Releases · thanos-io/thanos

Had to do another version release due to broken base image SHAs. No changes.

This change fixes a small issue regarding timeouts in the Shipper component in the Receiver - we've accidentally set them too small. Sorry for that!

Changed

#8920: receive: bump timeouts

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

#8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
#8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
#8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
#8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
#8720: Receive: Fix 503 errors during restarts in some cases.
#8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
#8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
#8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
#8810: Ruler: correctly pass query partial response for gRPC.

Added

#8691: Cache: add redis key prefix support
#8691: query/ui: show fanout information
#8691: Compactor: remove the directory marker objects for some s3 compatible object stores
#8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
#8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
#8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
#8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
#8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
#8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
#8594: Query: Support per endpoint TLS configuration.

Changed

#8670: Receive: breaking ⚠️ removed --shipper.ignore-unequal-block-size. TSDB now delays compaction until blocks have been uploaded by the shipper, allowing compaction while uploading without risking data loss.
#8802: Cache: add SendToReplicas option while initializing Rueidis client to allow sending read-only requests to Redis replica instances.
#8839: Store: breaking ⚠️ removed --debug.advertise-compatibility-label. Stores now don't advertise @thanos_compatibility_store_type=store external label by default, breaking compatibility with Thanos Query before v0.8.0.
#8831: Query-Frontend: change time_taken field to time_taken_ms for consistent JSON output for easier parsing by the log collector.
#8853: Compactor: remove labels specified as dedup replica labels in hashmod calculation; this fixes a footgun that users could inadvertently hit.
#8796: queryfrontend: add other params to key

Removed

v0.42.0-rc.2 - 2026 06 30

RC.2 fixes a few small regressions after introducing the *os.Root API.

NOTE: we skipped over rc.0 because the release pipeline was broken due to update base image SHAs. There are no other changes except for that in comparison to rc.0.

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

#8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
#8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
#8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
#8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
#8720: Receive: Fix 503 errors during restarts in some cases.
#8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
#8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
#8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
#8810: Ruler: correctly pass query partial response for gRPC.

Added

#8691: Cache: add redis key prefix support
#8691: query/ui: show fanout information
#8691: Compactor: remove the directory marker objects for some s3 compatible object stores
#8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
#8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
#8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
#8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
#8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
#8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
#8594: Query: Support per endpoint TLS configuration.

Changed

#8670: Receive: breaking ⚠️ removed --shipper.ignore-unequal-block-size. TSDB now delays compaction until blocks have been uploaded by the shipper, allowing compaction while uploading without risking data loss.
#8802: Cache: add SendToReplicas option while initializing Rueidis client to allow sending read-only requests to Redis replica instances.
#8839: Store: breaking ⚠️ removed --debug.advertise-compatibility-label. Stores now don't advertise @thanos_compatibility_store_type=store external label by default, breaking compatibility with Thanos Query before v0.8.0.
#8831: Query-Frontend: change time_taken field to time_taken_ms for consistent JSON output for easier parsing by the log collector.
#8853: Compactor: remove labels specified as dedup replica labels in hashmod calculation; this fixes a footgun that users could inadvertently hit.
#8796: queryfrontend: add other params to key

v0.42.0-rc.1 - 2026 06 26

NOTE: we skipped over rc.0 because the release pipeline was broken due to update base image SHAs. There are no other changes except for that in comparison to rc.0.

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

#8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
#8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
#8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
#8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
#8720: Receive: Fix 503 errors during restarts in some cases.
#8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
#8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
#8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
#8810: Ruler: correctly pass query partial response for gRPC.

Added

#8691: Cache: add redis key prefix support
#8691: query/ui: show fanout information
#8691: Compactor: remove the directory marker objects for some s3 compatible object stores
#8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
#8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
#8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
#8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
#8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
#8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
#8594: Query: Support per endpoint TLS configuration.

Changed

#8670: Receive: breaking ⚠️ removed --shipper.ignore-unequal-block-size. TSDB now delays compaction until blocks have been uploaded by the shipper, allowing compaction while uploading without risking data loss.
#8802: Cache: add SendToReplicas option while initializing Rueidis client to allow sending read-only requests to Redis replica instances.
#8839: Store: breaking ⚠️ removed --debug.advertise-compatibility-label. Stores now don't advertise @thanos_compatibility_store_type=store external label by default, breaking compatibility with Thanos Query before v0.8.0.
#8831: Query-Frontend: change time_taken field to time_taken_ms for consistent JSON output for easier parsing by the log collector.
#8853: Compactor: remove labels specified as dedup replica labels in hashmod calculation; this fixes a footgun that users could inadvertently hit.
#8796: queryfrontend: add other params to key

@hek2mgl

This is a good one, among several bug fixes, we have batched Series and Query RPCs now - this should lead to drastic improvements in network bandwidth and decent improvements in CPU/Memory usage of Querier and all its endpoints.

Changes

Fixed

#8378: Store: fix the reuse of dirty posting slices
#8558: Query-Frontend: Fix not logging requests when external-prefix is set in query
#8254 Receive: Endless loop of retried replication with capnproto and distributors
#8618: Query-Frontend: ensure slow query and stats logging on request failures
#8480: Store: fix(readerpool): avoid inserting nil LazyBinaryReader on error to avoid panic

Added

#8623: Query: Enable batching of Series per SeriesResponse.
#8582: Sidecar: support --storage.tsdb.delay-compact-file.path Prometheus flag.
#8595: *: add --shipper.upload-compacted flag for controlling upload concurrency in components that use shippper

Changed

#8630: Receive: breaking ⚠️ shuffle sharding now uses consistent hashing for stability on scale. Existing tenant-to-node assignments will change on upgrade.
#8555: Promu: re-add Darwin and FreeBSD as release platforms
#8661: Upgrade Prometheus to v3.8.0. tsdb.enable-native-histograms flag in Receiver and Ruler becomes a no-op and deprecated. Now native histogram ingestion is always enabled.

New Contributors

@hek2mgl made their first contribution in #8425
@jrisebor made their first contribution in #8569
@prymitive made their first contribution in #8582
@abhiweye made their first contribution in #8592
@TessaIO made their first contribution in #8556
@dethi made their first contribution in #8622
@adezxc made their first contribution in #8623
@erlan-z made their first contribution in #8480
@dowgird made their first contribution in #8595
@pvlltvk made their first contribution in #8618

Like v0.41.0-rc.0 but with additional cherry-pick of:

downgrade grpc-go to fix memory leak: #8671

@hek2mgl

This is a good one, among several bug fixes, we have batched Series and Query RPCs now - this should lead to drastic improvements in network bandwidth and decent improvements in CPU/Memory usage of Querier and all its endpoints.

Changes

Fixed

#8378: Store: fix the reuse of dirty posting slices
#8558: Query-Frontend: Fix not logging requests when external-prefix is set in query
#8254 Receive: Endless loop of retried replication with capnproto and distributors
#8618: Query-Frontend: ensure slow query and stats logging on request failures
#8480: Store: fix(readerpool): avoid inserting nil LazyBinaryReader on error to avoid panic

Added

#8623: Query: Enable batching of Series per SeriesResponse.
#8582: Sidecar: support --storage.tsdb.delay-compact-file.path Prometheus flag.
#8595: *: add --shipper.upload-compacted flag for controlling upload concurrency in components that use shippper

Changed

#8630: Receive: breaking ⚠️ shuffle sharding now uses consistent hashing for stability on scale. Existing tenant-to-node assignments will change on upgrade.
#8555: Promu: re-add Darwin and FreeBSD as release platforms
#8661: Upgrade Prometheus to v3.8.0. tsdb.enable-native-histograms flag in Receiver and Ruler becomes a no-op and deprecated. Now native histogram ingestion is always enabled.

New Contributors

@hek2mgl made their first contribution in #8425
@jrisebor made their first contribution in #8569
@prymitive made their first contribution in #8582
@abhiweye made their first contribution in #8592
@TessaIO made their first contribution in #8556
@dethi made their first contribution in #8622
@adezxc made their first contribution in #8623
@erlan-z made their first contribution in #8480
@dowgird made their first contribution in #8595
@pvlltvk made their first contribution in #8618

@GiedriusS

-- There is still a performance regression in this release #8549 that we are working on fixing --

This fix fixes a performance regression in the gRPC layer.

What's Changed

Pull extgrpc fix and release 0.40.1 by @GiedriusS in #8547

Full Changelog: v0.40.0...v0.40.1

@paul-hsieh

v0.40.0 - 2025 10 27

Fixed

#8334 Query: wait for initial endpoint discovery before becoming ready
#8486 Receive: fix exemplar label corruption from Cap'n Proto memory references
#8499 Query: support UTF-8 label names for the /api/v1/label/:name/values API.
#8336 store: fix race between lazy index header creation

Added

#8366 Store: optionally ignore Parquet migrated blocks
#8359 Tools: add --shipper.upload-compacted flag for uploading compacted blocks to bucket upload-blocks
#8484 Query: add /api/v1/status/tsdb API endpoint.
#8454 Compact: ensure we don't mark blocks for deletion again after just deleting them
#8410 Compact: ignore blocks with deletion mark in partial deletes

Changed

#8370 Query: announced labelset now reflects relabel-config
#8464 Query: assume that we do not unmark a block for deletion. This solves a race between Thanos Store and Compactor.
#8402 Query/Receive: trim labelsets in String()
#8334 Query: wait for initial endpoint discovery before becoming ready
#8401 block/compact: rework consistency check, make writers only write
#8389 block: bust cache if modified timestamp differs

New Contributors

@paul-hsieh made their first contribution in #8321
@jdgeisler made their first contribution in #8359
@NickGoog made their first contribution in #8400
@erikgb made their first contribution in #8427
@parthivrmenon made their first contribution in #8456
@dbuchanaRH made their first contribution in #8486

Full Changelog: v0.39.2...v0.40.0

Uh oh!

Releases: thanos-io/thanos

Release list

v0.42.2

Uh oh!

v0.42.1

Changed

Uh oh!

v0.42.0

Fixed

Added

Changed

Removed

Uh oh!

v0.42.0-rc.2

v0.42.0-rc.2 - 2026 06 30

Fixed

Added

Changed

Uh oh!

v0.42.0-rc.1

v0.42.0-rc.1 - 2026 06 26

Fixed

Added

Changed

Uh oh!

v0.41.0

Changes

Fixed

Added

Changed

New Contributors

Contributors

Uh oh!

v0.41.0-rc.1

Uh oh!

v0.41.0-rc.0

Changes

Fixed

Added

Changed

New Contributors

Contributors

Uh oh!

v0.40.1

What's Changed

Contributors

Uh oh!

v0.40.0

v0.40.0 - 2025 10 27

Fixed

Added

Changed

New Contributors

Contributors

Uh oh!