Your message dated Fri, 24 Jul 2026 01:25:25 +0000
with message-id <[email protected]>
and subject line Bug#1138247: fixed in prometheus 3.5.3+ds1-1
has caused the Debian Bug report #1138247,
regarding Upgrade to Prometheus 3.5
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138247: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138247
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: src:prometheus
Severity: important
X-Debbugs-Cc: [email protected], [email protected], [email protected],
[email protected]
Hi Martina, Daniel, Lucas, and the pkg-golang team,
Now with Trixie released, we need to think about our upgrading strategy for
Prometheus. I haven't heard of such plans yet; please provide me with links so
that I can catch up in case I missed anything.
In the meantime, Iâve been looking into the current RC issues affecting the
2.53.x series in Unstable, and the situation is becoming increasingly difficult
to manage on the 2.x branch:
**1. Unpatched Security Vulnerabilities (Grave)**
Two high-severity CVEs were published in May 2026 (Bug #1135999):
* **CVE-2026-42151:** Plaintext exposure of the Azure AD `client_secret` via
the `/-/config` endpoint.
* **CVE-2026-42154:** DoS (memory exhaustion) via the `/api/v1/read` endpoint
when handling snappy-compressed requests.
Upstream has fixed these in the 3.x line (v3.5.3 LTS and v3.12.0). However,
because the 2.53 LTS branch officially reached its End-of-Life in July 2025,
upstream has **not** backported these fixes to 2.x, and no future 2.5x releases
are planned.
**2. Go 1.26 FTBFS Regression (Serious)**
We are seeing a FTBFS in archive rebuilds (Bugs #1137403, #1114942) with the
error `parse error: unexpected character inside braces: '0'`. This is a
regression tied to the Go 1.26 toolchain/libraries and stricter PromQL label
validation. This is also unlikely to be addressed upstream in the EOL 2.x
branch.
**Transition to 3.x**
What do we need for upgrading to 3.x? Is the old UI still available and can we
somehow avoid introducing all those nodejs dependencies? Is packaging the UI
separately an option?
-rt
--- End Message ---
--- Begin Message ---
Source: prometheus
Source-Version: 3.5.3+ds1-1
Done: Reinhard Tartler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
prometheus, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <[email protected]> (supplier of updated prometheus package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 19 Jul 2026 10:17:49 -0300
Source: prometheus
Architecture: source
Version: 3.5.3+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Reinhard Tartler <[email protected]>
Closes: 1135260 1135999 1138247
Changes:
prometheus (3.5.3+ds1-1) unstable; urgency=medium
.
* Team upload.
* New upstream release 3.5.3. (Closes: #1138247)
- Fixes CVE-2026-42151 and CVE-2026-42154. (Closes: #1135999)
- Fixes flaky tests. (Closes: #1135260)
* Refresh patches.
* Drop web UI due to missing dependencies in Debian (rust-rolldown).
* Drop obsolete UI dependencies (fonts, libjs) from debian/control.
* Drop legacy UTF-8 label validation patches to fix test panics and
restore test coverage.
* Add comprehensive autopkgtest for Prometheus systemd service.
Checksums-Sha1:
204071420470747a055b2f4778510238a1164a0b 4873 prometheus_3.5.3+ds1-1.dsc
3adc4411c506c14c50ca52e4579571b37d70f623 2005108
prometheus_3.5.3+ds1.orig.tar.xz
86f6c0206454134cfe3686debd7dcee8b600bfc7 78980
prometheus_3.5.3+ds1-1.debian.tar.xz
Checksums-Sha256:
188182e4314ed6da141e40da6b72697c0fa3099aeac40cb4b9a4c147203d3011 4873
prometheus_3.5.3+ds1-1.dsc
271a91b47e6ff9e507bf94e8c9eb76005ff24afd07a713bd1345a4b98e3add1c 2005108
prometheus_3.5.3+ds1.orig.tar.xz
def2b7a7f02c22ee669497ef9b9e7de91e33e4497144f1332f13e8ba14b0d721 78980
prometheus_3.5.3+ds1-1.debian.tar.xz
Files:
863f23f0679947b3b4f2144d3cbabc36 4873 golang optional
prometheus_3.5.3+ds1-1.dsc
5375a4d3c60f768f92a6a47535d9d380 2005108 golang optional
prometheus_3.5.3+ds1.orig.tar.xz
2fe2c37ac7f75edcc2b7492e8d30c7bb 78980 golang optional
prometheus_3.5.3+ds1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmpirbMUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstYPRAAjUutk9meph4Jz/emDA/Z3O0aqwk3
Ox65CUBYQ+mZPpUiM392Y1Q/CO3A6bTwexsGgQjvh9Mb7OS3BKHWqtvSyf6CIlUt
3OS1Z5dpSRWTxdd8PueKHUbomeBnTyVyQxwKRd4KTHPY8MxNf0rKI7Tt4gQSQPJ1
YZD/5xgskPXuYcVP9+RMW8p4nldAGZpn/2OAlsepAmAofmazbCCvBWN0UUc7+rRv
qZNXcj2u/nrWjKPPlgW/mbzU1ce4aC/hw8p3/Mcwygmc8PStFEu8nR7JtwP/yPly
S4WaZXLMHHLGDECSHxhhzf+YZZYGog3luJD1fbiPfSLMPgZw5zGFGrxmEG//2tzw
VqE+rCpjmIXvHx5uGbU6IAq1nCZPjxyo3Ppu6duJHuwsMBANsnA37QtDFUfRJoh1
neTEnPmr5YxNSgTLxbq2SUcjEUoNRezJWWZ4PnIcWZ9zLU0UHf6XI9uvX7544Ek5
g70ewKR5znDrPVuCIx+Obk/DrLuobRwDBoBspbEjf0KRC5+TUmGzeh9OgRnrpRtn
ELSTUuXizM+o9erdwDQzaRsbJZhd1DmUzs5NTcuJCeJbdEHemSD2u/x/rAH/j0Xb
IUv5co83IDqo4+51OurDzx+bxDXio83H52CQzpaLhZAmYR5nOBWfskMbW4n8c299
2Y8W9MNYKiptPmE=
=B1fi
-----END PGP SIGNATURE-----
pgpHkJsV4lES8.pgp
Description: PGP signature
--- End Message ---
