CuraDevOps

tag: Prometheus · 3 items

Plan Prometheus 3.14.0: API deprecations and PromQL behavioral changes
2026-08-24 · Releases: prometheus · source ↗ #prometheus#observability#breaking-change
  • Platform/SRE — Plan: Three behavioral changes affect running Prometheus deployments: the stats query-parameter deprecation (other values still work but will be rejected in the next major), the __meta_hetzner_datacenter label drop for hcloud targets, and PromQL duration expressions now enabled by default. Review your relabeling configs, any Hetzner service-discovery rules, and PromQL queries before upgrading; no hard deadline yet since rejection is deferred to the next major release.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: deprecation/EOL deadline mentioned: 2026-08-17
Plan archived Prometheus 3.13.2: security deps bump and PromQL SIGBUS bugfix
2026-08-03 · Releases: prometheus · source ↗ #prometheus#security#bugfix
  • Platform/SRE — Plan: Patch includes dependency updates for CVE-2026-56852 and GHSA-hrxh-6v49-42gf (neither KEV-listed nor actively exploited) plus a PromQL SIGBUS crash fix on full disks; schedule an upgrade to 3.13.2 this maintenance cycle.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: CVE-2026-56852 — CISA KEV: not listed, EPSS 0.00
Plan archived Prometheus 3.5.5 patches CVE-2026-53606 in UI sanitize-html dep
2026-07-13 · Releases: prometheus · source ↗ #prometheus#security#observability
  • Platform/SRE — Plan: Prometheus is core observability infrastructure; upgrade to v3.5.5 to patch CVE-2026-53606 in the UI’s sanitize-html dependency. Exploitation risk is low (EPSS 0.00, not KEV-listed), so this is routine patching rather than an emergency.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: CVE-2026-53606 — CISA KEV: not listed, EPSS 0.00