Releases — RATATOSK

Cortexv1.21.1ObservabilityJun 5, 2026

A maintenance release with operator-facing security fixes and configuration changes across ingestion, distribution, and status pages. It also includes fixes for request handling, authentication, configuration exposure, gossip limits, and client and runtime panics.

Check if affected (3)

securityStored XSS protection in Alertmanager and Store Gateway status pages
Applies if you run Alertmanager or Store Gateway.
Alertmanager and Store Gateway status pages now use html/template instead of text/template, fixing the stored XSS vulnerability.
securityWrappedHistogram native histogram size limit
Applies if you use native histograms.
The Distributor adds WrappedHistogram with a configurable size limit, controlled by -validation.max-native-histogram-size-bytes and set to 16 KB by default. The limit caps native histogram protobuf data before unmarshalling and addresses memory amplification attacks via packed varint deltas.
breakingDecompressed gzip output limit for ParseProtoReader and OTLP ingestion
Applies if you use the OTLP ingestion path.
The decompressed body in ParseProtoReader and the OTLP ingestion path is capped by -distributor.otlp-max-recv-msg-size.

Source ↗

Cortexv1.21.0ObservabilityApr 27, 2026

ACTION 1CHECK 1PLAN 3OTHER 81View full analysis

A feature and maintenance release that adds Store Gateway, federation, overrides, caching, metric, and query capabilities while graduating several experimental features. It also changes defaults and configuration names, updates dependencies, and fixes correctness, memory, panic, and data-corruption defects.

Action needed (1)

breakingThe blocks storage bucket index default
Blocks storage now enables the bucket index by default through -blocks-storage.bucket-store.bucket-index.enabled. Disabling it with -blocks-storage.bucket-store.bucket-index.enabled=false is not recommended for production.

Check if affected (1)

breakingThe Distributor type and unit label flag
Applies if you configure either -distributor.enable-type-and-unit-labels or -distributor.otlp.enable-type-and-unit-labels for remote write v2 and OTLP requests.
The Distributor adds the per-tenant -distributor.enable-type-and-unit-labels flag for adding __unit__ and __type__ labels to remote write v2 and OTLP requests. The -distributor.otlp.enable-type-and-unit-labels flag is deprecated, operates as a no-op, and is consolidated into the new flag.

Plan ahead (3)

breakingThe Ruler API flag rename
Applies if you configure -experimental.ruler.enable-api.
The -experimental.ruler.enable-api flag is renamed to -ruler.enable-api in the Ruler. The old flag remains available as deprecated.
breakingThe Alertmanager API flag rename
Applies if you configure -experimental.alertmanager.enable-api.
The -experimental.alertmanager.enable-api flag is renamed to -alertmanager.enable-api in Alertmanager. The old flag remains available as deprecated.
breakingThe Users Scanner user index update configuration
Applies if you configure either -*.users-scanner.user-index.cleanup-interval or clean_up_interval.
The Users Scanner flag -*.users-scanner.user-index.cleanup-interval is renamed to -*.users-scanner.user-index.update-interval. The clean_up_interval field is renamed to update_interval within the users_scanner configuration block.

Source ↗