upstream/prometheus
1
0
Fork 0
mirror of https://github.com/prometheus/prometheus.git synced 2026-07-08 00:31:14 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
17623 commits 384 branches 540 tags 992 MiB
Commit graph

2627 commits

Author SHA1 Message Date
György Krajcsovits
db46de3dcb
feat(api): add histogram_format=native to query endpoints 
Add a new optional histogram_format query parameter to /api/v1/query
and /api/v1/query_range. When set to native, native histograms in the
JSON response are emitted in a schema-aware shape.

For exponential schemas:

  {
    "count":          "<count>",
    "sum":            "<sum>",
    "schema":         <int>,
    "zero_threshold": "<threshold>",
    "zero_count":     "<count>",                       // when non-zero
    "negative_buckets": [ [ <index>, "<count>" ], ... ], // when non-empty
    "buckets":          [ [ <index>, "<count>" ], ... ]  // when non-empty
  }

zero_threshold is always emitted because, together with schema, it
fully describes the bucket layout. The negative/positive bucket
arrays carry the schema-defined bucket index and count, so empty
buckets that fall between non-empty ones are not transmitted.

For custom-bucket histograms (schema -53):

  {
    "count":      "<count>",
    "sum":        "<sum>",
    "schema":     -53,
    "boundaries": [ "<upper_bound>", ... ],
    "buckets":    [ [ <index>, "<count>" ], ... ]
  }

boundaries lists the bucket upper bounds; each bucket entry's index
is the 0-based index into boundaries.

This lets clients that already understand the schema (e.g. Grafana
rendering NHCB heatmaps) reconstruct every bucket including empty
custom-bucket slots, and is also substantially more compact than the
boundary-based representation for histograms with many buckets.

The existing boundary-based representation is unchanged when
histogram_format is absent or set to any other value.

Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
 2026-05-22 19:13:40 +02:00
Julien
aa260fcde5
Merge pull request #18687 from roidelapluie/roidelapluie/greatest_least 
Duration expression: Rename min/max -> min_of, max_of
 2026-05-21 10:34:29 +02:00
Julien
0df8ce7ac9
web/api: reject 0 for limit and batch_size in search endpoints (#18724)
Some checks are pending
buf.build / lint and publish (push) Waiting to run
Details
CI / Go tests (push) Waiting to run
Details
CI / More Go tests (push) Waiting to run
Details
CI / Go tests for 32-bit x86 (push) Waiting to run
Details
CI / Go tests for Prometheus upgrades and downgrades (push) Waiting to run
Details
CI / Go tests with previous Go version (push) Waiting to run
Details
CI / UI tests (push) Waiting to run
Details
CI / Go tests on Windows (push) Waiting to run
Details
CI / Mixins tests (push) Waiting to run
Details
CI / Compliance testing (push) Waiting to run
Details
CI / Build Prometheus for common architectures (push) Waiting to run
Details
CI / Build Prometheus for all architectures (push) Waiting to run
Details
CI / Report status of build Prometheus for all architectures (push) Blocked by required conditions
Details
CI / Check generated parser (push) Waiting to run
Details
CI / golangci-lint (push) Waiting to run
Details
CI / fuzzing (push) Waiting to run
Details
CI / codeql (push) Waiting to run
Details
CI / Publish main branch artifacts (push) Blocked by required conditions
Details
CI / Publish release artefacts (push) Blocked by required conditions
Details
CI / Publish UI on npm Registry (push) Blocked by required conditions
Details
govulncheck / Run govulncheck (push) Waiting to run
Details
Scorecards supply-chain security / Scorecards analysis (push) Waiting to run
Details 
* web/api: reject 0 for limit and batch_size in search endpoints

Treat 0 as invalid for limit and batch_size query parameters; clients
must supply a positive integer or omit the parameter to use the server
default of 100. Update OpenAPI descriptions accordingly.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>

* Update web/api/v1/openapi.go

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
Signed-off-by: Julien <291750+roidelapluie@users.noreply.github.com>

---------

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Signed-off-by: Julien <291750+roidelapluie@users.noreply.github.com>
Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
 2026-05-19 15:05:45 +00:00
Jyotishmoy Deka
300b4f495b
web/ui: fix lezer-promql module build on Windows (#18725) 
Signed-off-by: jyotishmoy12 <jyotishmoydeka62@gmail.com>
 2026-05-19 15:50:28 +02:00
Julien
e1f4380b2a
web/api: add search API endpoint (#18573) 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-19 13:58:00 +02:00
Julien Pivotto
a74f0b2e7a PromQL: Rename greatest, least, to max_of, min_of. 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-19 13:07:16 +02:00
Bartlomiej Plotka
2a146bce7f
Revert "chore: prepare 3.12.0-rc.0 release" 2026-05-19 08:40:18 +01:00
Julien Pivotto
7af21f195c promql: add least() and greatest() scalar functions 
Implement least(a, b) and greatest(a, b) as scalar-returning PromQL
functions backed by math.Min and math.Max respectively.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-18 11:15:31 +02:00
bwplotka
981aadfb02 make ui-bump-version 
Signed-off-by: bwplotka <bwplotka@gmail.com>
 2026-05-15 11:28:16 +01:00
Asish Kumar
a21f58c2c0
test: expect label value completion apply text 
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
 2026-05-14 22:13:03 +05:30
Asish Kumar
0254e010b3
Address PromQL autocomplete review feedback 
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
 2026-05-14 22:11:04 +05:30
Asish Kumar
7c6bab8c58
ui: escape label values in PromQL autocomplete 
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
 2026-05-14 22:11:04 +05:30
Julien Pivotto
76c859969d promql: rename min/max duration expr functions to least/greatest 
Rename the `min()` and `max()` duration expression functions to
`least()` and `greatest()` to avoid conflicts with the existing
PromQL aggregate functions `min` and `max`.

Update documentation and tests accordingly.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-13 17:35:52 +02:00
Julien Pivotto
dd406b3df5 web/api/v1: enable ExperimentalDurationExpr in translate AST tests 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-13 10:52:59 +02:00
Julien Pivotto
7b29b912e3 Revert "PromQL: Promote duration expressions as stable" 
This reverts commit 1463a5bb5a.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-13 09:59:50 +02:00
Julius Volz
ce93018f4e
Merge pull request #18682 from flying-musk/fix-y-axis-tick-precision 
ui: improve y-axis tick precision
 2026-05-13 08:00:14 +02:00
Flying Musk
b69f991b57 ui: improve y-axis tick precision 
Signed-off-by: Flying Musk <musk.flying@gmail.com>
 2026-05-12 16:11:03 -07:00
bwplotka
d36e9114cb chore: Upgrade Go deps 
Signed-off-by: bwplotka <bwplotka@gmail.com>
 2026-05-11 12:10:00 +01:00
Bartlomiej Plotka
24c06c068d
Merge pull request #18664 from prometheus/deps-update/go-github.com-prometheus-prometheus-vulnerability 
Update module github.com/prometheus/prometheus to v0.311.3 [SECURITY]
 2026-05-11 13:00:56 +02:00
Bartlomiej Plotka
42003b2e13
Merge pull request #18624 from roidelapluie/roidelapluie/dur-expr-in-parse-ast 
web/api: emit duration expression trees
 2026-05-11 12:59:41 +02:00
renovate[bot]
73844c223f
Update module github.com/prometheus/prometheus to v0.311.3 [SECURITY] 2026-05-11 10:20:11 +00:00
Julien
ecab2f45a8
Merge pull request #18651 from roidelapluie/roidelapluie/fgprof-concurrency-limit 
web: reject concurrent fgprof profiles with 500, aligning with pprof
 2026-05-08 18:12:46 +02:00
Julien Pivotto
dd54642a47 web: reject concurrent fgprof profiles with 500, aligning with pprof 
Add a mutex around the fgprof handler so that only one profile can
run at a time. A second concurrent request returns 500 with an error
message matching the pprof behaviour for CPU profiling already in use.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-08 17:41:27 +02:00
Julien Pivotto
64e465dddc chore: Update NPM deps for 3.12 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-08 13:59:50 +02:00
Julien Pivotto
20b5f16159 web/api: emit duration expression trees 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-05-06 12:10:03 +02:00
Julien
75ec141616
Merge pull request #18305 from charleskorn/duration-openapi-docs 
fix: correctly document supported formats for duration query request parameters in OpenAPI spec
 2026-05-05 14:29:13 +02:00
Julien Pivotto
5e4c110c65 Merge branch 'release-3.11' into merge-3.11 2026-04-27 17:11:39 +02:00
Julien Pivotto
5ba3545753 Release 3.11.3 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-27 15:48:10 +02:00
Julius Volz
38f23b9075 ui: fix stored XSS in old UI heatmap chart tick labels 
This fixes the stored XSS as described in:

https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28

Signed-off-by: Julius Volz <julius.volz@gmail.com>
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-27 12:28:10 +02:00
Julien Pivotto
1463a5bb5a PromQL: Promote duration expressions as stable 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-24 18:45:09 +02:00
Julien
89f5f51f46
Merge pull request #18538 from roidelapluie/roidelapluie/fixreturn
Some checks are pending
buf.build / lint and publish (push) Waiting to run
Details
CI / Go tests (push) Waiting to run
Details
CI / More Go tests (push) Waiting to run
Details
CI / Go tests for Prometheus upgrades and downgrades (push) Waiting to run
Details
CI / Go tests with previous Go version (push) Waiting to run
Details
CI / UI tests (push) Waiting to run
Details
CI / Go tests on Windows (push) Waiting to run
Details
CI / Mixins tests (push) Waiting to run
Details
CI / Compliance testing (push) Waiting to run
Details
CI / Build Prometheus for common architectures (push) Waiting to run
Details
CI / Build Prometheus for all architectures (push) Waiting to run
Details
CI / Report status of build Prometheus for all architectures (push) Blocked by required conditions
Details
CI / Check generated parser (push) Waiting to run
Details
CI / golangci-lint (push) Waiting to run
Details
CI / fuzzing (push) Waiting to run
Details
CI / codeql (push) Waiting to run
Details
CI / Publish main branch artifacts (push) Blocked by required conditions
Details
CI / Publish release artefacts (push) Blocked by required conditions
Details
CI / Publish UI on npm Registry (push) Blocked by required conditions
Details
Push README to Docker Hub / Push README to Docker Hub (push) Waiting to run
Details
Push README to Docker Hub / Push README to quay.io (push) Waiting to run
Details
govulncheck / Run govulncheck (push) Waiting to run
Details
Scorecards supply-chain security / Scorecards analysis (push) Waiting to run
Details 
web/api: return after respondError in serveWALReplayStatus
 2026-04-22 12:27:26 +02:00
Julien Pivotto
c20c88e0db web/api: return after respondError in serveWALReplayStatus 
Without the return, a successful respond() call would always follow
the error response, writing a second body to an already-written
ResponseWriter and producing a malformed HTTP response.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-17 17:03:25 +02:00
Julien Pivotto
504c5e67ea promql/ui: highlight start()/end()/range()/step() as functions; start()/end() as modifiers only after @ 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-17 16:48:54 +02:00
Julien
5d0bc055ef
Merge pull request #17877 from roidelapluie/roidelapluie/funcs 
PromQL: Add start() end() range() and step() functions
 2026-04-17 13:51:37 +02:00
Julien Pivotto
ae9e52c868 PromQL: Add start() end() range() and step() functions 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-16 10:59:23 +02:00
Julius Volz
34cebfe953
Merge pull request #18411 from prometheus/self-metrics-api
Some checks failed
buf.build / lint and publish (push) Has been cancelled
Details
CI / Go tests (push) Has been cancelled
Details
CI / More Go tests (push) Has been cancelled
Details
CI / Go tests for Prometheus upgrades and downgrades (push) Has been cancelled
Details
CI / Go tests with previous Go version (push) Has been cancelled
Details
CI / UI tests (push) Has been cancelled
Details
CI / Go tests on Windows (push) Has been cancelled
Details
CI / Mixins tests (push) Has been cancelled
Details
CI / Compliance testing (push) Has been cancelled
Details
CI / Build Prometheus for common architectures (push) Has been cancelled
Details
CI / Build Prometheus for all architectures (push) Has been cancelled
Details
CI / Check generated parser (push) Has been cancelled
Details
CI / golangci-lint (push) Has been cancelled
Details
CI / fuzzing (push) Has been cancelled
Details
CI / codeql (push) Has been cancelled
Details
Scorecards supply-chain security / Scorecards analysis (push) Has been cancelled
Details
CI / Report status of build Prometheus for all architectures (push) Has been cancelled
Details
CI / Publish main branch artifacts (push) Has been cancelled
Details
CI / Publish release artefacts (push) Has been cancelled
Details
CI / Publish UI on npm Registry (push) Has been cancelled
Details 
Add API endpoint for getting Prometheus' metrics about itself
 2026-04-15 14:47:38 +02:00
Julien
12de1243c0
Merge pull request #18518 from prometheus/release-3.11
Some checks are pending
buf.build / lint and publish (push) Waiting to run
Details
CI / Go tests (push) Waiting to run
Details
CI / More Go tests (push) Waiting to run
Details
CI / Go tests for Prometheus upgrades and downgrades (push) Waiting to run
Details
CI / Go tests with previous Go version (push) Waiting to run
Details
CI / UI tests (push) Waiting to run
Details
CI / Go tests on Windows (push) Waiting to run
Details
CI / Mixins tests (push) Waiting to run
Details
CI / Compliance testing (push) Waiting to run
Details
CI / Build Prometheus for common architectures (push) Waiting to run
Details
CI / Build Prometheus for all architectures (push) Waiting to run
Details
CI / Report status of build Prometheus for all architectures (push) Blocked by required conditions
Details
CI / Check generated parser (push) Waiting to run
Details
CI / golangci-lint (push) Waiting to run
Details
CI / fuzzing (push) Waiting to run
Details
CI / codeql (push) Waiting to run
Details
CI / Publish main branch artifacts (push) Blocked by required conditions
Details
CI / Publish release artefacts (push) Blocked by required conditions
Details
CI / Publish UI on npm Registry (push) Blocked by required conditions
Details
Scorecards supply-chain security / Scorecards analysis (push) Waiting to run
Details 
Merge back release 3.11.2
 2026-04-14 10:26:38 +02:00
Julien Pivotto
f08b9837f9 Release 3.11.2 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-13 13:12:35 +02:00
Julius Volz
d4935fbf6e Fix OpenAPI defs 
Signed-off-by: Julius Volz <julius.volz@gmail.com>
 2026-04-10 19:13:39 +02:00
Julius Volz
d456d314d2 Add some missing metrics protobuf field TypeScript definitions 
Signed-off-by: Julius Volz <julius.volz@gmail.com>
 2026-04-10 16:06:33 +02:00
Julius Volz
034c29411a Use ProtoJSON, allow regex-based filtering of metric names 
Signed-off-by: Julius Volz <julius.volz@gmail.com>
 2026-04-10 16:05:40 +02:00
Julius Volz
318c913fe2 Add API endpoint for getting Prometheus' metrics about itself 
This adds a /api/v1/status/self_metrics endpoint that allows the frontend to
fetch metrics about the server itself, making it easier to construct frontend
pages that show the current server state. This is needed because fetching
metrics from its own /metrics endpoint would be both hard to parse and also
require CORS permissions on that endpoint (for cases where the frontend
dashboard is not the same origin, at least).

Signed-off-by: Julius Volz <julius.volz@gmail.com>
 2026-04-10 16:05:08 +02:00
Julius Volz
fddbccf79b UI: Fix stored XSS via unescaped metric names and labels 
Metric names, label names, and label values containing HTML/JavaScript were
inserted into `innerHTML` without escaping in several UI code paths, enabling
stored XSS attacks via crafted metrics. This mostly becomes exploitable in
Prometheus 3.x, since it defaults to allowing any UTF-8 characters in metric
and label names.

Apply `escapeHTML()` to all user-controlled values before innerHTML
insertion in:

* Mantine UI chart tooltip
* Old React UI chart tooltip
* Old React UI metrics explorer fuzzy search
* Old React UI heatmap tooltip

See https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99

Signed-off-by: Julius Volz <julius.volz@gmail.com>
 2026-04-10 11:25:03 +02:00
Julius Volz
07c6232d15
Merge commit from fork 
UI: Fix stored XSS via unescaped metric names and labels
 2026-04-10 09:30:55 +01:00
Julien Pivotto
f45a7ee818 chore: speed up build time by moving helpers to test files. 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-09 12:02:29 +02:00
Julien
6115f305e2
Merge pull request #18478 from prometheus/release-3.11 
Merge back Release 3.11.1
 2026-04-09 09:54:44 +02:00
Arve Knudsen
56c6370b26
promql: fix info() handling of negated __name__ matchers (#17932)
Some checks are pending
buf.build / lint and publish (push) Waiting to run
Details
CI / Go tests (push) Waiting to run
Details
CI / More Go tests (push) Waiting to run
Details
CI / Go tests for Prometheus upgrades and downgrades (push) Waiting to run
Details
CI / Go tests with previous Go version (push) Waiting to run
Details
CI / UI tests (push) Waiting to run
Details
CI / Go tests on Windows (push) Waiting to run
Details
CI / Mixins tests (push) Waiting to run
Details
CI / Compliance testing (push) Waiting to run
Details
CI / Build Prometheus for common architectures (push) Waiting to run
Details
CI / Build Prometheus for all architectures (push) Waiting to run
Details
CI / Report status of build Prometheus for all architectures (push) Blocked by required conditions
Details
CI / Check generated parser (push) Waiting to run
Details
CI / golangci-lint (push) Waiting to run
Details
CI / fuzzing (push) Waiting to run
Details
CI / codeql (push) Waiting to run
Details
CI / Publish main branch artifacts (push) Blocked by required conditions
Details
CI / Publish release artefacts (push) Blocked by required conditions
Details
CI / Publish UI on npm Registry (push) Blocked by required conditions
Details
Scorecards supply-chain security / Scorecards analysis (push) Waiting to run
Details 
* promql: fix info() handling of negated __name__ matchers

---------

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
 2026-04-08 16:01:27 +00:00
Julien
9a3ac8910b
Merge pull request #18476 from roidelapluie/roidelapluie/fix-http-no-body
Some checks are pending
buf.build / lint and publish (push) Waiting to run
Details
CI / Go tests (push) Waiting to run
Details
CI / More Go tests (push) Waiting to run
Details
CI / Go tests for Prometheus upgrades and downgrades (push) Waiting to run
Details
CI / Go tests with previous Go version (push) Waiting to run
Details
CI / UI tests (push) Waiting to run
Details
CI / Go tests on Windows (push) Waiting to run
Details
CI / Mixins tests (push) Waiting to run
Details
CI / Compliance testing (push) Waiting to run
Details
CI / Build Prometheus for common architectures (push) Waiting to run
Details
CI / Build Prometheus for all architectures (push) Waiting to run
Details
CI / Report status of build Prometheus for all architectures (push) Blocked by required conditions
Details
CI / Check generated parser (push) Waiting to run
Details
CI / golangci-lint (push) Waiting to run
Details
CI / fuzzing (push) Waiting to run
Details
CI / codeql (push) Waiting to run
Details
CI / Publish main branch artifacts (push) Blocked by required conditions
Details
CI / Publish release artefacts (push) Blocked by required conditions
Details
CI / Publish UI on npm Registry (push) Blocked by required conditions
Details
Scorecards supply-chain security / Scorecards analysis (push) Waiting to run
Details 
web/api: use http.NoBody instead of nil for request body in test
 2026-04-07 17:17:47 +02:00
Julius Volz
d001e81d74
Merge pull request #18467 from prometheus/update-mantine-8-to-9 
mantine-ui: migrate from Mantine 8 to 9
 2026-04-07 16:15:58 +01:00
Julien Pivotto
fa4270f939 web/api: use http.NoBody instead of nil for request body in test 
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
 2026-04-07 16:48:02 +02:00