Hello Prometheus community!
Prometheus
3.13.0-rc.1 has been released. Note: rc.0 release process was only partially successful, thus that release was not published.
This includes security fixes, new features (in PromQL, HTTP API, etc), updates to experimental features (start time in TSDB) , performance improvements and bug fixes.
There are some breaking changes as well due to security considerations as well as changes in existing, but experimental features.
- [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997
- [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927
- [CHANGE] HTTP clients: Credentials (Authorization header, basic
auth, bearer token, OAuth2, configured headers) are no longer forwarded
when following a redirect to a different host; affects scraping, remote
read/write, alerting, and service discovery. Via prometheus/common
v0.69.0 (CVE-2025-4673 CVE-2023-45289). #18949
- [CHANGE] promtool: Relative file paths in the file passed to --http.config.file are now resolved relative to that config file's directory instead of its parent directory. Via prometheus/common v0.69.0. #18949
- [CHANGE] PromQL: Rename the min() and max() duration-expression functions (experimental feature flag experimental-duration-expr) to min_of() and max_of() to avoid confusion with the min and max aggregate operators. #18687
You can find the full changelog and download Prometheus 3.13.0-rc.1 at
Container images are available at
Gyorgy "krajo" Krajcsovits