●Change8

v3.13.0-rc.0

Breaking Changes
📦 prometheusView on GitHub →
⚠ 2 breaking✨ 12 features🐛 19 fixes🔧 10 symbols

Summary

This release introduces new experimental PromQL search endpoints and scalar functions, alongside significant performance improvements in TSDB and label matching. It also fixes a critical XSS vulnerability and addresses several PromQL and TSDB stability issues.

⚠️ Breaking Changes

  • HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host. This affects scraping, remote read/write, alerting, and service discovery. If you rely on credentials being forwarded across host redirects, you must update your configuration or ensure redirects stay on the same host.
  • PromQL: The experimental duration-expression functions `min()` and `max()` have been renamed to `min_of()` and `max_of()`. Update any usage of these functions in PromQL queries.

Migration Steps

  1. If you were using the experimental duration-expression functions `min()` or `max()`, rename them to `min_of()` and `max_of()` respectively in your PromQL queries.

✨ New Features

  • API: Added experimental search endpoints to search metric names, label names, and label values.
  • Discovery/AWS: Added ability to filter RDS instances.
  • PromQL: Added scalar experimental functions `min_of(a, b)` and `max_of(a, b)` to return the smaller or larger of two scalar values.
  • PromQL: Added support for smoothed/anchored rate with native histograms.
  • PromQL: Exposed per-query `samplesRead` (and `samplesReadPerStep` with `stats=all` and the `promql-per-step-stats` feature flag) in the query stats response, and added the `prometheus_engine_query_samples_read_total` engine counter.
  • Scrape: Added internal label `__convert_classic_histograms_to_nhcb__` to allow per-target override of `convert_classic_histograms_to_nhcb` scrape configuration via relabeling.
  • TSDB: Added `storage.tsdb.chunk_encoding.floats` configuration field to select float chunk encoding (`xor` or `xor2`) at runtime, independently of the `--enable-feature=xor2-encoding` flag.
  • remote_write: Added Certificate support for ingesting data into an Azure Monitor Workspace.
  • Scrape: Added internal labels `__always_scrape_classic_histograms__` and `__scrape_native_histograms__` to allow per-target override of corresponding scrape configuration via relabeling.
  • Enhancement: Container images are now also published to the GitHub Container Registry (ghcr.io).
  • PromQL Enhancement: Prettify `fill_left(x) fill_right(x)` as `fill(x)` when both fill values are equal.
  • UI Enhancement: Improved autocompletion after closing a function bracket.

🐛 Bug Fixes

  • SECURITY: UI: Fixed a cross-site scripting vulnerability by bumping `sanitize-html` (CVE-2026-44990).
  • Discovery/AWS: Fixed failure when processing an AWS RDS cluster without instances.
  • Fixed race condition in initTime that could cause ErrOutOfBounds.
  • PromQL: Fixed range queries whose `end` was not aligned to `step` from evaluating past the parent's last actual step, which inflated stats and wasted I/O.
  • PromQL: Fixed `predict_linear(metric[60s] @ T, X)` and similar expressions silently under-counting `totalQueryableSamples` for steps after step 0.
  • PromQL: Fixed `fill_left`/`fill_right` producing missing samples in range queries when using `group_left`/`group_right`.
  • PromQL: Fixed `resets()` and `changes()` in anchored range extenders with histograms.
  • PromQL: Fixed panic on `1[5m] smoothed` and similar expressions when extended range selectors are enabled.
  • PromQL: Fixed panic when a `smoothed` instant vector selector produces no samples for a series.
  • PromQL: Fixed panic when using a parenthesised plain number as an offset (e.g. `foo offset -(5)`).
  • promtool: Fixed panic when parsing exposition text containing empty braces `{}`.
  • Promtool: Fixed `check healthy` and `check ready` when `--url` ends with a trailing slash.
  • Rules: Closed PromQL query after each rule evaluation to ensure resources are released.
  • Scaleway SD: Resolved VPC/IPAM-only instances that have no legacy `private_ip` or `public_ip` field, but do have private NICs attached.
  • TSDB: Did not leak head series when an integer histogram append was rejected (e.g. out-of-order).
  • UI: Escaped label values offered by PromQL autocomplete.
  • TSDB: Fixed chunk snapshot encoding for EncXOR2 chunks, preventing corruption on TSDB restart when EncXOR2-encoded series were present.
  • TSDB: Stored a millisecond timestamp (not a WAL segment number) in walExpiries when a series was evicted via CompactStaleHead/CompactSelectedSeries, ensuring correct replay.
  • TSDB: Prevented loss of samples at the chunk-range boundary when CompactSelectedSeries (and CompactStaleHead) evict the series.

Affected Symbols

min() (PromQL function)max() (PromQL function)min_of() (PromQL function)max_of() (PromQL function)predict_linear() (PromQL function)fill_left() (PromQL function)fill_right() (PromQL function)resets() (PromQL function)changes() (PromQL function)prometheus_engine_query_samples_read_total (metric)