P
v0.313.2
v0.313.2
P
3.13.2 / 2026-07-29
What's Changed [SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). #19290 by @krajorama [BUGFIX] PromQL: Preallocate the active query tracker file to avoid SIGBUS crashes when the data disk is full. #19289 by @akshajrawat Full Changelog: v3.13.1...v3.13.2
P
v0.313.1
v0.313.1
P
3.13.1 / 2026-07-10
This is a bugfix release for 3.13 LTS. [BUGFIX] TSDB: Fix the head-chunk cache returning samples from the wrong chunk, or spurious not-found errors, to range queries after head-chunk truncation. #19134
P
3.5.5 / 2026-07-09
This release is built with Go 1.25.12 and fixes a security issue in a UI dependency. [SECURITY] UI: Bump sanitize-html to v2.17.5 to fix CVE-2026-53606. #19060
P
3.13.0-rc.0 / 2026-06-18
[SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697 [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927 [CHANGE] HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host; affects scraping, remo…
P
v0.305.5
v0.305.5
P
v0.313.0
v0.313.0
P
3.13.0 / 2026-07-01
This is a Long Term Support LTS release. [SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697 [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997 [CHANG…
P
3.13.0-rc.1 / 2026-06-22
Release notes of the 3.13-rc.1 release: The 3.13.0-rc.0 release was only partially successful due to the migration from NPM to PNPM and subsequent CI issues, so most of the changes in this release candidate are CI/build-related. The only user-facing change is: [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt,…
P
v0.313.0-rc.1
v0.313.0-rc.1
P
3.5.4 / 2026-06-17
This release fixes multiple security issues. [SECURITY] STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint. Thanks to @August829 and @Phaxma for reporting. GHSA-39j6-789q-qxvh #18650 [SECURITY] Dependencies: Bump golang.org/x/net to v0.55.0 and OpenTelemetry to v1.43.0 to fix reported CVEs (GO-2026-5026, GO-2026-4918, GO-2026-4985). #18934 [SECURITY] UI: Bump mantine-ui depe…
P
v0.305.4
v0.305.4
P
3.12.0 / 2026-05-28
This release contains security fixes, new features (especially around PromQL and Service Discovery), performance improvements in TSDB, Start Timestamp improvements and numerous bug fixes. Thanks to all contributors! Key Highlights Security: Two security vulnerabilities have been addressed: a denial of service in remote-write (snappy decompression limit) and a secret exposure leak in STACKIT servic…
P
v0.312.0
v0.312.0
P
v0.312.0-rc.0
v0.312.0-rc.0