What
The Prometheus exporter stack is two minor lines behind: metrics-exporter-prometheus 0.16.2 (latest 0.18.3), which pins metrics-util 0.19.1. This surfaced in the dependency-hygiene audit as the holder of three duplicate-version groups (rand 0.9, hashbrown 0.15, thiserror 1 via the exporter), and as an outdated version of a performance-sensitive dependency.
Why this is not a drive-by upgrade
metrics-util is the hot-path metrics registry (per-request record() path); an upgrade can move per-request cost in either direction and must be quantified on the benchmark rig (same-rig A/B, saturation grid) before landing.- The exporter renders the
/metrics text exposition; an upgrade must pass the series-diff harness byte-identically (or any diff must be explicitly reviewed as a rendering change, not a data change).
Suggested acceptance
- Same-rig A/B within the noise gate (±5%), fail=0
- Series-diff harness: zero unexplained diffs against the same traffic
- Duplicate groups
rand 0.9.x and hashbrown 0.15.x collapse or shift as expected
No behavior or performance numbers are claimed here; this issue only records the version gap and the gate it must pass.
What
The Prometheus exporter stack is two minor lines behind:
metrics-exporter-prometheus0.16.2 (latest 0.18.3), which pinsmetrics-util0.19.1. This surfaced in the dependency-hygiene audit as the holder of three duplicate-version groups (rand0.9,hashbrown0.15,thiserror1 via the exporter), and as an outdated version of a performance-sensitive dependency.Why this is not a drive-by upgrade
metrics-utilis the hot-path metrics registry (per-requestrecord()path); an upgrade can move per-request cost in either direction and must be quantified on the benchmark rig (same-rig A/B, saturation grid) before landing./metricstext exposition; an upgrade must pass the series-diff harness byte-identically (or any diff must be explicitly reviewed as a rendering change, not a data change).Suggested acceptance
rand 0.9.xandhashbrown 0.15.xcollapse or shift as expectedNo behavior or performance numbers are claimed here; this issue only records the version gap and the gate it must pass.