Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: PrometheusClear ×

Prometheusv3.14.0ObservabilityAug 18, 2026

ACTION 1CHECK 1PLAN 1OTHER 39View full analysis

A maintenance release with an API deprecation, operator-visible removals and default changes, new capabilities, performance improvements, and correctness fixes across discovery, PromQL, TSDB, and other components. No security advisories or explicitly described security vulnerabilities are included.

Action needed (1)

breakingDefault support for PromQL duration expressions
Duration expressions are enabled by default in PromQL. The promql-duration-expr feature flag is now a no-op.

Check if affected (1)

breakingThe __meta_hetzner_datacenter label, removed
Applies if you use hcloud targets.
The __meta_hetzner_datacenter label is removed from hcloud targets because it was removed from the Hetzner Cloud API.

Plan ahead (1)

deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced
Applies if you set stats to a value other than true or all.
The stats query parameter is deprecated for values other than true and all on /api/v1/query and /api/v1/query_range. Other values still enable basic statistics but return a deprecation warning and will be rejected in the next major release.

Source ↗

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
Credentials, including the Authorization header, basic authentication, bearer tokens, OAuth2 credentials, and configured headers, are no longer forwarded when following a redirect to a different host. The behavior ships via prometheus/common v0.69.0 and addresses CVE-2025-4673 and CVE-2023-45289.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
The experimental PromQL duration-expression functions min() and max() are renamed to min_of() and max_of() to distinguish them from the min and max aggregate operators.

Source ↗

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
Remote Write rejects snappy-compressed received requests whose declared decoded length exceeds 32MB.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
STACKIT SD no longer exposes secrets in plaintext through the /-/config endpoint. This fix addresses GHSA-39j6-789q-qxvh.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.
OTLP limits the decompressed body size for gzip-encoded write requests.

Source ↗

Prometheusv3.11.0ObservabilityApr 2, 2026

CHECK 1PLAN 2OTHER 42View full analysis

A broad release with new service discovery, PromQL, TSDB, and UI capabilities, alongside performance, dependency, output, and correctness changes. It also deprecates legacy Hetzner discovery labels and corrects TSDB retention-time handling.

Check if affected (1)

breakingThe storage.tsdb.retention.time unit handling
Applies if you configure storage.tsdb.retention.time.
TSDB fixes the unit mismatch in storage.tsdb.retention.time that could make retention 1e6 times longer than configured.

Plan ahead (2)

deprecatedThe __meta_hetzner_datacenter label, deprecatedremoval date not announced
Applies if you use __meta_hetzner_datacenter.
The __meta_hetzner_datacenter label is deprecated for the robot role but remains available for backward compatibility. For the hcloud role, it will stop working after 1 July 2026; __meta_hetzner_robot_datacenter is the replacement for robot.
deprecatedThe Hetzner Cloud datacenter location labels, deprecated
Applies if you use __meta_hetzner_hcloud_datacenter_location or __meta_hetzner_hcloud_datacenter_location_network_zone.
The __meta_hetzner_hcloud_datacenter_location and __meta_hetzner_hcloud_datacenter_location_network_zone labels are deprecated. They are replaced by __meta_hetzner_hcloud_location and __meta_hetzner_hcloud_location_network_zone.

Source ↗

Prometheusv3.10.0ObservabilityFeb 26, 2026

CHECK 1OTHER 29View full analysis

This release adds Prometheus capabilities and image/build options, changes defaults and outputs, improves performance, and fixes correctness defects. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingExpanded alert annotations hidden by default
Applies if you use the UI on the /alerts page.
The UI now hides expanded alert annotations by default on the /alerts page. This change ships in v3.10.0.

Source ↗

Prometheusv3.9.0ObservabilityJan 7, 2026

ACTION 1CHECK 1OTHER 34View full analysis

This release updates histogram collection and TSDB behavior while adding capabilities across the API, PromQL, storage, and UI. It also includes fixes for query handling, storage validation, receivers, and interface behavior.

Action needed (1)

breakingA 10,000-set limit for the TSDB status endpoint
The TSDB status endpoint now limits responses to a maximum of 10,000 sets of statistics.

Check if affected (1)

breakingThe native-histogram feature flag has no effect
Applies if you set scrape_native_histograms to collect Native Histogram samples from exporters.
In version 3.9, Native Histograms is no longer experimental, and the feature flag native-histogram has no effect. Collecting Native Histogram samples from exporters now requires the scrape_native_histograms config setting.

Source ↗

Browse by month