Releases — RATATOSK

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
Credentials, including the Authorization header, basic authentication, bearer tokens, OAuth2 credentials, and configured headers, are no longer forwarded when following a redirect to a different host. The behavior ships via prometheus/common v0.69.0 and addresses CVE-2025-4673 and CVE-2023-45289.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
The experimental PromQL duration-expression functions min() and max() are renamed to min_of() and max_of() to distinguish them from the min and max aggregate operators.

Source ↗