Bump prometheus and otel packages when k8s.io packages are updated

[mboersma]

/kind cleanup

What needs cleanup:

• Bump dependency versions

Describe the solution you'd like

Currently because of Go vendoring dependencies upstream in CAPI, the project can't ingest newer versions of otel or the prometheus client libraries. The fix for that is supposedly upstream in CAPI main now, but may wait for a new minor release before it trickles down.

This issue is to remind us to revisit this once we've updated vendoring, specifically k8s.io packages.

Anything else you would like to add:

For more context, see:

• dependabot(deps): bump go.opentelemetry.io/otel from 1.24.0 to 1.25.0 #4709 (comment)
• dependabot(deps): bump github.com/prometheus/client_golang from 1.18.0 to 1.19.1 #4836 (comment)

[nojnhuh]

This gives me the impression that maybe it's okay to ignore Prometheus dependencies if we're confident they'll get bumped transitively: https://github.com/kubernetes-sigs/cluster-api/blob/a7a32ed5705d991af0332d856f61dbcdd54abd94/.github/dependabot.yaml#L40-L41

This isn't something we would inherit automatically from CAPI, so I'll open a PR to port this over to here. I'll leave this issue open even after merging that as a reminder.

To future generations: If go.mod on the main branch ever lists github.com/prometheus/common at v0.48.0 or higher this issue can be closed.

[nojnhuh]

This isn't something we would inherit automatically from CAPI, so I'll open a PR to port this over to here.

#4861

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[nojnhuh]

I think the otel dependencies at least will be ironed out in #5057, prometheus will still be an issue I think until we pull in k8s 1.31.

This is what we have queued up so far in #5057:

cluster-api-provider-azure/go.mod

Lines 225 to 229 in abe85cb

	replace (
	github.com/google/cel-go => github.com/google/cel-go v0.17.8
	github.com/prometheus/client_golang => github.com/prometheus/client_golang v1.18.0
	github.com/prometheus/common => github.com/prometheus/common v0.46.0
	)

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale