chore(deps): fix reachable/hygiene Dependabot alerts across Go and npm

.github/workflows/build-test.yml

@@ -57,6 +57,7 @@ jobs:
         go-version-file: .go-version
 
     - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      if: ${{ steps.skip-check.outputs.should_skip != 'true' }}
 
     - name: Set up Node.js
       if: ${{ steps.skip-check.outputs.should_skip != 'true' }}

.github/workflows/container.yml

@@ -96,7 +96,7 @@ jobs:
         with:
           distribution: goreleaser
           version: ${{ env.GORELEASER_VERSION }}
-          args: build --clean --skip=validate --snapshot --debug --timeout=60m
+          args: build --clean --skip=validate --snapshot --debug --timeout=60m --parallelism=2
         env:
           GORELEASER_CURRENT_TAG: "${{ env.goreleaser_current_tag }}"
 

.github/workflows/release-dry-run.yml

@@ -117,7 +117,7 @@ jobs:
         with:
           distribution: goreleaser
           version: ${{ env.GORELEASER_VERSION }}
-          args: release --clean --skip=validate --skip-publish --timeout=60m
+          args: release --clean --skip=validate --skip-publish --timeout=60m --parallelism=2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GORELEASER_CURRENT_TAG: "${{ env.goreleaser_current_tag }}"

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
         with:
           distribution: goreleaser
           version: ${{ env.GORELEASER_VERSION }}
-          args: release --clean --timeout=60m
+          args: release --clean --timeout=60m --parallelism=2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/snap.yml

@@ -120,7 +120,7 @@ jobs:
         with:
           distribution: goreleaser
           version: ${{ env.GORELEASER_VERSION }}
-          args: release --clean --skip=validate --skip-publish --timeout=60m
+          args: release --clean --skip=validate --skip-publish --timeout=60m --parallelism=2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GORELEASER_CURRENT_TAG: "${{ env.goreleaser_current_tag }}"

.go-version

@@ -1 +1 @@
-1.26.1
+1.26.8

Dockerfile

@@ -10,7 +10,7 @@ ARG TARGETVARIANT=v1
 # renovate: datasource=github-releases depName=grpc-ecosystem/grpc-health-probe
 ARG GRPC_HEALTH_PROBE_VERSION=v0.4.47
 # Downloading grpc_health_probe from github releases with retry as we have seen it fail a lot on ci.
-RUN for i in `seq 1 50`; do \
+RUN for i in $(seq 1 50); do \
     wget -qO/bin/grpc_health_probe "https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-${TARGETOS}-${TARGETARCH}" && \
     chmod +x /bin/grpc_health_probe && \
     break; \
@@ -33,7 +33,7 @@ RUN chmod +x parca
 
 # https://github.com/hadolint/hadolint/issues/861
 # hadolint ignore=DL3029
-FROM --platform="${TARGETPLATFORM:-linux/amd64}"  docker.io/alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS runner
+FROM --platform="${TARGETPLATFORM:-linux/amd64}"  docker.io/alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS runner
 
 LABEL \
     org.opencontainers.image.source="https://github.com/parca-dev/parca" \
@@ -42,6 +42,7 @@ LABEL \
     org.opencontainers.image.licenses="Apache-2.0"
 
 RUN mkdir /data && chown nobody /data
+# hadolint ignore=DL3066
 USER nobody
 
 COPY --chown=0:0 --from=builder /bin/grpc_health_probe /

pkg/demangle/demangle.go

@@ -55,7 +55,7 @@ func stringsToDemanglerOptions(stringOptions []string) ([]demangle.Option, error
 	for _, str := range stringOptions {
 		opt, ok := demangleOptionMappings[str]
 		if !ok {
-			return nil, fmt.Errorf("unknown demangle option %q", opt)
+			return nil, fmt.Errorf("unknown demangle option %q", str)
 		}
 		res = append(res, opt)
 	}

pkg/parca/parca_test.go

@@ -33,7 +33,7 @@ import (
 	"github.com/polarsignals/frostdb"
 	"github.com/polarsignals/frostdb/query"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/prometheus/model/labels"
+	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/model/timestamp"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/trace/noop"
@@ -127,7 +127,7 @@ func Benchmark_WriteRaw(b *testing.B) {
 					Labels: &profilestorepb.LabelSet{
 						Labels: []*profilestorepb.Label{
 							{
-								Name:  labels.MetricName,
+								Name:  model.MetricNameLabel,
 								Value: "allocs",
 							},
 							{

pkg/profile/profile.go

@@ -18,6 +18,7 @@ import (
 	"time"
 
 	"github.com/apache/arrow-go/v18/arrow"
+	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/model/labels"
 	"github.com/prometheus/prometheus/promql/parser"
 	"google.golang.org/grpc/codes"
@@ -209,15 +210,15 @@ type QueryParts struct {
 // ParseQuery parses a Parca query string into its components.
 // The query format is: <name>:<sample-type>:<sample-unit>:<period-type>:<period-unit>[:delta]{label=value,...}.
 func ParseQuery(query string) (QueryParts, error) {
-	parsedSelector, err := parser.ParseMetricSelector(query)
+	parsedSelector, err := parser.NewParser(parser.Options{}).ParseMetricSelector(query)
 	if err != nil {
 		return QueryParts{}, status.Error(codes.InvalidArgument, "failed to parse query")
 	}
 
 	sel := make([]*labels.Matcher, 0, len(parsedSelector))
 	var nameLabel *labels.Matcher
 	for _, matcher := range parsedSelector {
-		if matcher.Name == labels.MetricName {
+		if matcher.Name == model.MetricNameLabel {
 			nameLabel = matcher
 		} else {
 			sel = append(sel, matcher)

pkg/profilestore/profilecolumnstore.go

@@ -156,7 +156,7 @@ func (s *ProfileColumnStore) writeSeries(ctx context.Context, req *profilestorep
 
 		// Validate profile type by trying to parse it as a PromQL selector.
 		queryStr := fmt.Sprintf("%s{}", profileType)
-		if _, parseErr := parser.ParseMetricSelector(queryStr); parseErr != nil {
+		if _, parseErr := parser.NewParser(parser.Options{}).ParseMetricSelector(queryStr); parseErr != nil {
 			return fmt.Errorf("invalid profile type at row %d (%s): %v", rowIdx, profileType, parseErr)
 		}
 	}

ui/package.json

@@ -116,8 +116,8 @@
     "ts-node": "10.9.2",
     "tsc-watch": "6.3.1",
     "typescript": "5.9.3",
-    "vite": "5.4.21",
-    "vitest": "1.6.1"
+    "vite": "6.4.3",
+    "vitest": "3.2.6"
   },
   "eslintConfig": {
     "overrides": [
@@ -148,15 +148,13 @@
       "basic-ftp@<5.2.0": "5.3.1",
       "serialize-javascript@<7.0.5": "7.0.5",
       "underscore@<=1.13.7": "1.13.8",
-      "svgo@>=2.1.0 <2.8.1": "2.8.3",
       "immutable@>=5.0.0 <5.1.5": "5.1.8",
       "flatted@<3.4.2": "3.4.2",
       "koa@<2.16.4": "2.16.4",
       "node-forge@<1.4.0": "1.4.0",
       "picomatch@<2.3.2": "2.3.2",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
       "jsonpath@<=1.2.1": "1.3.0",
-      "path-to-regexp@<0.1.13": "0.2.5",
       "prismjs@<1.30.0": "1.30.0",
       "postcss@<8.4.31": "8.5.23",
       "ajv@<6.14.0": "6.14.0",
@@ -169,7 +167,48 @@
       "yaml@>=2.0.0 <2.8.3": "2.8.3",
       "diff@>=4.0.0 <4.0.4": "4.0.4",
       "diff@>=5.0.0 <5.2.2": "5.2.2",
-      "qs@>=6.7.0 <=6.14.1": "6.15.2"
+      "path-to-regexp@<1.9.0": "1.9.0",
+      "svgo@>=1.0.0 <2.8.4": "2.8.4",
+      "@babel/plugin-transform-modules-systemjs@>=7.12.0 <=7.29.3": "7.29.4",
+      "@remix-run/router@>=1.3.0 <1.23.3": "1.23.3",
+      "@sigstore/core@<=3.2.0": "3.2.1",
+      "@sigstore/verify@3.1.0": "3.1.1",
+      "@tootallnate/once@<2.0.1": "2.0.1",
+      "@xhmikosr/decompress@<10.2.1": "10.2.1",
+      "axios@>=1.15.0 <1.18.0": "1.18.0",
+      "baseline-browser-mapping@>=2.0.0 <2.11.0": "2.11.0",
+      "body-parser@<1.20.6": "1.20.6",
+      "browserslist@<=4.28.6": "4.28.7",
+      "colord@<2.9.4": "2.9.4",
+      "esbuild@<=0.24.2": "0.25.0",
+      "fast-uri@>=3.0.0 <3.1.6": "3.1.6",
+      "follow-redirects@<=1.15.11": "1.16.0",
+      "form-data@>=3.0.0 <3.0.5": "3.0.5",
+      "form-data@>=4.0.0 <4.0.6": "4.0.6",
+      "http-proxy-middleware@<2.0.10": "2.0.10",
+      "ip-address@<=10.3.0": "10.3.1",
+      "js-cookie@<=3.0.5": "3.0.7",
+      "js-yaml@>=3.0.0 <3.15.2": "3.15.2",
+      "js-yaml@>=4.0.0 <4.3.2": "4.3.2",
+      "launch-editor@<=2.14.0": "2.14.1",
+      "morgan@<1.12.0": "1.12.0",
+      "nx@>=20.8.0 <22.7.7": "22.7.7",
+      "piscina@<=4.9.2": "4.9.3",
+      "react-router@>=6.7.0 <6.30.4": "6.30.4",
+      "shell-quote@>=1.1.0 <=1.8.4": "1.9.0",
+      "sigstore@<=4.1.0": "4.1.1",
+      "smol-toml@<=1.7.0": "1.7.1",
+      "tar@<=7.5.17": "7.5.18",
+      "tmp@<0.2.6": "0.2.6",
+      "undici@<6.28.0": "6.28.0",
+      "uuid@<11.1.1": "11.1.1",
+      "webpack-dev-server@<=5.2.5": "5.2.6",
+      "websocket-driver@<0.7.5": "0.7.5",
+      "ws@>=7.0.0 <7.5.11": "7.5.11",
+      "ws@>=8.0.0 <8.21.0": "8.21.0",
+      "qs": "6.16.0",
+      "vite": "6.4.3",
+      "postcss-selector-parser@>=6.1.0 <7.0.0": "6.1.2"
     }
   }
 }

ui/packages/app/web/package.json

@@ -56,7 +56,7 @@
     "react-github-btn": "^1.4.0",
     "react-markdown": "^8.0.4",
     "react-redux": "^8.0.2",
-    "react-router-dom": "6.30.3",
+    "react-router-dom": "6.30.6",
     "react-use": "17.6.0",
     "redux-persist": "^6.0.0",
     "tailwindcss": "3.2.4",