As discussed in the original issue (prometheus/prometheus#1679), some MS Windows client seem to insist to add UTF-8 BOM, despite contrary recommendations:
"A protocol SHOULD forbid use of U+FEFF as a signature for those textual protocol elements that the protocol mandates to be always UTF-8, the signature function being totally useless in those cases."
(https://tools.ietf.org/html/rfc3629)
It seemed consensus to filter out those BOMs. A PR is dangling for quite some time: prometheus/common#42 . It is only missing a test and the removal of logging.
However, we need to specify the official handling of the protocol. Something like: "BOMs are not part of the protocol. Creators MUST not add BOMs but consumers MAY filter them out instead of error out."