发布日期: 2026-07-01
版本号: v3.13.0

这是Prometheus的一个长期支持（LTS）版本更新，主要包含以下内容：修复了UI组件的跨站脚本漏洞；更新了安全策略，在重定向时不再转发凭证信息；将第三方许可证文件直接嵌入二进制文件中；API改用SHA-256生成分页令牌。新增功能包括：实验性的指标搜索端点、AWS RDS实例过滤、PromQL标量函数、原生直方图平滑速率支持以及更精细的查询采样统计。性能方面提升了正则表达式匹配和TSDB查询效率，并优化了内存分配。此外还修复了大量错误，涉及查询计算、配置文件解析、块编码、数据采集和UI等多个模块，增强了整体稳定性和可靠性。

更新内容 （中文）

这是长期支持 LTS 版本。

  • [安全] UI：升级 sanitize-html 以修复跨站脚本漏洞 (CVE-2026-44990)。#18697
  • [变更] UI：第三方 npm 依赖许可证现已嵌入 Prometheus 二进制文件，并通过 /assets/third-party-licenses.txt 提供服务，取代了先前随发布包和容器镜像分发的 npm_licenses.tar.bz2 归档文件。#18997
  • [变更] API：使用 SHA-256 而非 SHA-1 生成规则组分页令牌。#18927
  • [变更] HTTP 客户端：当重定向到不同主机时，不再转发凭据（Authorization 头、基本身份验证、Bearer 令牌、OAuth2、已配置的头）；影响抓取、远程读/写、告警和服务发现。通过 prometheus/common v0.69.0 (CVE-2025-4673 CVE-2023-45289)。#18949
  • [变更] promtool：传递给 --http.config.file 的文件中的相对文件路径，现在相对于该配置文件所在目录解析，而不是其父目录。通过 prometheus/common v0.69.0。#18949
  • [变更] PromQL：将 min() 和 max() 持续时间表达式函数（实验性功能标志 experimental-duration-expr）重命名为 min_of() 和 max_of()，以避免与聚合操作符 min 和 max 混淆。#18687
  • [功能] API：添加实验性搜索端点，用于搜索指标名称、标签名称和标签值。#18573
  • [功能] 发现/AWS：添加过滤 RDS 实例的能力。#18859
  • [功能] PromQL：添加 min_of(a, b) 和 max_of(a, b) 标量实验性函数，返回两个标量值中较小或较大的一个。#18687
  • [功能] PromQL：为原生直方图添加平滑/锚定速率支持。#18564
  • [功能] PromQL：在查询统计信息响应中公开每个查询的 samplesRead（以及在 stats=all 和 promql-per-step-stats 功能标志下的 samplesReadPerStep），并添加 prometheus_engine_query_samples_read_total 引擎计数器。samplesRead 反映存储 I/O，与 totalQueryableSamples（统计加载到评估器中的样本数，因此当一个样本在多个区间向量窗口中重用时会被重复计算）不同。#18081
  • [功能] 抓取：添加 __convert_classic_histograms_to_nhcb__ 内部标签，允许通过重写标签按目标覆盖 convert_classic_histograms_to_nhcb 抓取配置。#18840
  • [功能] TSDB：添加 storage.tsdb.chunk_encoding.floats 配置字段，用于在运行时选择浮点数块编码（xor 或 xor2），独立于 --enable-feature=xor2-encoding 标志。#18769
  • [功能] remote_write：添加证书支持，用于将数据采集到 Azure Monitor 工作区。#18217
  • [功能] 抓取：添加 __always_scrape_classic_histograms__ 和 __scrape_native_histograms__ 内部标签，允许通过重写标签按目标覆盖 always_scrape_classic_histograms 和 scrape_native_histograms 抓取配置。#18929
  • [改进] 发布：容器镜像现在也发布到 GitHub 容器注册表 (ghcr.io)。#18791
  • [改进] PromQL：当两个填充值相等时，将 fill_left(x) fill_right(x) 美化为 fill(x)。#18851
  • [改进] UI：改进关闭函数括号后的自动补全。#18894
  • [性能] 标签：添加不区分大小写的前缀匹配，以加速长时不区分大小写正则表达式的评估（最高快约 2 倍）。#18540
  • [性能] TSDB：减少块填充中的每样本开销，在基准测试中将受影响查询的速度提高约 12-15%。#18699
  • [性能] TSDB：消除 V2 直方图 WAL 解码器中不必要的堆分配，对于启用了原生直方图并创建时间戳存储（--enable-feature=created-timestamp-zero-ingestion）的部署，分配减少高达 50%，内存减少高达 10%。#18813
  • [修复] 发现/AWS：修复处理没有实例的 AWS RDS 集群时的失败问题。#18845
  • [修复] 修复 initTime 中可能导致 ErrOutOfBounds 的竞态条件。#18629
  • [修复] PromQL：范围查询的 end 未与 step 对齐，导致其内部的子查询在父查询的最后一个实际步骤之后进行评估，夸大查询统计中的 peakSamples 并超过 query.max-samples 限制，并浪费存储 I/O 读取从未在结果中使用的样本。#18081
  • [修复] PromQL：包含在带有 @ 修饰符的区间向量上使用 at 修饰符不安全函数的范围查询（例如 predict_linear(metric[60s] @ T, X)），在步骤 0 之后的步骤中，静默少计了 totalQueryableSamples。#18081
  • [修复] PromQL：修复在使用 group_left/group_right 时，fill_left/fill_right 在范围查询中产生缺失样本的问题。#18850
  • [修复] PromQL：修复锚定范围扩展器中带有直方图的 resets() 和 changes() 的问题。#18906
  • [修复] PromQL：修复启用扩展范围选择器时，1[5m] smoothed 及类似表达式的 panic 问题。#18764
  • [修复] PromQL：修复 smoothed 瞬时向量选择器为某个序列不产生样本时的 panic 问题。#18943
  • [修复] PromQL：修复使用括号内的纯数字作为偏移量（例如 foo offset -(5)）时的 panic 问题。#18768
  • [修复] promtool：修复解析包含空花括号 {} 的导出文本时的 panic 问题。通过 prometheus/common v0.69.0。#18949
  • [修复] Promtool：修复当 --url 以尾部斜杠结尾时，check healthy 和 check ready 的问题。#18854
  • [修复] 规则：每次规则评估后关闭 PromQL 查询，以确保资源被释放。#18733
  • [修复] Scaleway SD：解析仅支持 VPC/IPAM 且没有传统 private_ip 或 public_ip 字段，但已附加私有网卡的实例。#18772
  • [修复] TSDB：当整数直方图追加被拒绝（例如乱序）时，不泄漏头部序列。#18838
  • [修复] UI：转义 PromQL 自动补全提供的标签值。#18658
  • [修复] TSDB：修复 EncXOR2 块的块快照编码，防止在存在 EncXOR2 编码序列时 TSDB 重启导致损坏。#18739
  • [修复] TSDB：当序列通过 CompactStaleHead/CompactSelectedSeries 被驱逐时，在 walExpiries 中存储毫秒时间戳（而不是 WAL 段号），以便序列的标签记录在下一次 WAL 检查点中被正确保留并能干净回放。#18847
  • [修复] TSDB：防止在 CompactSelectedSeries（和 CompactStaleHead）驱逐序列时在块范围边界丢失样本——每个切片的压缩循环现在运行多一次迭代，以便在内存副本被移除之前，将边界时间戳捕获到块中。#18849

更新内容 （原始）

This is a Long Term Support LTS release.

  • [SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697
  • [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997
  • [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927
  • [CHANGE] HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host; affects scraping, remote read/write, alerting, and service discovery. Via prometheus/common v0.69.0 (CVE-2025-4673 CVE-2023-45289). #18949
  • [CHANGE] promtool: Relative file paths in the file passed to --http.config.file are now resolved relative to that config file’s directory instead of its parent directory. Via prometheus/common v0.69.0. #18949
  • [CHANGE] PromQL: Rename the min() and max() duration-expression functions (experimental feature flag experimental-duration-expr) to min_of() and max_of() to avoid confusion with the min and max aggregate operators. #18687
  • [FEATURE] API: Add experimental search endpoints to search metric names, label names, and label values. #18573
  • [FEATURE] Discovery/AWS: Add ability to filter RDS instances. #18859
  • [FEATURE] PromQL: Add min_of(a, b) and max_of(a, b) scalar experimental functions, returning the smaller or larger of two scalar values. #18687
  • [FEATURE] PromQL: Add support for smoothed/anchored rate with native histograms. #18564
  • [FEATURE] PromQL: Expose per-query samplesRead (and samplesReadPerStep with stats=all and the promql-per-step-stats feature flag) in the query stats response, and add the prometheus_engine_query_samples_read_total engine counter. samplesRead reflects storage I/O distinct from totalQueryableSamples, which counts samples loaded into the evaluator (and so over-counts when a sample is reused across multiple range-vector windows). #18081
  • [FEATURE] Scrape: Add __convert_classic_histograms_to_nhcb__ internal label to allow per-target override of convert_classic_histograms_to_nhcb scrape configuration via relabeling. #18840
  • [FEATURE] TSDB: Add storage.tsdb.chunk_encoding.floats configuration field to select float chunk encoding (xor or xor2) at runtime, independently of the --enable-feature=xor2-encoding flag. #18769
  • [FEATURE] remote_write: Add Certificate support for ingesting data into an Azure Monitor Workspace. #18217
  • [FEATURE] Scrape: Add __always_scrape_classic_histograms__ and __scrape_native_histograms__ internal labels to allow per-target override of the always_scrape_classic_histograms and scrape_native_histograms scrape configuration via relabeling. #18929
  • [ENHANCEMENT] Release: Container images are now also published to the GitHub Container Registry (ghcr.io). #18791
  • [ENHANCEMENT] PromQL: Prettify fill_left(x) fill_right(x) as fill(x) when both fill values are equal. #18851
  • [ENHANCEMENT] UI: Improve autocompletion after closing a function bracket. #18894
  • [PERF] Labels: Add case-insensitive prefix matching to speed up evaluation of long case-insensitive regular expressions (up to ~2x faster). #18540
  • [PERF] TSDB: Reduce per-sample overhead in chunk population, speeding up affected queries by ~12-15% in benchmarks. #18699
  • [PERF] TSDB: Eliminate unnecessary heap allocations in the V2 histogram WAL decoder, reducing allocations by up to 50% and memory by up to 10% for deployments using native histograms with created-timestamp storage enabled (--enable-feature=created-timestamp-zero-ingestion). #18813
  • [BUGFIX] Discovery/AWS: Fix failure when processing an AWS RDS cluster without instances. #18845
  • [BUGFIX] Fix race condition in initTime that could cause ErrOutOfBounds. #18629
  • [BUGFIX] PromQL: A range query whose end was not aligned to step caused subqueries inside it to evaluate past the parent’s last actual step, inflating peakSamples in the query stats and against the query.max-samples limit, and wasting storage I/O reading samples that were never used in the result. #18081
  • [BUGFIX] PromQL: A range query containing an at-modifier-unsafe function over a range-vector with an @ modifier (e.g. predict_linear(metric[60s] @ T, X)) silently under-counted totalQueryableSamples for steps after step 0. #18081
  • [BUGFIX] PromQL: Fix fill_left/fill_right producing missing samples in range queries when using group_left/group_right. #18850
  • [BUGFIX] PromQL: Fix for resets() and changes() in anchored range extenders with histograms. #18906
  • [BUGFIX] PromQL: Fix panic on 1[5m] smoothed and similar expressions when extended range selectors are enabled. #18764
  • [BUGFIX] PromQL: Fix panic when a smoothed instant vector selector produces no samples for a series. #18943
  • [BUGFIX] PromQL: Fix panic when using a parenthesised plain number as an offset (e.g. foo offset -(5)). #18768
  • [BUGFIX] promtool: Fix panic when parsing exposition text containing empty braces {}. Via prometheus/common v0.69.0. #18949
  • [BUGFIX] Promtool: Fix check healthy and check ready when --url ends with a trailing slash. #18854
  • [BUGFIX] Rules: Close PromQL query after each rule evaluation to ensure resources are released. #18733
  • [BUGFIX] Scaleway SD: Resolve VPC/IPAM-only instances that have no legacy private_ip or public_ip field, but do have private NICs attached. #18772
  • [BUGFIX] TSDB: Do not leak head series when an integer histogram append is rejected (e.g. out-of-order). #18838
  • [BUGFIX] UI: Escape label values offered by PromQL autocomplete. #18658
  • [BUGFIX] TSDB: Fix chunk snapshot encoding for EncXOR2 chunks, preventing corruption on TSDB restart when EncXOR2-encoded series were present. #18739
  • [BUGFIX] TSDB: Store a millisecond timestamp (not a WAL segment number) in walExpiries when a series is evicted via CompactStaleHead/CompactSelectedSeries, so the series’s label record is correctly retained in the next WAL checkpoint and replays cleanly. #18847
  • [BUGFIX] TSDB: Prevent loss of samples at the chunk-range boundary when CompactSelectedSeries (and CompactStaleHead) evict the series — the per-slice compaction loop now runs one more iteration so the boundary timestamp is captured in a block before the in-memory copy is removed. #18849

下载链接