LoginSign Up
← Back to all sparks
Prometheus logo

Prometheus

DEVOPS
Velocity6.3

Monitoring system

prometheus.io ↗

Prometheus has a new LTS baseline, and it tightened how credentials survive a redirect.

observabilitylts-releasesecurity-hardeningpromqlservice-discoverytsdb
◆Current state
Prometheus is running two support lines at once: 3.5.x, which now receives security backports only, and 3.13.x, the Long Term Support release cut on July 1 that has already taken two patch releases. Recent work is dominated by hardening — secrets exposed through the /-/config endpoint in STACKIT and AzureAD paths, snappy decompression limits on remote read and write, and repeated XSS fixes in the UI. Feature work lives in the 3.12 line and earlier: new service-discovery providers, a self-metrics API endpoint, constant-time head-chunk lookup, and experimental PromQL around start timestamps and duration expressions.
◆Where it's heading
The security work has shifted from patching dependencies to changing default behavior — 3.13.0 stops forwarding Authorization headers, basic auth, bearer tokens, OAuth2, and configured headers when a redirect crosses hosts, which touches scraping, remote read and write, alerting, and service discovery alike. That is the project trading silent convenience for a safe default, and it is the kind of change an LTS is deliberately timed around. Alongside it, the experimental PromQL surface keeps churning: duration functions were renamed inside the RC window, and the start-timestamp family is still gated behind flags.
◆Prediction
Expect the 3.13 line to keep taking small patch releases while 3.5.x receives security-only backports toward end of life. The experimental PromQL work — start timestamps and duration expressions — is the most likely candidate to either stabilize or get renamed again in the next minor.

◆Recent moves

  1. 12d ago

    3.13.2 fixes SIGBUS crashes when the data disk fills

    A patch on the new LTS line pairing two dependency CVE bumps with a real reliability fix: the active query tracker file is now preallocated so a full data disk no longer takes the server down with SIGBUS. Small, but the kind of failure mode that only shows up in production.

    View source ↗
  2. 1mo ago

    3.13.1 corrects wrong range-query results after chunk truncation

    The first patch on 3.13 LTS corrects a TSDB fault where range queries could read samples from the wrong chunk or hit spurious not-found errors after head-chunk truncation. A wrong-answer bug rather than a crash, which matters more on the line operators are being told to standardize on.

    View source ↗
  3. 1mo ago

    3.5.5 rebuilds the old LTS with a patched UI dependency

    A maintenance build on the outgoing 3.5 LTS line carrying a newer Go toolchain and one patched UI dependency. No behavior change — this is the security-only mode the older line has settled into.

    View source ↗
  4. 1mo ago

    3.13.0-rc.0 previews the LTS behavior changes

    The first release candidate for the LTS, and the first place the credential-forwarding change is visible to operators testing upgrades. It also carries the SHA-256 switch for rule-group pagination tokens, a promtool path-resolution change, and a rename of the experimental duration functions.

    View source ↗
  5. 1mo ago

    3.13.0 / 2026-07-01

    ⚡ SPARK

    The new Long Term Support release, and the point where credentials stop crossing a host boundary on redirect. It sets the baseline most deployments will sit on for the next support cycle, and it is a behavior change rather than a patch — which is why it landed in an LTS rather than a routine minor.

    View source ↗
  6. 1mo ago

    3.13.0-rc.1 re-cuts the candidate after a broken build pipeline

    A second release candidate cut because the first was only partially published after the npm-to-pnpm migration broke CI. Almost everything in it is build plumbing; the one user-facing change is where third-party UI licenses are served from.

    View source ↗