●Change8

v3.13.0-rc.1

Breaking Changes
📦 prometheusView on GitHub →
⚠ 2 breaking✨ 11 features🐛 19 fixes⚡ 1 deprecations🔧 14 symbols

Summary

This release candidate focuses heavily on CI/build improvements following migration issues, while introducing several PromQL enhancements, performance optimizations in TSDB, and security fixes. Key user-facing changes include embedding third-party licenses in the binary and renaming experimental duration functions.

⚠️ Breaking Changes

  • HTTP clients no longer forward credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) when following a redirect to a different host. This affects scraping, remote read/write, alerting, and service discovery. Users relying on credentials being forwarded across host redirects must update their configuration or client logic.
  • Relative file paths in the file passed to `promtool --http.config.file` are now resolved relative to that config file's directory instead of its parent directory. Users relying on the old behavior must update their paths.

Migration Steps

  1. If you relied on credentials being forwarded across host redirects for HTTP clients (scraping, remote read/write, alerting, service discovery), update your configuration as credentials are no longer forwarded.
  2. If you used relative file paths with `promtool --http.config.file`, ensure paths are now relative to the config file's directory, not its parent directory.

✨ New Features

  • Third-party npm dependency licenses are now embedded in the Prometheus binary and served at `/assets/third-party-licenses.txt`, replacing the `npm_licenses.tar.bz2` archive.
  • Added experimental search endpoints to search metric names, label names, and label values in the API.
  • Added ability to filter RDS instances in AWS service discovery.
  • Added experimental PromQL scalar functions `min_of(a, b)` and `max_of(a, b)` to return the smaller or larger of two scalar values.
  • Added support for smoothed/anchored rate with native histograms in PromQL.
  • Expose per-query `samplesRead` (and `samplesReadPerStep` with feature flag) in the query stats response, and added the `prometheus_engine_query_samples_read_total` engine counter.
  • Added `__convert_classic_histograms_to_nhcb__` internal label to allow per-target override of `convert_classic_histograms_to_nhcb` scrape configuration via relabeling.
  • Added `storage.tsdb.chunk_encoding.floats` configuration field to select float chunk encoding (`xor` or `xor2`) at runtime.
  • Added Certificate support for ingesting data into an Azure Monitor Workspace via remote_write.
  • Added `__always_scrape_classic_histograms__` and `__scrape_native_histograms__` internal labels to allow per-target override of scrape configuration via relabeling.
  • Container images are now also published to the GitHub Container Registry (ghcr.io).

🐛 Bug Fixes

  • Bumped `sanitize-html` to fix a cross-site scripting vulnerability (CVE-2026-44990) in the UI.
  • Rule evaluation now closes PromQL queries after each evaluation to ensure resources are released.
  • Fixed failure when processing an AWS RDS cluster without instances in service discovery.
  • Fixed race condition in initTime that could cause ErrOutOfBounds.
  • Fixed range queries whose `end` was not aligned to `step` from inflating `peakSamples` and wasting storage I/O.
  • Fixed `predict_linear(metric[60s] @ T, X)` style expressions silently under-counting `totalQueryableSamples` for steps after step 0.
  • Fixed `fill_left`/`fill_right` producing missing samples in range queries when using `group_left`/`group_right`.
  • Fixed `resets()` and `changes()` in anchored range extenders with histograms.
  • Fixed panic on `1[5m] smoothed` and similar expressions when extended range selectors are enabled.
  • Fixed panic when a `smoothed` instant vector selector produces no samples for a series.
  • Fixed panic when using a parenthesised plain number as an offset (e.g. `foo offset -(5)`).
  • Fixed `promtool` panic when parsing exposition text containing empty braces `{}`.
  • Fixed `promtool check healthy` and `check ready` when `--url` ends with a trailing slash.
  • Fixed Scaleway SD resolution for VPC/IPAM-only instances lacking legacy IP fields but having private NICs.
  • TSDB no longer leaks head series when an integer histogram append is rejected (e.g. out-of-order).
  • Fixed UI PromQL autocomplete by escaping label values.
  • Fixed chunk snapshot encoding for EncXOR2 chunks, preventing corruption on TSDB restart.
  • TSDB now stores a millisecond timestamp in `walExpiries` when a series is evicted, ensuring label records are retained correctly.
  • Prevented loss of samples at the chunk-range boundary during series eviction via compaction by running the per-slice compaction loop one more iteration.

Affected Symbols

min()max()min_of()max_of()prometheus_engine_query_samples_read_total__convert_classic_histograms_to_nhcb____always_scrape_classic_histograms____scrape_native_histograms__storage.tsdb.chunk_encoding.floatspredict_linearfill_leftfill_rightresets()changes()

⚡ Deprecations

  • The experimental PromQL duration-expression functions `min()` and `max()` are deprecated in favor of `min_of()` and `max_of()` to avoid confusion with aggregate operators.