Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: PrometheusClear ×

Prometheusv3.13.2ObservabilityJul 30, 2026

ACTION 2OTHER 2View full analysis

Prometheus v3.13.2 updates dependencies for two disclosed vulnerabilities and includes related transitive dependency upgrades. It also fixes a PromQL SIGBUS crash when the data disk is full.

Action needed (2)

securityhighgolang.org/x/text update for CVE-2026-56852
golang.org/x/text updates from v0.38.0 to v0.39.0 in Prometheus v3.13.2 for CVE-2026-56852.
securityhighgoogle.golang.org/grpc update for GHSA-hrxh-6v49-42gf
google.golang.org/grpc updates from v1.81.1 to v1.82.1 in Prometheus v3.13.2 for GHSA-hrxh-6v49-42gf.

Source ↗

Prometheusv3.5.5ObservabilityJul 9, 2026

ACTION 1OTHER 1View full analysis

Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.

Action needed (1)

securitymediumThe sanitize-html dependency update for CVE-2026-53606
The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.

Source ↗

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
Credentials, including the Authorization header, basic authentication, bearer tokens, OAuth2 credentials, and configured headers, are no longer forwarded when following a redirect to a different host. The behavior ships via prometheus/common v0.69.0 and addresses CVE-2025-4673 and CVE-2023-45289.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
The experimental PromQL duration-expression functions min() and max() are renamed to min_of() and max_of() to distinguish them from the min and max aggregate operators.

Source ↗

Prometheusv3.5.4ObservabilityJun 17, 2026

ACTION 2CHECK 1OTHER 1View full analysis

Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr.io.

Action needed (2)

securitycriticalgolang.org/x/net and OpenTelemetry dependency updates
The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Check if affected (1)

securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.
The /-/config endpoint no longer exposes secrets in plaintext. This fix addresses advisory GHSA-39j6-789q-qxvh.

Source ↗

Browse by month