Releases

Litmus 3.31.0 is a routine bugfix release addressing memory leaks in GraphQL subscriptions, probe initialization and validation issues, user handler correctness, and infrastructure resolver safety. Documentation updates include Node experiment Tunables and otel-demo OpenSearch integration; test coverage has been expanded.

Thanos v0.42.0 is a mixed release: it patches a critical gRPC authorization-bypass vulnerability (CVE-2026-33186, CVSS 9.1) that could defeat path-based deny rules, alongside several breaking flag removals in Receive and Store, a gRPC keepalive policy change, and a batch of new TLS/cipher configuration options. Upgrade promptly for the security fix, but review the removed flags and renamed Query-Frontend field before rolling out.

• securityFix critical gRPC authorization bypass (CVE-2026-33186)

  A malformed `:path` header in gRPC requests can bypass path-based "deny" rules in `grpc/authz` interceptors, effectively defeating authorization checks. Fixed via an updated `thanos-community/grpc-go` fork. CVSS 9.1, critical, tracked as CVE-2026-33186. Upgrade to v0.42.0 immediately if you rely on gRPC path-based authorization.

• breakingReceive: --shipper.ignore-unequal-block-size removed

  `--shipper.ignore-unequal-block-size` is gone. TSDB now delays compaction until the shipper finishes uploading blocks, so compaction can safely proceed during upload without the risk this flag used to guard against. Remove any references to it from Receive configs.

• breakingStore: --debug.advertise-compatibility-label removed

  `--debug.advertise-compatibility-label` is gone and Store no longer advertises the `@thanos_compatibility_store_type=store` external label by default. This breaks compatibility with Thanos Query instances older than v0.8.0; upgrade Queriers first if you still run pre-v0.8.0 components.

• breakingQuery-Frontend: time_taken field renamed to time_taken_ms

  The Query-Frontend JSON field `time_taken` is now `time_taken_ms`, aligning naming with its unit for easier log parsing. Update any log collector rules or dashboards that key off the old field name.

OpenTelemetry Collector v0.156.0 is a bugfix rollup with one operator-relevant behavior change: the memory_limiter processor switches from continuous forced GC to exponential backoff, with the cap exposed via two new config fields. Several targeted fixes address permanent-error handling in otlp_http, receiver startup ordering, env var nil resolution, and retry config validation.

• enhancementmemory_limiter GC backoff now configurable via two new fields

  The memory_limiter processor now backs off GC calls exponentially when GC is deemed ineffective (soft limit still exceeded and less than 5% memory reclaimed). The backoff cap is controlled by max_gc_interval_when_soft_limited and max_gc_interval_when_hard_limited, both defaulting to 30s. If you tune GC aggressiveness, review these new fields; the default behavior changes from continuous forced GC to capped backoff.

Prometheus v3.13.0 is an LTS release leading with a HIGH-severity credential-forwarding fix (CVE-2025-4673, CVE-2023-45289) and a MEDIUM XSS fix (CVE-2026-44990), alongside four breaking changes to pagination tokens, path resolution, PromQL duration function names, and license file packaging, plus a broad set of new features and performance improvements.

• securityHIGH: Credentials no longer forwarded on cross-host redirects

  Credentials (Authorization header, basic auth, bearer token, OAuth2, and configured headers) are no longer forwarded when following a redirect to a different host. This affects scraping, remote read/write, alerting, and service discovery where credentials are configured and cross-host redirects occur. Tracked as CVE-2025-4673 and CVE-2023-45289; driven by upgrading prometheus/common from v0.68.x to v0.69.0. Review any targets or endpoints that rely on redirects, as credentials will now be dropped silently on host change.

• securityMEDIUM: XSS fix in UI dependency (CVE-2026-44990)

  sanitize-html was bumped to fix a cross-site scripting vulnerability (CVE-2026-44990) in the Prometheus UI. No configuration change needed; upgrade to v3.13.0.

• breakingPagination token algorithm changed from SHA-1 to SHA-256

  Rule group pagination tokens now use SHA-256 instead of SHA-1. Any client or tooling that stores or compares pagination tokens across versions will see different token values after upgrade.

• breaking--http.config.file relative path resolution changed

  Relative file paths inside the file passed to --http.config.file are now resolved relative to that config file's own directory, not its parent directory. If you use relative paths in that config, verify they still resolve correctly after upgrading.

• breakingDuration-expression functions min()/max() renamed to min_of()/max_of()

  If you use the experimental-duration-expr feature flag, the PromQL duration functions min() and max() have been renamed to min_of() and max_of(). Update any queries or rules that use the old names.

• breakingnpm_licenses.tar.bz2 removed; licenses now at /assets/third-party-licenses.txt

  npm_licenses.tar.bz2 is no longer shipped in release tarballs or container images. Third-party npm license text is now embedded in the binary and served at /assets/third-party-licenses.txt. Any automation that extracted that archive needs updating.