[lowgame]

@bwplotka

Reproduction

promhttp.HandlerFor negotiates its response media type from Accept and, when compression is enabled, its content encoding from Accept-Encoding. However, successful responses did not include a Vary header. A shared HTTP cache could therefore reuse an OpenMetrics or compressed representation for a client that negotiated a different representation.

The added TestHandlerSetsVaryHeader failed on the previous implementation with an empty Vary header in both the compression-enabled and compression-disabled cases.

Root cause

The handler set the negotiated Content-Type and optional Content-Encoding, but did not describe the request headers used to select those values.

Solution

Add Vary: Accept to negotiated metrics responses and add Vary: Accept-Encoding when compression negotiation is enabled. Header.Add preserves values installed by outer middleware. The regression test also verifies that disabling compression omits Accept-Encoding from Vary.

Tests

• go test ./prometheus/promhttp -run '^TestHandlerSetsVaryHeader$' -count=1 — pass
• go test ./prometheus/promhttp -count=1 — pass
• make common-lint — pass, 0 issues
• go test ./... — affected package passes; the command retains pre-existing failures in prometheus and prometheus/collectors because two expected Go runtime metrics are absent with the installed toolchain. The same focused failures reproduce at upstream commit 589113c.

[Copilot]

Copilot review overview

🟢 Approval recommended

The cache negotiation fix is correct, backward-compatible, and adequately tested.

Review effort: Balanced
Findings: None

What changed in this PR

Adds cache-correct Vary headers to negotiated Prometheus metrics responses.

Changes:

• Varies responses by Accept and, when enabled, Accept-Encoding.
• Adds regression coverage for enabled and disabled compression.

File	Description
prometheus/​promhttp/​http.go	Adds negotiated-response Vary headers.
prometheus/​promhttp/​http_test.go	Tests Vary behavior across compression modes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.