fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@google/gemini-cli	0.60.0 → 0.61.0			dependencies	minor
@​steipete/summarize	0.23.0 → 0.23.1			dependencies	patch
cloudflare/cloudflared	2026.9.1 → 2026.9.3				patch
grafana/alloy	v1.19.2 → v1.20.0				minor
headscale/headscale	v0.29.3 → v0.29.4				patch
mcporter	0.14.0 → 0.14.1			dependencies	patch
quay.io/prometheus/prometheus	v3.14.0 → v3.15.0				minor

---

Release Notes

google-gemini/gemini-cli (@​google/gemini-cli)

v0.61.0

Compare Source

What's Changed

• Changelog for v0.60.0-preview.0 by @​gemini-cli-robot in #​29251
• chore(release): bump version to 0.61.0-nightly.20260908.gc647533d6 by @​gemini-cli-robot in #​29254
• Changelog for v0.59.0 by @​gemini-cli-robot in #​29253
• fix(core): preserve explicit versioned Flash model IDs by @​SandyTao520 in #​29252
• fix(core): prevent indirect prompt injection via build file modifications and untrusted flags by @​villahernandez-coder in #​29250
• fix(sandbox): harden filesystem boundaries and isolate runtime state by @​diegogodinezr in #​29214
• fix(core): ensure AgentLoopContext properties are preserved across object spread by @​diegogodinezr in #​29335
• fix(patch): cherry-pick 62364cb to release/v0.61.0-preview.0-pr-29443 to patch version v0.61.0-preview.0 and create version 0.61.0-preview.1 by @​gemini-cli-robot in #​29455

Full Changelog: google-gemini/gemini-cli@v0.60.0...v0.61.0

cloudflare/cloudflared (cloudflare/cloudflared)

v2026.9.3

Compare Source

SHA256 Checksums:

cloudflared-amd64.pkg: 48d0d3b28b3b5d142490f57316981b65ae46fbbe33408c22b0a4a11b5242de50
cloudflared-arm64.pkg: 79f17181cda2bbcfe6ad36cd9ee1946faaf079e6a9d6c0bc4a32fbb644a4c29d
cloudflared-darwin-amd64.tgz: ab588b3b4db9cdb4476c30a3db2a72635b1d8327d44741fee6799a0f37b0ec07
cloudflared-darwin-arm64.tgz: 5472c1a01c84bc31b3021056a73b4e5774ddddefc572124ea8fdf6c340639f32
cloudflared-fips-linux-amd64: 32a68f04c5816304ece7f5129ab81581c95eb26352848d2605cde42d63316e88
cloudflared-fips-linux-amd64.deb: 4dd10ab302a672c34739d88305ad83bf847b37840ccbd1f17a2ab94bf3dc690c
cloudflared-fips-linux-x86_64.rpm: eae2945bc1b947d225b25325eda961be1fa924097d9cfdd0ae70e154bd16dc3e
cloudflared-linux-386: d6b2f917e2e78b3e3afba760af726e51751d10c2fcad4a2fb2a69feb4bd47421
cloudflared-linux-386.deb: efd821ce6adeb899b419a26965f09ca4d64c7dca9b386b1be6ecb5b7e947cf34
cloudflared-linux-386.rpm: e3c3d6bf81c14eec403a540328e66ef3304539fc5c00f0dada6d5b70a9205d59
cloudflared-linux-aarch64.rpm: e37b746dd252ab51b8dbe90f07eaf50c0335d137009cc224a97203acf1c331ab
cloudflared-linux-amd64: 77e26d8d900e0b8469f416239d14b5f296525fdf79fee6f511ef55609e3fbac2
cloudflared-linux-amd64.deb: bc073ef293d504cf5ac533bd0aa1c824ef6b4f358765ccaa6628a8a95cacb4b7
cloudflared-linux-arm: 967dc371a3fedbf09e881c13ee7ba317155ebc336cbd4afb756b46fc6785e5af
cloudflared-linux-arm.deb: a9d12267d5991328c40c5071fcc82c3d6d1953800bd30d3530a5120b2dda9b4f
cloudflared-linux-arm.rpm: 20b3b2ae15b744a04eb27b94300450eb9d280ffff4d196ff3e2509daaf0c7024
cloudflared-linux-arm64: aaeb2d7d0da3614634c7e03ab13487a1522c2e79165ed2929cfe23d5e95b326d
cloudflared-linux-arm64.deb: bcce0111878f13d26e66b1d2ea7f270c8bde4bd549e32ce74d32474521583ca3
cloudflared-linux-armhf: a714b1bee87e71ce7260555b30722ce711d12aaa0fee5a8aadc767ee6b816a14
cloudflared-linux-armhf.deb: 4815dd7fc7b4c3ff5d29a7bbe80bba9e253d29b2eb84079e853b158fdfd7e975
cloudflared-linux-armhf.rpm: 4350c58a83ce4cd8717eb6352713e6d2d615c204a6e6161015cf0db4a2142c18
cloudflared-linux-x86_64.rpm: b64f9131b5ea2772c4a8fb9fb67f95437190ad63e909871396adb92c2b6d99eb
cloudflared-windows-386.exe: 9b95ddc2eba67b86ed3dc4cc2a15881960563031b52ce564376af41fb91ad402
cloudflared-windows-386.msi: c26a212d4e04e3d0525aa131c02653801920cd88c706cb67c0eb8a09293f4591
cloudflared-windows-amd64.exe: f096265ec2fcbe9bb6e2d64268db167ced3fcbb83d894bdb9e2fcdb26f2ea7e2
cloudflared-windows-amd64.msi: 597c2f4daa5965f10a3893a56aefe27a5e5946bcbd333d984a32743c6df7a561

v2026.9.2

Compare Source

SHA256 Checksums:

cloudflared-amd64.pkg: 86dd0f8fcb3060b6080f2c3233967887d6ceb0fbed180ccfd8999f4b82baa0fd
cloudflared-arm64.pkg: 966fd7f038fc04286fc2a9883352b6342899927958b694d1d316a99cc4f58c9a
cloudflared-darwin-amd64.tgz: 5353cd803c5ed275a23cf1185860776bf3917d93890588b021a7ff896136efb4
cloudflared-darwin-arm64.tgz: 1e4cf155145f9a459e3cc5b1ca147c312fb7dca6be7faef75d8832ff6d673c7a
cloudflared-fips-linux-amd64: 605ca757adedbb81b45a93584f87d23ebbe35d5b018a5475a6cc6858d664f682
cloudflared-fips-linux-amd64.deb: 5fb596219cc8c37e400e06bca1ca3a0e23a477a56e4446229eb52919f6f42974
cloudflared-fips-linux-x86_64.rpm: dcd12ba94fa9edb8c971d4e3d16f4bea71127207713d4ded905d6cdb38060a76
cloudflared-linux-386: 4d813b9d5b35ef683f5614dc0811c69618bad1fc3350687e95ad4fc549e7342c
cloudflared-linux-386.deb: 25c17dcc4c496abd34682e22d6a3f864f0c4797581a19ce3f3ae5e27963239c0
cloudflared-linux-386.rpm: 1f2ff2662358a578f0735ec462e7d2654dc58e4c23725abf9ba6081c34601156
cloudflared-linux-aarch64.rpm: cb7842ff6f959d3a77d43314be5b6015dc17a3a90d92630887396fab0797c31f
cloudflared-linux-amd64: ea2c9bb2d5017a796b64bf36e605d727accf76a5500014bb12952ce11ae1f932
cloudflared-linux-amd64.deb: aa2604c46d5b8848247c6d32ca8e6d7e62e97d7d7ecc4a62023d58d246f6dea4
cloudflared-linux-arm: 871f8a4f48b841d91834b45157b169c601c29892da3629edc4b1d2088ab4767d
cloudflared-linux-arm.deb: a55cada018840b7cbb07ce764e91f34d4797de1c0a0bc688bcdf86fee2a6aca3
cloudflared-linux-arm.rpm: 53ce7747b64f16ef6e75eb77d4ecaca7df1abc6399054d7b62f5eea86722f93d
cloudflared-linux-arm64: 39f23e7c55ce2c2e502a0b3e070b978bf69135b19246b5b7581dadb94cf2144d
cloudflared-linux-arm64.deb: 8bbbffa69cedbf546dc224a9319e90626069b0c917c4070b43aaf81f87cf2821
cloudflared-linux-armhf: dbab3ca93dc0bb7bff1b15486c3ca2b96c71b3ac0cda24e340517ceae20898cc
cloudflared-linux-armhf.deb: 1f6a3a17a309f0ad2b25c85f7322a298b4938ad5e904b19bced157040ee07e55
cloudflared-linux-armhf.rpm: f3709a03692906b8539c9bd27c1b38f3d183d71d20d6c0d991abb9566fcfe610
cloudflared-linux-x86_64.rpm: e18befe6459389d8667d2b6496664009164c16f45aa660cfd0cfdfd8f748576a
cloudflared-windows-386.exe: d2be3e66033b499634dc9a675051b70dd37fb2bd91d4f864073fd71cc69c1003
cloudflared-windows-386.msi: 5321d7e658043beab5179d9f0b32b199b722d0c95bfad5085c89c6fa70b3f82a
cloudflared-windows-amd64.exe: 214f5d74f66941d147d054f6cc9d821c60ff6a9b2d5355f6c854c6bee217c548
cloudflared-windows-amd64.msi: 73a62ea87074d97a8fa98575f2100de826fb6d38ee52b70f569c113f8a824c99

grafana/alloy (grafana/alloy)

v1.20.0

Compare Source

⚠ BREAKING CHANGES

• discovery.hetzner: discovery.hetzner no longer exports the __meta_hetzner_datacenter label for targets with role = "hcloud". Relabeling rules that reference this label for hcloud targets silently stop matching. The label is unaffected for role = "robot" targets, which also now export it under the additional name __meta_hetzner_robot_datacenter.
• otelcol.receiver.filelog: otelcol.receiver.filelog's top_n now distinguishes an explicit 0 ("track all files") from leaving it unset ("apply the default"), matching upstream. Breaking change: previously, top_n = 0 was treated the same as unset.
• otelcol.exporter.awss3: Apply upstream retry defaults and expose retry_on_failure (#​7138)
• otelcol.processor.memory_limiter: Apply upstream GC interval defaults and expose them (#​7137)
• otelcol.receiver.kafka: plaintext credentials are now translated into a sasl block with mechanism set to PLAIN, matching what upstream's Kafka client actually requires. This also applies to otelcol.exporter.kafka. Configs relying on the old (broken) silent-drop behavior will now authenticate correctly instead of connecting anonymously.
• otelcol.processor.k8sattributes: otelcol.processor.k8sattributes now extracts container.image.tags (a list) instead of container.image.tag (a string) by default. Default label/annotation attribute keys for pod, namespace, and node sources change from the deprecated plural form (k8s.pod.labels.) to the singular form (k8s.pod.label.). There's no configuration option to restore the previous behavior. The deployment_name_from_replicaset argument has also been removed; the processor now always extracts the deployment name from the ReplicaSet name.
• otelcol.receiver.faro: otelcol.receiver.faro now emits deployment.environment.name instead of the deprecated deployment.environment resource attribute by default.
• otelcol.processor.transform: Base64Decode has been removed. Use Decode(value, "base64") instead. This also affects otelcol.processor.filter and any other OTTL-consuming component.
• otelcol.processor.transform: Previously a no-op, set(target, nil) now sets target to nil, because upstream's ottl.set.allowNil feature gate is enabled by default as of this bump.
• prometheus.exporter.windows now applies the documented default textfile directory (\textfile_inputs) when neither textfile.directories nor the deprecated text_file.text_file_directory is set, restoring behavior that was lost in v1.11.0. Deployments that were relying on the collector silently returning nothing will start receiving any .prom files found there, or an error if that directory doesn't exist, either of which can be avoided by setting directories explicitly or removing textfile from enabled_collectors.

Features 🌟

• Add 32MB and 64MB buckets to Loki histograms (#​7059) (c973f57) (@​grobinson-grafana)
• Add special reason when Loki returns 413 (#​7058) (ca2118c) (@​grobinson-grafana)
• database_observability.mysql: Add index-usage collectors (#​7069) (a4271ba) (@​gaantunes, @​cristiangreco)
• database_observability.mysql: Add primary and unique index labels and a new row_count metric (#​7095) (9199e72) (@​gaantunes)
• database_observability.postgres: Add index-usage collectors (#​7068) (e9c7d65) (@​gaantunes)
• database_observability.postgres: Add support for clustering mode (#​7158) (a832899) (@​matthewnolf)
• database_observability.postgres: Support monitoring multiple database blocks (#​6912) (f3de7a4) (@​matthewnolf)
• database_observability.sql_server: Add query_samples collector (#​7106) (6751607) (@​cristiangreco, @​matthewnolf, @​clayton-cornell)
• database_observability.sql_server: Add query_timeout setting (#​7157) (89929a2) (@​cristiangreco)
• database_observability.sql_server: Add explain_plans collector (#​6941) (f7fec75) (@​rgeyer, @​clayton-cornell)
• deps: Update beyla.ebpf component to 3.35.0 (#​7084) (64747dc) (@​grcevski)
• Distroless Alloy docker image using chisel (#​6948) (d842c8e) (@​x1unix, @​clayton-cornell)
• helm: Add controller.dnsConfig to alloy chart pod spec (#​6399) (09252c3) (@​younsl, @​dehaansa)
• helm: Add service.trafficDistribution to values.yaml (#​7057) (deb039c) (@​agermel)
• loki.secretfilter: Promote secretfilter to GA (#​7071) (a7293ea) (@​kleimkuhler)
• loki.write: Add loki_write_batch_size_bytes histogram (#​7052) (a38299a) (@​grobinson-grafana)
• monitors: Support native histogram for service and pod monitors (#​6817) (0d731b0) (@​hdost)
• Move otelcol.exporter.faro to public preview (#​6940) (02d8c29) (@​mar4uk)
• Move otelcol.receiver.faro to public preview (#​6939) (c7e3265) (@​mar4uk)
• OTel service installation support for systemd (#​7006) (9ad8ee4) (@​blewis12, @​thampiotr)
• OTel service installation support for windows service (#​7007) (4017d4e) (@​blewis12)
• otelcol.exporter.kafka: Add signal_header (#​7146) (8d57c65) (@​dehaansa)
• otelcol.exporter.otlphttp,otelcol.exporter.faro: Add keepalive block (#​7152) (9ae05d8) (@​dehaansa)
• otelcol.processor.k8sattributes: Adopt upstream's stable Kubernetes semantic conventions by default (#​7109) (95354a7) (@​dehaansa)
• otelcol.processor.resourcedetection: Add azureappservice detector (#​7150) (857a73f) (@​dehaansa)
• otelcol.processor.resourcedetection: Add azurecontainerapps detector (#​7151) (29f52b7) (@​dehaansa)
• otelcol.processor.resourcedetection: Expose the retry block added in OTel v0.161 (#​7141) (5f934a5) (@​kgeckhart)
• otelcol.processor.tail_sampling: Add num_shards (#​7144) (3ecb703) (@​dehaansa)
• otelcol.processor.transform: set(target, nil) now sets a nil value (#​7109) (95354a7) (@​dehaansa)
• otelcol.processor.transform: Add experimental shared_cache to statement blocks, available with --stability.level=experimental (#​7164) (8c62dc7) (@​dehaansa)
• otelcol.processor.transform: Remove the Base64Decode OTTL converter function (#​7109) (95354a7) (@​dehaansa)
• otelcol.receiver.faro: Adopt upstream's stable resource-attribute semantic conventions by default (#​7109) (95354a7) (@​dehaansa)
• otelcol.receiver.filelog: Add skip_unmodified_files attribute (#​7170) (c10b6d5) (@​dehaansa)
• otelcol.receiver.filelog: Expose explicit top_n=0 "match all files" semantics (#​7139) (8bb2561) (@​dehaansa)
• otelcol.receiver.kafka: Add partition_processing block (#​7163) (077db7d) (@​dehaansa)
• otelcol.receiver.syslog: Add auth argument to tcp block (#​7149) (f4d9e79) (@​dehaansa)
• otelcol.receiver.tcplog: Add auth argument for TCP connections (#​7148) (bb080ea) (@​dehaansa)
• otelcol.receiver.vcenter: Add host-level memory metrics (#​7143) (41def15) (@​dehaansa)
• otelcol: Add keepalive block to shared HTTP server config (#​7166) (20244eb) (@​dehaansa)
• otelcol: Log a warning for deprecated Kafka and k8sattributes settings on component start and on every config update (#​7109) (95354a7) (@​dehaansa)
• otelcol: Support encoding extensions for otelcol.receiver.awss3 (#​7014) (c9f1806) (@​x1unix, @​clayton-cornell, @​dehaansa)
• otelcol: Upgrade to OTel Collector v0.161.0, Prometheus v0.314.0, and Loki (#​7109) (95354a7) (@​dehaansa)
• prometheus.remote_write: Expose sigv4 session_name and tags (#​7145) (a872c11) (@​dehaansa)
• prometheus.scrape: Allow excluding labels from clustering ownership (#​7160) (8a97530) (@​thampiotr, @​clayton-cornell)
• Update cAdvisor to v0.60.5 (#​7079) (4ade38c) (@​dehaansa)

Bug Fixes 🐛

• database_observability.mysql: Resolve query-parsed table names against known-table casing (#​6953) (7243eae) (@​gaantunes)
• database_observability.postgres: Set explain plan search_path to all schemas of the database (#​7075) (23d9b8a) (@​cristiangreco)
• database_observability.sql_server: Fix explain_plans timeout (#​7086) (0381e93) (@​rgeyer)
• database_observability.sql_server: Model Update and Assert explain plan operators (#​7142) (6f99ec7) (@​rgeyer)
• Debug log the reason an exporter metrics handler fails instead of discarding it (#​7064) (d325d4b) (@​thampiotr)
• deps: Update Go dependencies to fix security advisories (#​7041) (bff3d36) (@​dehaansa)
• discovery.hetzner: Document __meta_hetzner_datacenter no longer set for hcloud targets (#​7169) (08b82b0) (@​dehaansa)
• Ensure Windows exporter uses correct text file defaults when not specified (#​7047) (b5c82cb) (@​blewis12)
• faro.receiver: Allow Faro SDK retry headers through CORS (#​7054) (a6e19ce) (@​Blinkuu)
• loki.source.docker: Reduce initial buffer allocation (#​7183) (2fa1a08) (@​kalleep)
• loki.source.journal: Dont override configured job label (#​6982) (866eca2) (@​kalleep)
• loki.source.kubernetes_events: Check for event.Series.LastObservedTime (#​6825) (172f0b5) (@​NachoxMacho)
• loki.write: Potential deadlock when queue is full and component shuts down (#​7091) (5b405e4) (@​kalleep, @​kgeckhart)
• loki.write: Prevent data to be marked as sent if request is canceled due to hard shutdown (#​7113) (b434582) (@​kalleep)
• loki.write: Serialize WAL segment marker file access on Windows (#​7181) (4af0406) (@​dehaansa)
• loki.write: Stop started endpoints when one of them fails (#​7115) (3df385d) (@​kalleep)
• loki.write: WAL writer metrics is now collected after reload (#​7093) (f6bf023) (@​kalleep)
• Only log cluster warning for host-specific exporters when clustering is enabled (#​7048) (163a617) (@​blewis12)
• otel-supervisor: Remove the inert reports_remote_config capability from the built-in Grafana Fleet Management config (#​7109) (95354a7) (@​dehaansa)
• otelcol.auth.google: Set valid authorization token header (#​7031) (0dffb9f) (@​odam06)
• otelcol.exporter.awss3: Apply upstream retry defaults and expose retry_on_failure (#​7138) (5abf066) (@​kgeckhart)
• otelcol.processor.memory_limiter: Apply upstream GC interval defaults and expose them (#​7137) (406030b) (@​kgeckhart)
• otelcol.receiver.cloudflare: Apply the documented default arguments (#​7088) (b29717c) (@​kgeckhart)
• otelcol.receiver.kafka: authentication { plaintext { } } no longer silently drops its credentials (#​7109) (95354a7) (@​dehaansa)
• otelcol.receiver.kafka: Reject configuring both authentication.kerberos and authentication.sasl/authentication.plaintext (#​7109) (95354a7) (@​dehaansa)
• otelcol: Reject disable_keep_alives combined with a client keepalive block (#​7171) (4ca2f1c) (@​dehaansa)
• Prevent loki.write WAL watcher panic when a record spans a page boundary (#​6766) (b7d69af), refs #​6757 (@​emmayusufu)
• prometheus.remote_write: Don't let metadata impact Remote Write v2 shard count (#​7136) (2fa81a1) (@​kgeckhart)
• prometheus.remote_write: Reset the WAL buffer after a failed write (#​7179) (bdb9450) (@​kgeckhart)
• prometheus.remote_write: Stop truncating the WAL on restart over records we wrote ourselves (#​7180) (9493f4a) (@​kgeckhart)
• pyroscope.ebpf: Count pprof samples correctly (#​7119) (55bb01e) (@​korniltsev-grafanista)
• remotecfg: Use atomic writes for cache file (#​7131) (58a5b97) (@​dehaansa)
• ui: Add accessible auto-scroll toggle in live debugging (#​6649) (c86029b) (@​harsh543)
• windows: Statically link Windows builds to fix missing DLL errors on startup (#​6972) (3914c54) (@​blewis12)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

openclaw/mcporter (mcporter)

v0.14.1

Compare Source

Highlights: Windows background commands stay quiet, and daemon activity logs honor the chosen server aliases.

• Honor daemon start --log-servers for each caller-visible server alias, suppressing unselected activity in both stdout and log files even when aliases share a connection.
• Prevent Windows console flashes during stdio server cleanup and CLI generation by hiding background PowerShell, Bun, and npm subprocesses. Thanks @​VladislavEkimtcov and @​KalebCole (#​398).
• Refresh eligible dependencies and development tools, including URI normalization and bounded brace parsing security fixes in development fixtures, while preserving Node 24 and the 48-hour dependency release-age policy (#​400).

Verification: npm, registry tarball, native assets, and browser Gatekeeper proof. npm integrity: sha512-/6pvMjFPlCtFU3NhzWEV8vj2EwvbY2nisc8XYDwtPiyApj8v6A+B0Va5ul018oqSEkw7BiKCLoazBc4l+8QsdQ==.

prometheus/prometheus (quay.io/prometheus/prometheus)

v3.15.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.