mirrors/prometheus
1
0
Fork 0
mirror of https://github.com/prometheus/prometheus.git synced 2026-05-04 20:06:12 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #18516 from roidelapluie/roidelapluie/cut-3.5.2

Browse Source 
Release 3.5.2 LTS
This commit is contained in:
Julien 2026-04-13 13:32:08 +02:00 committed by GitHub
commit f227287843
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
7 changed files with 21 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
CHANGELOG.md
View File

@ -2,6 +2,13 @@
## main / unreleased
## 3.5.2 / 2026-04-13
This release has a fix for a Stored XSS vulnerability that can be triggered via crafted metric names and label values in Prometheus web UI tooltips and metrics explorer. Thanks to Duc Anh Nguyen from TinyxLab for reporting it.
* [SECURITY] UI: Fix stored XSS via unescaped metric names and labels. CVE-2026-40179. #18507
* [PERF] Regex: Stop calling Simplify. #17908
## 3.5.1 / 2026-01-07
No code changes, just some dependency updates:

2
VERSION
View File

@ -1 +1 @@
3.5.1
3.5.2

4
web/ui/mantine-ui/package.json
View File

@ -1,7 +1,7 @@
{
"name": "@prometheus-io/mantine-ui",
"private": true,
"version": "0.305.1",
"version": "0.305.2",
"type": "module",
"scripts": {
"start": "vite",
@ -28,7 +28,7 @@
"@microsoft/fetch-event-source": "^2.0.1",
"@nexucis/fuzzy": "^0.5.1",
"@nexucis/kvsearch": "^0.9.1",
"@prometheus-io/codemirror-promql": "0.305.1",
"@prometheus-io/codemirror-promql": "0.305.2",
"@reduxjs/toolkit": "^2.7.0",
"@tabler/icons-react": "^3.31.0",
"@tanstack/react-query": "^5.74.7",

4
web/ui/module/codemirror-promql/package.json
View File

@ -1,6 +1,6 @@
{
"name": "@prometheus-io/codemirror-promql",
"version": "0.305.1",
"version": "0.305.2",
"description": "a CodeMirror mode for the PromQL language",
"types": "dist/esm/index.d.ts",
"module": "dist/esm/index.js",
@ -29,7 +29,7 @@
},
"homepage": "https://github.com/prometheus/prometheus/blob/main/web/ui/module/codemirror-promql/README.md",
"dependencies": {
"@prometheus-io/lezer-promql": "0.305.1",
"@prometheus-io/lezer-promql": "0.305.2",
"lru-cache": "^11.1.0"
},
"devDependencies": {

2
web/ui/module/lezer-promql/package.json
View File

@ -1,6 +1,6 @@
{
"name": "@prometheus-io/lezer-promql",
"version": "0.305.1",
"version": "0.305.2",
"description": "lezer-based PromQL grammar",
"main": "dist/index.cjs",
"type": "module",

14
web/ui/package-lock.json generated
View File

@ -1,12 +1,12 @@
{
"name": "prometheus-io",
"version": "0.305.1",
"version": "0.305.2",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "prometheus-io",
"version": "0.305.1",
"version": "0.305.2",
"workspaces": [
"mantine-ui",
"module/*"
@ -24,7 +24,7 @@
},
"mantine-ui": {
"name": "@prometheus-io/mantine-ui",
"version": "0.305.1",
"version": "0.305.2",
"dependencies": {
"@codemirror/autocomplete": "^6.18.6",
"@codemirror/language": "^6.11.0",
@ -42,7 +42,7 @@
"@microsoft/fetch-event-source": "^2.0.1",
"@nexucis/fuzzy": "^0.5.1",
"@nexucis/kvsearch": "^0.9.1",
"@prometheus-io/codemirror-promql": "0.305.1",
"@prometheus-io/codemirror-promql": "0.305.2",
"@reduxjs/toolkit": "^2.7.0",
"@tabler/icons-react": "^3.31.0",
"@tanstack/react-query": "^5.74.7",
@ -189,10 +189,10 @@
},
"module/codemirror-promql": {
"name": "@prometheus-io/codemirror-promql",
"version": "0.305.1",
"version": "0.305.2",
"license": "Apache-2.0",
"dependencies": {
"@prometheus-io/lezer-promql": "0.305.1",
"@prometheus-io/lezer-promql": "0.305.2",
"lru-cache": "^11.1.0"
},
"devDependencies": {
@ -222,7 +222,7 @@
},
"module/lezer-promql": {
"name": "@prometheus-io/lezer-promql",
"version": "0.305.1",
"version": "0.305.2",
"license": "Apache-2.0",
"devDependencies": {
"@lezer/generator": "^1.7.3",

2
web/ui/package.json
View File

@ -1,7 +1,7 @@
{
"name": "prometheus-io",
"description": "Monorepo for the Prometheus UI",
"version": "0.305.1",
"version": "0.305.2",
"private": true,
"scripts": {
"build": "bash build_ui.sh --all",