[dependabot]

Bumps the go-modules group with 2 updates: github.com/gookit/color and github.com/katbyte/go-kt.

Updates github.com/gookit/color from 1.6.1 to 1.6.3

Release notes

Sourced from github.com/gookit/color's releases.

v1.6.3

Change Log

Fixed

• fix(convert): zero-pad each channel in RgbToHex (#120) gookit/color@0d17892

Other

• Decode canonical color cube and grayscale palette values (#122) gookit/color@9bc305f
• build(deps): color 更新到 v1.6.2 gookit/color@dd2f770

v1.6.2

Change Log

• chore: add RevertColorLevel for testing gookit/color@289d54c

Commits

• c27a367 Merge remote-tracking branch 'origin/master'
• dd2f770 build(deps): color 更新到 v1.6.2
• 9bc305f Decode canonical color cube and grayscale palette values (#122)
• 0d17892 fix(convert): zero-pad each channel in RgbToHex (#120)
• 289d54c chore: add RevertColorLevel for testing
• See full diff in compare view

Updates github.com/katbyte/go-kt from 0.2.0 to 0.9.1

Release notes

Sourced from github.com/katbyte/go-kt's releases.

v0.9.1

• README: the tools that use the library are listed by the names they have now: the three metrics tools are Prometheus exporters, and sas-exporter and syslog-relay are added. Nothing in the library changes

v0.9.0

• prometheus/metrics (breaking): the reading that says which build wrote the page is named for the tool, as Prometheus's own tools name theirs: sas-exporter gives sas_exporter_build_info. Options.Namespace is gone, so a tool drops it; Options.BuildInfo names the reading outright, to keep a name a dashboard already uses
• prometheus/metricstest: a saved page leaves out the build's reading whatever the tool is called

v0.8.0

• httpc (breaking): chttp is renamed httpc. A tool changes its import and calls httpc.New where it called chttp.New; nothing else changes
• httpd: add the package, the HTTP server under a tool's routes: it listens, answers a health check, and on stop lets requests under way finish. mcp/server and prometheus/metrics serve through it, with nothing changed for a tool
• text: add the package, small helpers for wording more than one tool needs: a description's first sentence or first line, and the article a word takes
• mcp/registry: the page size a call asked for, where the next page starts, and how long a call asked to wait, which four MCP servers each kept a copy of
• prometheus/metrics (breaking): pmetrics moves here, beside the other Prometheus pieces. A tool changes its import and calls metrics.New where it called pmetrics.New; nothing else changes
• prometheus/metrics: a tool lists its readings in one place and writes them with the package's writer, in place of its own copy of both. A reading given twice is left off rather than spoiling the page
• prometheus/metrics (fix): a page with one reading that cannot be written is printed without that reading, where it printed nothing at all
• prometheus/metricstest: add the package, the checks a tool's tests make of its metrics page: against a saved copy, against Prometheus's naming rules, and of a running tool's page
• prometheus/poller: add the package. It asks what a tool reports on, on schedules of the tool's own, and keeps the last good answers, so the page is served from memory; one slow or missing target holds up no other. Every tool reads its --intervals setting the same way
• prometheus/exporter: add the package, a tool's print and serve commands in two calls

v0.7.0

• pmetrics: add the package, a tool's Prometheus metrics page. It holds the tool's own readings and nothing of the Go runtime's, puts the labels whoever runs the tool asks for on every reading, and says which build wrote it. It is written as text or served over HTTP beside a health check. Only this package uses the Prometheus client, so a tool without a metrics page does not build it in
• every package: asks for Go 1.27, where it asked for 1.26, as every project that uses the library already does

v0.6.4

• chttp, mcp/registry (fix): a name with password, passphrase or secret anywhere in it is a credential's, where only a name ending in one was. passwordConfirmation was written to the write log in clear under an argument a server said was safe to show, and was shown in a trace; so was any name with something after the word. SecretName, RedactJSON, a trace and the line written for a write all go by the one rule. The price is a harmless name with the word in it, passwordHint, hidden too. A token, a cookie or a key is still known only by how its name ends, so maxTokens is left alone
• chttp, cout, mcp/registry, test/replayproxy, test/services/sabnzbd: tidied for three rules a newer lint asks for, with no change in what any of them does: a pointer is checked before it is followed, a field set to its empty value is left out, and an import lost a second name it did not need. Nine Go files changed for this alone
• every package: built, linted and tested with Go 1.27.2, where it was 1.26.6. go.mod still asks for Go 1.26 and the tests still run on 1.26.0, so nothing changes for a project that uses the library

v0.6.3

• mcp/registry (fix): a free-form argument a server names in Config.ShownArguments is written as sent only for a call the tool answered. A call the tool failed, or one refused before it ran, was written the same way, though it was never held to the tool's own list of names: a setting the tool would not take, one that carries every signing key's secret, went into the line in clear. Such a call is now written with every value under the argument blanked, like any other
• mcp/registry: Config.LogWrite's doc says the line is not shown at a tool's default log level: it goes to the shared log at info, for whoever sets the log to info
• mcp/acctest: Suite.Secret's doc says a secret must be a string that is nothing's name and too long to turn up by chance; a password that is also a token's name is found wherever the name is listed

v0.6.2

• mcp/registry (fix): the line written for a write blanked only an argument named as a credential, so a key, a cookie or a passkey under a name of someone else's choosing, in a settings object, was written in clear to a log at info. Blanked now, with its names kept, is everything under an argument a tool takes as a free-form object; in an address anywhere in what is left, who it signs in as, the value of every parameter and what follows its #; and whatever Config.SecretArguments names, whole, for a file's text, a command or an address whose path is the secret. Config.ShownArguments names, by tool, a free-form argument that holds no credential and is written as sent. What was blanked is blanked in the failure beside it too, which is apt to repeat what it was sent. The arguments are written with their names in order, where they were written as the caller had them
• mcp/registry: a failure's words reach the caller with what an address in them may carry a credential in taken out, around every tool: who it signs in as, the value of every parameter and what follows its #. A server quotes an address back in an error with a credential of its own on the end, an indexer's stored key, and the tool handed that to the model as it was. An answer's addresses are left as they are
• outside: add BlankAddresses, text with what each address in it may carry a credential in blanked, who it signs in as, the value of every parameter and what follows its #: for a server's own words about what went wrong, a failed test's reason or a line of a log, which quote the address it called with its own key on the end. It is the rule a failure's words and the line written for a write are held to. An address written inside brackets, as at [http://host/api?apikey=...] is, keeps the bracket that closes them
• mcp/registry: Config.BlankAddresses names the values in an answer that are a server's own words for what went wrong, by the JSON names they are answered under, and each address under such a name is answered as one in a failure is, however deep and whether or not answers are cleaned; every other address in an answer is the caller's to use and is left. BlankAddressesUnused is the names on that list no tool answers under, for a server's test to hold to none
• mcp/registry (fix): an empty map in an answer is sent as {}, as an empty list is sent as []; it was sent as null, which the SDK refused the whole call for, the tool's own schema saying an object
• mcp/registry: a tool whose input is any takes no arguments, and refuses one as every other tool does and as the shared instructions say; the SDK's schema for such a tool took whatever it was sent. This changes what a server lists for such a tool, whose input schema now says it takes no properties; a call with no arguments, or with {}, is answered as before
• chttp (fix): a StatusError and a Preview carry the start of a server's answer with its credentials blanked; a server that refuses a save echoes the record back, key and all, and the error reaches a log and whoever called with it in clear
• chttp: add SecretName, whether a name is a credential's by the rule a trace hides one by; a name that ends passphrase, passkey, cookie, private_key or privatekey is one now, in a trace as well
• mcp/acctest: Suite.Secret has everything a tool answers or refuses with read, all run long, for a credential the suite gives the server or the server's own, and Suite.LeakReport says where one was shown, for a suite's TestMain to fail on: a server hands a key back where nobody thinks to test, and it takes no test to think of the tool that shows it; sonarr-mcp's, which radarr-mcp and prowlarr-mcp had each copied

... (truncated)

Changelog

Sourced from github.com/katbyte/go-kt's changelog.

v0.9.1 (2026-10-20)

• README: the tools that use the library are listed by the names they have now: the three metrics tools are Prometheus exporters, and sas-exporter and syslog-relay are added. Nothing in the library changes

v0.9.0 (2026-10-15)

• prometheus/metrics (breaking): the reading that says which build wrote the page is named for the tool, as Prometheus's own tools name theirs: sas-exporter gives sas_exporter_build_info. Options.Namespace is gone, so a tool drops it; Options.BuildInfo names the reading outright, to keep a name a dashboard already uses
• prometheus/metricstest: a saved page leaves out the build's reading whatever the tool is called

v0.8.0 (2026-10-14)

• httpc (breaking): chttp is renamed httpc. A tool changes its import and calls httpc.New where it called chttp.New; nothing else changes
• httpd: add the package, the HTTP server under a tool's routes: it listens, answers a health check, and on stop lets requests under way finish. mcp/server and prometheus/metrics serve through it, with nothing changed for a tool
• text: add the package, small helpers for wording more than one tool needs: a description's first sentence or first line, and the article a word takes
• mcp/registry: the page size a call asked for, where the next page starts, and how long a call asked to wait, which four MCP servers each kept a copy of
• prometheus/metrics (breaking): pmetrics moves here, beside the other Prometheus pieces. A tool changes its import and calls metrics.New where it called pmetrics.New; nothing else changes
• prometheus/metrics: a tool lists its readings in one place and writes them with the package's writer, in place of its own copy of both. A reading given twice is left off rather than spoiling the page
• prometheus/metrics (fix): a page with one reading that cannot be written is printed without that reading, where it printed nothing at all
• prometheus/metricstest: add the package, the checks a tool's tests make of its metrics page: against a saved copy, against Prometheus's naming rules, and of a running tool's page
• prometheus/poller: add the package. It asks what a tool reports on, on schedules of the tool's own, and keeps the last good answers, so the page is served from memory; one slow or missing target holds up no other. Every tool reads its --intervals setting the same way
• prometheus/exporter: add the package, a tool's print and serve commands in two calls

v0.7.0 (2026-10-12)

• pmetrics: add the package, a tool's Prometheus metrics page. It holds the tool's own readings and nothing of the Go runtime's, puts the labels whoever runs the tool asks for on every reading, and says which build wrote it. It is written as text or served over HTTP beside a health check. Only this package uses the Prometheus client, so a tool without a metrics page does not build it in
• every package: asks for Go 1.27, where it asked for 1.26, as every project that uses the library already does

v0.6.4 (2026-10-11)

• chttp, mcp/registry (fix): a name with password, passphrase or secret anywhere in it is a credential's, where only a name ending in one was. passwordConfirmation was written to the write log in clear under an argument a server said was safe to show, and was shown in a trace; so was any name with something after the word. SecretName, RedactJSON, a trace and the line written for a write all go by the one rule. The price is a harmless name with the word in it, passwordHint, hidden too. A token, a cookie or a key is still known only by how its name ends, so maxTokens is left alone
• chttp, cout, mcp/registry, test/replayproxy, test/services/sabnzbd: tidied for three rules a newer lint asks for, with no change in what any of them does: a pointer is checked before it is followed, a field set to its empty value is left out, and an import lost a second name it did not need. Nine Go files changed for this alone
• every package: built, linted and tested with Go 1.27.2, where it was 1.26.6. go.mod still asks for Go 1.26 and the tests still run on 1.26.0, so nothing changes for a project that uses the library

v0.6.3 (2026-10-10)

• mcp/registry (fix): a free-form argument a server names in Config.ShownArguments is written as sent only for a call the tool answered. A call the tool failed, or one refused before it ran, was written the same way, though it was never held to the tool's own list of names: a setting the tool would not take, one that carries every signing key's secret, went into the line in clear. Such a call is now written with every value under the argument blanked, like any other
• mcp/registry: Config.LogWrite's doc says the line is not shown at a tool's default log level: it goes to the shared log at info, for whoever sets the log to info
• mcp/acctest: Suite.Secret's doc says a secret must be a string that is nothing's name and too long to turn up by chance; a password that is also a token's name is found wherever the name is listed

v0.6.2 (2026-10-10)

• mcp/registry (fix): the line written for a write blanked only an argument named as a credential, so a key, a cookie or a passkey under a name of someone else's choosing, in a settings object, was written in clear to a log at info. Blanked now, with its names kept, is everything under an argument a tool takes as a free-form object; in an address anywhere in what is left, who it signs in as, the value of every parameter and what follows its #; and whatever Config.SecretArguments names, whole, for a file's text, a command or an address whose path is the secret. Config.ShownArguments names, by tool, a free-form argument that holds no credential and is written as sent. What was blanked is blanked in the failure beside it too, which is apt to repeat what it was sent. The arguments are written with their names in order, where they were written as the caller had them
• mcp/registry: a failure's words reach the caller with what an address in them may carry a credential in taken out, around every tool: who it signs in as, the value of every parameter and what follows its #. A server quotes an address back in an error with a credential of its own on the end, an indexer's stored key, and the tool handed that to the model as it was. An answer's addresses are left as they are
• outside: add BlankAddresses, text with what each address in it may carry a credential in blanked, who it signs in as, the value of every parameter and what follows its #: for a server's own words about what went wrong, a failed test's reason or a line of a log, which quote the address it called with its own key on the end. It is the rule a failure's words and the line written for a write are held to. An address written inside brackets, as at [http://host/api?apikey=...] is, keeps the bracket that closes them
• mcp/registry: Config.BlankAddresses names the values in an answer that are a server's own words for what went wrong, by the JSON names they are answered under, and each address under such a name is answered as one in a failure is, however deep and whether or not answers are cleaned; every other address in an answer is the caller's to use and is left. BlankAddressesUnused is the names on that list no tool answers under, for a server's test to hold to none
• mcp/registry (fix): an empty map in an answer is sent as {}, as an empty list is sent as []; it was sent as null, which the SDK refused the whole call for, the tool's own schema saying an object
• mcp/registry: a tool whose input is any takes no arguments, and refuses one as every other tool does and as the shared instructions say; the SDK's schema for such a tool took whatever it was sent. This changes what a server lists for such a tool, whose input schema now says it takes no properties; a call with no arguments, or with {}, is answered as before
• chttp (fix): a StatusError and a Preview carry the start of a server's answer with its credentials blanked; a server that refuses a save echoes the record back, key and all, and the error reaches a log and whoever called with it in clear
• chttp: add SecretName, whether a name is a credential's by the rule a trace hides one by; a name that ends passphrase, passkey, cookie, private_key or privatekey is one now, in a trace as well
• mcp/acctest: Suite.Secret has everything a tool answers or refuses with read, all run long, for a credential the suite gives the server or the server's own, and Suite.LeakReport says where one was shown, for a suite's TestMain to fail on: a server hands a key back where nobody thinks to test, and it takes no test to think of the tool that shows it; sonarr-mcp's, which radarr-mcp and prowlarr-mcp had each copied

... (truncated)

Commits

• 351fddc v0.9.1
• 67c5d87 List the tools that use the library by the names they have now
• 98d3206 Have a bare make format and build
• 2305509 v0.9.0
• adac2dc Name the build reading for the tool, as Prometheus's own tools do
• 98dfe41 v0.8.0
• 7e838f7 Give mcp/registry the paging and waiting helpers four MCP servers share
• cd2ba05 Add text, small helpers for wording more than one tool needs
• dbfa0b7 Add httpd, the HTTP server under the MCP server and the metrics page
• 7b9360c Rename chttp to httpc
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions