AI-analyzed release notes for CNCF graduated and incubating projects.
This release adds configuration and feature-gate capabilities, corrects defects, changes histogram bucket values, and introduces the configstorage module. It also removes or deprecates API symbols, with no security issues or advisories identified.
Check if affected (1)
breakingThe BalancerName function, removed
Applies if you use BalancerName.
Plan ahead (1)
deprecatedThe WithForceUnmarshaler option, deprecated
Applies if you use WithForceUnmarshaler.
This release combines new cost data and collection capabilities with operational updates. Endpoint access defaults change, and the release includes corrections across pricing, pagination, request handling, providers, and serialization.
Check if affected (1)
breakingEndpoint defaults, deactivated without an admin token
Applies if you use endpoints without setting an admin token.
A release with backend compatibility removals, forced migrations, new configuration and CLI capabilities, and correctness fixes across storage, extensions, and related components. It does not disclose security advisories or security-specific flaws.
Action needed (1)
breakingTemplate creation through esclient
Template creation moves to esclient, and legacy mapping rendering is retired.
Check if affected (3)
breakingSupport for elasticsearch v6, removed
Applies if you use elasticsearch v6.
breakingThe jaegermcp extension, merged into jaegerquery
Applies if you use the jaegermcp extension.
breakingExpired stable feature gates, removed
Applicability is not stated in the release notes.
Plan ahead (1)
deprecatedThe legacy flag, deprecated
Applies if you use legacy flag.
A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.
Action needed (1)
securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.
Check if affected (4)
securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper. flag removed
Applies if you configure --shipper..
A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.
Action needed (2)
securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.. This replaces the npm_licenses. archive previously shipped in release tarballs and container images.
Check if affected (2)
securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
