struct for better performance and maintainability. (#​8669)

Behavior Changes

• balancer/pickfirst: Remove support for the old pick_first LB policy via the environment variable GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false. The new pick_first has been the default since v1.71.0. (#​8672)

Bug Fixes

• xdsclient: Fix a race condition in the ADS stream implementation that could result in resource-not-found errors, causing the gRPC client channel to move to TransientFailure. (#​8605)
• client: Ignore HTTP status header for gRPC streams. (#​8548)
• client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. (#​8534)
  • Special Thanks: @​jgold2-stripe
• client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy.
  • Setting environment variable GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false disables this change; please file a bug if any problems are encountered as we will remove this option soon. (#​8613)
• balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. (#​8611)
• server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. (#​8573)
  • Special Thanks: @​hugehoo
• balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to pick_first but don't set endpoints. (#​8610)
• mem: Clear large buffers before re-using. (#​8670)

Performance Improvements

• transport: Reduce heap allocations to reduce time spent in garbage collection. (#​8624, #​8630, #​8639, #​8668)
• transport: Avoid copies when reading and writing Data frames. (#​8657, #​8667)
• mem: Avoid clearing newly allocated buffers. (#​8670)

New Features

• outlierdetection: Add metrics specified in gRFC A91. (#​8644)
  • Special Thanks: @​davinci26, @​PardhuKonakanchi
• stats/opentelemetry: Add support for optional label grpc.lb.backend_service in per-call metrics (#​8637)
• xds: Add support for JWT Call Credentials as specified in gRFC A97. Set environment variable GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true to enable this feature. (#​8536)
  • Special Thanks: @​dimpavloff
• experimental/stats: Add support for up/down counters. (#​8581)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.46.0 -> v0.46.1-0.20251013234738-63d1a5100f82
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250826171959-ef028d996bc1 -> v0.0.0-20251022142026-3a174f9686a8

File name: imagestore/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250826171959-ef028d996bc1 -> v0.0.0-20251022142026-3a174f9686a8

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.