# Prometheus v3.13.5

> Observability · 2026-10-21

A security-focused maintenance release distrusts compromised root certificates in container images and updates vulnerable Go dependencies. It also raises the minimum Go version required to build Prometheus.

## Action needed
- **[security · critical]** `golang.org/x/net` version
  - `golang.org/x/net` is updated to `v0.60.0` to fix HTTP/2 vulnerabilities identified by `GO-2026-6603`, `GO-2026-6610`, `GO-2026-6611`, `GO-2026-6612`, and `GO-2026-6617`.
- **[security · low]** `OpenTelemetry` version
  - `OpenTelemetry` is updated to `v1.45.0` to fix exporter endpoint URLs leaking into info logs, as identified by `GO-2026-6505`.
- **[security]** `Go` 1.26.10 build version
  - Prometheus now builds with `Go` 1.26.10, which fixes vulnerabilities in `net/http`, `net/textproto`, `crypto/tls`, and `html/template`.

## Check if affected
- **[security]** Container image CA certificates
  - Applies if you use container images.
  - Container images update their CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" after the compromise of eMudhra intermediate CA private keys.
- **[breaking]** `Go` 1.26 build requirement
  - Applies if you do not depend on `Go` 1.26 or later to build Prometheus.
  - Building Prometheus now requires `Go` 1.26 or later.

[Full analysis](https://ratatosk.io/en/releases/prometheus/v3.13.5)

[Original release notes](https://github.com/prometheus/prometheus/releases/tag/v3.13.5)