RATATOSKRATATOSK
Sign in

Prometheus

v3.13.5Observability
Oct 21, 2026

ACTION 3CHECK 2

A security-focused maintenance release distrusts compromised root certificates in container images and updates vulnerable Go dependencies. It also raises the minimum Go version required to build Prometheus.

Action needed (3)

  • securitycriticalgolang.org/x/net version

    golang.org/x/net is updated to v0.60.0 to fix HTTP/2 vulnerabilities identified by GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, and GO-2026-6617.

  • securitylowOpenTelemetry version

    OpenTelemetry is updated to v1.45.0 to fix exporter endpoint URLs leaking into info logs, as identified by GO-2026-6505.

  • securityGo 1.26.10 build version

    Prometheus now builds with Go 1.26.10, which fixes vulnerabilities in net/http, net/textproto, crypto/tls, and html/template.

Check if affected (2)

  • securityContainer image CA certificates

    Applies if you use container images.

    Container images update their CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" after the compromise of eMudhra intermediate CA private keys.

  • breakingGo 1.26 build requirement

    Applies if you do not depend on Go 1.26 or later to build Prometheus.

    Building Prometheus now requires Go 1.26 or later.

Add Prometheus to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Prometheus releases →