chore(all): update deps

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/spf13/cobra	v1.10.1 -> v1.10.2			require	patch
go (source)	1.25.3 -> 1.25.5			toolchain	patch
golang.org/x/exp	d2f985d -> 8475f28			require	digest
google.golang.org/grpc	v1.76.0 -> v1.77.0			require	minor

---

Release Notes

spf13/cobra (github.com/spf13/cobra)

v1.10.2

Compare Source

🔧 Dependencies

• chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in #​2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

• Fix linter and allow CI to pass by @​marckhouzam in #​2327
• fix: actions/setup-go v6 by @​jpmcb in #​2337

🔥✍🏼 Docs

• Add documentation for repeated flags functionality by @​rvergis in #​2316

🍂 Refactors

• refactor: replace several vars with consts by @​htoyoda18 in #​2328
• refactor: change minUsagePadding from var to const by @​ssam18 in #​2325

🤗 New Contributors

• @​rvergis made their first contribution in #​2316
• @​htoyoda18 made their first contribution in #​2328
• @​ssam18 made their first contribution in #​2325
• @​dims made their first contribution in #​2336

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

golang/go (go)

v1.25.5

v1.25.4

grpc/grpc-go (google.golang.org/grpc)

v1.77.0: Release 1.77.0

Compare Source

API Changes

• mem: Replace the Reader interface with a struct for better performance and maintainability. (#​8669)

Behavior Changes

• balancer/pickfirst: Remove support for the old pick_first LB policy via the environment variable GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false. The new pick_first has been the default since v1.71.0. (#​8672)

Bug Fixes

• xdsclient: Fix a race condition in the ADS stream implementation that could result in resource-not-found errors, causing the gRPC client channel to move to TransientFailure. (#​8605)
• client: Ignore HTTP status header for gRPC streams. (#​8548)
• client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. (#​8534)
  • Special Thanks: @​jgold2-stripe
• client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy.
  • Setting environment variable GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false disables this change; please file a bug if any problems are encountered as we will remove this option soon. (#​8613)
• balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. (#​8611)
• server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. (#​8573)
  • Special Thanks: @​hugehoo
• balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to pick_first but don't set endpoints. (#​8610)
• mem: Clear large buffers before re-using. (#​8670)

Performance Improvements

• transport: Reduce heap allocations to reduce time spent in garbage collection. (#​8624, #​8630, #​8639, #​8668)
• transport: Avoid copies when reading and writing Data frames. (#​8657, #​8667)
• mem: Avoid clearing newly allocated buffers. (#​8670)

New Features

• outlierdetection: Add metrics specified in gRFC A91. (#​8644)
  • Special Thanks: @​davinci26, @​PardhuKonakanchi
• stats/opentelemetry: Add support for optional label grpc.lb.backend_service in per-call metrics (#​8637)
• xds: Add support for JWT Call Credentials as specified in gRFC A97. Set environment variable GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true to enable this feature. (#​8536)
  • Special Thanks: @​dimpavloff
• experimental/stats: Add support for up/down counters. (#​8581)

---

Configuration

📅 Schedule: Branch creation - Monday through Friday ( * * * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coveralls]

coverage: 88.728%. remained the same
when pulling 006a7dc on renovate-bot:renovate/deps
into b29aaff on openconfig:master.

[forking-renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.42.0 -> v0.46.1-0.20251013234738-63d1a5100f82
golang.org/x/sys	v0.34.0 -> v0.37.0
golang.org/x/text	v0.28.0 -> v0.30.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250804133106-a7a43d27e69b -> v0.0.0-20251022142026-3a174f9686a8