Prometheus 2 to 3

[CHANGE] API: Deprecate the stats query parameter of /api/v1/query and /api/v1/query_range for values other than true and all. Other values still enable basic statistics but now return a deprecation warning; they will be rejected in the nex

[SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). #19290 by @krajorama [BUGFIX] PromQL: Preallocate the active query tracker file to avoid SIGBUS crashes when the data

This is a bugfix release for 3.13 LTS. [BUGFIX] TSDB: Fix the head-chunk cache returning samples from the wrong chunk, or spurious not-found errors, to range queries after head-chunk truncation. #19134

This release is built with Go 1.25.12 and fixes a security issue in a UI dependency. [SECURITY] UI: Bump sanitize-html to v2.17.5 to fix CVE-2026-53606. #19060

This is a Long Term Support LTS release. [SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697 [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and s

This release fixes multiple security issues. [SECURITY] STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint. Thanks to @August829 and @Phaxma for reporting. GHSA-39j6-789q-qxvh #18650 [SECURITY] Dependencies: Bump gola

This release contains security fixes, new features (especially around PromQL and Service Discovery), performance improvements in TSDB, Start Timestamp improvements and numerous bug fixes. Thanks to all contributors! Key Highlights Security:

This release fixes mutiple security issues. We would like to thank the following people for the responsible disclosures: Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability. Brett Gervasoni for the AzureA

This release fixes mutiple security issues. We would like to thank the following people for the responsible disclosures: Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability. Brett Gervasoni for the AzureA

This release has a fix for a Stored XSS vulnerability that can be triggered via crafted metric names and label values in Prometheus web UI tooltips and metrics explorer. Thanks to Duc Anh Nguyen from TinyxLab for reporting it. [SECURITY] UI

This release has a fix for a Stored XSS vulnerability that can be triggered via crafted metric names and label values in Prometheus web UI tooltips and metrics explorer. Thanks to Duc Anh Nguyen from TinyxLab for reporting it. [SECURITY] UI

[BUGFIX] Tracing: Fix startup failure for OTLP HTTP tracing with insecure: true. #18469

[CHANGE] Hetzner SD: The __meta_hetzner_datacenter label is deprecated for the role robot but kept for backward compatibility, use the __meta_hetzner_robot_datacenter label instead. For the role hcloud, the label is deprecated and will stop

Prometheus now offers a distroless Docker image variant alongside the default busybox image. The distroless variant provides enhanced security with a minimal base image, uses UID/GID 65532 (nonroot) instead of nobody, and removes the VOLUME

This is the current "Long Term Support" release. No code changes since 3.5.0, just some dependency updates: Docker library updated from 28.2.2 to 28.5.2. #17821 Built with Go 1.24.11.

[BUGFIX] Agent: fix crash shortly after startup from invalid type of object. #17802 [BUGFIX] Scraping: fix relabel keep/drop not working. #17807

Note for users of Native Histograms In version 3.9, Native Histograms is no longer experimental, and the feature flag native-histogram has no effect. You must now turn on the config setting scrape_native_histograms to collect Native Histogr

[BUGFIX] remote: Fix Remote Write receiver, so it does not send wrong response headers for v1 flow and cause Prometheus senders to emit false partial error log and metrics. #17683

Note for users of Native Histograms This is the first release with Native Histograms as a stable feature. However, scraping Native Histograms has to be activated explicitly via the scrape_native_histograms config setting (newly introduced i

[BUGFIX] UI: Revert changed (and breaking) redirect behavior for -web.external-url if -web.route-prefix is configured, which was introduced in #17240. #17389 [BUGFIX] Fix federation of some native histograms. #17299 #17409 [BUGFIX] promtool

[BUGFIX] AWS SD: Fix AWS SDK v2 credentials handling for EC2 and Lightsail discovery. #17355 [BUGFIX] AWS SD: Load AWS region from IMDS when not set. #17376 [BUGFIX] Relabeling: Fix labelmap action validation with the legacy metric name val

[BUGFIX] OTLP: Prefix key_ to label name when translating an OTel attribute name starting with a single underscore, and keep multiple consecutive underscores in label name when translating an OTel attribute name. This reverts the breaking c

Warning We discovered a breaking change in the OTLP endpoint: OpenTelemetry attribute names starting with underscore, for example _attrib, are no longer automatically translated to key_attrib. Please use 3.7.1 instead for OTLP ingestion. Ch

[FEATURE] PromQL: Add step(), and min() and max() on durations, behind feature flag promql-duration-expr. #16777 [FEATURE] API: Add a /v1/status/tsdb/blocks endpoint exposing metadata about loaded blocks. #16695 [FEATURE] Templates: Add toD

is a Long Term Support (LTS) release; see release https://prometheus.io/docs/introduction/release-cycle/ There are a number of new features, and no known breaking changes in this release: [FEATURE] PromQL: Add experimental type and unit met

[BUGFIX] OTLP receiver: Fix default configuration not being respected if the otlp: block is unset in the config file. #16693

[BUGFIX] Parser: Add reproducer for a dangling-reference issue in parsers. #16633

[CHANGE] Config: Make setting out-of-order native histograms feature (--enable-feature=ooo-native-histograms) a no-op. Out-of-order native histograms are now always enabled when out_of_order_time_window is greater than zero and --enable-fea

[BUGFIX] Azure SD: Fix panic on malformed log message. #16434 #16210 [BUGFIX] Config: Update GOGC before loading TSDB. #16491

[FEATURE] PromQL: Implement idelta() and irate() for native histograms. #15853 [ENHANCEMENT] Scaleway SD: Add __meta_scaleway_instance_public_ipv4_addresses and __meta_scaleway_instance_public_ipv6_addresses labels. #14228 [ENHANCEMENT] TSD

[BUGFIX] Don't send Accept header escape=allow-utf-8 when metric_name_validation_scheme: legacy is configured. #16061

Prometheus v3.2.0 Changelog [CHANGE] relabel: Replace actions can now use UTF-8 characters in targetLabel field. Note that $<chars> or ${<chars>} will be expanded. This also apply to replacement field for LabelMap action. #15851 [CHANGE] ru

[SECURITY] upgrade golang.org/x/crypto to address reported CVE-2024-45337. #15691 [CHANGE] Notifier: Increment prometheus_notifications_errors_total by the number of affected alerts rather than per batch. #15428 [CHANGE] API: list rules fie

The first bug fix release for Prometheus 3. [BUGFIX] Promql: Make subqueries left open. #15431 [BUGFIX] Fix memory leak when query log is enabled. #15434 [BUGFIX] Support utf8 names on /v1/label/:name/values endpoint. #15399

This release includes new features such as a brand new UI and UTF-8 support enabled by default. As this marks the first new major version in seven years, several breaking changes are introduced. The breaking changes are mainly around the re