Prometheus - Package Updates

Package Updates

[2.11.3]

Update prometheus to 3.11.3
Full Changelog
[SECURITY] AzureAD remote write: Fix OAuth client_secret being exposed in plaintext via /-/config endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 #18590
[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 #18584
[SECURITY] UI: Fix stored XSS via unescaped le label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 #18588

Package Updates

[1.15.1]

Update alertmanager to 0.32.1
Full Changelog
[BUGFIX] dispatcher: Fix issue with dispatching to a contended route. #5179
[BUGFIX] ui: Provide prebuilt ui assets in release. #5191
[ENHANCEMENT] ui: Support building artifacts in containers with Docker or Podman. #5102

Package Updates

[2.12.0]

Update prometheus to 3.12.0
Full Changelog
[SECURITY] Remote-write: Reject snappy-compressed requests whose declared decoded length exceeds the 32MB. Thanks to @hibrian827 for reporting it. #18642
[SECURITY] STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint. Thanks to @August829 and @Phaxma for reporting. GHSA-39j6-789q-qxvh #18649
[CHANGE] TSDB/Agent: Adds Start Timestamp field to all WAL Histogram samples in memory; used st-storage flag is enabled. #18221
[FEATURE] API: Add /api/v1/status/self_metrics endpoint returning the current state of the Prometheus server's own metrics about itself as JSON. #18411
[FEATURE] Discovery: Add DigitalOcean Managed Databases service discovery #18287
[FEATURE] PromQL: Add start(), end(), range(), and step() experimental functions #17877
[FEATURE] UI: Add a web interface for deleting time series and cleaning tombstones, accessible from the Status menu. #18390
[BUGFIX] PromQL: Fix info() function incorrectly handling negated __name__ matchers #17932
[BUGFIX] Config: Validate remote_write queue_config fields at load time to prevent runtime panic and silent misconfiguration. #18209
[BUGFIX] TSDB: panic with native histograms during query of overlapping chunks. #18692

Package Updates

[1.15.2]

Package Updates

[2.13.0]

Update prometheus to 3.13.0
Full Changelog
[CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997

Package Updates

[1.16.1]

Update alertmanager to 0.33.1
Full Changelog
[BUGFIX] doc: fix missing notification_reason field in webhook documentation (#5329)
[BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily. (#5330)
[BUGFIX] silence with no matchers should populate an empty array in API response (#5331)

Package Updates

[2.13.1]

Update prometheus to 3.13.1
Full Changelog
This is a bugfix release for 3.13 LTS.
[BUGFIX] TSDB: Fix the head-chunk cache returning samples from the wrong chunk, or spurious not-found errors, to range queries after head-chunk truncation. #19134

Package Updates

[2.13.2]

Update prometheus to 3.13.2
Full Changelog
[SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). #19290
[BUGFIX] PromQL: Preallocate the active query tracker file to avoid SIGBUS crashes when the data disk is full. #19289

Package Updates

[1.17.0]

Update alertmanager to 0.34.0
Full Changelog
[CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #5332
[FEATURE] Add optional templatable labels to alert routes. #5328
[FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #5315
[FEATURE] eventrecorder: Add stdout output type. #5311
[FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #5406
[FEATURE] sns: Add aws external_id support in sigv4 configuration. #5157
[FEATURE] template: Add toDate and mustToDate functions. #5327
[BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #5307
[BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #5379
[BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304

Package Updates

[2.14.0]

Update prometheus to 3.14.0
Full Changelog
API: Deprecate the stats query parameter of /api/v1/query and /api/v1/query_range for values other than true and all. Other values still enable basic statistics but now return a deprecation warning; they will be rejected in the next major release. #19124
Discovery/Hetzner: Drop the __meta_hetzner_datacenter label for hcloud targets, following its removal from the Hetzner Cloud API. #19269
PromQL: Enable duration expressions by default. The promql-duration-expr feature flag is now a no-op. #19033
Discovery: Add Oracle Cloud Infrastructure compute service discovery (oci_sd_configs). #18919
PromQL: Add experimental start_timestamp(instant-vector) function returning the start timestamp of each sample in the given vector. Requires the use-start-timestamps feature flag. #19089
BUGFIX] Alerting: Fix 100% CPU usage on shutdown that could delay graceful shutdown and trigger timeout-based kills. #17859
TSDB: Fix silent data loss and potential crash loop when stale_series_compaction_threshold is used in the config file. #19016
TSDB: Fix potential data loss on restart when out-of-order ingestion is enabled and blocks are compacted. #19016
TSDB: Fix out-of-order queries blocking compaction for hours, causing memory usage to grow. #19013
Scrape: Fix scrape manager spinning at 100% CPU on shutdown. #19149

Cloudron Forum