发布日期: 2026-06-22
版本号: v3.13.0-rc.1

Prometheus 3.13-rc.1版本的发布说明指出，此前的3.13.0-rc.0发布因从NPM迁移到PNPM及后续CI问题仅部分成功，因此本候选版本主要涉及CI与构建相关改进。面向用户的唯一变更是：第三方npm依赖许可证现已嵌入Prometheus二进制文件，并通过/assets/third-party-licenses.txt提供，取代了以往发行包和容器镜像中的npm_licenses.tar.bz2归档文件。

3.13-rc.0版本（此前未发布）包含多项重要更新：安全方面，升级了sanitize-html以修复跨站脚本漏洞。API变更中，规则组分页令牌改用SHA-256算法，并新增实验性搜索端点。HTTP客户端不再将认证凭证转发至不同主机的重定向请求。PromQL中，实验性的min()和max()持续时间表达函数重命名为min_of()和max_of()以避免混淆，并新增了对应的标量函数。此外还增加了对原生直方图平滑/锚定速率的支持，以及在查询统计中暴露samplesRead指标。

功能增强包括：AWS服务发现支持过滤RDS实例；远程写入支持Azure Monitor工作区证书；Scrape配置新增多个内部标签以实现更灵活的目标级覆盖；TSDB可配置浮点块编码；发布容器镜像同步至GitHub容器仓库。

性能优化方面，标签匹配支持大小写不敏感的前缀匹配，评估速度提升最高约2倍；TSDB优化了块填充和V2直方图WAL解码器，分别加速查询约12-15%并减少内存占用。

此外修复了多个缺陷，涵盖AWS RDS集群处理、查询边界对齐、直方图操作中的空值处理、Panic崩溃问题、资源释放以及TSDB数据一致性等方面。

更新内容 （中文）

3.13-rc.1版本的发布说明：

3.13.0-rc.0版本由于从NPM迁移至PNPM以及随后的CI问题，仅获得部分成功，因此此候选版本中的大部分变更与CI/构建相关。唯一面向用户的变更为：

  • [变更] UI：第三方npm依赖许可证现嵌入Prometheus二进制文件中，并通过/assets/third-party-licenses.txt提供服务，取代了此前发行压缩包和容器镜像中附带的npm_licenses.tar.bz2归档文件。 #18997

3.13-rc.0版本的发布说明（因其在部分状态下未发布，故完整列出）：

  • [安全] UI：升级sanitize-html以修复跨站脚本漏洞（CVE-2026-44990）。 #18697
  • [变更] API：规则组分页令牌生成改用SHA-256替代SHA-1。 #18927
  • [变更] HTTP客户端：重定向至不同主机时不再转发凭证（Authorization头、基本认证、Bearer令牌、OAuth2、已配置的头信息）；影响抓取、远程读写、告警及服务发现。通过prometheus/common v0.69.0更新（CVE-2025-4673 CVE-2023-45289）。 #18949
  • [变更] promtool：传递给--http.config.file的文件中，相对文件路径现在基于该配置文件所在目录解析（而非其父目录）。通过prometheus/common v0.69.0更新。 #18949
  • [变更] PromQL：将实验性功能标志experimental-duration-expr的min()和max()持续时间表达式函数重命名为min_of()和max_of()，以避免与聚合运算符min和max混淆。 #18687
  • [功能] API：新增实验性搜索端点，用于搜索指标名称、标签名称和标签值。 #18573
  • [功能] 发现/AWS：新增RDS实例过滤功能。 #18859
  • [功能] PromQL：新增min_of(a, b)和max_of(a, b)标量实验函数，返回两个标量值中的较小或较大值。 #18687
  • [功能] PromQL：支持原生直方图的平滑/锚定速率。 #18564
  • [功能] PromQL：在查询统计响应中公开每个查询的samplesRead（以及使用stats=all和promql-per-step-stats功能标志时的samplesReadPerStep），并新增prometheus_engine_query_samples_read_total引擎计数器。samplesRead反映与totalQueryableSamples不同的存储I/O（后者计算加载到评估器中的样本数，因此当样本在多个范围向量窗口中重复使用时会导致计数过高）。 #18081
  • [功能] 抓取：新增__convert_classic_histograms_to_nhcb__内部标签，允许通过重写标签按目标覆盖convert_classic_histograms_to_nhcb抓取配置。 #18840
  • [功能] TSDB：新增storage.tsdb.chunk_encoding.floats配置字段，可在运行时选择浮点分块编码（xor或xor2），独立于--enable-feature=xor2-encoding标志。 #18769
  • [功能] remote_write：新增证书支持，用于向Azure Monitor工作区摄入数据。 #18217
  • [功能] 抓取：新增__always_scrape_classic_histograms__和__scrape_native_histograms__内部标签，允许通过重写标签按目标覆盖always_scrape_classic_histograms和scrape_native_histograms抓取配置。 #18929
  • [增强] 发布：容器镜像现已同步发布至GitHub容器注册表（ghcr.io）。 #18791
  • [增强] PromQL：当fill_left(x)和fill_right(x)的填充值相同时，美化显示为fill(x)。 #18851
  • [增强] UI：改进函数括号关闭后的自动补全功能。 #18894
  • [性能] 标签：新增大小写不敏感的前缀匹配，加速大小写不敏感的长正则表达式求值（速度提升最高约2倍）。 #18540
  • [性能] TSDB：减少分块填充时的每样本开销，在基准测试中使受影响查询速度提升约12-15%。 #18699
  • [性能] TSDB：消除V2直方图WAL解码器中的不必要堆分配，在启用创建时间戳存储（--enable-feature=created-timestamp-zero-ingestion）使用原生直方图的部署中，分配减少最多50%，内存减少最多10%。 #18813
  • [错误修复] 发现/AWS：修复处理无实例的AWS RDS集群时的故障。 #18845
  • [错误修复] 修复initTime中的竞态条件，该问题可能导致ErrOutOfBounds。 #18629
  • [错误修复] PromQL：修复范围查询中end未与step对齐时，其内部子查询会超出父查询的最后实际步骤求值，导致查询统计中的peakSamples虚高、触及query.max-samples限制，并浪费存储I/O读取结果中从未使用的样本。 #18081
  • [错误修复] PromQL：修复包含在带@修饰符的范围向量上使用@修饰符不安全函数的范围查询（如predict_linear(metric[60s] @ T, X)），在0步后步骤中会静默少计totalQueryableSamples的问题。 #18081
  • [错误修复] PromQL：修复在范围查询中使用group_left/group_right时，fill_left/fill_right产生缺失样本的问题。 #18850
  • [错误修复] PromQL：修复在锚定范围扩展器中对直方图使用resets()和changes()的问题。 #18906
  • [错误修复] PromQL：修复启用扩展范围选择器时，表达式如1[5m] smoothed引发的panic。 #18764
  • [错误修复] PromQL：修复当smoothed即时向量选择器对某序列不产生样本时引发的panic。 #18943
  • [错误修复] PromQL：修复使用括号括起的纯数字作为偏移量（如foo offset -(5)）时引发的panic。 #18768
  • [错误修复] promtool：修复解析包含空花括号{}的指标文本时引发的panic。通过prometheus/common v0.69.0更新。 #18949
  • [错误修复] Promtool：修复当--url以斜杠结尾时，check healthy和check ready命令执行异常的问题。 #18854
  • [错误修复] 规则：在每次规则评估后关闭PromQL查询，确保资源被释放。 #18733
  • [错误修复] Scaleway SD：解析仅具有VPC/IPAM属性但无传统private_ip或public_ip字段，但已附加私有NIC的实例。 #18772
  • [错误修复] TSDB：修复当整数直方图追加被拒绝（如乱序）时，头部序列泄露的问题。 #18838
  • [错误修复] UI：对PromQL自动补全提供的标签值进行转义。 #18658
  • [错误修复] TSDB：修复EncXOR2分块的分块快照编码问题，防止在TSDB重启时若存在EncXOR2编码的序列导致数据损坏。 #18739
  • [错误修复] TSDB：修复当通过CompactStaleHead/CompactSelectedSeries淘汰序列时，walExpiries中存储毫秒时间戳（而非WAL段号），确保序列的标签记录在下一个WAL检查点中正确保留并能清晰重放。 #18847
  • [错误修复] TSDB：防止在CompactSelectedSeries（及CompactStaleHead）淘汰序列时，于分块范围边界丢失样本——每个切片的压缩循环现在会多运行一次迭代，以便在移除内存副本之前将边界时间戳捕获到块中。 #18849

更新内容 （原始）

Release notes of the 3.13-rc.1 release:

The 3.13.0-rc.0 release was only partially successful due to the migration from NPM to PNPM and subsequent CI issues, so most of the changes in this release candidate are CI/build-related. The only user-facing change is:

  • [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997

Release notes of the 3.13-rc.0 release, as it was not published in partial state:

  • [SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697
  • [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927
  • [CHANGE] HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host; affects scraping, remote read/write, alerting, and service discovery. Via prometheus/common v0.69.0 (CVE-2025-4673 CVE-2023-45289). #18949
  • [CHANGE] promtool: Relative file paths in the file passed to --http.config.file are now resolved relative to that config file’s directory instead of its parent directory. Via prometheus/common v0.69.0. #18949
  • [CHANGE] PromQL: Rename the min() and max() duration-expression functions (experimental feature flag experimental-duration-expr) to min_of() and max_of() to avoid confusion with the min and max aggregate operators. #18687
  • [FEATURE] API: Add experimental search endpoints to search metric names, label names, and label values. #18573
  • [FEATURE] Discovery/AWS: Add ability to filter RDS instances. #18859
  • [FEATURE] PromQL: Add min_of(a, b) and max_of(a, b) scalar experimental functions, returning the smaller or larger of two scalar values. #18687
  • [FEATURE] PromQL: Add support for smoothed/anchored rate with native histograms. #18564
  • [FEATURE] PromQL: Expose per-query samplesRead (and samplesReadPerStep with stats=all and the promql-per-step-stats feature flag) in the query stats response, and add the prometheus_engine_query_samples_read_total engine counter. samplesRead reflects storage I/O distinct from totalQueryableSamples, which counts samples loaded into the evaluator (and so over-counts when a sample is reused across multiple range-vector windows). #18081
  • [FEATURE] Scrape: Add __convert_classic_histograms_to_nhcb__ internal label to allow per-target override of convert_classic_histograms_to_nhcb scrape configuration via relabeling. #18840
  • [FEATURE] TSDB: Add storage.tsdb.chunk_encoding.floats configuration field to select float chunk encoding (xor or xor2) at runtime, independently of the --enable-feature=xor2-encoding flag. #18769
  • [FEATURE] remote_write: Add Certificate support for ingesting data into an Azure Monitor Workspace. #18217
  • [FEATURE] Scrape: Add __always_scrape_classic_histograms__ and __scrape_native_histograms__ internal labels to allow per-target override of the always_scrape_classic_histograms and scrape_native_histograms scrape configuration via relabeling. #18929
  • [ENHANCEMENT] Release: Container images are now also published to the GitHub Container Registry (ghcr.io). #18791
  • [ENHANCEMENT] PromQL: Prettify fill_left(x) fill_right(x) as fill(x) when both fill values are equal. #18851
  • [ENHANCEMENT] UI: Improve autocompletion after closing a function bracket. #18894
  • [PERF] Labels: Add case-insensitive prefix matching to speed up evaluation of long case-insensitive regular expressions (up to ~2x faster). #18540
  • [PERF] TSDB: Reduce per-sample overhead in chunk population, speeding up affected queries by ~12-15% in benchmarks. #18699
  • [PERF] TSDB: Eliminate unnecessary heap allocations in the V2 histogram WAL decoder, reducing allocations by up to 50% and memory by up to 10% for deployments using native histograms with created-timestamp storage enabled (--enable-feature=created-timestamp-zero-ingestion). #18813
  • [BUGFIX] Discovery/AWS: Fix failure when processing an AWS RDS cluster without instances. #18845
  • [BUGFIX] Fix race condition in initTime that could cause ErrOutOfBounds. #18629
  • [BUGFIX] PromQL: A range query whose end was not aligned to step caused subqueries inside it to evaluate past the parent’s last actual step, inflating peakSamples in the query stats and against the query.max-samples limit, and wasting storage I/O reading samples that were never used in the result. #18081
  • [BUGFIX] PromQL: A range query containing an at-modifier-unsafe function over a range-vector with an @ modifier (e.g. predict_linear(metric[60s] @ T, X)) silently under-counted totalQueryableSamples for steps after step 0. #18081
  • [BUGFIX] PromQL: Fix fill_left/fill_right producing missing samples in range queries when using group_left/group_right. #18850
  • [BUGFIX] PromQL: Fix for resets() and changes() in anchored range extenders with histograms. #18906
  • [BUGFIX] PromQL: Fix panic on 1[5m] smoothed and similar expressions when extended range selectors are enabled. #18764
  • [BUGFIX] PromQL: Fix panic when a smoothed instant vector selector produces no samples for a series. #18943
  • [BUGFIX] PromQL: Fix panic when using a parenthesised plain number as an offset (e.g. foo offset -(5)). #18768
  • [BUGFIX] promtool: Fix panic when parsing exposition text containing empty braces {}. Via prometheus/common v0.69.0. #18949
  • [BUGFIX] Promtool: Fix check healthy and check ready when --url ends with a trailing slash. #18854
  • [BUGFIX] Rules: Close PromQL query after each rule evaluation to ensure resources are released. #18733
  • [BUGFIX] Scaleway SD: Resolve VPC/IPAM-only instances that have no legacy private_ip or public_ip field, but do have private NICs attached. #18772
  • [BUGFIX] TSDB: Do not leak head series when an integer histogram append is rejected (e.g. out-of-order). #18838
  • [BUGFIX] UI: Escape label values offered by PromQL autocomplete. #18658
  • [BUGFIX] TSDB: Fix chunk snapshot encoding for EncXOR2 chunks, preventing corruption on TSDB restart when EncXOR2-encoded series were present. #18739
  • [BUGFIX] TSDB: Store a millisecond timestamp (not a WAL segment number) in walExpiries when a series is evicted via CompactStaleHead/CompactSelectedSeries, so the series’s label record is correctly retained in the next WAL checkpoint and replays cleanly. #18847
  • [BUGFIX] TSDB: Prevent loss of samples at the chunk-range boundary when CompactSelectedSeries (and CompactStaleHead) evict the series — the per-slice compaction loop now runs one more iteration so the boundary timestamp is captured in a block before the in-memory copy is removed. #18849

下载链接