grafana/k6 v1.8.1

on GitHub

k6 v1.8.1 is here! This patch release includes:

• Bug fix for the cloud secret source being enabled by default, which broke scripts that configure their own secret source
• Bug fix for HTTP/2 negotiation and error classification under Go 1.27
• Security updates for gRPC, golang.org/x/net, golang.org/x/text, golang.org/x/crypto, OpenTelemetry, klauspost/compress, and the Go toolchain

Bug fixes

• #6274 Stops enabling the Grafana Cloud secret source by default in k6 cloud run --local-execution, reverting #5875. Scripts that configured their own secret source failed with no secret source with name "default" is configured. Explicitly configured secret sources now work again as they did in v1.7. Fixes #6093.
• #6275 Fixes HTTP/2 negotiation and error classification under Go 1.27, which changed HTTP/2 negotiation and error behaviour. Keeps VUs on HTTP/2, classifies connection and GOAWAY errors consistently across Go versions, and preserves unknown HTTP/2 error buckets. Backport of #6234.

Maintenance and security updates

• #6193, #6194 Updates google.golang.org/grpc to v1.82.1 [security].
• #6187, #6189 Updates golang.org/x/net to v0.56.0 [security].
• #6188, #6190 Updates golang.org/x/text to v0.39.0 [security].
• #6207 Updates go.opentelemetry.io/otel to v1.44.0 [security].
• #6220 Updates github.com/klauspost/compress to v1.18.7 [security].
• #6135 Updates the Go toolchain to v1.25.12 [security].
• Updates golang.org/x/crypto to v0.53.0 [security].