# Prometheus v3.13.4

> Observability · 2026-10-02

A security-focused maintenance release updates a vulnerable Go dependency and refreshes UI npm dependencies. It also includes fixes for rollback compatibility, native histogram corruption, and failing scrapes.

## Action needed
- **[security · high]** `google.golang.org/grpc` update for `GO-2026-6348`
  - The release updates `google.golang.org/grpc` to `v1.83.1` to fix HTTP/2 DATA frame fragmentation memory exhaustion associated with `GO-2026-6348`.
- **[security]** UI npm dependency updates
  - The UI updates vulnerable npm dependencies.

## Other recorded changes
- 3 (defect_corrected 3)

[Full analysis](https://ratatosk.io/en/releases/prometheus/v3.13.4)

[Original release notes](https://github.com/prometheus/prometheus/releases/tag/v3.13.4)