chore(deps): update dependency grafana/xk6 to v1

[renovate]

This PR contains the following updates:

Package	Update	Change
grafana/xk6	major	0.20.1 -> 1.2.3

---

Release Notes

grafana/xk6 (grafana/xk6)

v1.2.3

Compare Source

Grafana xk6 v1.2.3 is here! 🎉

This small patch release focuses on improving the usability and robustness of the xk6 lint command, particularly for automated testing and CI/CD pipelines, and includes several dependency updates.

Changes and Improvements

xk6 lint Enhancements

• Enhanced Exit Code Handling: The command now provides three distinct exit codes for better CI/CD automation support:
  • 0: All checks passed successfully.
  • 1: Command execution error (invalid arguments, internal failure, etc.).
  • 2: Linting completed but one or more checks failed.
• Decoupled Linter Checkers: Linter checkers have been refactored to be fully independent of one another. This removes previous hidden dependencies, ensuring that any combination of checkers can be selected and run correctly without assuming a specific execution order or prior state.
• Corrected Directory Argument Handling: All linter checkers now run correctly when passed a directory argument. This fixes an issue where the build linter specifically failed to function properly if the provided directory path was relative.

Dependency Updates

• Bumps securego/gosec from 2.22.9 to 2.22.10.
• Bumps astral-sh/setup-uv from 7.0.0 to 7.1.0.
• Bumps golang base image from 1.24.8-alpine3.22 to 1.24.9-alpine3.22

v1.2.2

Compare Source

Grafana xk6 v1.2.2 is here! 🎉

This small patch release fixes a critical issue with the exit code of the xk6 lint command. This bug was introduced in v1.2.0.

Bug Fix

• Corrected xk6 lint Exit Code: The xk6 lint command now correctly returns a non-zero exit code (e.g., 1) when one or more lint checks fail. Previously, the command always returned 0, making it impossible for CI/CD pipelines (like GitHub Actions) to correctly detect linting failures and fail the build.

v1.2.1

Compare Source

Grafana xk6 v1.2.1 is here! 🎉

This is a patch release focusing on several minor fixes and improvements to the xk6 lint command and internal tooling for a smoother development experience.

Fixes & Improvements

• Consistent Environment Variable Handling: xk6 lint now correctly treats empty environment variables (export K6_VAR="") as if they were unset or non-existent. This ensures that environment variable logic is consistent with how CLI flags are handled, preventing unexpected overrides of default values.

• Tooling Clarity: The internal code generation utility, tools/presetter, has been renamed to the more accurate and generic tools/codegen. This resolves confusion, as the tool generates Go source code and documentation for checks and presets, not just presets.

• Smarter Validation Workflow: The versions checker has been disabled within the xk6 lint run in the shared extension-validate workflow. Since this workflow typically runs on Pull Requests (before a release is created), checking for final version tags was causing unnecessary failures.

v1.2.0

Compare Source

Grafana xk6 v1.2.0 is here! 🎉

This release introduces a major enhancement to the xk6 lint command with check presets, making it easier to validate k6 extensions for different use cases and environments. The linting system has been significantly improved with better documentation, flexible configuration options, and streamlined compliance workflows.

BREAKING CHANGES

• Grade system removal: The compliance grading system (A-F scores) has been removed. Extensions now receive clear pass/fail results for each check instead of weighted scores.

What's New

Check Presets for xk6 lint

The xk6 lint command now supports presets - predefined sets of compliance checks tailored for different extension development scenarios:

• loose (default): Minimal preset focusing on essential quality and security checks, perfect for development environments
• strict: Comprehensive preset for production-ready extensions with all compliance checks except official Grafana-specific ones
• all: Complete validation with every available check in the linting system
• private: Tailored for private/internal extensions used within organizations
• community: Optimized for community-maintained extensions published to public repositories
• official: Full compliance suite including Grafana-specific requirements like CODEOWNERS validation

Enhanced Lint Command Interface

The xk6 lint command has been redesigned with improved flexibility:

### Use presets for common scenarios
xk6 lint --preset strict
xk6 lint --preset community

### Customize checks beyond presets
xk6 lint --preset private --enable security,vulnerability
xk6 lint --preset all --disable codeowners
xk6 lint --enable-only module,readme,license

### Get help on available options
xk6 lint checks    # List all available checkers
xk6 lint presets   # List all available presets

Comprehensive Documentation Overhaul

All linting documentation has been significantly improved:

• Consistent terminology: Standardized use of "compliance" throughout the system
• Detailed check descriptions: Each checker now includes clear descriptions, rationales, and resolution guidance
• Professional help content: Improved CLI help text and embedded documentation

v1.1.6

Compare Source

Grafana xk6 v1.1.6 is here! 🎉

This release focuses on essential updates to core Go modules and Docker images to enhance security, stability, and maintain compatibility.

Security and Maintenance Updates

Several dependencies have been updated to their latest patch versions, which includes critical security fixes and stability improvements.

Go Module Updates

The following Go module dependencies are updated:

• github.com/go-git/go-git/v5: Updated to v5.16.3.
• golang.org/x/mod: Updated to v0.29.0.

Docker and CI Tooling Updates

The Docker images used in the build and security processes are updated:

• Build Base Image: Updated to golang:1.24.8-alpine3.22.
• Security Scanner: Updated securego/gosec to 2.22.9.

Rationale

These dependency updates are crucial for maintaining the security posture of xk6. Applying these updates was prioritized before the planned refactoring of the xk6 lint subcommand to ensure a stable and secure foundation for future development efforts.

v1.1.5

Compare Source

Grafana xk6 v1.1.5 is here! 🎉

This is a maintenance release, with bug fixes and feature enhancements.

Changes:

• Building private extensions
• License Validation Aligned with Grafana Plugins Policy
• The lint command is now functional in Docker images

Building private extensions

Previously, the build command did not work correctly with private extensions. This is because the environment variables required for git over SSH were not passed to the build library. This has now been fixed so that git over SSH works, which is crucial for building private extensions.

To build an xk6 extension from a private Git repository, you need to configure your environment to handle authentication.

Core Prerequisite

First, you must set the GOPRIVATE environment variable. This tells the Go compiler to bypass the standard Go proxy for your repository, allowing it to access the private module directly.

export GOPRIVATE=github.com/owner/repo

Method 1: Using SSH

To handle authentication in non-interactive environments like CI/CD pipelines, configure Git to use the SSH protocol instead of HTTPS. This allows for authentication with an SSH key. This command globally configures Git to rewrite any https://github.com/ URLs to ssh://[email protected]/.

git config --global url.ssh://[email protected]/.insteadOf https://github.com/

Method 2: Using GitHub CLI

An alternative to using SSH is to leverage the GitHub CLI as a Git credential helper. In this case, Git will still access the repository over HTTPS, but it will use the GitHub CLI to handle the authentication process, eliminating the need to manually enter a password.

git config --global --add 'credential.https://github.com.helper' '!gh auth git-credential'

License Validation Aligned with Grafana Plugins Policy

The xk6 lint command's license checker has been updated to align with the official Grafana Plugins policy. Previously, the checker accepted a broad range of OSI-approved licenses, which was wider than the list of licenses accepted by Grafana.

With this release, xk6 lint now validates extension licenses against the specific list found in the Accepted licenses section of the Grafana Plugins policy. This change ensures that extensions passing the license check are compatible with Grafana Cloud's license requirements.

The lint command is now functional in Docker images

The official xk6 Docker image now includes the gosec and govulncheck tools. Previously, these tools were missing from the image, preventing the xk6 lint command from performing security and vulnerability checks.

With this update, the xk6 lint command can be used to its full extent within the Docker container, which supports automated and containerized workflows.

v1.1.4

Compare Source

Grafana xk6 v1.1.4 is here! 🎉

This release improves the version command and includes dependency updates.

Improved version command

Previously, installing with go install go.k6.io/xk6 caused the xk6 version command to display an incorrect version (0.0.0-next). This was due to the version being injected at build time as a linker variable by goreleaser.

Now, if the version variable is not injected (such as with go install), the version is correctly determined using debug.BuildInfo.

v1.1.3

Compare Source

Grafana xk6 v1.1.3 is here! 🎉

Security update: Fixed the following CVEs by updating the Docker base image to golang:1.24.6-alpine3.22

• CVE-2025-4674
• CVE-2025-47907

v1.1.2

Compare Source

Grafana xk6 v1.1.2 is here! 🎉

Bug Fixes

• The xk6 build command now correctly logs the k6 version being used. The version number is emphasized, and a warning is displayed if it's not the latest.
• xk6 build now respects HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables, allowing it to work in proxied environments.

New Feature

The xk6 sync command can now generate results in multiple formats:

• Terminal text: The default, colored output.
• JSON: Use the --json flag for standard JSON output or combine it with --compact for unindented JSON.
• Markdown: Use the --markdown flag to generate a Markdown report, which is useful for changelogs.

v1.1.1

Compare Source

Grafana xk6 v1.1.1 is here! 🎉

This is a patch release that addresses a critical bug in our multi-arch Docker image, ensuring proper functionality on arm64 platforms.

Bug Fix

Corrected the build process for the linux/arm64 Docker image. Previously, the image was incorrectly shipping amd64 binaries, causing an exec format error on ARM-based systems like Apple Silicon (M1/M2/M3) and AWS Graviton. The multi-arch image now contains the correct native binaries for the arm64 platform and functions as expected.

This resolves the issue where running xk6 on an arm64 host would fail. A big thank you to @​potyl for reporting this!

v1.1.0

Compare Source

Grafana xk6 v1.1.0 is here! 🎉

New Features

xk6 sync subcommand

The xk6 sync subcommand synchronizes the versions of dependencies in go.mod with those used in the k6 project. Dependencies not found in k6's go.mod remain unchanged. Future updates may include synchronization of other files.

The purpose of xk6 sync subcommand is to avoid dependency conflicts when building the extension with k6 (and other extensions).

Inspired by the grafana/go-depsync command.

Maintenance

• Docker base image updated to golang:1.24.5-alpine3.22

v1.0.1

Compare Source

Grafana xk6 v1.0.0 is here! 🎉

xk6 v1.0.0 marks a significant milestone, incorporating numerous features and capabilities that were gradually introduced in previous versions. These release notes are a bit different, by detailing changes implemented incrementally in anticipation of this major release.

xk6 version 1.0.0 introduces significant enhancements, effectively evolving the Custom k6 builder into a comprehensive k6 extension developer toolbox.

What's been removed in xk6 v1.0.0?

Breaking Changes

No unknown k6 commands wrapping

xk6 v1.0.0 only wraps the k6 run command as xk6 run. Any other commands will no longer be automatically passed through. Previously, xk6 would forward all unrecognized commands to the dynamically built k6.

Previously, the xk6 version command displayed the k6 version built during the process. Now, this command shows the xk6 version itself.

No API exposed

xk6 v1.0.0 does not expose a public Go API.

A dedicated Go library (grafana/k6foundry) now exists for building k6 executables. Since xk6 utilizes this library directly, there is no benefit to adding another layer of wrapping.

What's new in xk6 v1.0.0?

Get started docs

Before getting into what's new, it's worth mentioning the new docs that help you get started with extension development.

The k6 extension development quick start guide offers a straightforward, step-by-step introduction. For a more in-depth understanding, the k6 extension development tutorial provides a practical example of extension development.

There are also two new example extensions to help users get started:

• xk6-example: This JavaScript extension shows the integration between the k6 JavaScript runtime and a Go extension. It also provides JavaScript API documentation and demonstrates the use of reusable GitHub workflows offered by xk6.
• xk6-output-example: This output extension shows how to process k6 runtime metrics within an extension.

Refactored command handling

The command-line interface has been significantly refactored in xk6 v1.0.0. This overhaul introduces new commands alongside the existing xk6 build and xk6 run, expanding xk6's functionality. All commands support the standard --help flag for displaying usage instructions.

Print xk6 Version

The command xk6 version is now available and outputs the xk6 version.

Create Extension

The xk6 new command simplifies the creation of new k6 extensions. With a single command, you can generate a functional extension. This command utilizes the grafana/xk6-example and grafana/xk6-output-example repositories as a template for the new extension.

Check Compliance

The xk6 lint command verifies an extension's compliance with recommended practices by examining the source directory. When used within a git repository, it also analyzes git metadata. Compliance is assessed as a weighted percentage (0-100), derived from individual checker scores. This percentage is then translated into a compliance grade (A-F).

Build logic extracted

The k6 build logic has been extracted into a dedicated go library (grafana/k6foundry). This library is used by all elements of the k6 ecosystem, including xk6.

The extraction of code into a library involved refactoring, which may introduce minor compatibility issues. These incompatibilities are actively being resolved.

Reusable GitHub workflows

xk6 offers two GitHub workflows to streamline k6 extension development:

• Extension Validate: This workflow, usually triggered by a pull request, conducts several validation checks.
• Extension Release: Triggered by creating a version tag, this workflow generates release artifacts. It builds k6 with the extension for specified platforms and includes it in the release.

You can find reusable workflows in the .github/workflows directory of the xk6-example repository.

Read more in xk6 workflows.

Simplified Go install

The main Go package is now located in the repository's root directory. This change simplifies the installation process using go install and direct execution with go run.

### install
go install go.k6.io/xk6@​latest

### execute without install
go run go.k6.io/xk6@​latest version

GitHub CLI extension

The gh-xk6 extension enables the use of xk6 commands within the GitHub CLI. This can streamline xk6 installation for users who already have the GitHub CLI.

### install
gh extension install grafana/gh-xk6

### execute
gh xk6 version

The GitHub CLI's availability by default in GitHub workflows is a significant advantage.

Homebrew formula

MacOS and Linux users can now install and manage xk6 with a dedicated Homebrew formula.

### install
brew install xk6

### execute
xk6 version

Dev Container Feature

Integrate xk6 into Development Containers by adding xk6 Feature to your Dev Containers configuration.

 "features": {
    "ghcr.io/grafana/devcontainer-features/xk6:1": { "version": "1.0.0" }
  }

For developing the following extensions, Dev Containers is now the recommended environment:

• grafana/xk6-example
• grafana/xk6-output-example
• grafana/xk6-faker
• grafana/xk6-sql
• grafana/xk6-dashboard
• grafana/xk6-ssh

Read more in Development Containers and k6.

v1.0.0

Compare Source

Grafana xk6 v1.0.0 is here! 🎉

xk6 v1.0.0 marks a significant milestone, incorporating numerous features and capabilities that were gradually introduced in previous versions. These release notes are a bit different, by detailing changes implemented incrementally in anticipation of this major release.

xk6 version 1.0.0 introduces significant enhancements, effectively evolving the Custom k6 builder into a comprehensive k6 extension developer toolbox.

What's been removed in xk6 v1.0.0?

Breaking Changes

No unknown k6 commands wrapping

xk6 v1.0.0 only wraps the k6 run command as xk6 run. Any other commands will no longer be automatically passed through. Previously, xk6 would forward all unrecognized commands to the dynamically built k6.

Previously, the xk6 version command displayed the k6 version built during the process. Now, this command shows the xk6 version itself.

No API exposed

xk6 v1.0.0 does not expose a public Go API.

A dedicated Go library (grafana/k6foundry) now exists for building k6 executables. Since xk6 utilizes this library directly, there is no benefit to adding another layer of wrapping.

What's new in xk6 v1.0.0?

Get started docs

Before getting into what's new, it's worth mentioning the new docs that help you get started with extension development.

The k6 extension development quick start guide offers a straightforward, step-by-step introduction. For a more in-depth understanding, the k6 extension development tutorial provides a practical example of extension development.

There are also two new example extensions to help users get started:

• xk6-example: This JavaScript extension shows the integration between the k6 JavaScript runtime and a Go extension. It also provides JavaScript API documentation and demonstrates the use of reusable GitHub workflows offered by xk6.
• xk6-output-example: This output extension shows how to process k6 runtime metrics within an extension.

Refactored command handling

The command-line interface has been significantly refactored in xk6 v1.0.0. This overhaul introduces new commands alongside the existing xk6 build and xk6 run, expanding xk6's functionality. All commands support the standard --help flag for displaying usage instructions.

Print xk6 Version

The command xk6 version is now available and outputs the xk6 version.

Create Extension

The xk6 new command simplifies the creation of new k6 extensions. With a single command, you can generate a functional extension. This command utilizes the grafana/xk6-example and grafana/xk6-output-example repositories as a template for the new extension.

Check Compliance

The xk6 lint command verifies an extension's compliance with recommended practices by examining the source directory. When used within a git repository, it also analyzes git metadata. Compliance is assessed as a weighted percentage (0-100), derived from individual checker scores. This percentage is then translated into a compliance grade (A-F).

Build logic extracted

The k6 build logic has been extracted into a dedicated go library (grafana/k6foundry). This library is used by all elements of the k6 ecosystem, including xk6.

The extraction of code into a library involved refactoring, which may introduce minor compatibility issues. These incompatibilities are actively being resolved.

Reusable GitHub workflows

xk6 offers two GitHub workflows to streamline k6 extension development:

• Extension Validate: This workflow, usually triggered by a pull request, conducts several validation checks.
• Extension Release: Triggered by creating a version tag, this workflow generates release artifacts. It builds k6 with the extension for specified platforms and includes it in the release.

You can find reusable workflows in the .github/workflows directory of the xk6-example repository.

Read more in xk6 workflows.

Simplified Go install

The main Go package is now located in the repository's root directory. This change simplifies the installation process using go install and direct execution with go run.

### install
go install go.k6.io/xk6@​latest

### execute without install
go run go.k6.io/xk6@​latest version

GitHub CLI extension

The gh-xk6 extension enables the use of xk6 commands within the GitHub CLI. This can streamline xk6 installation for users who already have the GitHub CLI.

### install
gh extension install grafana/gh-xk6

### execute
gh xk6 version

The GitHub CLI's availability by default in GitHub workflows is a significant advantage.

Homebrew formula

MacOS and Linux users can now install and manage xk6 with a dedicated Homebrew formula.

### install
brew install xk6

### execute
xk6 version

Dev Container Feature

Integrate xk6 into Development Containers by adding xk6 Feature to your Dev Containers configuration.

 "features": {
    "ghcr.io/grafana/devcontainer-features/xk6:1": { "version": "1.0.0" }
  }

For developing the following extensions, Dev Containers is now the recommended environment:

• grafana/xk6-example
• grafana/xk6-output-example
• grafana/xk6-faker
• grafana/xk6-sql
• grafana/xk6-dashboard
• grafana/xk6-ssh

Read more in Development Containers and k6.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.