Summary pending.
changelog ↗Prometheus
tool12 releases · 0 support linesReleases
newest first
- Security vulnerabilities patched in golang.org/x/text and google.golang.org/grpc dependencies
- Fixed SIGBUS crashes when the data disk is full during PromQL query execution
advisories
- Fixed a bug where range queries could return samples from the wrong chunk or report spurious not-found errors after head-chunk truncation in TSDB
- Security fix for cross-site scripting vulnerability in the UI (CVE-2026-44990)
- Credentials are no longer forwarded when following redirects to different hosts, affecting scraping, remote read/write, alerting, and service discovery (CVE-2025-4673, CVE-2023-45289)
- Third-party npm dependency licenses now embedded in the binary at /assets/third-party-licenses.txt instead of shipped as a separate archive
- New experimental search endpoints for metric names, label names, and label values; new PromQL functions min_of() and max_of(); improved query performance and native histogram support
what breaks
Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following redirects to different hosts. This affects scraping, remote read/write, alerting, and service discovery. The min() and max() duration-expression functions (experimental feature) are renamed to min_of() and max_of(). Relative file paths in promtool's --http.config.file are now resolved relative to the config file's directory instead of its parent directory. SHA-256 replaces SHA-1 for rule group pagination tokens.
to upgrade
If using the experimental duration-expression feature flag, update queries using min() and max() to use min_of() and max_of() instead. Review any promtool configurations using relative file paths with --http.config.file as resolution behavior has changed. Verify that credential forwarding behavior across host redirects aligns with your security requirements.
Summary pending.
changelog ↗- Security fix for a vulnerability in the UI's sanitize-html dependency (CVE-2026-53606)
advisories
Summary pending.
changelog ↗- The changelog for this release gives no detail.
- The changelog for this release gives no detail.
- The changelog for this release gives no detail.
Summary pending.
changelog ↗- The changelog for this release gives no detail.