Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: PrometheusClear ×

Prometheusv3.14.0ObservabilityAug 18, 2026

ACTION 1CHECK 1PLAN 1OTHER 39View full analysis

A maintenance release with an API deprecation, operator-visible removals and default changes, new capabilities, performance improvements, and correctness fixes across discovery, PromQL, TSDB, and other components. No security advisories or explicitly described security vulnerabilities are included.

Action needed (1)

breakingDefault support for PromQL duration expressions
Duration expressions are enabled by default in PromQL. The promql-duration-expr feature flag is now a no-op.

Check if affected (1)

breakingThe __meta_hetzner_datacenter label, removed
Applies if you use hcloud targets.
The __meta_hetzner_datacenter label is removed from hcloud targets because it was removed from the Hetzner Cloud API.

Plan ahead (1)

deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced
Applies if you set stats to a value other than true or all.
The stats query parameter is deprecated for values other than true and all on /api/v1/query and /api/v1/query_range. Other values still enable basic statistics but return a deprecation warning and will be rejected in the next major release.

Prometheusv3.13.2ObservabilityJul 30, 2026

ACTION 2OTHER 2View full analysis

Prometheus v3.13.2 updates dependencies for two disclosed vulnerabilities and includes related transitive dependency upgrades. It also fixes a PromQL SIGBUS crash when the data disk is full.

Action needed (2)

securityhighgolang.org/x/text update for CVE-2026-56852
golang.org/x/text updates from v0.38.0 to v0.39.0 in Prometheus v3.13.2 for CVE-2026-56852.
securityhighgoogle.golang.org/grpc update for GHSA-hrxh-6v49-42gf
google.golang.org/grpc updates from v1.81.1 to v1.82.1 in Prometheus v3.13.2 for GHSA-hrxh-6v49-42gf.

Prometheusv3.13.1ObservabilityJul 10, 2026

OTHER 1View full analysis

Prometheus v3.13.1 is a focused bug-fix release. It corrects a TSDB head-chunk cache defect that could affect range-query results after head-chunk truncation.

Prometheusv3.5.5ObservabilityJul 9, 2026

ACTION 1OTHER 1View full analysis

Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.

Action needed (1)

securitymediumThe sanitize-html dependency update for CVE-2026-53606
The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
Credentials, including the Authorization header, basic authentication, bearer tokens, OAuth2 credentials, and configured headers, are no longer forwarded when following a redirect to a different host. The behavior ships via prometheus/common v0.69.0 and addresses CVE-2025-4673 and CVE-2023-45289.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
The experimental PromQL duration-expression functions min() and max() are renamed to min_of() and max_of() to distinguish them from the min and max aggregate operators.

Prometheusv3.5.4ObservabilityJun 17, 2026

ACTION 2CHECK 1OTHER 1View full analysis

Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr.io.

Action needed (2)

securitycriticalgolang.org/x/net and OpenTelemetry dependency updates
The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Check if affected (1)

securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.
The /-/config endpoint no longer exposes secrets in plaintext. This fix addresses advisory GHSA-39j6-789q-qxvh.

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
Remote Write rejects snappy-compressed received requests whose declared decoded length exceeds 32MB.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
STACKIT SD no longer exposes secrets in plaintext through the /-/config endpoint. This fix addresses GHSA-39j6-789q-qxvh.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.
OTLP limits the decompressed body size for gzip-encoded write requests.

Prometheusv3.11.3ObservabilityApr 27, 2026

CHECK 3View full analysis

A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.

Check if affected (3)

securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
In v3.11.3, OAuth client_secret is no longer exposed in plaintext through the /-/config endpoint for AzureAD remote write. This addresses GHSA-wg65-39gg-5wfj and CVE-2026-42151.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
In v3.11.3, Remote-read rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. This addresses GHSA-8rm2-7qqf-34qm and CVE-2026-42154.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.
In v3.11.3, the old UI heatmap chart escapes le label values in tick labels to fix stored XSS. This addresses GHSA-fw8g-cg8f-9j28.

Prometheusv3.5.3ObservabilityApr 27, 2026

CHECK 4View full analysis

A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.

Check if affected (4)

securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
AzureAD remote write no longer exposes the OAuth client_secret in plaintext through the /-/config endpoint. The fix ships with CVE-2026-42151 and GHSA-wg65-39gg-5wfj.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
Remote-read now rejects snappy-compressed requests whose declared decoded length exceeds the decode limit. The fix ships with CVE-2026-42154 and GHSA-8rm2-7qqf-34qm.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
The old UI heatmap chart no longer permits stored XSS through unescaped le label values in chart tick labels. The fix ships with GHSA-fw8g-cg8f-9j28.
+ 1 more on the release page

Prometheusv3.11.2ObservabilityApr 13, 2026

CHECK 1OTHER 2View full analysis

Release v3.11.2 fixes stored XSS in the Prometheus web UI and changes Consul service-discovery filtering. The Consul updates add health_filter support and correct how filter parameters are applied to the Health API.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI, CVE-2026-40179
Applies if you use the Prometheus web UI.
The Prometheus web UI now escapes metric names and labels, fixing stored XSS via unescaped values. This fix ships in v3.11.2 and addresses CVE-2026-40179.

Prometheusv3.5.2ObservabilityApr 13, 2026

CHECK 1OTHER 1View full analysis

Prometheus v3.5.2 fixes a stored XSS vulnerability in the Prometheus web UI. The release also includes a regex performance improvement.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI
Applies if crafted metric names or label values can reach the Prometheus web UI.
The Prometheus web UI fixes stored XSS through escaped handling of metric names and label values in tooltips and the metrics explorer. The fix is tracked as CVE-2026-40179.

Prometheusv3.11.1ObservabilityApr 7, 2026

OTHER 1View full analysis

This release includes an operator-facing bug fix for OTLP HTTP tracing when insecure: true is used. No change entry is displayed here.

Prometheusv3.11.0ObservabilityApr 2, 2026

CHECK 1PLAN 2OTHER 42View full analysis

A broad release with new service discovery, PromQL, TSDB, and UI capabilities, alongside performance, dependency, output, and correctness changes. It also deprecates legacy Hetzner discovery labels and corrects TSDB retention-time handling.

Check if affected (1)

breakingThe storage.tsdb.retention.time unit handling
Applies if you configure storage.tsdb.retention.time.
TSDB fixes the unit mismatch in storage.tsdb.retention.time that could make retention 1e6 times longer than configured.

Plan ahead (2)

deprecatedThe __meta_hetzner_datacenter label, deprecatedremoval date not announced
Applies if you use __meta_hetzner_datacenter.
The __meta_hetzner_datacenter label is deprecated for the robot role but remains available for backward compatibility. For the hcloud role, it will stop working after 1 July 2026; __meta_hetzner_robot_datacenter is the replacement for robot.
deprecatedThe Hetzner Cloud datacenter location labels, deprecated
Applies if you use __meta_hetzner_hcloud_datacenter_location or __meta_hetzner_hcloud_datacenter_location_network_zone.
The __meta_hetzner_hcloud_datacenter_location and __meta_hetzner_hcloud_datacenter_location_network_zone labels are deprecated. They are replaced by __meta_hetzner_hcloud_location and __meta_hetzner_hcloud_location_network_zone.

Prometheusv3.10.0ObservabilityFeb 26, 2026

CHECK 1OTHER 29View full analysis

This release adds Prometheus capabilities and image/build options, changes defaults and outputs, improves performance, and fixes correctness defects. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingExpanded alert annotations hidden by default
Applies if you use the UI on the /alerts page.
The UI now hides expanded alert annotations by default on the /alerts page. This change ships in v3.10.0.

Prometheusv3.5.1ObservabilityJan 22, 2026

OTHER 2View full analysis

Prometheus v3.5.1 contains dependency and toolchain version updates without code changes. The recorded release metadata does not describe security-related changes or operator actions beyond upgrading.

Prometheusv3.9.1ObservabilityJan 7, 2026

OTHER 2View full analysis

Prometheus v3.9.1 is a small bug-fix release. It addresses an Agent startup crash and restores scraping relabel keep and drop rules.

Prometheusv3.9.0ObservabilityJan 7, 2026

ACTION 1CHECK 1OTHER 34View full analysis

This release updates histogram collection and TSDB behavior while adding capabilities across the API, PromQL, storage, and UI. It also includes fixes for query handling, storage validation, receivers, and interface behavior.

Action needed (1)

breakingA 10,000-set limit for the TSDB status endpoint
The TSDB status endpoint now limits responses to a maximum of 10,000 sets of statistics.

Check if affected (1)

breakingThe native-histogram feature flag has no effect
Applies if you set scrape_native_histograms to collect Native Histogram samples from exporters.
In version 3.9, Native Histograms is no longer experimental, and the feature flag native-histogram has no effect. Collecting Native Histogram samples from exporters now requires the scrape_native_histograms config setting.

Browse by month