Merge upstream Prometheus v2.55.1 into invoca-2.53.1-base by ColinDKelley · Pull Request #27 · Invoca/prometheus

ColinDKelley · 2026-07-08T22:58:50Z

Summary

Merge upstream Prometheus v2.55.1 into invoca-2.53.1-base, creating the invoca-2.55.1-base version anchor for Invoca's 2.55.1 work.

This is the first PR in the 2.55.1 stack — the feature branches (#21 → #22 → #20 → #26) stack on top of this branch once merged.

Lineage

invoca-v2.35.0-base
└─ invoca-2.53.1-base ← base for this PR
└─ invoca-2.55.1-base ← this PR (upstream v2.55.1 merge)
└─ #21 → #22 → #20 → #26

What this brings in

Single merge commit (74e3596e4) pulling upstream release v2.55.1 (317 commits from 2.53.1 → 2.55.1), including TSDB/PromQL changes, dependency bumps, and Go 1.22+ toolchain updates. No Invoca-specific feature changes — those land in the stacked PRs above.

Test plan

go build ./...
go test -count=1 ./... (or at minimum ./promql/... + ./tsdb/... if full suite is too slow for review)
Confirm Docker/build pipeline still works against this base before merging feature stack

Add `HeadAndOOOQuerier` which iterates just once over series, then where necessary merges chunks from in-order and out-of-order lists. Add a ChunkQuerier for in-order and ooo together Add copy-last-chunk behaviour to HeadAndOOOChunkReader Out-of-order chunk IDs are distinguished from in-order by setting bit 23. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

So we can pass nil and have it read just OOO chunks. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Signed-off-by: suntala <arati.rana@grafana.com>

…-mixed-custom-exponential-histograms promql: fix incorrect results and panics in `sum` and `avg` over mixed custom and exponential buckets, or incompatible custom buckets

Was not working even on main. Some cases still error. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Just query via `HeadAndOOOQuerier`, which will skip series where no in-order chunks are in range. Now we don't need `OOORangeHead`. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Use HeadAndOOOChunkReader instead. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Use headIndexReader instead. OOOCompactionHeadIndexReader needs to be expanded slightly, because it previously delegated to OOOHeadIndexReader. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

This makes the diffs easier to follow. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Signed-off-by: Bryan Boreham <bjboreham@gmail.com> * Re-enable check in `createHeadWithOOOSamples` which wasn't really broken. * Move code making `Block` into a `Queryable` into test file. * Make `getSeriesChunks` return a slice (renamed `appendSeriesChunks`). * Rename `oooMergedChunks` to `mergedChunks`. * Improve comment on `ChunkOrIterableWithCopy`. * Name return values from unpackHeadChunkRef. Co-authored-by: Oleg Zaytsev <mail@olegzaytsev.com> Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

In `mmapCurrentOOOHeadChunk`, check if the number is at the maximum and drop the data with an error log. This is not expected to happen as the maximum is over 8 million; that's 8 years of 1 sample every second. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

[PERF] TSDB: Query head and ooo-head together The current implementation of out-of-order querying runs two queriers which each iterate all series in the head, then runs a merge operation on the output. This PR adds HeadAndOOOQuerier which iterates just once over series, then where necessary merges chunks from in-order and out-of-order lists. In order to distinguish in-order from out-of-order chunk references I set bit 23 (i.e. 1<<23) on ooo references; this reduces the maximum number of chunks from 16 million to 8 million. Note one side-effect of this change is that results may come in a different order - the merge operation done previously required a sort of all series. This only changes where Prometheus does not guarantee the order. Fixesprometheus#11628

…to-2.54 Ignore stale histograms for counter reset detection

…to-2.54 Use CopyTo when resetting histogram in stats iterator

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Signed-off-by: cuiweiyuan <cuiweiyuan@aliyun.com>

chore: fix some function names

Make text more consistent with 3.0 branch Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Go's sorting functions can re-order equal elements, so the strategy of sorting by the fallback ordering first does not always work. Pulling the fallback into the main comparison function is more reliable and more efficient. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

[Release 2.55] [BUGFIX] PromQL: make sort_by_label stable

…oad" This reverts commit 50f5327, reversing changes made to eb4004c. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

…4769 [Release 2.55] Revert pull request prometheus#14769 - auto config reload

Because we are reimplementing the `IndexReader` to fetch in-order and out-of-order chunks together, we must reproduce the behaviour of `Head.indexRange()`, which floors the minimum time queried at `head.MinTime()`. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

[Release 2.55] [BUGFIX] TSDB: Don't read in-order chunks from before head MinTime

…metheus#14900) New method is named `evalVectorSelector`. --------- Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

[Release 2.55] [REFACTOR] promql.Engine: Refactor vector selector evaluation into a method

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

…ise-certificate-proxy [Release 2.55] [BUILD] Upgrade github.com/googleapis/enterprise-certificate-proxy to v0.3.4

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

…eval [Release 2.55] Refactor evaluator.rangeEval by splitting out gatherVector method

The `info` function is an experiment to improve UX around including labels from info metrics. `info` has to be enabled via the feature flag `--enable-feature=promql-experimental-functions`. This MVP of info simplifies the implementation by assuming: * Only support for the target_info metric * That target_info's identifying labels are job and instance Also: * Encode info samples' original timestamp as sample value * Deduce info series select hints from top-most VectorSelector --------- Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: Ying WANG <ying.wang@grafana.com> Co-authored-by: Augustin Husson <augustin.husson@amadeus.com> Co-authored-by: Bartlomiej Plotka <bwplotka@gmail.com> Co-authored-by: Björn Rabenstein <github@rabenste.in> Co-authored-by: Bryan Boreham <bjboreham@gmail.com>

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Prepare release 2.55.0-rc.1

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Create release 2.55.0

Signed-off-by: Ben Ye <benye@amazon.com>

…removal Fix round function not hornoring delayed name removal flag

With one bugfix. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Create release 2.55.1

v2.55.1 # -----BEGIN SSH SIGNATURE----- # U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgX42TrpDUXJbbi9yZ3hs6cDg+kz # G6d3nAlAb2XQInrEgAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5 # AAAAQDv8SSMDVt2qKy7xMJE77lb0XxIDZQOdXWFOADfsrEDMih944jS9lKfmQrfHbLanxv # 0WBcUEpeaekbj/8gIqSQM= # -----END SSH SIGNATURE----- # gpg verification failed. * tag 'v2.55.1': (317 commits) Create release 2.55.1 fix round function ignoring enableDelayedNameRemoval feature flag Create release 2.55.0 Add CHANGELOG entry for prometheus#12532 Prepare release 2.55.0-rc.1 [FEATURE] PromQL: Add experimental info function MVP (prometheus#14495) evaluator.rangeEval: Split out gatherVector method Upgrade github.com/googleapis/enterprise-certificate-proxy to v0.3.4 promql.Engine: Refactor vector selector evaluation into a method (prometheus#14900) [BUGFIX] TSDB: Don't read in-order chunks from before head MinTime Revert "Merge pull request prometheus#14769 from roidelapluie/autoreload" [BUGFIX] PromQL: make sort_by_label stable [Release 2.55] Update CHANGELOG Add prometheus#14948 to CHANGELOG [BUGFIX] TSDB: Only query chunks up to truncation time (prometheus#14948) CHANGELOG: Add prometheus#14821 Merge pull request prometheus#14821 from charleskorn/nh-negative-multiplication-division Prepare release 2.55.0-rc.0 Backward compatibility with upcoming index v3 Fix error flood by downgrading OTel dependencies (prometheus#14884) ...

wiz-b82ec45539 · 2026-07-08T22:59:44Z

Wiz Scan Summary

⚠️ Many findings detected

Many findings were detected, but only a subset of the findings are displayed inline due to API constraints. To view all findings inline, please click here.

Scanner	Findings
Vulnerabilities	20 9 24 4
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	2
Software Management Findings	-

Total	20 9 24 6

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

wiz-b82ec45539 · 2026-07-08T22:59:45Z

-	golang.org/x/crypto v0.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.29.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	golang.org/x/crypto v0.26.0 // indirect


Vulnerability Finding
The following vulnerabilities impact golang.org/x/crypto versions <0.52.0: CVE-2024-45337, CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598.
These can be remediated by updating to version 0.52.0 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
golang.org/x/crypto v0.26.0// indirect
golang.org/x/crypto v0.52.0// indirect

wiz-b82ec45539 · 2026-07-08T22:59:46Z

-	github.com/digitalocean/godo v1.117.0
-	github.com/docker/docker v26.1.3+incompatible
+	github.com/digitalocean/godo v1.122.0
+	github.com/docker/docker v27.2.0+incompatible


Vulnerability Finding
More Details

Vulnerabilities [github.com/docker/docker:27.2.0+incompatible]
Name Severity Source Fixed version CVSS score CVSS exploitability score Has public exploit Has CISA KEV exploit
CVE-2026-33997 https://github.com/advisories/GHSA-pxq6-2prw-chj9 - 8.1 2.8 false false
CVE-2026-41567 https://github.com/advisories/GHSA-x86f-5xw2-fm2r - 7.2 0.8 false false
CVE-2026-41568 https://github.com/advisories/GHSA-vp62-88p7-qqf5 - 6.1 0.8 false false
CVE-2026-42306 https://github.com/advisories/GHSA-rg2x-37c3-w2rh - 7.2 0.8 false false

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate

wiz-b82ec45539 · 2026-07-08T22:59:46Z

+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.29.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.29.0
+	go.opentelemetry.io/otel/sdk v1.29.0


Vulnerability Finding
The following vulnerabilities impact go.opentelemetry.io/otel/sdk versions <1.43.0: CVE-2026-24051, CVE-2026-39883.
These can be remediated by updating to version 1.43.0 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
go.opentelemetry.io/otel/sdk v1.29.0
go.opentelemetry.io/otel/sdk v1.43.0

wiz-b82ec45539 · 2026-07-08T22:59:46Z

+	golang.org/x/tools v0.24.0
+	google.golang.org/api v0.195.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed
+	google.golang.org/grpc v1.66.0


Vulnerability Finding
The following vulnerability impacts google.golang.org/grpc versions <1.79.3: CVE-2026-33186.
It can be remediated by updating to version 1.79.3 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
google.golang.org/grpc v1.66.0
google.golang.org/grpc v1.79.3

wiz-b82ec45539 · 2026-07-08T22:59:46Z

 	github.com/godbus/dbus/v5 v5.0.4 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
-	github.com/golang/glog v1.2.0 // indirect
+	github.com/golang/glog v1.2.1 // indirect


Vulnerability Finding
The following vulnerability impacts github.com/golang/glog versions <1.2.4: CVE-2024-45339.
It can be remediated by updating to version 1.2.4 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
github.com/golang/glog v1.2.1// indirect
github.com/golang/glog v1.2.4// indirect

wiz-b82ec45539 · 2026-07-08T22:59:46Z

-	github.com/digitalocean/godo v1.117.0
-	github.com/docker/docker v26.1.3+incompatible
+	github.com/digitalocean/godo v1.122.0
+	github.com/docker/docker v27.2.0+incompatible


Vulnerability Finding
The following vulnerabilities impact github.com/docker/docker versions <29.3.1: CVE-2025-54410, CVE-2026-33997, CVE-2026-34040, CVE-2026-41567, CVE-2026-41568, CVE-2026-42306.
These can be remediated by updating to version 29.3.1 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
github.com/docker/docker v27.2.0+incompatible
github.com/docker/docker v29.3.1

wiz-b82ec45539 · 2026-07-08T22:59:46Z

 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.24.0 // indirect
-	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/crypto v0.25.0 // indirect


Vulnerability Finding
The following vulnerabilities impact golang.org/x/crypto versions <0.52.0: CVE-2024-45337, CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598.
These can be remediated by updating to version 0.52.0 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
golang.org/x/crypto v0.25.0// indirect
golang.org/x/crypto v0.52.0// indirect

wiz-b82ec45539 · 2026-07-08T22:59:46Z

-	golang.org/x/crypto v0.24.0 // indirect
-	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/crypto v0.25.0 // indirect
+	golang.org/x/net v0.27.0 // indirect


Vulnerability Finding
The following vulnerabilities impact golang.org/x/net versions <0.55.0: CVE-2025-22870, CVE-2025-22872, CVE-2026-25680, CVE-2026-39821.
These can be remediated by updating to version 0.55.0 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
golang.org/x/net v0.27.0// indirect
golang.org/x/net v0.55.0// indirect

wiz-b82ec45539 · 2026-07-08T22:59:46Z

 	golang.org/x/time v0.5.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
-	google.golang.org/grpc v1.64.0 // indirect
+	google.golang.org/grpc v1.65.0 // indirect


Vulnerability Finding
The following vulnerability impacts google.golang.org/grpc versions <1.79.3: CVE-2026-33186.
It can be remediated by updating to version 1.79.3 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
google.golang.org/grpc v1.65.0// indirect
google.golang.org/grpc v1.79.3// indirect

wiz-b82ec45539 · 2026-07-08T22:59:46Z

-	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157
-	google.golang.org/grpc v1.64.0
-	google.golang.org/protobuf v1.34.1
+	golang.org/x/oauth2 v0.23.0


Vulnerability Finding
The following vulnerability impacts golang.org/x/oauth2 versions <0.27.0: CVE-2025-22868.
It can be remediated by updating to version 0.27.0 or higher.

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
Suggested change
golang.org/x/oauth2 v0.23.0
golang.org/x/oauth2 v0.27.0

After the 2.53 merge, the extended-range branch of matrixIterSlice kept comparing buffered-sample timestamps against the original mint instead of the new mintFloats sentinel, causing samples from the previous range-query step to be re-appended and inflating counter-reset corrections for xrate/xincrease/xdelta in range mode. Also update three expected rate() values in the rate-vs-xrate showcase to match upstream's current extrapolation behavior. The narrative of the showcase (and every xrate value) is unchanged. Made-with: Cursor

Use -=, *=, and /= compound assignments flagged by golangci-lint. Co-authored-by: Cursor <cursoragent@cursor.com>

krajoramaand others added 30 commits August 13, 2024 16:05

Merge pull requestprometheus#14658from krajorama/zero-rate-nh-quantile
fe5354d
Native histograms: define behavior when rate is null.

Merge pull requestprometheus#14621from charleskorn/panic-message
c2bc6cf
promql: clarify error message logged when panic occurs during query evaluation

Merge branch 'main' into sum-and-avg-over-mixed-custom-exponential-hi…
52818a9
…stograms # Conflicts: # promql/promqltest/testdata/native_histograms.test

tsdb: prepare inserting native histograms into OOO head
4165616
Rename a variable. Add parameters to memSeries.insert function. No effect on how float samples are handled. Related to prometheus#14546 Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>

Merge pull requestprometheus#14671from krajorama/prep-ooo-native-hi…
ff0a1e5
…stograms tsdb: prepare inserting native histograms into OOO head

[Benchmark] TSDB: Add BenchmarkQuerierSelectWithOutOfOrder
0c85268
Refactor existing BenchmarkQuerierSelect to provide the set-up. Note that Head queries now run faster because they use a RangeHead. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Refactoring: extract getSeriesChunks
c75c8f8
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Refactoring: extract getOOOSeriesChunks
a32aca0
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Refactor: extract headChunkReader.chunkFromSeries()
7e24844
For when you have a series locked already. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Refactor: extract selectSeriesSet and selectChunkSeriesSet
da31da3
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

[Tests] Promtool: Sort output where Prometheus does not guarantee the…
2936ab8
… order. Previously this was working because iout-of-order chunks forced a sort and merge. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: NewHeadAndOOOChunkReader takes headChunkReader
6529d63
So we can pass nil and have it read just OOO chunks. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: Fix up LabelValues to work for OOO-only head
f261597
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Link to specific feature flag entry
ce4eac8
Signed-off-by: suntala <arati.rana@grafana.com>

Merge pull requestprometheus#14611from charleskorn/sum-and-avg-over…
9849418
…-mixed-custom-exponential-histograms promql: fix incorrect results and panics in `sum` and `avg` over mixed custom and exponential buckets, or incompatible custom buckets

TSDB tests: Fix up BenchmarkQueries
0a2ff76
Was not working even on main. Some cases still error. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: Remove code for querying OOO-head only
e7e50a3
Just query via `HeadAndOOOQuerier`, which will skip series where no in-order chunks are in range. Now we don't need `OOORangeHead`. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: Remove OOOHeadChunkReader
a299c7b
Use HeadAndOOOChunkReader instead. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: Remove OOOHeadIndexReader
26b3de0
Use headIndexReader instead. OOOCompactionHeadIndexReader needs to be expanded slightly, because it previously delegated to OOOHeadIndexReader. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: Lock round access to labels, where necessary
e95607b
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

TSDB: Cosmetic: move HeadAndOOO implementations where old code was
7ffd3ca
This makes the diffs easier to follow. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Merge pull requestprometheus#14623from prometheus/backport-pr14514-…
03d5c63
…to-2.54 Ignore stale histograms for counter reset detection

Merge pull requestprometheus#14624from prometheus/backport-pr14538-…
26977b5
…to-2.54 Use CopyTo when resetting histogram in stats iterator

Merge remote-tracking branch 'prometheus/main' into arve/wlog-histograms
b5d13a1
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

chore: fix some function names
1800af5
Signed-off-by: cuiweiyuan <cuiweiyuan@aliyun.com>

Merge pull requestprometheus#14626from cuiweiyuan/main
1daf7cd
chore: fix some function names

bborehamand others added 24 commits September 22, 2024 17:42

[Release 2.55] Update CHANGELOG
e3f5c7c
Make text more consistent with 3.0 branch Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Merge pull requestprometheus#14985from bboreham/fix-sort-by-labels
7d6884e
[Release 2.55] [BUGFIX] PromQL: make sort_by_label stable

Revert "Merge pull requestprometheus#14769from roidelapluie/autorel…
6b247c5
…oad" This reverts commit 50f5327, reversing changes made to eb4004c. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Merge pull requestprometheus#15020from prometheus/rel-2.55-revert-1…
16f3eaf
…4769 [Release 2.55] Revert pull request prometheus#14769 - auto config reload

Merge pull requestprometheus#15162from prometheus/cp-15210-2-55
e26a3db
[Release 2.55] [BUGFIX] TSDB: Don't read in-order chunks from before head MinTime

promql.Engine: Refactor vector selector evaluation into a method (pro…
f7b396a
…metheus#14900) New method is named `evalVectorSelector`. --------- Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Merge pull requestprometheus#15163from prometheus/backport-14900-2-55
e7f23c0
[Release 2.55] [REFACTOR] promql.Engine: Refactor vector selector evaluation into a method

Upgrade github.com/googleapis/enterprise-certificate-proxy to v0.3.4
90cc7e5
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Merge pull requestprometheus#15166from aknuds1/arve/upgrade-enterpr…
04ec65b
…ise-certificate-proxy [Release 2.55] [BUILD] Upgrade github.com/googleapis/enterprise-certificate-proxy to v0.3.4

evaluator.rangeEval: Split out gatherVector method
e05e97c
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Merge pull requestprometheus#15168from aknuds1/arve/refactor-range-…
249969d
…eval [Release 2.55] Refactor evaluator.rangeEval by splitting out gatherVector method

Prepare release 2.55.0-rc.1
8ea2c6a
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Add CHANGELOG entry forprometheus#12532
2788d20
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Merge pull requestprometheus#15007from prometheus/prep-2.55.0-rc.1
1f9e634
Prepare release 2.55.0-rc.1

Create release 2.55.0
bb27c6b
Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Merge pull requestprometheus#15194from prometheus/make-release-2.55
91d8025
Create release 2.55.0

fix round function ignoring enableDelayedNameRemoval feature flag
b7aca45
Signed-off-by: Ben Ye <benye@amazon.com>

Merge pull requestprometheus#15250from yeya24/fix-round-delay-name-…
a6fd22b
…removal Fix round function not hornoring delayed name removal flag

Create release 2.55.1
cfeaa2c
With one bugfix. Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

Merge pull requestprometheus#15326from prometheus/make-release-2.55.1
6d75691
Create release 2.55.1

ColinDKelley mentioned this pull request Jul 8, 2026
Fix xrate extended-range iteration and refresh rate-vs-xrate showcase (2.55) #21
Closed
2 tasks

wiz-b82ec45539Bot reviewed Jul 8, 2026
View reviewed changes

ColinDKelley mentioned this pull request Jul 9, 2026
Merge upstream Prometheus v3.13.0 into invoca-2.55.1-base #28
Draft
24 tasks

ColinDKelleyand others added 2 commits July 9, 2026 15:17

Fix gocritic assignOp lint in promql rate helpers
d77f1d8
Use -=, *=, and /= compound assignments flagged by golangci-lint. Co-authored-by: Cursor <cursoragent@cursor.com>

Navigation Menu

Uh oh!

Merge upstream Prometheus v2.55.1 into invoca-2.53.1-base - #27

Merge upstream Prometheus v2.55.1 into invoca-2.53.1-base#27
ColinDKelley wants to merge 503 commits into
invoca-2.53.1-basefrom
invoca-2.55.1-base

ColinDKelley commented Jul 8, 2026

Uh oh!

wiz-b82ec45539Bot commented Jul 8, 2026•
edited
Loading

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

	golang.org/x/crypto v0.26.0// indirect
	golang.org/x/crypto v0.52.0// indirect

Name	Source	Fixed version	CVSS score	CVSS exploitability score	Has public exploit	Has CISA KEV exploit
`CVE-2026-33997`	`https://github.com/advisories/GHSA-pxq6-2prw-chj9`	-	8.1	2.8	false	false
`CVE-2026-41567`	`https://github.com/advisories/GHSA-x86f-5xw2-fm2r`	-	7.2	0.8	false	false
`CVE-2026-41568`	`https://github.com/advisories/GHSA-vp62-88p7-qqf5`	-	6.1	0.8	false	false
`CVE-2026-42306`	`https://github.com/advisories/GHSA-rg2x-37c3-w2rh`	-	7.2	0.8	false	false

	go.opentelemetry.io/otel/sdk v1.29.0
	go.opentelemetry.io/otel/sdk v1.43.0

	google.golang.org/grpc v1.66.0
	google.golang.org/grpc v1.79.3

	github.com/golang/glog v1.2.1// indirect
	github.com/golang/glog v1.2.4// indirect

	github.com/docker/docker v27.2.0+incompatible
	github.com/docker/docker v29.3.1

	golang.org/x/crypto v0.25.0// indirect
	golang.org/x/crypto v0.52.0// indirect

	golang.org/x/net v0.27.0// indirect
	golang.org/x/net v0.55.0// indirect

	google.golang.org/grpc v1.65.0// indirect
	google.golang.org/grpc v1.79.3// indirect

Uh oh!

Conversation

ColinDKelley commented Jul 8, 2026

Summary

Lineage

What this brings in

Test plan

Related

Uh oh!

wiz-b82ec45539Bot commented Jul 8, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Vulnerabilities [github.com/docker/docker:27.2.0+incompatible]

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

wiz-b82ec45539BotJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

wiz-b82ec45539Bot commented Jul 8, 2026•
edited
Loading

Vulnerabilities [`github.com/docker/docker:27.2.0+incompatible`]