chore(deps): bump the go-runtime group across 1 directory with 17 updates by dependabot[bot] · Pull Request #13 · rajveer100704/AgentOS

dependabot · 2026-09-03T05:54:26Z

Bumps the go-runtime group with 10 updates in the / directory:

Package	From	To
github.com/go-chi/chi/v5	`5.3.0`	`5.3.2`
github.com/prometheus/client_golang	`1.23.2`	`1.24.1`
github.com/quic-go/quic-go	`0.59.1`	`0.62.0`
github.com/redis/go-redis/v9	`9.19.0`	`9.22.0`
github.com/tetratelabs/wazero	`1.11.0`	`1.12.0`
go.opentelemetry.io/otel	`1.44.0`	`1.46.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`1.44.0`	`1.46.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`1.44.0`	`1.46.0`
k8s.io/apimachinery	`0.36.1`	`0.37.0`
k8s.io/client-go	`0.36.1`	`0.37.0`

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @VojtechVitek in go-chi/chi#1151

docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @VojtechVitek in go-chi/chi#1111

fix: don't drop handlers that collide with a Mount()/Route() pattern by @VojtechVitek in go-chi/chi#1148

Don't duplicate methods in Allow: header for 405 responses by @flimzy in go-chi/chi#1029

fix(middleware): reject catch-all compress wildcards by @VojtechVitek in go-chi/chi#1156

middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

v5.3.1

What's Changed

Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in go-chi/chi#1110

Tidy build directives by @JRaspass in go-chi/chi#1113

feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in go-chi/chi#1127

Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in go-chi/chi#1050

middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in go-chi/chi#1131

feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in go-chi/chi#1132

ci: pin GitHub Actions to full commit SHAs by @XananasX7 in go-chi/chi#1116

New Contributors

@DucMinhNe made their first contribution in go-chi/chi#1110

@doganarif made their first contribution in go-chi/chi#1050

@XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits

3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @dependabot[bot] in prometheus/client_golang#1852

Refactor LabelNames to return model.LabelNames type for consistency by @yshngg in prometheus/client_golang#1850

remote: simplified Store interface; renamed Handler to WriteHandler by @bwplotka in prometheus/client_golang#1855

feat(api/prometheus): add format_query endpoint for query formatting by @yshngg in prometheus/client_golang#1846

feat(api): add FormatQuery method to Prometheus v1 API by @yshngg in prometheus/client_golang#1856

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

Commits

d6087ee release: cut v1.24.1 (#2076)
48dd383 Cut v1.24.0 (#2061)
a725305 Cut v1.24.0-rc.0 (#2058)
77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
34e9a7f Merge pull request #2055 from prombot/repo_sync
43749bc Update common Prometheus files
de19217 examples: improve simple main.go example (#1999)
20355eb fix: correct typos in comments and test error messages (#2049)
4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.59.1 to 0.62.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.62.0

This release adds support for stream priorities based on RFC 9218:

SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #5770, #5774

HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #5783, #5789, #5790, #5795

Notable Changes

http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #5765

Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #5782, thanks to @0xFA11

Breaking Changes

quic-go now requires Go 1.26 or newer: #5801

Notable Fixes

Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #5824

http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #5771

http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #5825

http3: request schemes are now normalized to lowercase: #5826

http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #5827

http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #5828

http3: regular CONNECT requests containing :scheme are now rejected: #5829

http3: requests containing duplicate Host header fields are now rejected: #5830

http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #5833

http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #5834

Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #5764, thanks to @floating-cat

Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #5798, #5823, thanks to @tlstpierre

OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #5787, thanks to @the-sarge

Changelog

return error from Conn.NextConnection when the connection is closed by @floating-cat in quic-go/quic-go#5764

ci: bump docker/login-action from 4.4.0 to 4.5.1 by @dependabot[bot] in quic-go/quic-go#5766

http3: expose TryWriteAll method on Stream and RequestStream by @marten-seemann in quic-go/quic-go#5765

http3: make server reject 0-RTT when settings are incompatible by @marten-seemann in quic-go/quic-go#5771

prioritize retransmissions over sending new stream data by @marten-seemann in quic-go/quic-go#5770

ringbuffer: optimize memory consumption of the ring buffer data structure by @marten-seemann in quic-go/quic-go#5773

ci: bump CodSpeedHQ/action from 4.18.5 to 5.0.1 by @dependabot[bot] in quic-go/quic-go#5775

ci: bump docker/login-action from 4.5.1 to 4.6.0 by @dependabot[bot] in quic-go/quic-go#5776

ci: bump CodSpeedHQ/action from 5.0.1 to 5.0.3 by @dependabot[bot] in quic-go/quic-go#5778

implement RFC 9218-style stream priorities for Stream and SendStream by @marten-seemann in quic-go/quic-go#5774

inline stream priority buckets in the framer by @marten-seemann in quic-go/quic-go#5779

avoid locking stream mutex when reading priorities in the framer by @marten-seemann in quic-go/quic-go#5781

http3: implement handling of RFC 9218 priority headers by @marten-seemann in quic-go/quic-go#5783

offer both draft-09 and draft-07 of Reliable Stream Resets by @0xFA11 in quic-go/quic-go#5782

http3: add support for handling RFC 9218 PRIORITY_UPDATE frames by @marten-seemann in quic-go/quic-go#5789

remove receive-side checks from connection flow controller reset by @marten-seemann in quic-go/quic-go#5791

remove unused mtuDiscoverer interface by @marten-seemann in quic-go/quic-go#5792

... (truncated)

Commits

793f74d add an integration test for stream priorities (#5835)
eb1fe05 http3: don't use gzip to decompress successful CONNECT responses (#5834)
1e19960 http3: distinguish empty pseudo-header fields from omitted ones (#5833)
1818db9 http3: reject duplicate Host header fields (#5830)
74b7cb7 http3: support Host when :authority is omitted (#5828)
4aac58a http3: reject regular CONNECT requests with :scheme (#5829)
a2aaf58 http3: validate request method syntax (#5827)
cb8e1ec http3: normalize request schemes to lowercase (#5826)
148fd03 http3: reject userinfo subcomponent in URIs (#5825)
1d6a463 check for unread CRYPTO data when advancing encryption levels (#5824)
Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.19.0 to 9.22.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.22.0

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.

WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.

AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/HEAD/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @ndyakov, with help from @cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).

LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.

SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.

XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.

TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.

FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.22.0 (2026-08-03)

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.

WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.

AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/master/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @ndyakov, with help from @cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).

LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.

SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.

XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.

TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.

FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Commits

c7f59a2 chore(release): prepare 9.22.0 (#3947)
c994cfc feat(autopipeline): automatic command pipelining (#3942)
228b463 chore(deps): bump actions/stale from 10 to 11 (#3944)
a6be850 feat(csc): add standalone client-side caching (#3941)
82b0213 chore(release): prepare 9.22.0-beta.1 (#3940)
8eb9583 fix(rediscmd): redact credential args in AppendCmd (#3939)
90fd088 chore(ci): point 8.10 testing at custom client-libs-test image (#3938)
93f961a feat(timeseries): support multiple aggregators per key in TS.NRANGE (#3937)
49e0041 feat(himport): HIMPORT command with lazy per-connection prepare (#3919)
3dd9675 fix(proto): peek push notification name without demanding 36 bytes (#3936)
Additional commits viewable in compare view

Updates github.com/tetratelabs/wazero from 1.11.0 to 1.12.0

Release notes

Sourced from github.com/tetratelabs/wazero's releases.

v1.12.0

Hi wazero friends! The new release of wazero v1.12.0 has arrived.

This release advances us a few more steps towards Wasm 3.0! See wazero/wazero#2426 for where we currently stand.

Behavioral changes

929e4000 Extended Constant Expressions (#2468) @mpoindexter

bfb20e0b Exception handling (#2489) @evacchi

2c14bbff Typed references (#2497) @evacchi

8ee25086, a877b1b4 non-blocking IO on custom files (#2476, #2479) @paralin

Bug fixes

2bbd517b Fix fd_prestat_get integer overflow on 32-bit platforms (#2491) @hanxi

0bcb5f2a Ensure i32 operations are masked (#2488) @evacchi

dafe2caa Fix error when attempting to invoke a start function imported from a host module (#2475) @mpoindexter

f7cf1693 Fix error when importing functions which were re-exported (#2463) @mpoindexter

aa7ebad5 Don't use compiler when executable mmap is disabled (#2471) @anuraaga

Commits

2ab480b Remove SQLite (#2502)
2c14bbf feat: typed function references spec (#2497)
475a1f8 fix: compilation cache should store catch clause table (EH) (#2498)
a3374cf refactor: wasm.ValueType as type definition + widening (uint64) (#2495)
8755611 arm64: fix relocation bug when number of args > 8 (#2492)
golang.org/x/crypto
Resolves CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
Resolves CVE-2026-56852 — golang.org/x/text: Denial of Service via invalid UTF-8 input
Resolves all 2 issues in google.golang.org/grpc

…ates Bumps the go-runtime group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.0` | `5.3.2` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.59.1` | `0.62.0` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.19.0` | `9.22.0` | | [github.com/tetratelabs/wazero](https://github.com/tetratelabs/wazero) | `1.11.0` | `1.12.0` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.46.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.46.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.46.0` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.1` | `0.37.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.1` | `0.37.0` | Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.2 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.3.0...v5.3.2) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/quic-go/quic-go` from 0.59.1 to 0.62.0 - [Release notes](https://github.com/quic-go/quic-go/releases) - [Commits](quic-go/quic-go@v0.59.1...v0.62.0) Updates `github.com/redis/go-redis/v9` from 9.19.0 to 9.22.0 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md) - [Commits](redis/go-redis@v9.19.0...v9.22.0) Updates `github.com/tetratelabs/wazero` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/tetratelabs/wazero/releases) - [Commits](wazero/wazero@v1.11.0...v1.12.0) Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.46.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.46.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.46.0) Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.43.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.45.0) Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.46.0) Updates `go.opentelemetry.io/otel/trace` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.46.0) Updates `golang.org/x/net` from 0.55.0 to 0.58.0 - [Commits](golang/net@v0.55.0...v0.58.0) Updates `golang.org/x/text` from 0.37.0 to 0.41.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.37.0...v0.41.0) Updates `google.golang.org/grpc` from 1.81.1 to 1.83.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.81.1...v1.83.1) Updates `google.golang.org/protobuf` from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 Updates `k8s.io/apimachinery` from 0.36.1 to 0.37.0 - [Commits](kubernetes/apimachinery@v0.36.1...v0.37.0) Updates `k8s.io/client-go` from 0.36.1 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.1...v0.37.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/quic-go/quic-go dependency-version: 0.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/tetratelabs/wazero dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.opentelemetry.io/otel dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: golang.org/x/net dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 3, 2026

Navigation Menu

Repository navigation

chore(deps): bump the go-runtime group across 1 directory with 17 updates - #13

chore(deps): bump the go-runtime group across 1 directory with 17 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-runtime-e468360138

dependabot Bot commented on behalf of github Sep 3, 2026 •

edited by sourcery-ai Bot

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026 • edited by sourcery-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.3.2

What's Changed

v5.3.1

What's Changed

New Contributors

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

1.24.1 / 2026-07-23

1.24.0 / 2026-07-20

v0.62.0

Notable Changes

Breaking Changes

Notable Fixes

Changelog

9.22.0

🚀 Highlights

Client-Side Caching (Experimental)

Automatic Pipelining (Experimental)

Redis 8.10 Support

Cross-SDK Aligned Defaults

9.22.0 (2026-08-03)

🚀 Highlights

Client-Side Caching (Experimental)

Automatic Pipelining (Experimental)

Redis 8.10 Support

Cross-SDK Aligned Defaults

v1.12.0

Behavioral changes

Bug fixes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 3, 2026 •

edited by sourcery-ai Bot

Loading