AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with bug fixes, behavior changes, and two operator-visible default changes. It also updates a runtime dependency and tightens validation and payload handling; no security vulnerability or advisory is explicitly identified.
Check if affected (2)
breakingThe in_monitor_agent visibility default
Applies if in_monitor_agent runs.
breakingThe in_debug_agent local-machine default
Applies if in_debug_agent runs.
A release that removes stabilized feature gates, updates processor metric names, and changes service configuration APIs. It also adds schema and metadata tooling capabilities and fixes generator defects.
Check if affected (9)
breakingThe confightp. feature gate, removed
Applies if you use confightp..
breakingThe configoptional. feature gate, removed
Applies if you use configoptional..
breakingThe confmap. feature gate, removed
Applies if you use confmap..
Plan ahead (1)
deprecatedService configuration API deprecations
Applies if you use service. or extensioncapabilities..
Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr..
Action needed (2)
securitycriticalgolang. and OpenTelemetry dependency updates
The golang. dependency is updated to v0., and OpenTelemetry to v1.. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.
Check if affected (1)
securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.
A maintenance release with operator-facing security fixes and configuration changes across ingestion, distribution, and status pages. It also includes fixes for request handling, authentication, configuration exposure, gossip limits, and client and runtime panics.
Check if affected (3)
securityStored XSS protection in Alertmanager and Store Gateway status pages
Applies if you run Alertmanager or Store Gateway.
securityWrappedHistogram native histogram size limit
Applies if you use native histograms.
breakingDecompressed gzip output limit for ParseProtoReader and OTLP ingestion
Applies if you use the OTLP ingestion path.
