发布日期: 2026-07-09
版本号: v3.13.0-rc.0

本次更新包含多项重要变更和改进：安全方面修复了 sanitize-html 的跨站脚本漏洞；API 改用 SHA-256 生成规则组分页令牌；HTTP 客户端在重定向到不同主机时不再转发凭据，影响抓取、远程读写等组件；PromQL 重命名了 min() 和 max() 函数以避免混淆。新增特性包括实验性搜索端点、AWS RDS 实例过滤、PromQL 的 min_of()/max_of() 函数及原生直方图平滑速率支持，同时改进了查询统计指标和抓取配置灵活性。性能上优化了标签匹配和 TSDB 查询效率。此外，修复了包括 PromQL 查询逻辑、TSDB 数据存储、promtool 工具以及 UI 自动补全等在内的多项错误，提升了整体稳定性。

更新内容 （中文）

  • [安全] UI: 升级 sanitize-html 以修复跨站脚本漏洞（CVE-2026-44990）。#18697
  • [变更] API: 规则组分页令牌改用 SHA-256 算法替代 SHA-1 生成。#18927
  • [变更] HTTP客户端: 当跟随重定向至不同主机时，不再转发凭证（Authorization头、基本认证、bearer令牌、OAuth2、已配置的请求头）；此变更影响抓取、远程读写、告警和服务发现功能。通过 prometheus/common v0.69.0 实现（CVE-2025-4673 CVE-2023-45289）。#18949
  • [变更] promtool: 传递给 --http.config.file 的配置文件中的相对路径，现在将相对于该配置文件所在目录解析，而非其父目录。通过 prometheus/common v0.69.0 实现。#18949
  • [变更] PromQL: 重命名 min() 和 max() 持续时间表达式函数（实验性功能标志 experimental-duration-expr）为 min_of() 和 max_of()，以避免与 min 和 max 聚合操作符混淆。#18687
  • [特性] API: 新增实验性搜索端点，用于搜索指标名称、标签名称和标签值。#18573
  • [特性] Discovery/AWS: 新增过滤 RDS 实例的功能。#18859
  • [特性] PromQL: 新增 min_of(a, b) 和 max_of(a, b) 标量实验函数，返回两个标量值中的较小或较大者。#18687
  • [特性] PromQL: 支持原生直方图的平滑/锚定速率计算。#18564
  • [特性] PromQL: 在查询统计响应中暴露每次查询的 samplesRead（当使用 stats=all 和 promql-per-step-stats 功能标志时还包括 samplesReadPerStep），并新增引擎计数器 prometheus_engine_query_samples_read_total。samplesRead 反映与 totalQueryableSamples 不同的存储 I/O，后者统计加载到评估器中的样本数（因此当样本在多个区间向量窗口中重用时会过度计数）。#18081
  • [特性] Scrape: 新增内部标签 __convert_classic_histograms_to_nhcb__，允许通过重写标签（relabeling）按目标覆盖 convert_classic_histograms_to_nhcb 抓取配置。#18840
  • [特性] TSDB: 新增配置字段 storage.tsdb.chunk_encoding.floats，可在运行时独立于 --enable-feature=xor2-encoding 标志选择浮点数分块编码格式（xor 或 xor2）。#18769
  • [特性] remote_write: 新增对 Azure Monitor 工作区数据注入的证书支持。#18217
  • [特性] Scrape: 新增内部标签 __always_scrape_classic_histograms__ 和 __scrape_native_histograms__，允许通过重写标签按目标覆盖 always_scrape_classic_histograms 和 scrape_native_histograms 抓取配置。#18929
  • [增强] 发布: 容器镜像现同步发布至 GitHub Container Registry (ghcr.io)。#18791
  • [增强] PromQL: 当左右填充值相等时，将 fill_left(x) fill_right(x) 美化为 fill(x)。#18851
  • [增强] UI: 改进函数括号关闭后的自动补全体验。#18894
  • [性能] 标签: 新增大小写不敏感的前缀匹配，加速长正则表达式（大小写不敏感模式）的评估（最高提升约2倍速度）。#18540
  • [性能] TSDB: 降低分块填充过程中的每样本开销，基准测试中相关查询速度提升约12-15%。#18699
  • [性能] TSDB: 消除V2直方图WAL解码器中不必要的堆分配，对启用创建时间戳存储（--enable-feature=created-timestamp-zero-ingestion）且使用原生直方图的部署，分配量减少最高50%，内存占用降低最高10%。#18813
  • [缺陷修复] Discovery/AWS: 修复处理无实例的 AWS RDS 集群时的失败问题。#18845
  • [缺陷修复] 修复 initTime 中的竞态条件，该问题可能导致 ErrOutOfBounds 错误。#18629
  • [缺陷修复] PromQL: 区间查询的 end 时间未与 step 对齐时，其内部子查询会评估到父查询最后一个实际步骤之后，导致查询统计中的 peakSamples 虚增、触及 query.max-samples 限制，并浪费存储 I/O 读取结果中从未使用的样本。#18081
  • [缺陷修复] PromQL: 包含对带有 @ 修饰符的区间向量执行的 at 修饰符不安全函数（如 predict_linear(metric[60s] @ T, X)）的区间查询，在步骤0之后会静默低估 totalQueryableSamples。#18081
  • [缺陷修复] PromQL: 修复在使用 group_left/group_right 时，fill_left/fill_right 在区间查询中产生缺失样本的问题。#18850
  • [缺陷修复] PromQL: 修复锚定区间扩展器中针对直方图的 resets() 和 changes() 函数问题。#18906
  • [缺陷修复] PromQL: 修复启用扩展区间选择器时，表达式 1[5m] smoothed 及类似表达式导致的 panic 问题。#18764
  • [缺陷修复] PromQL: 修复当平滑即时向量选择器对某序列未产生样本时导致的 panic。#18943
  • [缺陷修复] PromQL: 修复将括号括起的纯数字作为偏移量使用时（如 foo offset -(5)）导致的 panic。#18768
  • [缺陷修复] promtool: 修复解析包含空花括号 {} 的 exposition 文本时的 panic 问题。通过 prometheus/common v0.69.0 实现。#18949
  • [缺陷修复] Promtool: 修复当 --url 以尾部斜杠结尾时，check healthy 和 check ready 命令的问题。#18854
  • [缺陷修复] 规则: 每次规则评估后关闭 PromQL 查询以确保资源释放。#18733
  • [缺陷修复] Scaleway SD: 解析无传统 private_ip 或 public_ip 字段但附加了私有网卡的 VPC/IPAM 专用实例。#18772
  • [缺陷修复] TSDB: 当整数直方图追加被拒绝（如乱序）时，不再泄漏头部序列。#18838
  • [缺陷修复] UI: 对 PromQL 自动补全提供的标签值进行转义处理。#18658
  • [缺陷修复] TSDB: 修复 EncXOR2 分块的分块快照编码，防止在存在 EncXOR2 编码序列时 TSDB 重启导致数据损坏。#18739
  • [缺陷修复] TSDB: 通过 CompactStaleHead/CompactSelectedSeries 驱逐序列时，在 walExpiries 中存储毫秒时间戳（而非 WAL 段号），确保序列标签记录在下次 WAL 检查点中正确保留并能干净重放。#18847
  • [缺陷修复] TSDB: 防止 CompactSelectedSeries（和 CompactStaleHead）驱逐序列时在分块范围边界丢失样本——按分片合并循环现在会多运行一次迭代，以便在移除内存副本之前将边界时间戳捕获到块中。#18849

更新内容 （原始）

  • [SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697
  • [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927
  • [CHANGE] HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host; affects scraping, remote read/write, alerting, and service discovery. Via prometheus/common v0.69.0 (CVE-2025-4673 CVE-2023-45289). #18949
  • [CHANGE] promtool: Relative file paths in the file passed to --http.config.file are now resolved relative to that config file’s directory instead of its parent directory. Via prometheus/common v0.69.0. #18949
  • [CHANGE] PromQL: Rename the min() and max() duration-expression functions (experimental feature flag experimental-duration-expr) to min_of() and max_of() to avoid confusion with the min and max aggregate operators. #18687
  • [FEATURE] API: Add experimental search endpoints to search metric names, label names, and label values. #18573
  • [FEATURE] Discovery/AWS: Add ability to filter RDS instances. #18859
  • [FEATURE] PromQL: Add min_of(a, b) and max_of(a, b) scalar experimental functions, returning the smaller or larger of two scalar values. #18687
  • [FEATURE] PromQL: Add support for smoothed/anchored rate with native histograms. #18564
  • [FEATURE] PromQL: Expose per-query samplesRead (and samplesReadPerStep with stats=all and the promql-per-step-stats feature flag) in the query stats response, and add the prometheus_engine_query_samples_read_total engine counter. samplesRead reflects storage I/O distinct from totalQueryableSamples, which counts samples loaded into the evaluator (and so over-counts when a sample is reused across multiple range-vector windows). #18081
  • [FEATURE] Scrape: Add __convert_classic_histograms_to_nhcb__ internal label to allow per-target override of convert_classic_histograms_to_nhcb scrape configuration via relabeling. #18840
  • [FEATURE] TSDB: Add storage.tsdb.chunk_encoding.floats configuration field to select float chunk encoding (xor or xor2) at runtime, independently of the --enable-feature=xor2-encoding flag. #18769
  • [FEATURE] remote_write: Add Certificate support for ingesting data into an Azure Monitor Workspace. #18217
  • [FEATURE] Scrape: Add __always_scrape_classic_histograms__ and __scrape_native_histograms__ internal labels to allow per-target override of the always_scrape_classic_histograms and scrape_native_histograms scrape configuration via relabeling. #18929
  • [ENHANCEMENT] Release: Container images are now also published to the GitHub Container Registry (ghcr.io). #18791
  • [ENHANCEMENT] PromQL: Prettify fill_left(x) fill_right(x) as fill(x) when both fill values are equal. #18851
  • [ENHANCEMENT] UI: Improve autocompletion after closing a function bracket. #18894
  • [PERF] Labels: Add case-insensitive prefix matching to speed up evaluation of long case-insensitive regular expressions (up to ~2x faster). #18540
  • [PERF] TSDB: Reduce per-sample overhead in chunk population, speeding up affected queries by ~12-15% in benchmarks. #18699
  • [PERF] TSDB: Eliminate unnecessary heap allocations in the V2 histogram WAL decoder, reducing allocations by up to 50% and memory by up to 10% for deployments using native histograms with created-timestamp storage enabled (--enable-feature=created-timestamp-zero-ingestion). #18813
  • [BUGFIX] Discovery/AWS: Fix failure when processing an AWS RDS cluster without instances. #18845
  • [BUGFIX] Fix race condition in initTime that could cause ErrOutOfBounds. #18629
  • [BUGFIX] PromQL: A range query whose end was not aligned to step caused subqueries inside it to evaluate past the parent’s last actual step, inflating peakSamples in the query stats and against the query.max-samples limit, and wasting storage I/O reading samples that were never used in the result. #18081
  • [BUGFIX] PromQL: A range query containing an at-modifier-unsafe function over a range-vector with an @ modifier (e.g. predict_linear(metric[60s] @ T, X)) silently under-counted totalQueryableSamples for steps after step 0. #18081
  • [BUGFIX] PromQL: Fix fill_left/fill_right producing missing samples in range queries when using group_left/group_right. #18850
  • [BUGFIX] PromQL: Fix for resets() and changes() in anchored range extenders with histograms. #18906
  • [BUGFIX] PromQL: Fix panic on 1[5m] smoothed and similar expressions when extended range selectors are enabled. #18764
  • [BUGFIX] PromQL: Fix panic when a smoothed instant vector selector produces no samples for a series. #18943
  • [BUGFIX] PromQL: Fix panic when using a parenthesised plain number as an offset (e.g. foo offset -(5)). #18768
  • [BUGFIX] promtool: Fix panic when parsing exposition text containing empty braces {}. Via prometheus/common v0.69.0. #18949
  • [BUGFIX] Promtool: Fix check healthy and check ready when --url ends with a trailing slash. #18854
  • [BUGFIX] Rules: Close PromQL query after each rule evaluation to ensure resources are released. #18733
  • [BUGFIX] Scaleway SD: Resolve VPC/IPAM-only instances that have no legacy private_ip or public_ip field, but do have private NICs attached. #18772
  • [BUGFIX] TSDB: Do not leak head series when an integer histogram append is rejected (e.g. out-of-order). #18838
  • [BUGFIX] UI: Escape label values offered by PromQL autocomplete. #18658
  • [BUGFIX] TSDB: Fix chunk snapshot encoding for EncXOR2 chunks, preventing corruption on TSDB restart when EncXOR2-encoded series were present. #18739
  • [BUGFIX] TSDB: Store a millisecond timestamp (not a WAL segment number) in walExpiries when a series is evicted via CompactStaleHead/CompactSelectedSeries, so the series’s label record is correctly retained in the next WAL checkpoint and replays cleanly. #18847
  • [BUGFIX] TSDB: Prevent loss of samples at the chunk-range boundary when CompactSelectedSeries (and CompactStaleHead) evict the series — the per-slice compaction loop now runs one more iteration so the boundary timestamp is captured in a block before the in-memory copy is removed. #18849

下载链接