Releases

Check if affected (1)

• breakingThe __meta_hetzner_datacenter label, removed

  Applies if you use hcloud targets.

  The __meta_hetzner_datacenter label is removed from hcloud targets because it was removed from the Hetzner Cloud API.

Plan ahead (1)

• deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced

  Applies if you set stats to a value other than true or all.

  The stats query parameter is deprecated for values other than true and all on /api/v1/query and /api/v1/query_range. Other values still enable basic statistics but return a deprecation warning and will be rejected in the next major release.

Check if affected (2)

• securitymediumRedirect credential forwarding

  Applies if you use scraping, remote read/write, alerting, or service discovery.

  Credentials, including the Authorization header, basic authentication, bearer tokens, OAuth2 credentials, and configured headers, are no longer forwarded when following a redirect to a different host. The behavior ships via prometheus/common v0.69.0 and addresses CVE-2025-4673 and CVE-2023-45289.

• breakingPromQL duration-expression function names

  Applies if you enable experimental-duration-expr and use min() and max().

  The experimental PromQL duration-expression functions min() and max() are renamed to min_of() and max_of() to distinguish them from the min and max aggregate operators.

Check if affected (1)

• securityPlaintext secret exposure via /-/config corrected

  Applies if you access the /-/config endpoint.

  The /-/config endpoint no longer exposes secrets in plaintext. This fix addresses advisory GHSA-39j6-789q-qxvh.

Check if affected (3)

• securityRemote Write decoded-length constraint

  Applies if you use Remote Write.

  Remote Write rejects snappy-compressed received requests whose declared decoded length exceeds 32MB.

• securityPlaintext secret exposure in STACKIT SD

  Applies if you use STACKIT SD.

  STACKIT SD no longer exposes secrets in plaintext through the /-/config endpoint. This fix addresses GHSA-39j6-789q-qxvh.

• breakingDecompressed body-size limit for OTLP write requests

  Applies if you use OTLP.

  OTLP limits the decompressed body size for gzip-encoded write requests.

Check if affected (1)

• breakingThe native-histogram feature flag has no effect

  Applies if you set scrape_native_histograms to collect Native Histogram samples from exporters.

  In version 3.9, Native Histograms is no longer experimental, and the feature flag native-histogram has no effect. Collecting Native Histogram samples from exporters now requires the scrape_native_histograms config setting.