There are 3 open security issues in trixie.
There are 3 open security issues in sid.
There are 3 open security issues in forky.
commit 69e02e1346c051182d7afacb89d692538f0f24eb
Author: Reinhard Tartler <siretart@tauware.de>
Date: Sun Jul 19 10:18:11 2026 -0300
Upload to unstable
commit e41b7492ccb6fcc8537d793b9a15e579df081162
Author: Reinhard Tartler <siretart@tauware.de>
Date: Sat Jul 18 13:53:12 2026 -0400
normalize with wrap-and-sort
commit c2470d4bb36a7ca24d416f0810519c59aa2a5109
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jul 2 03:03:58 2026 -0400
Update debian/changelog for 3.5.3+ds1-1 release
commit 8889ce13faf683ec63e7ba71be37fefcf3b5db3d
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jul 2 02:48:32 2026 -0400
Drop legacy UTF-8 validation patch and fix prometheus/common test panics
The patch 0014-Use-legacy-label-name-validation.patch was a workaround
introduced when prometheus/common v0.62.0 dropped legacy (non-UTF-8)
label support, but Prometheus itself was still on an older version
(v2.x) that didn't support UTF-8 labels natively.
As explicitly noted in that patch description, it is safe to drop once
Prometheus is updated to >= v2.55.0. Since we are now packaging Prometheus
v3.5.3, native UTF-8 label validation is fully supported.
Dropping this legacy validation patch allows us to also drop
0023-Disable-UTF-8-tests-broken-by-legacy-default.patch, which restores
significant upstream test coverage.
However, dropping the legacy validation revealed that the zero-value
expfmt.TextParser constructor panics in newer versions of prometheus/common
if a validation scheme is not explicitly set. This commit adds a new patch
(0023-Use-UTF8Validation-for-TextParser-to-fix-test-panics.patch) to
update all instances of expfmt.TextParser to use
expfmt.NewTextParser(model.UTF8Validation).
commit b211dde72894d9dfa7b0bc13c425f47884c8403a
Author: Reinhard Tartler <siretart@tauware.de>
Date: Wed Jul 1 14:21:09 2026 -0400
Add comprehensive autopkgtest for Prometheus systemd service
This test verifies that the prometheus daemon starts up successfully
via systemd, that the metrics and buildinfo endpoints are reachable
over HTTP, and most importantly, that the root endpoint (/) correctly
serves the static 'no UI' placeholder text instead of returning a 404
or crashing now that the classic/React UIs have been removed.
commit b118c2c5bcd81ce859640a199712f18d99a322e7
Author: Reinhard Tartler <siretart@tauware.de>
Date: Wed Jul 1 13:37:43 2026 -0400
normalize with wrap-and-sort
commit ce1540e32970842ba29f3180d672ab4de13129c4
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 07:39:18 2026 -0400
Drop Prometheus Web UI and related dependencies
The Prometheus Web UI (both Classic and React) relies on build tools
like rust-rolldown and node-vite which are either blocked or missing
in Debian. The pre-built vendored node_modules cannot be included due
to DFSG violations.
This commit systematically removes the Web UI:
- Drops the classic UI patches and assets
- Removes fonts-* and libjs-* dependencies from debian/control
- Cleans up stale web/ui/static entries in debian/prometheus.install
- Drops missing-sources UI references from debian/copyright
- Disables UI flags in the CLI help
- Adds debian/README.source explaining the DFSG and build system blockers
- Updates debian/NEWS to inform users of the removed functionality
- Refreshes quilt patches
commit 6b0e8d405237aba1f98a6dae0568d79fafb92047
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 06:35:42 2026 -0400
Disable UTF-8 tests
commit 40a423c43a9d42a8f261b05f8a361842c5e82179
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 06:04:58 2026 -0400
Disable failing tests
commit 00e362b3a071f9965098ac728597a187b64412fb
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 05:53:10 2026 -0400
debian/copyright: remove unused patterns
commit 2c2ab90650fce48d917b2834054232f3556ae9c8
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 05:47:59 2026 -0400
Remove expfmt.WithUnit from scrape test
commit 53b8626a76ce17a6f81224c92db4f6322e0325d9
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 05:47:59 2026 -0400
Remove klog slog bridge due to missing functions in Debian klog package
commit 932a2ce9e53ad13ad47cb1690c24295f7ba4157c
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 05:47:59 2026 -0400
Disable StackIT service discovery
commit f5c4cf5cda442e0ec6059d5d180e64bd123e574e
Author: Reinhard Tartler <siretart@tauware.de>
Date: Thu Jun 18 05:47:59 2026 -0400
Disable OpenStack service discovery
commit aba5ba2512c4de0e4857ad371f40a4fd0c56cd80
Author: Reinhard Tartler <siretart@tauware.de>
Date: Wed Jun 17 09:05:53 2026 -0400
debian/changelog: update
commit d158d53b620b4c94e8a3c762576fe348590c2d05
Author: Reinhard Tartler <siretart@tauware.de>
Date: Wed Jun 17 09:03:32 2026 -0400
Refresh patches
commit 8fea7f32b78010ae6ddeab34127258f871abecfd
Merge: 93e3fea83 792b54416
Author: Reinhard Tartler <siretart@tauware.de>
Date: Tue Jun 16 22:06:29 2026 -0400
Merge tag 'upstream/3.5.3+ds1' into debian/sid
Upstream version 3.5.3+ds1
commit 792b544167d74009288b65fed7d3d230e67768b3
Merge: 57a40c08a dcd3d551c
Author: Reinhard Tartler <siretart@tauware.de>
Date: Tue Jun 16 22:06:29 2026 -0400
New upstream version 3.5.3+ds1
commit dcd3d551ced8b8dc14e0217f8cb14e547109cd5f
Merge: cbcbf1f2d d1c574651
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 16:12:05 2026 +0200
Merge pull request #18593 from roidelapluie/roidelapluie/cut-rel-3.5.3
Release 3.5.3
commit d1c574651d966226628ede1b0e43cf673762c05b
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 15:43:24 2026 +0200
Release 3.5.3
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit cbcbf1f2d11a729147e4cee21fc30d5d73936bce
Merge: b2b977c81 6e1eebf5b
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 15:03:40 2026 +0200
Merge pull request #18591 from roidelapluie/roidelapluie/rw-decode-limit
remote: validate snappy decoded length before allocation in write endpoint
commit b2b977c813fbb797ad0e2fe056566a1a83b8e945
Merge: cb493a437 bf6fb7362
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 13:19:18 2026 +0200
Merge pull request #18589 from roidelapluie/roidelapluie/react-escape-lts
ui: fix stored XSS in old UI heatmap chart tick labels
commit 6e1eebf5ba0d682f78aace455357d5b2e343cdd8
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 13:10:33 2026 +0200
remote: validate snappy decoded length before allocation in write endpoint
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit cb493a437beae76c40f4b51240b35ac1e7a3e493
Merge: 3ac006347 cc0856868
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 12:48:13 2026 +0200
Merge pull request #18587 from roidelapluie/roidelapluie/azadsecret-lts
remote/azuread: use Secret type for OAuth client_secret
commit 3ac006347ae98970c7d945ca5bacefce09a78984
Merge: f22728784 a75e3011d
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 12:45:12 2026 +0200
Merge pull request #18585 from roidelapluie/roidelapluie/snappylength-lts
remote: validate snappy decoded length before allocation in read enpoint
commit bf6fb7362e761b19da2b40a1ff546f370b531361
Author: Julius Volz <julius.volz@gmail.com>
Date: Wed Apr 22 17:31:29 2026 +0200
ui: fix stored XSS in old UI heatmap chart tick labels
This fixes the stored XSS as described in:
https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28
Signed-off-by: Julius Volz <julius.volz@gmail.com>
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit cc085686844f66d29b724772e5fac6bee3c0b322
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 12:16:46 2026 +0200
remote/azuread: use Secret type for OAuth client_secret
The ClientSecret field in OAuthConfig was typed as plain string,
causing it to be exposed in plaintext via the /-/config HTTP endpoint.
Change it to config_util.Secret so Prometheus redacts it as <secret>.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit a75e3011d9f0ebfd3b9adf4e41d7d377fb4cdc29
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 27 11:57:37 2026 +0200
remote: validate snappy decoded length before allocation in read endpoint
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit f22728784338bb4994cfa9cf33ca03e151566629
Merge: dd63f3d24 55cba91ce
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 13 13:32:08 2026 +0200
Merge pull request #18516 from roidelapluie/roidelapluie/cut-3.5.2
Release 3.5.2 LTS
commit 55cba91ce1689d2aa76d691f59fd897e47facdee
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 13 13:02:35 2026 +0200
Release 3.5.2 LTS
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit dd63f3d24a9c3c6c922726ba75f4771e2682068d
Merge: 56a4f039f 1f5690d89
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 13 12:58:00 2026 +0200
Merge pull request #18508 from roidelapluie/roidelapluie/update-go-grpc-lts
LTS: Bump go to 1.25; bump some dependencies
commit 1f5690d89ad103b198ade63e82205b68b08ae73e
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Apr 13 11:17:10 2026 +0200
Update CODEOWNERS in LTS
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit ec34996111dd57f6cb04f15c3b1074a539a88d83
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Fri Apr 10 11:34:48 2026 +0200
Bump go to 1.25; bump dependencies
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 56a4f039f7c533659d7478827237c700a9538f4c
Merge: 2834efc2b a7b86697d
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Fri Apr 10 14:16:33 2026 +0200
Merge pull request #18507 from roidelapluie/roidelapluie/backport-xss-issue-3.5
UI: Fix stored XSS via unescaped metric names and labels
commit a7b86697d684a0bb9a8d549ed3737bdde9766194
Author: Julius Volz <julius.volz@gmail.com>
Date: Sat Apr 4 11:54:22 2026 +0200
UI: Fix stored XSS via unescaped metric names and labels
Metric names, label names, and label values containing HTML/JavaScript were
inserted into `innerHTML` without escaping in several UI code paths, enabling
stored XSS attacks via crafted metrics. This mostly becomes exploitable in
Prometheus 3.x, since it defaults to allowing any UTF-8 characters in metric
and label names.
Apply `escapeHTML()` to all user-controlled values before innerHTML
insertion in:
* Mantine UI chart tooltip
* Old React UI chart tooltip
* Old React UI metrics explorer fuzzy search
* Old React UI heatmap tooltip
See https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99
Signed-off-by: Julius Volz <julius.volz@gmail.com>
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 1c93b41cb14a894eee5254ccea3a97517347bae7
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Fri Apr 10 11:40:56 2026 +0200
Do not run tests with previous go version
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 2834efc2bb0aeed34a249e5621eb7358fb944508
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Thu Apr 9 18:33:48 2026 +0200
ci: disable fuzzing CI on LTS branch (#18500)
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit abababf005bfefcf6ceebaa5b488ae2828625190
Merge: a967901a9 042f945af
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Fri Jan 23 10:00:24 2026 +0100
Merge pull request #17908 from roidelapluie/roidelapluie/cpsimplify
[Backport 3.5LTS] [PERF] Regex: stop calling Simplify
commit a967901a9f4abfb183a1ce6994bbbeaac48e8aba
Author: Ben Kochie <superq@gmail.com>
Date: Thu Jan 22 22:23:15 2026 +0100
Bump promci action (#17912) (#17918)
Update promci to pick up `latest` tag fix.
Fixes: https://github.com/prometheus/prometheus/issues/16238
Signed-off-by: SuperQ <superq@gmail.com>
commit 042f945af1e854155dfd6b4637ee8e14a2be3996
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Thu Sep 18 10:58:25 2025 +0100
[PERF] Regex: stop calling Simplify
It slows down compilation and doesn't make any of our benchmarks go faster.
Assumed to be something that helped at an earlier point, but doesn't help now.
Add a benchmark with a more complicated regex to demonstrate the slowdown.
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit 7d42ddfaad88c3a1fd52236e5a7707315c58e84d
Merge: d1916a681 ce47e4c58
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Wed Jan 21 13:27:59 2026 +0000
Merge pull request #17797 from prometheus/cut-3.5.1
LTS: Bump to version 3.5.1
commit ce47e4c58ada7722534f7407cf3481cc7e870fde
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Tue Jan 6 16:49:05 2026 +0000
Bump to version 3.5.1
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit d1916a6819d9128d8e16e761bad54c68c8714411
Merge: 8be3a9560 468bcc7ed
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Tue Jan 20 11:48:57 2026 +0000
Merge pull request #17821 from garyclee/bump-docker
LTS: Bump docker from 28.2.2 to 28.5.2
commit 468bcc7edd38ae2f4b99b5c30eb8055a6bc9b5c9
Author: Gary Lee <gary.lee.ext@ericsson.com>
Date: Fri Jan 9 09:10:49 2026 +1100
Bump docker from 28.2.2 to 28.5.2
Signed-off-by: Gary Lee <gary.lee.ext@ericsson.com>
commit 8be3a9560fbdd18a94dedec4b747c35178177202
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jul 14 12:38:42 2025 +0100
Prepare release 3.5.0
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit eea203702ce26d89495b969db2498e582a7695fa
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Wed Jul 9 12:07:27 2025 +0100
Prepare release 3.5.0-rc.1 (#16845)
This RC reverts the feature "OTLP: Support promoting OTel scope attributes".
Add the line back into the CHANGELOG for 3.5.0-rc.0, since we are not changing that version.
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit 4b9d0fb92ff3a6e8e5ceaa28ebed1eeda8e39b1a
Author: Arthur Silva Sens <arthursens2005@gmail.com>
Date: Tue Jul 8 07:37:19 2025 -0300
Revert: OTLP Support including scope metadata as metric labels (#16842)
Reverts #16730 and #16760
This is being done because we've noticed a problem in the spec that could
lead to name collisions if attributes name, version or schema_url are added
to the scope. They would collide with the already reserved labels
otel_scope_name, otel_scope_version and otel_scope_schema_url.
Since this new configuration option never made it into a release, we can
safely remove it from the 3.5 release. We'll sort this out for the 3.6 release
Signed-off-by: Arthur Silva Sens <arthursens2005@gmail.com>
commit 31f0c7007e7187b706da03e05aeeb303101164f8
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jun 30 14:19:45 2025 +0100
Prepare release 3.5.0-rc.0 (#16778)
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
Co-authored-by: Julius Volz <julius.volz@gmail.com>
commit 9e73fb43b3dbf3574fbfad3b8d84843e057f47f8
Merge: 748fe6d82 ce809e625
Author: Björn Rabenstein <beorn@grafana.com>
Date: Fri Jun 27 14:57:12 2025 +0200
Merge pull request #16773 from prometheus/beorn7/promql
promql: Re-introduce direct mean calculation
commit ce809e625f8ba5768fa0928cb82cd5d5c3eb0627
Author: beorn7 <beorn@grafana.com>
Date: Tue Jun 24 15:52:35 2025 +0200
promql: Re-introduce direct mean calculation for better accuracy
This commit brings back direct mean calculation (for `avg` and
`avg_over_time`) but isn't an outright revert of #16569. It keeps the
improved incremental mean calculation and features generally a bit
cleaner code than before.
Also, this commit...
- ...updates the lengthy comment explaining the whole situation and
trade-offs.
- ...divides the running sum and the Kahan compensation term
separately (in direct mean calculation) to avoid the (unlikely)
possibility that sum and Kahan compensation together ovorflow
float64.
- ...uncomments the tests that should now work again on darwin/arm64.
- ...uncomments the test that should now reliably yield the
(inaccurate) value 0 on all hardware platforms. Also, the test
description has been updated accordingly.
- ...adds avg_over_time tests for zero and one sample in the range.
Signed-off-by: beorn7 <beorn@grafana.com>
commit f71daa797786b8a98a82c98f86f71bb709e5c609
Author: beorn7 <beorn@grafana.com>
Date: Tue Jun 24 14:35:58 2025 +0200
promql: Remove falsified comment from test
The test in question actually worked fine even before #16569. The
finding reported in the comment has turned out to be caused by
something else.
Signed-off-by: beorn7 <beorn@grafana.com>
commit 2b3fc1f115e7c09eb182ced42f8ec6d826b676ee
Author: beorn7 <beorn@grafana.com>
Date: Tue Jun 24 12:41:30 2025 +0200
promql: Add test cases for direct mean calculation
These demonstrate that direct mean calculation has some merits after
all.
Signed-off-by: beorn7 <beorn@grafana.com>
commit 748fe6d825b3450e41265be8d6698fd9b829a287
Author: Łukasz Mierzwa <l.mierzwa@gmail.com>
Date: Fri Jun 27 12:34:07 2025 +0100
Limit concurrency of scrape pool reloads (#16783)
To avoid possible overload.
As per https://github.com/prometheus/prometheus/pull/16595#issuecomment-3005027067 this changes scrape pool manager to limit the number of scrape pools that can reload at the same time.
Signed-off-by: Lukasz Mierzwa <l.mierzwa@gmail.com>
commit df4f1df43fe0899e3c5a0d12349af8e27be41c56
Merge: 9c791faad 5a1deb84c
Author: Jan-Otto Kröpke <mail@jkroepke.de>
Date: Fri Jun 27 05:28:42 2025 +0200
Merge pull request #16787 from jkroepke/release-3.4-main
commit 5a1deb84cced399a7c27dcf6ccc82226d7751d58
Merge: 9c791faad b392caf25
Author: Jan-Otto Kröpke <mail@jkroepke.de>
Date: Thu Jun 26 22:54:24 2025 +0200
Merge branch 'release-3.4' into release-3.4-main
# Conflicts:
# CHANGELOG.md
commit b392caf256d7ed36980992496c8a6274e5557d36
Author: Jan-Otto Kröpke <mail@jkroepke.de>
Date: Thu Jun 26 22:48:39 2025 +0200
Prepare release 3.4.2
Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
commit 9c791faade4e05a232721b4c79e9cff4b5d17c86
Author: Arve Knudsen <arve.knudsen@gmail.com>
Date: Wed Jun 25 18:18:45 2025 +0200
OTLP receiver: Don't append _total suffix to non-monotonic OTel sums (#16776)
* OTLP receiver: Don't append _total suffix to non-monotonic OTel sums
Fix the OTLP receiver so the suffix _total isn't appended to metrics
converted from non-monotonic OTel sum metrics, if otlp.translation_strategy is
UnderscoreEscapingWithSuffixes or NoUTF8EscapingWithSuffixes.
Also add translation tests.
---------
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
commit aa1d46a9da0f9710ca1528bef7623f1b4fb93f53
Author: Owen Williams <owen.williams@grafana.com>
Date: Wed Jun 25 11:14:13 2025 -0400
scrape: set validation and escaping defaults in default config vars (#16751)
Fixes https://github.com/prometheus/prometheus/issues/16750
Signed-off-by: Owen Williams <owen.williams@grafana.com>
commit 5b7ff92d95a16ebbf23764982167e8b02be8a28a
Author: George Krajcsovits <krajorama@users.noreply.github.com>
Date: Wed Jun 25 13:37:43 2025 +0200
fix(promql): histogram_quantile and histogram_fraction NaN observed in native histogram (#16724)
* fix(promql): histogram_quantile NaN observed in native histogram
Fixes: #16578
See the issue for detailed explanation.
When a histogram had only NaN observations and no normal observations,
we returned 0 from the quantile, which is completely wrong. If there were
normal observations but we went over them, we returned the upper bound of
the existing buckets, however that contradicts expectations on
histogram_fraction. Now we return NaN if the quantile is calculated to be
over all normal observations, falling into NaNs (in a virtual +Inf bucket).
We also return info level annotations if we see any NaN observations.
The annotation calls out if we returned NaN or even if we took the
virtual +Inf bucket into account.
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
* fix(promql): histogram_fraction NaN observed in native histogram
Fixes: #16580
According to the specification we should not take NaN observations
into account when calculating the fraction. This commit fixes that
and adds an info level annotation to let the user know about this.
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
commit 31e158b7495a2bb7dbd0d380f502510c263082ec
Author: Rishi Jat <rishijat098@gmail.com>
Date: Wed Jun 25 01:22:55 2025 +0530
Add documentation for custom_values usage in NHCB (#16757)
Signed-off-by: rishi-jat <rishijat098@gmail.com>
Signed-off-by: Rishi Jat <rishijat098@gmail.com>
Co-authored-by: George Krajcsovits <krajorama@users.noreply.github.com>
commit bdada2330cffd67957173cc14193bf8a847cf0ed
Merge: 7289d4194 d6f9ba631
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Tue Jun 24 12:20:06 2025 +0100
Merge pull request #16765 from bboreham/update-go-deps
Release 3.5 preparation: Update go dependencies
commit 7289d41940bb05a4a79c0a4debcc86d06725562e
Author: Carrie Edwards <edwrdscarrie@gmail.com>
Date: Mon Jun 23 08:42:38 2025 -0700
Add tests for relabeling of type and unit labels (#16743)
Signed-off-by: Carrie Edwards <edwrdscarrie@gmail.com>
commit d6f9ba6310cc87bd94e5a7d1ce03fcb473787121
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jun 23 16:15:58 2025 +0100
[BUILD] Docker SD: Fix up deprecated types
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit 95d47c051235b7b4ce5dba35543a5851429d9a9d
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jun 23 15:04:41 2025 +0100
[TESTS] Rules: remove brittle TestNewGroup
It broke on different implementation of 'NewNopLogger'.
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit b2e0d3f16c70b4e6d0e29a6c05da792238d9b7bf
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jun 23 15:31:42 2025 +0100
[BUILD] Wind back dependencies which require Go 1.24
We need Prometheus to build with the last 2 versions of Go.
Remove Go toolchain line - it is redundant with the `go`` line above,
and could mislead readers.
Also don't update `fsnotify` which is pinned to an older version.
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit 3253ba63107ee5db50f98d3dc418f25a829d1a7b
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jun 23 14:27:37 2025 +0100
[BUILD] Wind back otlptranslator update which has breaking change
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit b0b3676f351e9ab5875b24aaf4a582eaa22b7615
Author: Bryan Boreham <bjboreham@gmail.com>
Date: Mon Jun 23 14:19:40 2025 +0100
[BUILD] Ran make update-go-deps
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
commit 8ed37d3c0939767e3071c549e1a58cefaf142228
Merge: d66838260 59bf3d442
Author: Björn Rabenstein <beorn@grafana.com>
Date: Mon Jun 23 00:56:08 2025 +0200
Merge pull request #16744 from harry671003/fix_last_over_time
PromQL: Fix native histogram last_over_time
commit d6683826080b96bc0d4c9592dba24e23f2e76be7
Merge: c70163603 7f2946ccd
Author: Julius Volz <julius.volz@gmail.com>
Date: Sat Jun 21 09:49:07 2025 +0200
Merge pull request #16759 from roidelapluie/add-info-warning-graph
mantine-ui: add query info warnings display to graph view
commit c70163603458822ee68ac2bf8f66899dad57c359
Author: Arve Knudsen <arve.knudsen@gmail.com>
Date: Fri Jun 20 15:09:02 2025 +0200
OTLP receiver: Rename `otlp.convert_scope_metadata` to `otlp.promote_scope_metadata` (#16760)
* Rename otlp.convert_scope_metadata to otlp.promote_scope_metadata
---------
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
Co-authored-by: Julius Hinze <juliusmh@proton.me>
commit 8f75da3fd675dbde9a1caca82dc6643ae1d729d4
Merge: 76a97ca27 71217a6e4
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Fri Jun 20 13:53:59 2025 +0200
Merge pull request #16754 from simonpasquier/fix-promql-panic
fix: prevent invalid array access in aggregate expression
commit 7f2946ccdd8dfd15c457ae452235d32d4bb3b749
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Fri Jun 20 13:47:15 2025 +0200
mantine-ui: add query info warnings display to graph view
Followup of https://github.com/prometheus/prometheus/pull/16753
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 71217a6e43514c7c1b227128f9650df2c9a8e0fd
Author: Simon Pasquier <spasquie@redhat.com>
Date: Thu Jun 19 15:10:49 2025 +0200
fix: prevent invalid array access in aggregate expression
This commit fixes the evaluation of invalid expressions like
`sum(rate(`. Before that, it would trigger a panic in the PromQL engine
because it tried to access an index which is out of range.
The bug was probably introduced by 06d0b063ea.
Signed-off-by: Simon Pasquier <spasquie@redhat.com>
commit 76a97ca273a786ec524538c39d032e1f1a75e2fa
Merge: 69906bb4f 8dcb0ba24
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Thu Jun 19 14:05:35 2025 +0200
Merge pull request #16753 from roidelapluie/add-warning-graph
mantine-ui: add query warnings display to graph view
commit 8dcb0ba24acf4e094ce7dc5212f05607e865c4e6
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Thu Jun 19 11:57:32 2025 +0200
mantine-ui: add query warnings display to graph view
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 69906bb4f5f9e62255bced373c56fc13a3f61093
Author: Kapil Lamba <kapillamba4@gmail.com>
Date: Thu Jun 19 03:27:39 2025 +0530
Add script for converting PromQL tests to new syntax format (#16562)
Signed-off-by: Kapil Lamba <kapillamba4@gmail.com>
Co-authored-by: Neeraj Gartia <80708727+NeerajGartia21@users.noreply.github.com>
commit 8d9dfa075d2c0b6de22d8cb7288b0161802f9061
Author: Charles Korn <charleskorn@users.noreply.github.com>
Date: Thu Jun 19 07:53:46 2025 +1000
promql: reuse `histogramStatsIterator` where possible, and expose it for other implementations to use (#16686)
* Expose type
* Add `Reset` method
---------
Signed-off-by: Charles Korn <charles.korn@grafana.com>
commit 32b471ed472ef25e56a55d71a6fc9f2795371185
Merge: f69c83f5f 70eb58219
Author: Björn Rabenstein <beorn@grafana.com>
Date: Wed Jun 18 20:11:23 2025 +0200
Merge pull request #16417 from amanycodes/histogram-helper-test
ui-tests: Add Unit tests to Native histogram and its helpers.
commit f69c83f5f1dce5f0b2f90172d5f6f9e2bda91fec
Merge: 964bd7d1a 91eab63d3
Author: Björn Rabenstein <beorn@grafana.com>
Date: Wed Jun 18 13:02:55 2025 +0200
Merge pull request #16702 from bboreham/simpler-detect
[Refactor] PromQL: Simplify detectHistogramStatsDecoding
commit 964bd7d1a9f8df51f15707273b6cc2775729e96c
Author: Arve Knudsen <arve.knudsen@gmail.com>
Date: Wed Jun 18 09:13:51 2025 +0200
OTLP: Support including scope metadata as metric labels (#16730)
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
commit 59bf3d442bb019f4da384468ebaebbca1825943e
Author: 🌲 Harry 🌊 John 🏔 <johrry@amazon.com>
Date: Tue Jun 17 10:47:48 2025 -0700
PromQL: Fix native histogram last_over_time with offset
Signed-off-by: 🌲 Harry 🌊 John 🏔 <johrry@amazon.com>
commit cfa922e67734594a6438e6b3cb063a66196ba71e
Merge: ceaa3bd6f 9b894ee4f
Author: Matthias Loibl <mail@matthiasloibl.com>
Date: Tue Jun 17 16:38:33 2025 +0200
Merge pull request #16739 from datamuc/patch-1
prometheus-mixin: Fix unit for Scrape failures
commit 9b894ee4f6b1ae5af35c77cbc40a09b47ed116d9
Author: datamuc <m@rbfh.de>
Date: Tue Jun 17 16:21:20 2025 +0200
Fix unit for Scrape failures
Signed-off-by: datamuc <m@rbfh.de>
commit ceaa3bd6f94f8c0e4c036286ce70d976ad58ac69
Author: Jan-Otto Kröpke <mail@jkroepke.de>
Date: Tue Jun 17 15:41:14 2025 +0200
discovery: add STACKIT SD (#16401)
commit 5a1cce4fbb55458841e0cf33de1f6ea7dc9a2436
Author: Owen Williams <owen.williams@grafana.com>
Date: Tue Jun 17 08:24:30 2025 -0400
config: fix typo in comments (#16734)
Signed-off-by: Owen Williams <owen.williams@grafana.com>
commit e81132f1628528d54f43481c4764bd907d4c99c6
Merge: 998840c49 ec98e7f06
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Tue Jun 17 09:18:31 2025 +0200
Merge pull request #16733 from MichaHoffmann/mhoffmann/fix-ts-of-last-over-time-histograms
promql: fix ts_of_last_over_time for histogram vectors
commit ec98e7f069ffcdba758f1115635f55a6d51fccfa
Author: Michael Hoffmann <mhoffmann@cloudflare.com>
Date: Mon Jun 16 13:01:15 2025 +0000
promql: fix ts_of_last_over_time for histogram vectors
This PR fixes a bug in ts_of_last_over_time where the float samples
where used when computing the last timestamp of the histogram samples.
Signed-off-by: Michael Hoffmann <mhoffmann@cloudflare.com>
commit 998840c496071b5db81c09026c4715d0b8f9b24b
Merge: 4aee71801 db1568163
Author: Julien <291750+roidelapluie@users.noreply.github.com>
Date: Mon Jun 16 11:13:34 2025 +0200
Merge pull request #16713 from roidelapluie/fix-pow-dur-expr
promql: Fix unary operator precedence in duration expressions
commit db15681633f302bf076ed9d7b191652ae5dcfe27
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Mon Jun 16 10:53:36 2025 +0200
Update duration expression docs
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 6d56e77e0e42c80715fe658025be65d9177f0ea1
Author: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Tue Jun 10 16:43:27 2025 +0200
promql: Fix unary operator precedence in duration expressions
Split unary operator handling in duration expressions into two specific
cases to fix precedence conflicts:
- Handle unary operators with number literals directly
- Handle unary operators with parenthesized expressions separately
This prevents unary minus from incorrectly binding to subsequent
operators in expressions like `foo offset -1^1`, ensuring it parses
as `(foo offset -1) ^ 1` rather than `foo offset (-1^1)`.
Fixes #16711
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
commit 4aee718013c52bef1ccb336bcc21886336e6252e
Merge: 4eeeb6ee8 a5fa9431d
Author: Björn Rabenstein <beorn@grafana.com>
Date: Thu Jun 12 19:40:18 2025 +0200
Merge pull request #16722 from MichaHoffmann/mhoffmann/add-tmin-tmax-tlast-over-time-functions
promql: add ts_of_(min|max|last)_over_time
commit a5fa9431d8dd7b692329806131d4170ef6f28899
Author: Michael Hoffmann <mhoffmann@cloudflare.com>
Date: Thu Jun 12 10:49:39 2025 +0000
promql: add ts_of_(max,min,last)_over_time functions
This commit adds the ts_of_(max,min,last)_over_time functions behind the experimental feature flag.
Signed-off-by: Michael Hoffmann <mhoffmann@cloudflare.com>
commit 4eeeb6ee88e69d79884127775598467f922c7e2a
Author: Julius Volz <julius.volz@gmail.com>
Date: Thu Jun 12 16:16:41 2025 +0200
Fetch and display full query stats in hover tooltip in table query tab (#16723)
Fixes https://github.com/prometheus/prometheus/issues/5857
Signed-off-by: Julius Volz <julius.volz@gmail.com>
commit c9d638fd8f26e9a36e1a861a8a173e9c5ec70f09
Merge: f8508ccaf 85d63ba86
Author: George Krajcsovits <krajorama@users.noreply.github.com>
Date: Thu Jun 12 15:52:35 2025 +0200
Merge pull request #16720 from krajorama/krajo/fix-nhcb-after-exponential
fix(nhcb): not converting to NHCB after exponential native histogram encountered
commit f8508ccafa9dffda67d0a6a248adc3c6adbe47c1
Author: Aman <95525722+amanycodes@users.noreply.github.com>
Date: Thu Jun 12 13:53:04 2025 +0530
mantine-ui: fix /alerts accordian theme colors (#16043)
* fix-alerts-accordion-theme
Signed-off-by: amanycodes <amanycodes@gmail.com>
* fixes
Signed-off-by: amanycodes <amanycodes@gmail.com>
* added changes to /rules page
Signed-off-by: amanycodes <amanycodes@gmail.com>
* more fixes
Signed-off-by: amanycodes <amanycodes@gmail.com>
---------
Signed-off-by: amanycodes <amanycodes@gmail.com>
Signed-off-by: Aman <95525722+amanycodes@users.noreply.github.com>
commit 472f0de66108d5c3512a6e0c396044dff5ed3d67
Author: AxcelXander <72107018+AxcelXander@users.noreply.github.com>
Date: Wed Jun 11 13:06:45 2025 -0700
Enhance TestDropOldTimeSeries to test both v1 and v2 protocols (#16709)
- Wrapped existing test logic in a loop to run with both protocol versions
- Ensures consistent behavior across protocol versions for dropping old time series
Signed-off-by: AxcelXander <tyz666@bu.edu>
Co-authored-by: AxcelXander <tyz666@bu.edu>
commit 85d63ba86149d2f6068a64b84082a57a2d2078d1
Author: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
Date: Wed Jun 11 20:06:38 2025 +0200
refactor(nhcb): get rid of extra lastHistogramExponential state
and make it a regular state of inhibiting NHCB conversion.
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
commit 3844a2173807b6f8e9a7e5d71964b17f0adf5485
Author: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
Date: Wed Jun 11 19:48:56 2025 +0200
fix(nhcb): do not loose NHCB after exponential with different labels
The problem happens when we parse a standalone native histogram, which
sets the p.lastHistogramExponential state flag. We never unset it.
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
commit 94d5e0f41cc2adf238e596353578d30b0c8dbf53
Author: Innokentii Konstantinov <innokenty.konstantinov@grafana.com>
Date: Wed Jun 11 21:09:57 2025 +0800
engine: fix PossibleNonCounterInfo annotation for rate and increase. (#16718)
* Comment exposed field
Signed-off-by: Innokentii Konstantinov <innokenty.konstantinov@grafana.com>
* Remove invalid test
Signed-off-by: Innokentii Konstantinov <innokenty.konstantinov@grafana.com>
* Fix PossibleNonCounterInfo annotation.
Signed-off-by: Innokentii Konstantinov <innokenty.konstantinov@grafana.com>
* lint
Signed-off-by: Innokentii Konstantinov <innokenty.konstantinov@grafana.com>
---------
Signed-off-by: Innokentii Konstantinov <innokenty.konstantinov@grafana.com>
commit 19848bb4450dd0628429a1d50c2aed65a857386a
Merge: ea75bc18e 68b1bcc64
Author: Björn Rabenstein <beorn@grafana.com>
Date: Wed Jun 11 01:03:32 2025 +0200
Merge pull request #16715 from prometheus/beorn7/promql
promql: Deactivate three failing tests for the time being
There is 1 open security issue in bookworm.
You can find information about how to handle this issue in the security team's documentation.
Among the 22 debian patches available in version 2.53.5+ds1-5 of the package, we noticed the following issues:
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/prometheus.png){kind=link}