[dependabot]

Bumps the all-go-deps group with 1 update: github.com/HdrHistogram/hdrhistogram-go.

Updates github.com/HdrHistogram/hdrhistogram-go from 1.3.0 to 1.4.0

Release notes

Sourced from github.com/HdrHistogram/hdrhistogram-go's releases.

Version 1.4.0

• New: PackedHistogram, a sparse histogram for keeping many lightly populated histograms in memory: about 0.3 KB instead of 184 KB each at a typical latency configuration (see below).
• Faster: asking for several percentiles in one call is 3.4 to 5.7x faster; single queries are unchanged and recording is within 4%.
• Fixed: a number of silent correctness and decoding problems, including hangs and panics on malformed input.
• Behaviour changes: some of those fixes change results for inputs that were already wrong, such as hostile streams, overflowing totals and negative values. Read Behaviour changes before upgrading.
• Compatibility: nothing exported was removed or changed signature. Snapshot gained a field, so unkeyed literals such as Snapshot{1, 1000, 3, counts} no longer compile; use field names.

Highlight: PackedHistogram

New allocates the full counts array up front: about 184 KB at a typical latency configuration (New(1, 3600000000, 3)), however few values are recorded. Services that keep many sparsely populated histograms (per endpoint, per tenant, per connection, or a ring of per-second slices) pay that for every one. PackedHistogram stores only the populated buckets, each count in 1, 2, 4 or 8 bytes as needed:

Populated buckets	Histogram	PackedHistogram
10	184 KB	~0.3 KB
100	184 KB	~0.8 KB
1,600	184 KB	~10 KB

For one thousand histograms with ten populated buckets each, that is 179.7 MB dense against 273 KB packed (#75).

• Same model as Histogram: the same constructor arguments and bucket layout, and the same queries: RecordValue(s), RecordCorrectedValue, ValueAtPercentile, ValueAtPercentilesSlice, Min, Max, Mean, StdDev, CountAtValue, TotalCount, plus Clone, geometry getters, and interval start/end times and tags.
• Wire-compatible: Encode writes the standard V2 compressed format, byte-for-byte the same as the dense encoder on equivalent data. DecodePacked reads V2 streams from Go, Java and C writers, including shifted Java histograms and streams from hdrhistogram-go v1.2.0 and earlier. HistogramLogWriter.OutputIntervalPackedHistogram writes packed intervals to logs directly.
• Built for rolling windows: record into a dense histogram, keep completed slices packed, and aggregate on demand with MergeFrom (dense into packed), MergeInto (packed into dense), Merge (packed into packed), Reset (keeps storage), Compact (shrinks it) and ForEachBucket.
• The trade-off is recording speed: recording is a binary search, and a new bucket costs O(populated). A last-hit cache skips the search when consecutive records land in the same bucket (#117). Keep the dense Histogram for hot recording paths and for histograms that fill most buckets.
• Hardened before release: two dedicated fuzz targets (hostile decoding, and a differential against the dense histogram) run in CI and nightly, alongside multi-agent adversarial reviews of every packed PR.

h := hdrhistogram.NewPacked(1, 3600000000, 3)
h.RecordValue(1234)
p99 := h.ValueAtPercentile(99)
encoded, err := h.Encode() // standard V2, same bytes as Histogram.Encode

Guides: the README section (memory, costs and a rolling-window example) and the C/Java compatibility guide.

Update Urgency: High

High: contains fixes for decoders that hung or panicked on malformed input (#80), for totals that silently wrapped past MaxInt64 (#114, #109), for negative values recorded as huge positive ones (#103), and for wrong percentiles at very large counts (#108). Anyone decoding untrusted streams or logs, or recording very large weighted counts, should update.

API Additions

• PackedHistogram, NewPacked and DecodePacked (#75); see Highlight
• PackedHistogram rolling-window support: Reset, ForEachBucket, MergeInto (packed into dense) and MergeFrom (dense into packed) (#81), and packed-to-packed Merge and Compact (#82)
• PackedHistogram parity with the dense type: Mean, StdDev, RecordCorrectedValue, geometry getters, Clone, interval start/end time and tag, EncodeV2, and HistogramLogWriter.OutputIntervalPackedHistogram with ...WithLogOptions (#105)
• Histogram.Clone, a deep copy of geometry, counts, total, tag and times; use w.Merge().Clone() to keep a windowed result (#112)
• Snapshot.Validate, which rejects negative counts, counts outside the geometry, sums past MaxInt64 and unrepresentable geometry before Import; Snapshot.IntegerToDoubleConversionRatio carries the V2 conversion ratio (#112, #105)
• Histogram.EncodeV2 (#105)

Performance

... (truncated)

Commits

• 687f303 perf(packed): last-hit write cache to skip the per-record binary search (#117)
• 186f8b9 perf: resolve ValueAtPercentilesSlice with the blocked skip-scan (~3-4x) (#116)
• f072b62 perf: resolve ValueAtPercentiles with a blocked skip-scan (~6x) (#115)
• 1608007 fix: reject dense counts that would overflow the total (#114)
• 8c2ddcc fix: dense Histogram ownership docs, Clone, Snapshot.Validate and consistent ...
• af6b2e5 fix: bound percentile ranks for large histogram counts (#108)
• f5e65c2 fix: decode legacy Go and shifted Java streams in DecodePacked; reject overfl...
• de66007 Complete packed APIs and define C/Java compatibility contracts (#105)
• 5ffadfa fix: zero-digit decode, negative values, boundary maxima, dropped-count wrap ...
• b43b9a8 docs: add a PackedHistogram section to the README (#83)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

✅ 19 untouched benchmarks

---

_{Comparing dependabot/go_modules/all-go-deps-9482f86125 (5ae7e48) with main (39867a4)}

[dependabot]

Looks like github.com/HdrHistogram/hdrhistogram-go is no longer updatable, so this is no longer needed.