Update NGINX Agent to v3.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/nginx/agent/v3	v3.3.2 -> v3.4.0			require	minor
nginx/agent	v3.3.2 -> v3.4.0				minor

---

Release Notes

nginx/agent (github.com/nginx/agent/v3)

v3.4.0

Compare Source

What's Changed

🐛 Bug Fixes

• Fix isAllowedDir matching by prefix by @​sean-breen in #​1276
• Fix file permission validation by @​spencerugbo in #​1316

📝 Maintenance

• Integration tests for N1C metrics by @​spencerugbo in #​1210

🔨 Enhancements

• Add attributes to nginx.request.count by @​aphralG in #​1263
• Refactor Plus Scraper by @​aphralG in #​1264
• Rollback Using Temp Files & Fix Atomic Writes by @​aphralG in #​1302
• Perform atomic writes during a config apply by @​dhurley in #​1265
• Add labels to NAP security logs by @​spencerugbo in #​1280
• Update OTel dependencies by @​dhurley in #​1282
• Update proto validator and go-grpc-middleware versions by @​dhurley in #​1300
• Validate file permissions during config apply by @​spencerugbo in #​1284
• Add Temp Hidden Agent Directory by @​aphralG in #​1318
• Update nginx-plus-go-client to v3.0.1 by @​dhurley in #​1327

⬆️ Dependencies

• Bump github/codeql-action from 3.25.3 to 3.30.3 by @​dependabot[bot] in #​1266
• Bump actions/checkout from 4.1.1 to 5.0.0 by @​dependabot[bot] in #​1267
• Bump actions/download-artifact from 4.1.2 to 5.0.0 by @​dependabot[bot] in #​1269
• Bump actions/setup-node from 4.0.2 to 5.0.0 by @​dependabot[bot] in #​1271
• Bump golang.org/x/mod from 0.23.0 to 0.28.0 by @​dependabot[bot] in #​1268
• Bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @​dependabot[bot] in #​1270
• Bump release-drafter/release-drafter from 5.25.0 to 6.1.0 by @​dependabot[bot] in #​1292
• Bump azure/CLI from 2.0.0 to 2.2.0 by @​dependabot[bot] in #​1294
• Bump docker/setup-buildx-action from 3.3.0 to 3.11.1 by @​dependabot[bot] in #​1293
• Bump actions/setup-go from 5.5.0 to 6.0.0 by @​dependabot[bot] in #​1295
• Bump github.com/testcontainers/testcontainers-go from 0.38.0 to 0.39.0 by @​dependabot[bot] in #​1287
• Bump github.com/prometheus/common from 0.65.0 to 0.66.1 by @​dependabot[bot] in #​1288
• Bump github.com/docker/docker from 28.3.3+incompatible to 28.4.0+incompatible by @​dependabot[bot] in #​1289
• Bump docker/login-action from 3.3.0 to 3.6.0 by @​dependabot[bot] in #​1308
• Bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in #​1310

Full Changelog: nginx/agent@v3.3.2...v3.4.0

Resources

• Documentation -- https://github.com/nginx/agent#readme

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go	v1.36.4-20250130201111-63bb56e20495.1 -> v1.36.9-20250912141014-52f32327d4b0.1
github.com/prometheus/procfs	v0.16.1 -> v0.17.0
golang.org/x/time	v0.9.0 -> v0.12.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.71%. Comparing base (7374a97) to head (67b2d68).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4075   +/-   ##
=======================================
  Coverage   86.71%   86.71%           
=======================================
  Files         128      128           
  Lines       16758    16758           
  Branches       62       62           
=======================================
  Hits        14531    14531           
  Misses       2042     2042           
  Partials      185      185           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

dismissing review as it seems upgrade is breaking functionality.

[ciarams87]

Seeing issues in our pipelines testing the latest release of Agent due to agent attempting to create a .agent-<UUID> temp directory at the nginx.conf location (introduced here), but we run with readOnlyRootFilesystem which blocks writes to /etc/nginx. There is no way to currently configure where this temporary directory is created so we'll need to wait for a fix before we can upgrade
{Programmed False 1 2025-10-17 07:39:55 +0000 UTC Invalid The Gateway is not programmed due to a failure to reload nginx with the configuration: msg: Config apply failed; error: mkdir /etc/nginx/.agent-79abcb1a-b982-3262-8638-b4c846d5d456: read-only file system}

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v3.4.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.