Prometheus vs Supabase

Prometheus is running two support lines at once: 3.5.x, which now receives security backports only, and 3.13.x, the Long Term Support release cut on July 1 that has already taken two patch releases. Recent work is dominated by hardening — secrets exposed through the /-/config endpoint in STACKIT and AzureAD paths, snappy decompression limits on remote read and write, and repeated XSS fixes in the UI. Feature work lives in the 3.12 line and earlier: new service-discovery providers, a self-metrics API endpoint, constant-time head-chunk lookup, and experimental PromQL around start timestamps and duration expressions.

The security work has shifted from patching dependencies to changing default behavior — 3.13.0 stops forwarding Authorization headers, basic auth, bearer tokens, OAuth2, and configured headers when a redirect crosses hosts, which touches scraping, remote read and write, alerting, and service discovery alike. That is the project trading silent convenience for a safe default, and it is the kind of change an LTS is deliberately timed around. Alongside it, the experimental PromQL surface keeps churning: duration functions were renamed inside the RC window, and the start-timestamp family is still gated behind flags.

Expect the 3.13 line to keep taking small patch releases while 3.5.x receives security-only backports toward end of life. The experimental PromQL work — start timestamps and duration expressions — is the most likely candidate to either stabilize or get renamed again in the next minor.