Prometheus - Package Updates

[Package Updates]

[2.7.1]

• Update prometheus to 3.7.1
• Full Changelog
• [BUGFIX] OTLP: Prefix key_ to label name when translating an OTel attribute name starting with a single underscore, and keep multiple consecutive underscores in label name when translating an OTel attribute name. This reverts the breaking changes introduced in 3.7.0. #17344

[Package Updates]

[2.7.2]

• Update prometheus to 3.7.2
• Full Changelog
• [BUGFIX] AWS SD: Fix AWS SDK v2 credentials handling for EC2 and Lightsail discovery. #17355
• [BUGFIX] AWS SD: Load AWS region from IMDS when not set. #17376
• [BUGFIX] Relabeling: Fix labelmap action validation with the legacy metric name validation scheme. #17372
• [BUGFIX] PromQL: Fix parsing failure when anchored and smoothed are used as metric names and label names. #17353
• [BUGFIX] PromQL: Fix formatting of range vector selectors with smoothed/anchored modifier. #17354

[Package Updates]

[2.7.3]

• Update prometheus to 3.7.3
• Full Changelog
• [BUGFIX] UI: Revert changed (and breaking) redirect behavior for -web.external-url if -web.route-prefix is configured, which was introduced in #​17240. #​17389
• [BUGFIX] Fix federation of some native histograms. #​17299 #​17409
• [BUGFIX] promtool: check config would fail when --lint=none flag was set. #​17399 #​17414
• [BUGFIX] Remote-write: fix a deadlock in the queue resharding logic that can lead to suboptimal queue behavior. #​17412

[Package Updates]

[2.8.0]

• Update prometheus to 3.8.0
• Full Changelog
• [FEATURE] OAuth2: support jwt-bearer grant-type (RFC7523 3.1). #17592
• [FEATURE] Dockerfile: Add OpenContainers spec labels to Dockerfile. #16483
• [FEATURE] SD: Add unified AWS service discovery for ec2, lightsail and ecs services. #17046
• [FEATURE] Native histograms are now a stable, but optional feature, use the scrape_native_histogram config setting. #17232 #17315
• [FEATURE] UI: Support anchored and smoothed keyword in promql editor. #17239
• [FEATURE] UI: Show detailed relabeling steps for each discovered target. #17337
• [FEATURE] Alerting: Add urlQueryEscape to template functions. #17403
• [FEATURE] Promtool: Add Remote-Write 2.0 support to promtool push metrics via the --protobuf_message flag. #17417

[Package Updates]

[2.8.1]

• Update prometheus to 3.8.1
• Full Changelog
• [BUGFIX] remote: Fix Remote Write receiver, so it does not send wrong response headers for v1 flow and cause Prometheus senders to emit false partial error log and metrics. #​17683

[Package Updates]

[2.9.0]

• Update prometheus to 3.9.0
• Full Changelog
• [CHANGE] Native Histograms are no longer experimental! Make the native-histogram feature flag a no-op. Use scrape_native_histograms config option instead. #17528
• [CHANGE] API: Add maximum limit of 10,000 sets of statistics to TSDB status endpoint. #17647
• [FEATURE] API: Add /api/v1/features for clients to understand which features are supported. #17427
• [FEATURE] Promtool: Add start_timestamp field for unit tests. #17636
• [FEATURE] Promtool: Add --format seriesjson option to tsdb dump to output just series labels in JSON format. #13409
• [FEATURE] Add --storage.tsdb.delay-compact-file.path flag for better interoperability with Thanos. #17435
• [FEATURE] UI: Add an option on the query drop-down menu to duplicate that query panel. #17714
• [BUGFIX] UI: PromQL autocomplete now shows the correct type and HELP text for OpenMetrics counters whose samples end in _total. #17682
• [BUGFIX] UI: Fixed codemirror-promql incorrectly showing label completion suggestions after the closing curly brace of a vector selector. #17602
• [BUGFIX] UI: Query editor no longer suggests a duration unit if one is already present after a number. #17605

[Package Updates]

[2.9.1]

• Update prometheus to 3.9.1
• Full Changelog
• [BUGFIX] Agent: fix crash shortly after startup from invalid type of object. #​17802
• [BUGFIX] Scraping: fix relabel keep/drop not working. #​17807

[Package Updates]

[2.10.0]

• Update prometheus to 3.10.0
• Full Changelog
• [CHANGE] Alerting: Add alertmanager dimension to following metrics: prometheus_notifications_dropped_total, prometheus_notifications_queue_capacity, prometheus_notifications_queue_length. #​16355
• [CHANGE] UI: Hide expanded alert annotations by default, enabling more information density on the /alerts page. #​17611
• [FEATURE] AWS SD: Add MSK Role. #​17600
• [FEATURE] PromQL: Add fill() / fill_left() / fill_right() binop modifiers for specifying default values for missing series. #​17644
• [FEATURE] Web: Add OpenAPI 3.2 specification for the HTTP API at /api/v1/openapi.yaml. #​17825
• [FEATURE] Dockerfile: Add distroless image variant using UID/GID 65532 and no VOLUME declaration. Busybox image remains default. #​17876
• [FEATURE] Web: Add on-demand wall time profiling under <URL>/debug/pprof/fgprof. #​18027
• [ENHANCEMENT] PromQL: Add more detail to histogram quantile monotonicity info annotations. #​15578
• [ENHANCEMENT] Alerting: Independent alertmanager sendloops. #​16355
• [ENHANCEMENT] TSDB: Experimental support for early compaction of stale series in the memory with configurable threshold stale_series_compaction_threshold in the config file. #​16929

[Package Updates]

[2.11.2]

• Update prometheus to 3.11.2
• Full Changelog
• [SECURITY] UI: Fix stored XSS via unescaped metric names and labels. CVE-2026-40179. #​18506
• [ENHANCEMENT] Consul SD: Introduce health_filter field for Health API filtering. #​18499
• [BUGFIX] Consul SD: Fix filter parameter being incorrectly applied to the Health API. #​18499

[Package Updates]

[2.11.3]

• Update prometheus to 3.11.3
• Full Changelog
• [SECURITY] AzureAD remote write: Fix OAuth client_secret being exposed in plaintext via /-/config endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 #18590
• [SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 #18584
• [SECURITY] UI: Fix stored XSS via unescaped le label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 #18588