Dependabot backlog triage: 47 open PRs, 15 already superseded by main, 1 reachable CVE

Hi maintainers. I ran a reachability-based triage of the open Dependabot backlog against main (govulncheck for Go, osv-scanner plus the committed UI source map for the React app). Summary and proposed actions below. The two PRs I could do without maintainer coordination are open (#9015, #9016); happy to do the batch bumps and the closes too if you want them.

Why Dependabot stopped opening Go PRs

.github/dependabot.yml caps gomod at open-pull-requests-limit: 20; there are 21 open gomod PRs, so nothing new has been proposed since 2025-11-20. Closing the superseded ones below re-arms it.

What is actually reachable

• otel/bridge/opentracing v1.36.0: GO-2026-6258 / CVE-2026-45404 (baggage map panic under concurrency), called from pkg/tracing/migration. Fixed in v1.45.0. PR: #9015. Supersedes #8462, which only went to v1.38.0.
• prometheus/prometheus v0.309.1 shows four advisories (GO-2026-5264, 5381, 5662, 5710), but they have no symbol data in OSV, so govulncheck flags the whole module. The vulnerable code is Prometheus-server HTTP surface (remote-read handler, old web UI, config API) that Thanos does not serve. Not applicable as far as I can tell; happy to be corrected. Bumping to v0.311.3 is a coordinated job anyway (chunkenc.Iterator.AtST, relabel.Process, parser.ParseExpr, BucketQuantile signature, promql-engine and prom-label-proxy all break).
• Prep PR #9016: drop the tsdb/errors dependency (removed upstream in v0.311) via errutil.NewMulti/errutil.CloseAll, so the eventual bump has one less blocker.

Superseded: main is already at or past the PR target — close

• #8529 (actions) build(deps): bump actions/setup-node from 4.0.3 to 6.0.0 — main has v6.4.0
• #8247 (docker) build(deps): bump golang from 1.24.0-alpine3.20 to 1.24.3-alpine3.20 — main is on golang:1.26.4-alpine3.24
• #7425 (gomod) Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1. — main has v1.13.1
• #7443 (gomod) Bump github.com/lightstep/lightstep-tracer-go from 0.25.0 to 0.26.0 — main has v0.26.0
• #7451 (gomod) Bump go.opentelemetry.io/otel/exporters/jaeger from 1.16.0 to 1.17.0 — main has v1.17.0
• #7454 (gomod) Bump github.com/sony/gobreaker from 0.5.0 to 1.0.0 — main has v1.0.0
• #8125 (gomod) build(deps): bump capnproto.org/go/capnp/v3 from 3.0.0-alpha.30 to 3.1 — main has v3.1.0-alpha.1
• #8195 (gomod) build(deps): bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0 — main has v1.9.0
• #8438 (gomod) build(deps): bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2. — main has v2.4.0
• #8461 (gomod) build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/ot — main has v1.43.0
• #8519 (gomod) build(deps): bump golang.org/x/text from 0.26.0 to 0.30.0 — main has v0.39.0
• #8520 (gomod) build(deps): bump github.com/prometheus/common from 0.65.1-0.202507031 — main has v0.67.5
• #8541 (gomod) build(deps): bump github.com/prometheus/exporter-toolkit from 0.14.0 t — main has v0.15.0
• #8563 (gomod) build(deps): bump golang.org/x/crypto from 0.39.0 to 0.45.0 — main has v0.53.0

Dependency no longer in the tree — close

• #7801 (gomod) build(deps): bump go.uber.org/automaxprocs from 1.5.3 to 1.6.0

Still behind main — batch into one bump PR per ecosystem

• #8151 (actions) build(deps): bump peter-evans/create-pull-request from 7.0.7 to 7.0.8
• #8476 (actions) build(deps): bump actions/setup-go from 5.0.2 to 6.0.0
• #8503 (actions) build(deps): bump actions/cache from 4.2.1 to 4.3.0
• #8542 (actions) build(deps): bump github/codeql-action from 3.28.19 to 4.31.0
• #7438 (gomod) Bump github.com/leanovate/gopter from 0.2.9 to 0.2.11
• #8325 (gomod) build(deps): bump github.com/grpc-ecosystem/go-grpc-middleware/provide
• #8460 (gomod) build(deps): bump github.com/onsi/gomega from 1.36.2 to 1.38.2
• #8462 (gomod) build(deps): bump go.opentelemetry.io/otel/bridge/opentracing from 1.3
• #8497 (gomod) build(deps): bump github.com/olekukonko/tablewriter from 0.0.5 to 1.1.
• #8504 (gomod) build(deps): bump github.com/GoogleCloudPlatform/opentelemetry-operati
• #8516 (gomod) build(deps): bump cloud.google.com/go/trace from 1.11.6 to 1.11.7
• #8518 (gomod) build(deps): bump github.com/chromedp/chromedp from 0.9.2 to 0.14.2
• #6514 (npm) Bump tough-cookie from 4.0.0 to 4.1.3 in /pkg/ui/react-app
• #6536 (npm) Bump word-wrap from 1.2.3 to 1.2.4 in /pkg/ui/react-app
• #6818 (npm) build(deps): bump @babel/traverse from 7.17.3 to 7.23.2 in /pkg/ui/rea
• #7345 (npm) Bump ejs from 3.1.6 to 3.1.10 in /pkg/ui/react-app
• #7346 (npm) Bump follow-redirects from 1.14.9 to 1.15.6 in /pkg/ui/react-app
• #7349 (npm) Bump sanitize-html from 2.5.1 to 2.12.1 in /pkg/ui/react-app
• #7733 (npm) build(deps): bump bootstrap from 4.6.1 to 5.0.0 in /pkg/ui/react-app
• #7786 (npm) build(deps-dev): bump rollup from 2.70.2 to 2.79.2 in /pkg/ui/react-ap
• #7811 (npm) build(deps-dev): bump webpack from 5.91.0 to 5.95.0 in /pkg/ui/react-a
• #7976 (npm) build(deps): bump nanoid from 3.3.1 to 3.3.8 in /pkg/ui/react-app
• #8213 (npm) build(deps): bump @babel/runtime from 7.17.2 to 7.27.0 in /pkg/ui/reac
• #8214 (npm) build(deps-dev): bump http-proxy-middleware from 2.0.4 to 2.0.9 in /pk
• #8387 (npm) build(deps): bump form-data from 3.0.1 to 3.0.4 in /pkg/ui/react-app
• #8570 (npm) build(deps-dev): bump node-forge from 1.3.1 to 1.3.2 in /pkg/ui/react-

npm grouped security updates (dev-server toolchain, not shipped) — one hygiene PR

• #7734 (npm) build(deps): bump send and express in /pkg/ui/react-app
• #7735 (npm) build(deps): bump body-parser and express in /pkg/ui/react-app
• #7737 (npm) build(deps): bump serve-static and express in /pkg/ui/react-app
• #7810 (npm) build(deps): bump cookie and express in /pkg/ui/react-app
• #8382 (npm) build(deps): bump on-headers and compression in /pkg/ui/react-app
• #8565 (npm) build(deps): bump js-yaml in /pkg/ui/react-app

UI lockfile

67 vulnerable packages in pnpm-lock.yaml, but the committed source map shows only 9 ship in the browser bundle (sanitize-html, moment, moment-timezone, lodash, @babel/runtime, decode-uri-component, postcss via sanitize-html). The other 58 are build/test toolchain. sanitize-html is used once, on server-provided flag values. Low severity; one runtime-bump PR proposed after the Go fixes.