This is a Long Term Support LTS release.

• [SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697
• [CHANGE] UI: Third-party npm dependency licenses are now embedded in the Prometheus binary and served at /assets/third-party-licenses.txt, replacing the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images. #18997
• [CHANGE] API: Use SHA-256 instead of SHA-1 to generate rule group pagination tokens. #18927
• [CHANGE] HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host; affects scraping, remote read/write, alerting, and service discovery. Via prometheus/common v0.69.0 (CVE-2025-4673 CVE-2023-45289). #18949
• [CHANGE] promtool: Relative file paths in the file passed to --http.config.file are now resolved relative to that config file's directory instead of its parent directory. Via prometheus/common v0.69.0. #18949
• [CHANGE] PromQL: Rename the min() and max() duration-expression functions (experimental feature flag experimental-duration-expr) to min_of() and max_of() to avoid confusion with the min and max aggregate operators. #18687
• [FEATURE] API: Add experimental search endpoints to search metric names, label names, and label values. #18573
• [FEATURE] Discovery/AWS: Add ability to filter RDS instances. #18859
• [FEATURE] PromQL: Add min_of(a, b) and max_of(a, b) scalar experimental functions, returning the smaller or larger of two scalar values. #18687
• [FEATURE] PromQL: Add support for smoothed/anchored rate with native histograms. #18564
• [FEATURE] PromQL: Expose per-query samplesRead (and samplesReadPerStep with stats=all and the promql-per-step-stats feature flag) in the query stats response, and add the prometheus_engine_query_samples_read_total engine counter. samplesRead reflects storage I/O distinct from totalQueryableSamples, which counts samples loaded into the evaluator (and so over-counts when a sample is reused across multiple range-vector windows). #18081
• [FEATURE] Scrape: Add __convert_classic_histograms_to_nhcb__ internal label to allow per-target override of convert_classic_histograms_to_nhcb scrape configuration via relabeling. #18840
• [FEATURE] TSDB: Add storage.tsdb.chunk_encoding.floats configuration field to select float chunk encoding (xor or xor2) at runtime, independently of the --enable-feature=xor2-encoding flag. #18769
• [FEATURE] remote_write: Add Certificate support for ingesting data into an Azure Monitor Workspace. #18217
• [FEATURE] Scrape: Add __always_scrape_classic_histograms__ and __scrape_native_histograms__ internal labels to allow per-target override of the always_scrape_classic_histograms and scrape_native_histograms scrape configuration via relabeling. #18929
• [ENHANCEMENT] Release: Container images are now also published to the GitHub Container Registry (ghcr.io). #18791
• [ENHANCEMENT] PromQL: Prettify fill_left(x) fill_right(x) as fill(x) when both fill values are equal. #18851
• [ENHANCEMENT] UI: Improve autocompletion after closing a function bracket. #18894
• [PERF] Labels: Add case-insensitive prefix matching to speed up evaluation of long case-insensitive regular expressions (up to ~2x faster). #18540
• [PERF] TSDB: Reduce per-sample overhead in chunk population, speeding up affected queries by ~12-15% in benchmarks. #18699
• [PERF] TSDB: Eliminate unnecessary heap allocations in the V2 histogram WAL decoder, reducing allocations by up to 50% and memory by up to 10% for deployments using native histograms with created-timestamp storage enabled (--enable-feature=created-timestamp-zero-ingestion). #18813
• [BUGFIX] Discovery/AWS: Fix failure when processing an AWS RDS cluster without instances. #18845
• [BUGFIX] Fix race condition in initTime that could cause ErrOutOfBounds. #18629
• [BUGFIX] PromQL: A range query whose end was not aligned to step caused subqueries inside it to evaluate past the parent's last actual step, inflating peakSamples in the query stats and against the query.max-samples limit, and wasting storage I/O reading samples that were never used in the result. #18081
• [BUGFIX] PromQL: A range query containing an at-modifier-unsafe function over a range-vector with an @ modifier (e.g. predict_linear(metric[60s] @ T, X)) silently under-counted totalQueryableSamples for steps after step 0. #18081
• [BUGFIX] PromQL: Fix fill_left/fill_right producing missing samples in range queries when using group_left/group_right. #18850
• [BUGFIX] PromQL: Fix for resets() and changes() in anchored range extenders with histograms. #18906
• [BUGFIX] PromQL: Fix panic on 1[5m] smoothed and similar expressions when extended range selectors are enabled. #18764
• [BUGFIX] PromQL: Fix panic when a smoothed instant vector selector produces no samples for a series. #18943
• [BUGFIX] PromQL: Fix panic when using a parenthesised plain number as an offset (e.g. foo offset -(5)). #18768
• [BUGFIX] promtool: Fix panic when parsing exposition text containing empty braces {}. Via prometheus/common v0.69.0. #18949
• [BUGFIX] Promtool: Fix check healthy and check ready when --url ends with a trailing slash. #18854
• [BUGFIX] Rules: Close PromQL query after each rule evaluation to ensure resources are released. #18733
• [BUGFIX] Scaleway SD: Resolve VPC/IPAM-only instances that have no legacy private_ip or public_ip field, but do have private NICs attached. #18772
• [BUGFIX] TSDB: Do not leak head series when an integer histogram append is rejected (e.g. out-of-order). #18838
• [BUGFIX] UI: Escape label values offered by PromQL autocomplete. #18658
• [BUGFIX] TSDB: Fix chunk snapshot encoding for EncXOR2 chunks, preventing corruption on TSDB restart when EncXOR2-encoded series were present. #18739
• [BUGFIX] TSDB: Store a millisecond timestamp (not a WAL segment number) in walExpiries when a series is evicted via CompactStaleHead/CompactSelectedSeries, so the series's label record is correctly retained in the next WAL checkpoint and replays cleanly. #18847
• [BUGFIX] TSDB: Prevent loss of samples at the chunk-range boundary when CompactSelectedSeries (and CompactStaleHead) evict the series — the per-slice compaction loop now runs one more iteration so the boundary timestamp is captured in a block before the in-memory copy is removed. #18849

This release contains bug fixes since the 2.28.1 release. We recommend that you upgrade at the next available opportunity.

Bugfixes

• #10126 Fix bgw_job_stat_history migration for 2.28.1
• #10133 Fix chunk_constraint migration
• #10137 Fix column ordering on first/last-based sparse indexes
• #10164 Automatically drop incompatible smallint bloom filters when upgrading instead of stopping the upgrade

Thanks

• @juantxorena for reporting an issue with update script for 2.28.1
• @rusha1333 for reporting an issue when upgrading to 2.28.1

• Resolve FilterConstraints once and key the isConstrained cache by Class by @gavinbunney in https://github.com/Netflix/zuul/pull/2158
• Add single-pass setAll to Headers that preserves multi-valued headers by @gavinbunney in https://github.com/Netflix/zuul/pull/2157

Full Changelog: https://github.com/Netflix/zuul/compare/v3.6.17...v3.6.18

• #19077 build Create tarballs correctly
• #19070 inputs.opcua Close session on stop to prevent reload leak
• #19159 inputs.opcua Skip client certificate on unsecured None channel
• #19076 inputs.openweathermap Remove calls to deprecated v2.5 group API
• #19167 inputs.smartctl Parse stdout only to avoid corrupting JSON
• #19093 inputs.tail Prevent panic when closing tailers under load
• #19067 inputs.temp Use non-blocking read for hwmon temperatures
• #19126 inputs.vsphere Fix missing vSAN overall_health metric
• #19074 processors.parser Handle metrics without inner timestamp correctly
• #19129 migrations Add migration for inputs.aerospike
• #19121 migrations Add migration for inputs.kafka_consumer connection_strategy option
• #19122 migrations Add migration for inputs.openstack server_diagnotics option
• #19133 migrations Add migration for inputs.openweathermap query_style option
• #19117 migrations Add migration for inputs.tail from_beginning option
• #19128 migrations Add migration for outputs.amon

• #19138 deps Bump actions/checkout from 6 to 7
• #19065 deps Bump cloud.google.com/go/storage from 1.62.2 to 1.62.3
• #19058 deps Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0
• #19106 deps Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0
• #19059 deps Bump github.com/IBM/sarama from 1.50.1 to 1.50.2
• #19110 deps Bump github.com/IBM/sarama from 1.50.2 to 1.50.3
• #19102 deps Bump github.com/SAP/go-hdb from 1.16.11 to 1.16.12
• #19057 deps Bump github.com/aws/smithy-go from 1.27.0 to 1.27.2
• #19060 deps Bump github.com/gopacket/gopacket from 1.6.0 to 1.6.1
• #19142 deps Bump github.com/gopcua/opcua from 0.8.0 to 0.9.0
• #19064 deps Bump github.com/jedib0t/go-pretty/v6 from 6.7.10 to 6.8.0
• #19108 deps Bump github.com/jedib0t/go-pretty/v6 from 6.8.0 to 6.8.1
• #19150 deps Bump github.com/moby/moby/api from 1.54.2 to 1.55.0
• #19149 deps Bump github.com/moby/moby/client from 0.4.1 to 0.5.0
• #19053 deps Bump github.com/pion/dtls/v3 from 3.1.3 to 3.1.4
• #19115 deps Bump github.com/prometheus-community/pro-bing from 0.8.0 to 0.9.0
• #19147 deps Bump github.com/prometheus/common from 0.68.1 to 0.69.0
• #19141 deps Bump github.com/rabbitmq/amqp091-go from 1.11.0 to 1.12.0
• #19170 deps Bump github.com/rclone/rclone from 1.69.3 to 1.74.1-0.20260628215305-6bbc28cf02dc
• #19109 deps Bump github.com/redis/go-redis/v9 from 9.20.0 to 9.20.1
• #19148 deps Bump github.com/redis/go-redis/v9 from 9.20.1 to 9.21.0
• #19152 deps Bump github.com/testcontainers/testcontainers-go/modules/azure from 0.42.0 to 0.43.0
• #19143 deps Bump github.com/testcontainers/testcontainers-go/modules/kafka from 0.42.0 to 0.43.0
• #19144 deps Bump github.com/testcontainers/testcontainers-go/modules/vault from 0.42.0 to 0.43.0
• #19111 deps Bump go.opentelemetry.io/collector/pdata from 1.59.0 to 1.60.0
• #19054 deps Bump go.step.sm/crypto from 0.81.1 to 0.82.0
• #19104 deps Bump go.step.sm/crypto from 0.82.0 to 0.83.0
• #19061 deps Bump golang.org/x/crypto from 0.52.0 to 0.53.0
• #19055 deps Bump golang.org/x/mod from 0.36.0 to 0.37.0
• #19056 deps Bump golang.org/x/sync from 0.20.0 to 0.21.0
• #19066 deps Bump golang.org/x/sys from 0.45.0 to 0.46.0
• #19063 deps Bump golang.org/x/term from 0.43.0 to 0.44.0
• #19062 deps Bump golang.org/x/text from 0.37.0 to 0.38.0
• #19107 deps Bump golang.org/x/tools from 0.45.0 to 0.46.0
• #19101 deps Bump google.golang.org/api from 0.283.0 to 0.284.0
• #19145 deps Bump google.golang.org/api from 0.284.0 to 0.286.0
• #19103 deps Bump k8s.io/api from 0.36.1 to 0.36.2
• #19113 deps Bump k8s.io/client-go from 0.36.1 to 0.36.2
• #19052 deps Bump modernc.org/sqlite from 1.51.0 to 1.52.0
• #19151 deps Bump modernc.org/sqlite from 1.52.0 to 1.53.0
• #19105 deps Bump software.sslmate.com/src/go-pkcs12 from 0.7.1 to 0.7.2
• #19139 deps Bump super-linter/super-linter from 8.6.0 to 8.7.0
• #19051 deps Bump the aws-sdk-go-v2 group across 1 directory with 11 updates
• #19140 deps Bump the aws-sdk-go-v2 group with 2 updates
• #19100 deps Bump the aws-sdk-go-v2 group with 6 updates

• Fixed CVE-2026-44705 and CVE-2026-46625 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15721
• Fixed CVE-2026-45799 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15757
• Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15795
• Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15799

• Integration with IoT Hub by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15193
• AI models: structured output support for more providers; fix Vertex AI location routing by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15728
• Prevented integer overflow in calculated field SUM output by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15620
• Fixed queue prefix not applied in some cases causing orphaned topics by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15666
• Fixed RPC call request rule node returning null body by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15662
• Fixed permission check on alarm comment edit by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15715
• Hardened device credentials validation by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15550
• Fixed transport tenant-profile lock convoy under cold-cache reconnect storm by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15744

• Added help pages for html container by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/15767
• Fixed Switch Control widget hanging on one-way persistent RPC by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15711
• Fixed no widgets shown in mobile view after state transition from divided layout by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15710
• Fixed change Password button stays disabled when form is filled programmatically by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15701
• Fixed sync highlight overlay scroll on Safari in string-pattern-autocomplete by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15754
• Fixed Advanced Widget Style Editor rendering by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15803
• Fixed dashboard logo stretch at full width by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15800
• Fixed "Confirm exit" dialog appearing when the form was not changed by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15764
• Added handler for WebGL unavailability in map widget by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15640

• Fixed edge event loss for kafka edges during sync by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15756

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.3.1.2...v4.3.1.3

• Fixed CVE-2026-44705 and CVE-2026-46625 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15721
• Fixed CVE-2026-45799 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15757
• Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15795
• Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15799

• Integration with IoT Hub by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15193
• AI models: structured output support for more providers; fix Vertex AI location routing by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15728
• Prevented integer overflow in calculated field SUM output by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15620
• Fixed queue prefix not applied in some cases causing orphaned topics by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15666
• Fixed RPC call request rule node returning null body by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15662
• Fixed permission check on alarm comment edit by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15715
• Hardened device credentials validation by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15550
• Fixed transport tenant-profile lock convoy under cold-cache reconnect storm by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15744

• Added help pages for html container by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/15767
• Fixed Switch Control widget hanging on one-way persistent RPC by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15711
• Fixed no widgets shown in mobile view after state transition from divided layout by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15710
• Fixed change Password button stays disabled when form is filled programmatically by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15701
• Fixed Advanced Widget Style Editor rendering by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15803
• Fixed dashboard logo stretch at full width by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15800
• Added handler for WebGL unavailability in map widget by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15640

• Fixed edge event loss for kafka edges during sync by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15756

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.2.2.2...v4.2.2.3

• Fix a rare S3 snapshots bug by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6472

  We fixed a rare bug that could appear when using the S3 snapshot system. The bug is a race condition that occurs when we try to recycle internal buffers to reduce memory usage, which can cause an internal error and abort the snapshot upload.

• Avoid remote search to return the same document twice by @ManyTheFish in https://github.com/meilisearch/meilisearch/pull/6473

  When using the remote federated search, Meilisearch was returning the same document twice from different machines. This was due to an internal filter that was not forwarded properly to the remote instances.

• Add missing searchFilterParam to GET chat workspace settings response by @CaroFG in https://github.com/meilisearch/meilisearch/pull/6475
• Split unit tests into separate files (one commit per file) by @0xfandom in https://github.com/meilisearch/meilisearch/pull/6468
• Add missing information from pre-openAPI-migration by @curquiza in https://github.com/meilisearch/meilisearch/pull/6467

Thanks to @0xfandom, who made his first contribution in https://github.com/meilisearch/meilisearch/pull/6468 🎉

Full Changelog: https://github.com/meilisearch/meilisearch/compare/v1.48.2...v1.48.3