From d1c574651d966226628ede1b0e43cf673762c05b Mon Sep 17 00:00:00 2001 From: Julien Pivotto <291750+roidelapluie@users.noreply.github.com> Date: Mon, 27 Apr 2026 15:43:24 +0200 Subject: [PATCH] Release 3.5.3 Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com> --- CHANGELOG.md | 15 +++++++++++++++ VERSION | 2 +- web/ui/mantine-ui/package.json | 4 ++-- web/ui/module/codemirror-promql/package.json | 4 ++-- web/ui/module/lezer-promql/package.json | 2 +- web/ui/package-lock.json | 14 +++++++------- web/ui/package.json | 2 +- 7 files changed, 29 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eb6733b9f5..00eb9752cf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,21 @@ ## main / unreleased +## 3.5.3 / 2026-04-27 + +This release fixes mutiple security issues. + +We would like to thank the following people for the responsible disclosures: +- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability. +- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability. +- @iiihaiii and @Ngocnn97 for the Old UI XSS vulnerability. + + +- [SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 #18587 +- [SECURITY] Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. #18591 +- [SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 #18585 +- [SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 #18589 + ## 3.5.2 / 2026-04-13 This release has a fix for a Stored XSS vulnerability that can be triggered via crafted metric names and label values in Prometheus web UI tooltips and metrics explorer. Thanks to Duc Anh Nguyen from TinyxLab for reporting it. diff --git a/VERSION b/VERSION index 87ce492908..444877d48f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.5.2 +3.5.3 diff --git a/web/ui/mantine-ui/package.json b/web/ui/mantine-ui/package.json index d1d10be5bd..01521b3238 100644 --- a/web/ui/mantine-ui/package.json +++ b/web/ui/mantine-ui/package.json @@ -1,7 +1,7 @@ { "name": "@prometheus-io/mantine-ui", "private": true, - "version": "0.305.2", + "version": "0.305.3", "type": "module", "scripts": { "start": "vite", @@ -28,7 +28,7 @@ "@microsoft/fetch-event-source": "^2.0.1", "@nexucis/fuzzy": "^0.5.1", "@nexucis/kvsearch": "^0.9.1", - "@prometheus-io/codemirror-promql": "0.305.2", + "@prometheus-io/codemirror-promql": "0.305.3", "@reduxjs/toolkit": "^2.7.0", "@tabler/icons-react": "^3.31.0", "@tanstack/react-query": "^5.74.7", diff --git a/web/ui/module/codemirror-promql/package.json b/web/ui/module/codemirror-promql/package.json index 4fe240c97f..a74a6f79a1 100644 --- a/web/ui/module/codemirror-promql/package.json +++ b/web/ui/module/codemirror-promql/package.json @@ -1,6 +1,6 @@ { "name": "@prometheus-io/codemirror-promql", - "version": "0.305.2", + "version": "0.305.3", "description": "a CodeMirror mode for the PromQL language", "types": "dist/esm/index.d.ts", "module": "dist/esm/index.js", @@ -29,7 +29,7 @@ }, "homepage": "https://github.com/prometheus/prometheus/blob/main/web/ui/module/codemirror-promql/README.md", "dependencies": { - "@prometheus-io/lezer-promql": "0.305.2", + "@prometheus-io/lezer-promql": "0.305.3", "lru-cache": "^11.1.0" }, "devDependencies": { diff --git a/web/ui/module/lezer-promql/package.json b/web/ui/module/lezer-promql/package.json index f3c2eb3bf4..c88f1d0192 100644 --- a/web/ui/module/lezer-promql/package.json +++ b/web/ui/module/lezer-promql/package.json @@ -1,6 +1,6 @@ { "name": "@prometheus-io/lezer-promql", - "version": "0.305.2", + "version": "0.305.3", "description": "lezer-based PromQL grammar", "main": "dist/index.cjs", "type": "module", diff --git a/web/ui/package-lock.json b/web/ui/package-lock.json index e8310de400..43775d1419 100644 --- a/web/ui/package-lock.json +++ b/web/ui/package-lock.json @@ -1,12 +1,12 @@ { "name": "prometheus-io", - "version": "0.305.2", + "version": "0.305.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "prometheus-io", - "version": "0.305.2", + "version": "0.305.3", "workspaces": [ "mantine-ui", "module/*" @@ -24,7 +24,7 @@ }, "mantine-ui": { "name": "@prometheus-io/mantine-ui", - "version": "0.305.2", + "version": "0.305.3", "dependencies": { "@codemirror/autocomplete": "^6.18.6", "@codemirror/language": "^6.11.0", @@ -42,7 +42,7 @@ "@microsoft/fetch-event-source": "^2.0.1", "@nexucis/fuzzy": "^0.5.1", "@nexucis/kvsearch": "^0.9.1", - "@prometheus-io/codemirror-promql": "0.305.2", + "@prometheus-io/codemirror-promql": "0.305.3", "@reduxjs/toolkit": "^2.7.0", "@tabler/icons-react": "^3.31.0", "@tanstack/react-query": "^5.74.7", @@ -189,10 +189,10 @@ }, "module/codemirror-promql": { "name": "@prometheus-io/codemirror-promql", - "version": "0.305.2", + "version": "0.305.3", "license": "Apache-2.0", "dependencies": { - "@prometheus-io/lezer-promql": "0.305.2", + "@prometheus-io/lezer-promql": "0.305.3", "lru-cache": "^11.1.0" }, "devDependencies": { @@ -222,7 +222,7 @@ }, "module/lezer-promql": { "name": "@prometheus-io/lezer-promql", - "version": "0.305.2", + "version": "0.305.3", "license": "Apache-2.0", "devDependencies": { "@lezer/generator": "^1.7.3", diff --git a/web/ui/package.json b/web/ui/package.json index a9b83625cb..f083bb1b27 100644 --- a/web/ui/package.json +++ b/web/ui/package.json @@ -1,7 +1,7 @@ { "name": "prometheus-io", "description": "Monorepo for the Prometheus UI", - "version": "0.305.2", + "version": "0.305.3", "private": true, "scripts": { "build": "bash build_ui.sh --all",