From 7cb0c5f97294b2a308da2a1e5f4f74cec8e6f468 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 03:20:52 +0100
Subject: [PATCH] chore: use @prometheus-io/client, the maintained successor of
 the deprecated prom-client

---
 lib/metrics/index.ts |  4 ++--
 next.config.ts       |  6 +++---
 package-lock.json    | 29 ++++++++++++++---------------
 package.json         |  2 +-
 4 files changed, 20 insertions(+), 21 deletions(-)

diff --git a/lib/metrics/index.ts b/lib/metrics/index.ts
index dfdea1749..2bf5a33b8 100644
--- a/lib/metrics/index.ts
+++ b/lib/metrics/index.ts
@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
-import type { Counter, Gauge, Histogram, Registry } from 'prom-client';
-import client from 'prom-client';
+import type { Counter, Gauge, Histogram, Registry } from '@prometheus-io/client';
+import client from '@prometheus-io/client';
 import { routeGroup } from '@/lib/route-groups';
 
 /**
diff --git a/next.config.ts b/next.config.ts
index cb20d9f8c..2435bd968 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -61,9 +61,9 @@ const nextConfig: NextConfig = {
   // esbuild ships native binaries + a README the bundler can't parse; load
   // it from node_modules at runtime instead of trying to bundle it. Used by
   // PLUGIN_DEV_DIR's on-the-fly bundler. ioredis (the shared store, #1066)
-  // and prom-client (/api/metrics) are loaded from node_modules too, so the
-  // proxy and the route bundles don't each carry a copy.
-  serverExternalPackages: ["esbuild", "ioredis", "prom-client"],
+  // and @prometheus-io/client (/api/metrics) are loaded from node_modules
+  // too, so the proxy and the route bundles don't each carry a copy.
+  serverExternalPackages: ["esbuild", "ioredis", "@prometheus-io/client"],
   // The build's type check leaves out tests, which are a third of the files
   // and push tsc past the default heap on a 4 GB machine (#1431).
   // `npm run typecheck` still checks them with tsconfig.json.
diff --git a/package-lock.json b/package-lock.json
index 055af593f..4f178ae26 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,6 +21,7 @@
         "@opentelemetry/sdk-trace-base": "2.8.0",
         "@opentelemetry/sdk-trace-node": "2.8.0",
         "@opentelemetry/semantic-conventions": "1.44.0",
+        "@prometheus-io/client": "0.16.1",
         "@tabler/icons-react": "^3.50.0",
         "@tanstack/react-virtual": "^3.14.23",
         "@tiptap/extension-color": "^3.32.1",
@@ -50,7 +51,6 @@
         "otpauth": "^9.5.2",
         "pdfjs-dist": "^6.4.299",
         "postal-mime": "^4.1.4",
-        "prom-client": "15.1.3",
         "qrcode": "^1.5.4",
         "react": "^19.3.1",
         "react-dom": "^19.3.1",
@@ -2924,6 +2924,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@prometheus-io/client": {
+      "version": "0.16.1",
+      "resolved": "https://registry.npmjs.org/@prometheus-io/client/-/client-0.16.1.tgz",
+      "integrity": "sha512-XkFPsGFGoSs/UMg/vh0QLDpanl/tsrOV5PLHdpGe8Ho+ir/Llhytr15j6y8ZwLrpIGzK9gTVVpIalA6C4UjUZw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api": "^1.4.0",
+        "tdigest": "^0.1.1"
+      },
+      "engines": {
+        "node": "^22 || ^24 || >=26"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm-eabi": {
       "version": "1.2.15",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.15.tgz",
@@ -8587,20 +8600,6 @@
       "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
       "license": "MIT"
     },
-    "node_modules/prom-client": {
-      "version": "15.1.3",
-      "resolved": "https://registry.npmjs.org/prom-client/-/prom-client-15.1.3.tgz",
-      "integrity": "sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==",
-      "deprecated": "prom-client has been replaced by @prometheus-io/client",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.4.0",
-        "tdigest": "^0.1.1"
-      },
-      "engines": {
-        "node": "^16 || ^18 || >=20"
-      }
-    },
     "node_modules/prop-types": {
       "version": "15.8.1",
       "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
diff --git a/package.json b/package.json
index ae34dfde9..eead11624 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "@opentelemetry/sdk-trace-base": "2.8.0",
     "@opentelemetry/sdk-trace-node": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.44.0",
+    "@prometheus-io/client": "0.16.1",
     "@tabler/icons-react": "^3.50.0",
     "@tanstack/react-virtual": "^3.14.23",
     "@tiptap/extension-color": "^3.32.1",
@@ -80,7 +81,6 @@
     "otpauth": "^9.5.2",
     "pdfjs-dist": "^6.4.299",
     "postal-mime": "^4.1.4",
-    "prom-client": "15.1.3",
     "qrcode": "^1.5.4",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",