[mrueg]

web only used two things from github.com/prometheus/common/config: Secret and JoinDir. Importing that package links everything the HTTP client configuration needs, so every exporter using web inherited client_golang, oauth2, jwt, protobuf and more.

prometheus/common#1024 moved Secret into config/secret, which has no third-party dependencies. This PR:

• bumps prometheus/common to the merge commit of that PR, since it is not in a release yet
• uses secret.Secret in web
• inlines JoinDir as an unexported helper, so web no longer imports config at all

config.Secret is an alias of secret.Secret, so the exported Users and TLSKey fields stay assignable from config.Secret and this is not an API change for callers. config.MarshalSecretValue still works for programs that link config.

Effect on dependencies

Third-party modules and packages linked by each package, not counting exporter-toolkit itself:

Package	Modules before	Modules after	Packages before	Packages after
web	25	10	68	12
web/kingpinflag	28	13	71	15
bootstrap	28	21	79	64

Across the module, go.mod goes from 19 indirect requirements to 12, and go.sum from 82 lines to 68.

Removed from web and web/kingpinflag:

github.com/beorn7/perks
github.com/cespare/xxhash/v2
github.com/golang-jwt/jwt/v5
github.com/google/uuid
github.com/hashicorp/go-uuid
github.com/jpillora/backoff
github.com/munnerz/goautoneg
github.com/mwitkow/go-conntrack
github.com/pandatix/go-abnf
github.com/prometheus/client_golang
github.com/prometheus/client_model
github.com/prometheus/procfs
golang.org/x/oauth2
golang.org/x/text
google.golang.org/protobuf

Removed from bootstrap, which still needs client_golang for its metrics handler:

github.com/golang-jwt/jwt/v5
github.com/google/uuid
github.com/hashicorp/go-uuid
github.com/jpillora/backoff
github.com/mwitkow/go-conntrack
golang.org/x/oauth2
golang.org/x/text

Dropped from go.mod entirely: jwt, google/uuid, hashicorp/go-uuid, backoff, go-conntrack, x/oauth2 and x/text. The bump also raises go-abnf to v0.5.5 and x/net to v0.62.0, the minimum versions the new prometheus/common requires.

To reproduce, run this on master and on this branch:

go list -deps -f '{{if .Module}}{{.Module.Path}}{{end}}' ./web | sort -u | grep -v exporter-toolkit

🤖 Generated with Claude Code

[SuperQ]

I've released v0.74.0.

[mrueg]

Will look into this tomorrow