Releases — RATATOSK

Thanosv0.42.0ObservabilityJul 8, 2026

ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

securityReceive tenant ID validation
Applies if you run Receive.
Receive validates tenant IDs extracted from split-tenant labels to prevent path traversal.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
The Query-Frontend JSON output now uses time_taken_ms instead of time_taken, for consistent output and easier parsing by log collectors.
breaking--shipper.ignore-unequal-block-size flag removed
Applies if you configure --shipper.ignore-unequal-block-size.
The breaking --shipper.ignore-unequal-block-size flag is removed from Receive.
+ 1 more on the release page

Source ↗