We're pleased to announce the release of version 3.13.0 LTS of Prometheus.
This is a long term support version, replacing 3.5.0 as the LTS version.
This includes security fixes, new features (in PromQL, HTTP API,
etc), updates to experimental features (start time in TSDB) ,
performance improvements and bug fixes.
There
are some breaking changes as well due to security considerations as well
as changes in existing, but experimental features.
- [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997
- [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927
- [CHANGE] HTTP clients: Credentials (Authorization header, basic
auth, bearer token, OAuth2, configured headers) are no longer forwarded
when following a redirect to a different host; affects scraping, remote
read/write, alerting, and service discovery. Via prometheus/common
v0.69.0 (CVE-2025-4673 CVE-2023-45289). #18949
- [CHANGE] promtool: Relative file paths in the file passed to --http.config.file are now resolved relative to that config file's directory instead of its parent directory. Via prometheus/common v0.69.0. #18949
- [CHANGE] PromQL: Rename the min() and max() duration-expression functions (experimental feature flag experimental-duration-expr) to min_of() and max_of() to avoid confusion with the min and max aggregate operators. #18687
You can find the full changelog and download Prometheus 3.13.0 at
Container images are available at
Gyorgy "krajo" Krajcsovits