{ "schemaVersion": 3, "dataset": { "version": 3, "date": "2026-08-13", "group": { "id": "observability", "name": "Observability & Reliability" }, "repository": { "id": "loki", "repo": "grafana/loki", "name": "Loki", "keywords": [ "Grafana Loki" ] }, "context": { "repository": "grafana/loki", "url": "https://github.com/grafana/loki", "description": "Like Prometheus, but for logs.", "homepage": "https://grafana.com/oss/loki", "language": "Go", "topics": [ "cloudnative", "grafana", "hacktoberfest", "logging", "loki", "prometheus" ], "license": "AGPL-3.0", "defaultBranch": "main", "stars": 28722, "forks": 4091, "openIssues": 1754, "archived": false, "collectedAt": "2026-08-13T18:02:03.296869+00:00" }, "news": { "repository": "grafana/loki", "collectedAt": "2026-08-13T18:02:03.296869+00:00", "latestRelease": { "repository": "grafana/loki", "tag": "v3.7.6", "title": "v3.7.6", "url": "https://github.com/grafana/loki/releases/tag/v3.7.6", "publishedAt": "2026-08-06T09:42:29Z", "notes": "## [3.7.6](https://github.com/grafana/loki/compare/v3.7.5...v3.7.6) (2026-08-05)\n\n\n### Bug Fixes\n\n* **queryrange:** Preserve sketch in MergeLabels [release-3.7.x] ([#23770](https://github.com/grafana/loki/issues/23770)) ([d48329d](https://github.com/grafana/loki/commit/d48329d090320f668cd8bd7ecd636d3dc0e664d2))", "highlights": [ "3.7.6 (2026-08-05)", "Bug Fixes", "queryrange: Preserve sketch in MergeLabels [release-3.7.x] (#23770) (d48329d)" ], "prerelease": false }, "upcoming": [], "communityDiscussions": [] }, "runs": [ { "collectedAt": "2026-08-13T12:26:38.318Z", "since": "2026-08-12T12:26:38.318Z", "observedCount": 65, "changedCount": 65 }, { "collectedAt": "2026-08-13T13:48:00.446149Z", "since": "2026-08-12T13:48:00.446149Z", "observedCount": 64, "changedCount": 64 }, { "collectedAt": "2026-08-13T16:19:22.035158Z", "since": "2026-08-12T16:19:22.035158Z", "observedCount": 61, "changedCount": 10 }, { "collectedAt": "2026-08-13T17:43:20.785491Z", "since": "2026-08-12T17:43:20.785491Z", "observedCount": 60, "changedCount": 3 }, { "collectedAt": "2026-08-13T17:47:07.884300Z", "since": "2026-08-12T17:47:07.884300Z", "observedCount": 60, "changedCount": 0 }, { "collectedAt": "2026-08-13T18:01:55.420671Z", "since": "2026-08-12T18:01:55.420671Z", "observedCount": 61, "changedCount": 1 } ], "signals": [ { "id": "github:grafana/loki:issue:18760", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Duplicate log lines can be introduced by automatic stream sharding", "text": "There may be other issues describing this but with a brief search I didn't find any. Loki currently has de-duplication logic which follows these rules: Lines are removed from results as duplicates when: * Are in the same stream * They have the exact same timestamp to the nanosecond * Have the exact same log content Not related to this issue directly but a different bug also exists #15425 where that logic also needs to be extended to compare if the structured metadata is the same or not. The problem here though is there are a number of situations where a log can be accepted by Loki but re-sent by a client and by the nature of how automatic stream sharding works, end up in a different stream. Auto stream sharding will add a label e.g. `__stream_shard__=1`, but when the log is resent it may end up in a different stream e.g. `__stream_shard__=5` This will result in these log lines not being de-duplicated properly in results.", "url": "https://github.com/grafana/loki/issues/18760", "createdAt": "2025-08-07T18:23:28Z", "updatedAt": "2026-08-13T08:26:15Z", "timestamp": "2026-08-13T08:26:15Z", "metrics": { "reactions": 13, "comments": 3 }, "labels": [ "type/bug" ], "author": "slim-bean", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:issue:20673", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Replace `go.uber.go/atomic` with Go standard library `sync/atomic`", "text": "## Summary We currently have a linter rule that blocks usage of `sync/atomic` and forces us to use `go.uber.go/atomic` instead. This rule was originally added because `sync/atomic` required atomic operations on primitive types, which was considered error-prone. However, since **Go 1.19**, the standard library `sync/atomic` package now includes typed wrappers (e.g., `atomic.Uint32`, `atomic.Int64`, `atomic.Bool`, etc.) that provide the same safety guarantees as `go.uber.go/atomic`. This makes the uber package redundant. ## Context Prometheus is also making this transition: - Issue: https://github.com/prometheus/prometheus/issues/14866 - PR: https://github.com/prometheus/prometheus/pull/18009 ## Proposed Changes 1. **Remove the linter rule** that blocks `sync/atomic` 2. **Migrate all `go.uber.go/atomic` usage** to the standard library `sync/atomic` typed wrappers 3. **Configure a linter rule** to block the old-style atomic functions that operate on primitive types (e.g., `atomic.AddInt64`, `atomic.LoadUint32`) to ensure we only use the new typed wrappers and avoid accidental misuse This approach gives us: - Fewer external dependencies - Alignment with the broader Go ecosystem - Same safety guarantees we had with uber/atomic ## References - Go 1.19 release notes on atomic types: https://tip.golang.org/doc/go1.19#atomic_types - `sync/atomic` package docs: https://pkg.go.dev/sync/atomic", "url": "https://github.com/grafana/loki/issues/20673", "createdAt": "2026-02-04T12:44:57Z", "updatedAt": "2026-08-13T16:32:33Z", "timestamp": "2026-08-13T16:32:33Z", "metrics": { "reactions": 0, "comments": 6 }, "labels": [ "good first issue" ], "author": "Segflow", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:issue:21926", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "[Bug] PutObject fails with 400 InvalidArgument on non-AWS S3 (NetApp ONTAP, others) after PR #21848/#21849 - x-amz-content-sha256 PAYLOAD-TRAILER not supported", "text": "Summary PRs #21849 (3.7.2) and #21848 (3.6.11) introduced a regression that causes complete data loss on S3-compatible storage that does not support the STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER value in the x-amz-content-sha256 header. Ingesters fail to flush chunks to object storage after 8 retries and silently drop data. Affected versions ``` ┌──────────────┬──────────┬─────────────────────────────────────────────────────┐ │ Version │ Affected │ Reason │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.6.8–3.6.10 │ ✅ No │ AWS SDK v1, no checksum PR │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.6.11 │ ❌ Yes │ PR #21848 backport │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.7.0–3.7.1 │ ❌ Yes │ AWS SDK v2 migration (s3 >= v1.74.1, default CRC32) │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.7.2 │ ❌ Yes │ PR #21849 + SDK v2 │ └──────────────┴──────────┴─────────────────────────────────────────────────────┘ ``` Environment - Loki version: 3.7.2 (also reproduced on 3.7.1 and 3.6.11) - Deployment: Nomad, simple scalable mode (write/read/backend targets), replication_factor: 3 - Object storage: NetApp ONTAP 9.16.1P6 (S3-compatible API) - Schema: v13, TSDB store - Auth: SigV4, path-style requests (s3forcepathstyle: true), HTTPS with custom endpoint Error Every PutObject call fails: ``` level=error caller=flush.go:262 component=ingester loop=14 org_id=fake msg=\"failed to flush\" retries=8 err=\"failed to flush chunks: store put chunk: operation error S3: PutObject, https response error StatusCode: 400, RequestID: , HostID: , api error InvalidArgument: x-amz-content-sha256 must be UNSIGNED-PAYLOAD, STREAMING-AWS4-HMAC-SHA256-PAYLOAD or a valid sha256 value.\" ``` After 8 retries the chunk is permanently dropped. Data loss is immediate and affects all streams being flushed. Root cause PR #21849/#21848 hardcodes ChecksumAlgorithm: types.ChecksumAlgorithmSha256 directly in PutObjectInput in pkg/storage/chunk/client/aws/s3_storage_client.go: ``` // Added by PR #21849 input := &s3.PutObjectInput{ ... ChecksumAlgorithm: types.ChecksumAlgorithmSha256, // ← this } ``` When an explicit ChecksumAlgorithm is set in AWS SDK v2, the SDK switches to STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER signing mode (trailing checksums over HTTPS). Many S3-compatible implementations — including NetApp ONTAP 9.16.1P6 — do not support this signing variant and reject the request. The PR description states: | \"Non-Object-Lock buckets accept the extra header as well, so the change is safe for every target\" This assumption is incorrect for non-AWS S3 implementations. Additional note on 3.7.0/3.7.1 The 3.7.x series is also affected independently of the checksum PR: the AWS SDK v2 migration (s3 >= v1.74.1) enables RequestChecksumCalculation: WhenSupported by default, causing automatic CRC32 checksums on PutObject. This also results in STREAMING-UNSIGNED-PAYLOAD-TRAILER, which ONTAP rejects. Setting AWS_REQUEST_CHECKSUM_CALCULATION=WHEN_REQUIRED does not fix 3.7.2 or 3.6.11 because the explicit ChecksumAlgorithmSha256 field in PutObjectInput takes precedence over the global SDK setting. S3 config (for reference) ``` storage_config: aws: endpoint: https://s3.example.internal region: us-east-1 bucketnames: loki s3forcepathstyle: true insecure: false http_config: insecure_skip_verify: true # self-signed cert on internal endpoint storage_config: aws: endpoint: https://s3.example.internal region: us-east-1 bucketnames: loki s3forcepathstyle: true s3forcepathstyle: true insecure: false http_config: insecure_skip_verify: true # self-signed cert on internal endpoint ``` Proposed fix Gate ChecksumAlgorithm behind a new opt-in config flag, for example: ``` storage_config: aws: object_lock: true # default: false — only enable for actual Object Lock buckets ``` When object_lock: false (default), omit ChecksumAlgorithm from PutObjectInput, preserving the pre-3.6.11/3.7.2 behavior for non-AWS S3 users. Related - Original Object Lock bug this was meant to fix: #20088 - Identical pattern in another project with ONTAP: vmware-tanzu/velero#8152 - AWS SDK v2 default CRC32 behavior announcement: aws/aws-sdk-go-v2 discussion #2960", "url": "https://github.com/grafana/loki/issues/21926", "createdAt": "2026-05-15T11:06:29Z", "updatedAt": "2026-08-12T16:52:15Z", "timestamp": "2026-08-12T16:52:15Z", "metrics": { "reactions": 0, "comments": 9 }, "labels": [], "author": "adamw-linadm", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:issue:23439", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Dependency Dashboard", "text": "> ℹ️ **Note** > > This PR body was truncated due to platform limits. This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - ⚠️ WARN: GitHub failure: secondary rate limit - ⚠️ WARN: Package lookup failures - ⚠️ WARN: Error updating branch: update failure ## Abandoned Dependencies The following dependencies have not received updates for an extended period and may be unmaintained.
View abandoned dependencies (173) > [!NOTE] Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity. > | Datasource | Package | Last Updated | |------------|------|-------------| | bundler | [fluent-plugin-multi-format-parser](https://redirect.github.com/repeatedly/fluent-plugin-multi-format-parser) | `2023-11-29` | | gomod | [github.com/DmitriyVTitov/size](https://redirect.github.com/DmitriyVTitov/size) | `2022-04-11` | | gomod | [github.com/MasslessParticle/azure-storage-blob-go](https://redirect.github.com/MasslessParticle/azure-storage-blob-go) | `2021-07-02` | | gomod | [github.com/Masterminds/goutils](https://redirect.github.com/Masterminds/goutils) | `2021-02-04` | | gomod | [github.com/NYTimes/gziphandler](https://redirect.github.com/NYTimes/gziphandler) | `2019-02-21` | | gomod | [github.com/ViaQ/logerr/v2](https://redirect.github.com/ViaQ/logerr) | `2022-06-10` | | gomod | [github.com/alecthomas/kingpin/v2](https://redirect.github.com/alecthomas/kingpin) | `2023-09-30` | | gomod | [github.com/aliyun/aliyun-oss-go-sdk](https://redirect.github.com/aliyun/aliyun-oss-go-sdk) | `2023-12-28` | | gomod | [github.com/antlr4-go/antlr/v4](https://redirect.github.com/antlr4-go/antlr) | `2024-05-15` | | gomod | [github.com/atotto/clipboard](https://redirect.github.com/atotto/clipboard) | `2021-02-24` | | gomod | [github.com/bboreham/go-loser](https://redirect.github.com/bboreham/go-loser) | `2023-09-20` | | gomod | [github.com/beorn7/perks](https://redirect.github.com/beorn7/perks) | `2019-07-31` | | gomod | [github.com/blang/semver/v4](https://redirect.github.com/blang/semver) | `2020-05-24` | | gomod | [github.com/c2h5oh/datasize](https://redirect.github.com/c2h5oh/datasize) | `2023-12-15` | | gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` | | gomod | [github.com/containerd/fifo](https://redirect.github.com/containerd/fifo) | `2023-02-17` | | gomod | [github.com/containerd/log](https://redirect.github.com/containerd/log) | `2023-09-09` | | gomod | [github.com/coreos/go-semver](https://redirect.github.com/coreos/go-semver) | `2023-01-16` | | gomod | [github.com/coreos/go-systemd](https://redirect.github.com/coreos/go-systemd) | `2019-11-04` | | gomod | [github.com/cristalhq/hedgedhttp](https://redirect.github.com/cristalhq/hedgedhttp) | `2023-09-15` | | gomod | [github.com/d4l3k/messagediff](https://redirect.github.com/d4l3k/messagediff) | `2017-08-07` | | gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` | | gomod | [github.com/dennwc/varint](https://redirect.github.com/dennwc/varint) | `2019-06-16` | | gomod | [github.com/dgryski/go-rendezvous](https://redirect.github.com/dgryski/go-rendezvous) | `2020-08-23` | | gomod | [github.com/distribution/reference](https://redirect.github.com/distribution/reference) | `2024-03-20` | | gomod | [github.com/docker/go-metrics](https://redirect.github.com/docker/go-metrics) | `2019-08-28` | | gomod | [github.com/docker/go-plugins-helpers](https://redirect.github.com/docker/go-plugins-helpers) | `2024-07-01` | | gomod | [github.com/docker/go-units](https://redirect.github.com/docker/go-units) | `2022-05-17` | | gomod | [github.com/dolthub/maphash](https://redirect.github.com/dolthub/maphash) | `2023-04-03` | | gomod | [github.com/dolthub/swiss](https://redirect.github.com/dolthub/swiss) | `2023-08-28` | | gomod | [github.com/drone/envsubst](https://redirect.github.com/drone/envsubst) | `2021-06-16` | | gomod | [github.com/dustin/go-humanize](https://redirect.github.com/dustin/go-humanize) | `2023-01-10` | | gomod | [github.com/facette/natsort](https://redirect.github.com/facette/natsort) | `2018-12-10` | | gomod | [github.com/go-kit/log](https://redirect.github.com/go-kit/log) | `2022-04-27` | | gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-14` | | gomod | [github.com/go-ole/go-ole](https://redirect.github.com/go-ole/go-ole) | `2023-08-04` | | gomod | [github.com/go-playground/locales](https://redirect.github.com/go-playground/locales) | `2023-01-05` | | gomod | [github.com/go-playground/universal-translator](https://redirect.github.com/go-playground/universal-translator) | `2023-01-30` | | gomod | [github.com/gobwas/glob](https://redirect.github.com/gobwas/glob) | `2018-02-08` | | gomod | [github.com/gogo/googleapis](https://redirect.github.com/gogo/googleapis) | `2021-03-10` | | gomod | [github.com/gogo/protobuf](https://redirect.github.com/gogo/protobuf) | `2021-01-10` | | gomod | [github.com/gogo/status](https://redirect.github.com/gogo/status) | `2022-04-23` | | gomod | [github.com/golang/protobuf](https://redirect.github.com/golang/protobuf) | `2024-03-06` | | gomod | [github.com/golang/snappy](https://redirect.github.com/golang/snappy) | `2023-12-25` | | gomod | [github.com/google/gofuzz](https://redirect.github.com/google/gofuzz) | `2020-08-04` | | gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` | | gomod | [github.com/gorilla/mux](https://redirect.github.com/gorilla/mux) | `2023-10-18` | | gomod | [github.com/gorilla/websocket](https://redirect.github.com/gorilla/websocket) | `2024-06-14` | | gomod | [github.com/grafana/memberlist](https://redirect.github.com/grafana/memberlist) | `2021-11-12` | | gomod | [github.com/hashicorp/errwrap](https://redirect.github.com/hashicorp/errwrap) | `2020-07-14` | | gomod | [github.com/hashicorp/go-cleanhttp](https://redirect.github.com/hashicorp/go-cleanhttp) | `2021-02-03` | | gomod | [github.com/hashicorp/go-hclog](https://redirect.github.com/hashicorp/go-hclog) | `2024-04-01` | | gomod | [github.com/hashicorp/go-immutable-radix](https://redirect.github.com/hashicorp/go-immutable-radix) | `2023-11-21` | | gomod | [github.com/hashicorp/go-multierror](https://redirect.github.com/hashicorp/go-multierror) | `2021-03-11` | | gomod | [github.com/hashicorp/go-rootcerts](https://redirect.github.com/hashicorp/go-rootcerts) | `2019-12-10` | | gomod | [github.com/hashicorp/golang-lru](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-21` | | gomod | [github.com/hashicorp/golang-lru/v2](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-21` | | gomod | [github.com/huandu/xstrings](https://redirect.github.com/huandu/xstrings) | `2024-06-06` | | gomod | [github.com/inconshreveable/mousetrap](https://redirect.github.com/inconshreveable/mousetrap) | `2022-11-27` | | gomod | [github.com/influxdata/tdigest](https://redirect.github.com/influxdata/tdigest) | `2019-10-30` | | gomod | [github.com/jmespath/go-jmespath](https://redirect.github.com/jmespath/go-jmespath) | `2020-09-18` | | gomod | [github.com/joshdk/go-junit](https://redirect.github.com/joshdk/go-junit) | `2021-02-26` | | gomod | [github.com/jpillora/backoff](https://redirect.github.com/jpillora/backoff) | `2019-10-03` | | gomod | [github.com/json-iterator/go](https://redirect.github.com/json-iterator/go) | `2021-09-11` | | gomod | [github.com/klauspost/pgzip](https://redirect.github.com/klauspost/pgzip) | `2022-09-30` | | gomod | [github.com/kylelemons/godebug](https://redirect.github.com/kylelemons/godebug) | `2019-05-05` | | gomod | [github.com/mattn/go-ieproxy](https://redirect.github.com/mattn/go-ieproxy) | `2024-05-22` | | gomod | [github.com/mfridman/interpolate](https://redirect.github.com/mfridman/interpolate) | `2023-12-22` | | gomod | [github.com/minio/md5-simd](https://redirect.github.com/minio/md5-simd) | `2021-01-07` | | gomod | [github.com/mitchellh/colorstring](https://redirect.github.com/mitchellh/colorstring) | `2019-02-13` | | gomod | [github.com/mitchellh/copystructure](https://redirect.github.com/mitchellh/copystructure) | `2021-05-05` | | gomod | [github.com/mitchellh/go-homedir](https://redirect.github.com/mitchellh/go-homedir) | `2019-01-27` | | gomod | [github.com/mitchellh/go-wordwrap](https://redirect.github.com/mitchellh/go-wordwrap) | `2020-09-25` | | gomod | [github.com/mitchellh/mapstructure](https://redirect.github.com/mitchellh/mapstructure) | `2022-04-20` | | gomod | [github.com/mitchellh/reflectwalk](https://redirect.github.com/mitchellh/reflectwalk) | `2021-05-03` | | gomod | [github.com/moby/docker-image-spec](https://redirect.github.com/moby/docker-image-spec) | `2024-02-09` | | gomod | [github.com/modern-go/concurrent](https://redirect.github.com/modern-go/concurrent) | `2018-03-06` | | gomod | [github.com/modern-go/reflect2](https://redirect.github.com/modern-go/reflect2) | `2021-09-11` | | gomod | [github.com/muesli/cancelreader](https://redirect.github.com/muesli/cancelreader) | `2022-06-22` | | gomod | [github.com/munnerz/goautoneg](https://redirect.github.com/munnerz/goautoneg) | `2019-10-10` | | gomod | [github.com/mwitkow/go-conntrack](https://redirect.github.com/mwitkow/go-conntrack) | `2019-07-16` | | gomod | [github.com/opencontainers/go-digest](https://redirect.github.com/opencontainers/go-digest) | `2020-05-14` | | gomod | [github.com/opentracing/opentracing-go](https://redirect.github.com/opentracing/opentracing-go) | `2020-07-01` | | gomod | [github.com/pkg/browser](https://redirect.github.com/pkg/browser) | `2024-01-02` | | gomod | [github.com/pkg/errors](https://redirect.github.com/pkg/errors) | `2020-01-14` | | gomod | [github.com/planetscale/vtprotobuf](https://redirect.github.com/planetscale/vtprotobuf) | `2024-01-29` | | gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` | | gomod | [github.com/remyoudompheng/bigfft](https://redirect.github.com/remyoudompheng/bigfft) | `2023-01-29` | | gomod | [github.com/richardartoul/molecule](https://redirect.github.com/richardartoul/molecule) | `2021-12-17` | | gomod | [github.com/rivo/uniseg](https://redirect.github.com/rivo/uniseg) | `2024-02-08` | | gomod | [github.com/sean-/seed](https://redirect.github.com/sean-/seed) | `2017-03-13` | | gomod | [github.com/segmentio/fasthash](https://redirect.github.com/segmentio/fasthash) | `2020-05-27` | | gomod | [github.com/shopspring/decimal](https://redirect.github.com/shopspring/decimal) | `2024-04-12` | | gomod | [github.com/uber/jaeger-client-go](https://redirect.github.com/uber/jaeger-client-go) | `2021-12-07` | | gomod | [github.com/uber/jaeger-lib](https://redirect.github.com/uber/jaeger-lib) | `2021-03-29` | | gomod | [github.com/x448/float16](https://redirect.github.com/x448/float16) | `2020-01-17` | | gomod | [github.com/xhit/go-str2duration/v2](https://redirect.github.com/xhit/go-str2duration) | `2022-12-07` | | gomod | [github.com/yusufpapurcu/wmi](https://redirect.github.com/yusufpapurcu/wmi) | `2024-01-28` | | gomod | [github.com/zeebo/assert](https://redirect.github.com/zeebo/assert) | `2022-07-21` | | gomod | [go.opentelemetry.io/otel/exporters/jaeger](https://redirect.github.com/open-telemetry/opentelemetry-go) | `2023-08-28` | | gomod | [go.uber.org/atomic](https://redirect.github.com/uber-go/atomic) | `2023-05-03` | | gomod | [go.uber.org/goleak](https://redirect.github.com/uber-go/goleak) | `2023-10-24` | | gomod | [go.uber.org/multierr](https://redirect.github.com/uber-go/multierr) | `2023-03-29` | | gomod | [go4.org/netipx](https://redirect.github.com/go4org/netipx) | `2023-11-29` | | gomod | [gopkg.in/inf.v0](https://redirect.github.com/go-inf/inf) | `2018-03-26` | | gomod | [gopkg.in/yaml.v2](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` | | gomod | [gopkg.in/yaml.v3](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` | | gomod | [gotest.tools](https://redirect.github.com/gotestyourself/gotest.tools) | `2018-11-11` |
## Errored The following updates encountered an error and will be retried. To force a retry now, click on a checkbox below. - [ ] chore(deps): Pin dependencies (main) (`actions/checkout`, `actions/setup-go`, `apache/kafka`, `confluentinc/cp-kafka`, `confluentinc/cp-zookeeper`, `fluent/fluentd`, `gcr.io/distroless/base-nossl`, `gcr.io/distroless/static`, `github.com/grafana/grafonnet-lib/grafonnet`, `github.com/grafana/jsonnet-libs/consul`, `github.com/grafana/jsonnet-libs/enterprise-metrics`, `github.com/grafana/jsonnet-libs/grafana`, `github.com/grafana/jsonnet-libs/grafana-builder`, `github.com/grafana/jsonnet-libs/jaeger-agent-mixin`, `github.com/grafana/jsonnet-libs/ksonnet-util`, `github.com/grafana/jsonnet-libs/memcached`, `github.com/grafana/jsonnet-libs/mixin-utils`, `github.com/grafana/jsonnet-libs/tanka-util`, `github.com/grafana/loki/production/ksonnet/loki`, `github.com/grafana/loki/production/loki-mixin`, `github.com/grafana/mimir/operations/mimir-mixin`, `github.com/jsonnet-libs/k8s-libsonnet/1.18`, `github.com/jsonnet-libs/k8s-libsonnet/1.20`, `github.com/prometheus-operator/kube-prometheus/jsonnet/kube-prometheus/lib`, `golang`, `golangci/golangci-lint`, `grafana/alloy`, `grafana/docs-base`, `grafana/grafana`, `grafana/grafana-enterprise`, `grafana/loki`, `grafana/promtail`, `grafana/security-github-actions`, `grafana/writers-toolkit`, `hashicorp/consul`, `helm`, `mingrammer/flog`, `minio/minio`, `nginx`, `nixpkgs`, `nixpkgs-unstable`, `pgsty/mc`, `pgsty/minio`, `prom/prometheus`, `provectuslabs/kafka-ui`, `theperiklis/log-generator`, `theperiklis/loki`, `wurstmeister/kafka`, `wurstmeister/zookeeper`) ## PR Edited (Blocked) The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below. - [ ] [fix(security/UNKNOWN/operator/api/loki): Update module golang.org/x/net to v0.56.0 [SECURITY] (main)](../pull/23146) - [ ] [fix(security/UNKNOWN/operator/api/loki): Update module golang.org/x/text to v0.39.0 [SECURITY] (main)](../pull/23390) - [ ] [chore(deps): Update operator/website/themes/doks digest to 4370737 (main)](../pull/23731) ## Pending Status Checks The following updates await pending status checks. To force their creation now, click on a checkbox below. - [ ] chore(deps): Update github.com/charmbracelet/ultraviolet digest to 68fa937 (main) - [ ] chore(deps): Update golang.org/x/exp digest to 3d80eb7 (main) - [ ] [chore(deps): Update google.golang.org/genproto digest to ec0a776 (main)](../pull/22963) - [ ] [chore(deps): Update google.golang.org/genproto/googleapis/api digest to ec0a776 (main)](../pull/23804) - [ ] fix(deps): Update github.com/prometheus/client_golang/exp digest to 0c5dccd (main) - [ ] [fix(deps): Update github.com/twmb/franz-go/pkg/kfake digest to c7ff005 (main)](../pull/22534) - [ ] [fix(deps): Update google.golang.org/genproto/googleapis/rpc digest to ec0a776 (main)](../pull/23805) - [ ] chore(deps): Update cachix/install-nix-action action to v31.11.1 (main) - [ ] chore(deps): Update dependency github.com/grafana/loki/production/loki-mixin to v3.7.6 (main) - [ ] chore(deps): Update module github.com/charmbracelet/x/ansi to v0.11.8 (main) - [ ] chore(deps): Update module github.com/containerd/containerd/v2 to v2.3.4 (main) - [ ] chore(deps): Update module github.com/googleapis/enterprise-certificate-proxy to v0.3.21 (main) - [ ] chore(deps): Update module github.com/parquet-go/bitpack to v1.0.1 (main) - [ ] fix(deps): Update module charm.land/lipgloss/v2 to v2.0.6 (main) - [ ] chore(deps): Update logstash Docker tag to v9.5.1 (main) - [ ] chore(deps): Update module github.com/moby/sys/userns to v0.2.0 (main) - [ ] chore(deps): Update module golang.org/x/mod to v0.39.0 (main) - [ ] fix(deps): Update module github.com/Azure/azure-sdk-for-go/sdk/azcore to v1.23.0 (main) - [ ] fix(deps): Update module github.com/parquet-go/parquet-go to v0.32.0 (main) - [ ] fix(deps): Update module golang.org/x/crypto to v0.55.0 (main) - [ ] fix(deps): Update module golang.org/x/net to v0.58.0 (main) - [ ] fix(deps): Update module golang.org/x/text to v0.41.0 (main) - [ ] fix(deps): Update module google.golang.org/api to v0.293.0 (main) - [ ] chore(deps): Update module github.com/xo/terminfo to v1 (main) - [ ] chore(deps): Update nix to nixos-26.05 (main) --- > [!WARNING] > Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package anthropics/claude-code-action)`, `Could not determine new digest for update (github-tags package golangci/golangci-lint-action)`, `Could not determine new digest for update (github-tags package grafana/shared-workflows)`, `Failed to look up go package github.com/aws/aws-sdk-go-v2/service/sts: no-result`. > > Files affected: `.github/workflows/claude-code-review.yml`, `.github/workflows/claude.yml`, `.github/workflows/operator.yaml`, `.github/workflows/relyance.yml`, `go.mod` --- ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [fix(security/UNKNOWN/operator): Update go toolchain directive to v1.26.5 [SECURITY] (main)](../pull/23128) - [ ] [chore(deps): Update actions/checkout digest to d23441a (main)](../pull/23363) - [ ] [chore(deps): Update github.com/grafana/objstore digest to ec72e5a (main)](../pull/23741) - [ ] [chore(deps): Update github.com/Microsoft/go-winio digest to 7561016 (main)](../pull/22789) - [ ] [chore(deps): Update github.com/planetscale/vtprotobuf digest to 8ae5a48 (main)](../pull/22919) - [ ] [chore(deps): Update golang:1.26.5 Docker digest to 705e964 (main)](../pull/23762) - [ ] [chore(deps): Update logstash:9.4.4 Docker digest to bdb7d35 (main)](../pull/23757) - [ ] [chore(deps): Update ruby:4.0.6 Docker digest to c400c1e (main)](../pull/23763) - [ ] [fix(deps): Update github.com/prometheus/prometheus digest to 3c82a95 (main)](../pull/23627) - [ ] [chore(deps): Update dependency helm to v4.2.3 (main)](../pull/23240) - [ ] [chore(deps): Update Helm release rollout-operator to v0.50.1 (main)](../pull/23342) - [ ] [chore(deps): Update module github.com/knadh/koanf/maps to v0.1.3 (main)](../pull/23931) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/samplers/jaegerremote to v0.37.2 (main)](../pull/23842) - [ ] [fix(deps): Update module github.com/tjhop/slog-gokit to v0.2.2 (main)](../pull/23397) - [ ] [fix(deps): Update module github.com/twmb/franz-go to v1.21.5 (main)](../pull/22714) - [ ] [fix(deps): Update module google.golang.org/protobuf to v1.36.12 (main)](../pull/23941) - [ ] [chore(deps): Update github.com/go-openapi/analysis (main)](../pull/23916) (`github.com/go-openapi/analysis`, `github.com/go-openapi/validate`) - [ ] [chore(deps): Update golangci/golangci-lint-action action to v9.3.0 (main)](../pull/22916) - [ ] [chore(deps): Update module github.com/armon/go-metrics to v0.6.1 (main)](../pull/22586) - [ ] [chore(deps): Update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 (main)](../pull/23856) - [ ] [chore(deps): Update module go.etcd.io/etcd/api/v3 to v3.7.1 (main)](../pull/22574) - [ ] [chore(deps): Update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 (main)](../pull/22575) - [ ] [chore(deps): Update module go.etcd.io/etcd/client/v3 to v3.7.1 (main)](../pull/23000) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/bridges/prometheus to v0.70.0 (main)](../pull/23846) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/detectors/gcp to v1.45.0 (main)](../pull/23847) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/exporters/autoexport to v0.70.0 (main)](../pull/23848) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 (main)](../pull/23810) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.21.0 (main)](../pull/23811) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc to v1.45.0 (main)](../pull/23812) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.45.0 (main)](../pull/23814) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 (main)](../pull/23815) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 (main)](../pull/23816) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 (main)](../pull/23817) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/prometheus to v0.67.0 (main)](../pull/23818) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdoutlog to v0.21.0 (main)](../pull/23819) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdoutmetric to v1.45.0 (main)](../pull/23820) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdouttrace to v1.45.0 (main)](../pull/23826) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/log to v0.21.0 (main)](../pull/23827) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/sdk/log to v0.21.0 (main)](../pull/23830) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/sdk/metric to v1.45.0 (main)](../pull/23831) - [ ] [chore(deps): Update module modernc.org/libc to v1.75.3 (main)](../pull/23868) - [ ] [chore(deps): Update Terraform google to v7.43.0 (main)](../pull/22967) - [ ] [fix(deps): Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 (main)](../pull/23870) - [ ] [fix(deps): Update module github.com/IBM/ibm-cos-sdk-go to v1.15.0 (main)](../pull/23792) - [ ] [fix(deps): Update module github.com/redis/go-redis/v9 to v9.22.0 (main)](../pull/23806) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.70.0 (main)](../pull/23850) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.70.0 (main)](../pull/23851) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.70.0 (main)](../pull/23852) - [ ] [fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.45.0 (main)](../pull/23853) - [ ] [chore(deps): Update actions/checkout action to v7 (main)](../pull/22485) - [ ] [chore(deps): Update actions/labeler action to v7 (main)](../pull/23375) - [ ] [chore(deps): Update actions/setup-go action to v7 (main)](../pull/23344) - [ ] [chore(deps): Update module github.com/cenkalti/backoff/v5 to v7 (main)](../pull/22683) - [ ] [chore(deps): Update module github.com/hashicorp/consul/api to v2 (main)](../pull/22684) - [ ] [chore(deps): Update module github.com/hashicorp/go-immutable-radix to v2 (main)](../pull/22686) - [ ] [chore(deps): Update module github.com/hashicorp/golang-lru to v2 (main)](../pull/22687) - [ ] [chore(deps): Update module github.com/ncw/swift to v2 (main)](../pull/22688) - [ ] [chore(deps): Update module go.yaml.in/yaml/v2 to v3 (main)](../pull/23677) - [ ] [chore(deps): Update module gopkg.in/yaml.v2 to v3 (main)](../pull/22823) - [ ] [chore(deps): Update module modernc.org/libc to v2 (main)](../pull/22695) - [ ] [fix(deps): Update module github.com/twmb/franz-go/pkg/kmsg to v2 (main)](../pull/23871) - [ ] [fix(deps): Lock file maintenance (main)](../pull/23351) - [ ] [fix(security/UNKNOWN/pkg/push): Update module golang.org/x/net to v0.56.0 [SECURITY] (release-3.7.x)](../pull/23422) - [ ] [fix(security/UNKNOWN/pkg/push): Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x)](../pull/23423) - [ ] [fix(security/UNKNOWN/pkg/push): Update module google.golang.org/grpc to v1.82.1 [SECURITY] (release-3.7.x)](../pull/23416) - [ ] **Click on this checkbox to rebase all open PRs at once** ## Vulnerabilities > [!IMPORTANT] > `18`/`20` CVEs have Renovate fixes.
gomod
go.mod
golang.org/x/crypto
- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
operator/api/loki/go.mod
golang.org/x/net
- [GHSA-5cv4-jp36-h3mw](https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw) (fixed in >= 0.55.0) - [GHSA-qxp5-gwg8-xv66](https://osv.dev/vulnerability/GHSA-qxp5-gwg8-xv66) (fixed in >= 0.36.0) - [GHSA-vvgc-356p-c3xw](https://osv.dev/vulnerability/GHSA-vvgc-356p-c3xw) (fixed in >= 0.38.0) - [GO-2025-3503](https://osv.dev/vulnerability/GO-2025-3503) (fixed in >= 0.36.0) - [GO-2025-3595](https://osv.dev/vulnerability/GO-2025-3595) (fixed in >= 0.38.0) - [GO-2026-4440](https://osv.dev/vulnerability/GO-2026-4440) (fixed in >= 0.45.0) - [GO-2026-4441](https://osv.dev/vulnerability/GO-2026-4441) (fixed in >= 0.45.0) - [GO-2026-4918](https://osv.dev/vulnerability/GO-2026-4918) (fixed in >= 0.53.0) - [GO-2026-5025](https://osv.dev/vulnerability/GO-2026-5025) (fixed in >= 0.55.0) - [GO-2026-5026](https://osv.dev/vulnerability/GO-2026-5026) (fixed in >= 0.55.0) - [GO-2026-5027](https://osv.dev/vulnerability/GO-2026-5027) (fixed in >= 0.55.0) - [GO-2026-5028](https://osv.dev/vulnerability/GO-2026-5028) (fixed in >= 0.55.0) - [GO-2026-5029](https://osv.dev/vulnerability/GO-2026-5029) (fixed in >= 0.55.0) - [GO-2026-5030](https://osv.dev/vulnerability/GO-2026-5030) (fixed in >= 0.55.0) - [GO-2026-5942](https://osv.dev/vulnerability/GO-2026-5942) (fixed in >= 0.56.0)
golang.org/x/text
- [GO-2026-5970](https://osv.dev/vulnerability/GO-2026-5970) (fixed in >= 0.39.0)
operator/go.mod
go
- [GO-2026-4970](https://osv.dev/vulnerability/GO-2026-4970) (fixed in >= 1.26.5) - [GO-2026-5856](https://osv.dev/vulnerability/GO-2026-5856) (fixed in >= 1.26.5)
golang.org/x/crypto
- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated
bundler (3)
clients/cmd/fluentd/docker/Gemfile (2) - `fluentd '1.19.3'` - `fluent-plugin-multi-format-parser '~>1.1.0'`
clients/cmd/fluentd/Gemfile
clients/cmd/logstash/Gemfile (1) - `webmock \"~> 3.8\"`
devcontainer (1)
.devcontainer/devcontainer.json (1) - `grafana/loki-build-image 0.35.2`
docker-compose (15)
clients/cmd/docker-driver/docker-compose.yaml (1) - `grafana/grafana unknown version` → [Updates: `undefined`]
clients/cmd/fluentd/docker/docker-compose.yml (1) - `fluent/fluent-bit 5.1@sha256:bf09d620b6b45c080b4da86ac5d98fd3739c1213a148f93dec884fdcc64084cb`
cmd/logql-analyzer/docker-compose.yaml (1) - `grafana/docs-base latest` → [Updates: `latest`]
debug/docker-compose.yaml (3) - `grafana/loki-debug latest` - `grafana/promtail-debug latest` - `grafana/grafana master` → [Updates: `master`]
examples/getting-started/docker-compose.yaml (8) - `grafana/loki latest` → [Updates: `latest`] - `grafana/loki latest` → [Updates: `latest`] - `grafana/alloy latest` → [Updates: `latest`] - `minio/minio unknown version` → [Updates: `undefined`] - `grafana/grafana latest` → [Updates: `latest`] - `grafana/loki latest` → [Updates: `latest`] - `nginx latest` → [Updates: `latest`] - `mingrammer/flog unknown version` → [Updates: `undefined`]
examples/ha-monolithic/docker-compose.yaml (4) - `pgsty/minio latest` → [Updates: `latest`] - `pgsty/mc latest` → [Updates: `latest`] - `nginx alpine` → [Updates: `alpine`] - `grafana/loki 3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952`
production/docker/docker-compose.yaml (8) - `grafana/grafana 13.1.3@sha256:ab5cb380e3ff3172d6c8bd2e7cfd31cce977d2881b260e1f5bc089bf0b759b43` - `prom/prometheus v3.13.2@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69` - `mingrammer/flog unknown version` → [Updates: `undefined`] - `grafana/promtail latest` → [Updates: `latest`] - `minio/minio unknown version` → [Updates: `undefined`] - `nginx latest` → [Updates: `latest`] - `prom/alertmanager v0.33.1@sha256:9e082985f56f4c8c9f724e18f2288c6708f472e56a5286b8863d080434ea065d` - `grafana/loki 3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952`
tools/dev/kafka/docker-compose.yaml (5) - `grafana/grafana-enterprise latest` → [Updates: `latest`] - `prom/prometheus latest` → [Updates: `latest`] - `provectuslabs/kafka-ui latest` → [Updates: `latest`] - `apache/kafka latest` → [Updates: `latest`] - `theperiklis/log-generator latest` → [Updates: `latest`]
tools/dev/loki-tsdb-storage-s3/docker-compose.yml (7) - `hashicorp/consul unknown version` → [Updates: `undefined`] - `minio/minio RELEASE.2024-02-24T17-11-14Z` → [Updates: `RELEASE.2024-02-24T17-11-14Z`] - `memcached 1.6.45-alpine@sha256:c29847751abb41f4c268c84fb3087fee05d4edcbda44409ccb5086e26148e8a7` - `jaegertracing/all-in-one 1.76.0@sha256:ab6f1a1f0fb49ea08bcd19f6b84f6081d0d44b364b6de148e1798eb5816bacac` - `grafana/grafana unknown version` → [Updates: `undefined`] - `mingrammer/flog unknown version` → [Updates: `undefined`] - `mingrammer/flog unknown version` → [Updates: `undefined`]
tools/kafka/plain/docker-compose.yml (2) - `wurstmeister/zookeeper unknown version` → [Updates: `undefined`] - `wurstmeister/kafka unknown version` → [Updates: `undefined`]
tools/kafka/sasl-plain/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/sasl-scram/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/sasl-ssl/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/ssl/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/stream-generator/docker-compose.yaml (3) - `provectuslabs/kafka-ui latest` → [Updates: `latest`] - `apache/kafka latest` → [Updates: `latest`] - `theperiklis/loki feat-usage-tracker-293aed8` → [Updates: `feat-usage-tracker-293aed8`]
dockerfile (21)
clients/cmd/docker-driver/Dockerfile (2) - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
clients/cmd/fluent-bit/Dockerfile (2) - `golang 1.26.5-bookworm` → [Updates: `1.26.5-bookworm`] - `fluent/fluent-bit 5.1.0@sha256:bf09d620b6b45c080b4da86ac5d98fd3739c1213a148f93dec884fdcc64084cb`
clients/cmd/fluentd/Dockerfile (2) - `ruby 4.0.6@sha256:d9a5d26be31a40fb043069f816ba39139c1f38758aea530341eb7e2c153e4ab4` → [Updates: `4.0.6`] - `fluent/fluentd v1.19-debian-1` → [Updates: `v1.19-debian-1`]
clients/cmd/logstash/Dockerfile (1) - `logstash 9.4.4@sha256:7bf793131b910ce62b4683ae6dc304c15b6981688c38b50e953ce931bfa2c6cf` → [Updates: `9.5.1`, `9.4.4`]
cmd/logcli/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/logql-analyzer/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki-canary-boringcrypto/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/base-nossl debug` → [Updates: `debug`]
cmd/loki-canary/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki-canary/Dockerfile.cross (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki/Dockerfile (3) - `golang 1.26` → [Updates: `1.26`] - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
cmd/loki/Dockerfile.cross (3) - `golang 1.26` → [Updates: `1.26`] - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
cmd/loki/Dockerfile.debug (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/base-nossl debug` → [Updates: `debug`]
cmd/migrate/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/querytee/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
loki-build-image/Dockerfile
operator/calculator.Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
operator/Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
operator/passthrough-gateway.Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
production/helm/loki/src/helm-test/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
tools/dev/loki-tsdb-storage-s3/dev.dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
tools/stream-generator/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
git-submodules (1)
.gitmodules (1) - `operator/website/themes/doks 14fe597271d6efc7d77461798f22a6af068300d2` → [Updates: `undefined`]
github-actions (32)
.github/workflows/backport.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/build-loki-binary.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go ${{ env.GO_VERSION }}`
.github/workflows/claude-code-review.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `anthropics/claude-code-action 1.0@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4`
.github/workflows/claude.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `anthropics/claude-code-action 1.0@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4`
.github/workflows/conventional-commits.yml (1) - `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50`
.github/workflows/deploy-pr-preview.yml (1) - `grafana/writers-toolkit main` → [Updates: `main`]
.github/workflows/govulncheck.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go ${{ env.GO_VERSION }}`
.github/workflows/helm-ci.yml (14) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97` - `helm/chart-testing-action v2.8.0@6ec842c01de15ebb84c8627d2744a0c2f2755c9f` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `fluxcd/flux2 v2.9.4@889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm v4.2.2` → [Updates: `v4.2.3`, `v4.2.2`] - `python 3.13` - `helm v4.2.2` → [Updates: `v4.2.3`, `v4.2.2`]
.github/workflows/helm-diff-ci.yml (5) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
.github/workflows/helm-release.yaml
.github/workflows/helm-tagged-release-pr.yaml (3) - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `peter-evans/create-pull-request v8@5f6978faf089d4d20b00c7766989d076bb2fc7f1`
.github/workflows/images.yml (5) - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/labeler.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/labeler v6.2.0@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d` → [Updates: `v7.0.0`]
.github/workflows/lint-jsonnet.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go 1.26.5`
.github/workflows/logql-bench.yml (9) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` - `go 1.26.5`
.github/workflows/logql-correctness.yml (9) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` - `go 1.26.5`
.github/workflows/minor-release-pr.yml (49) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/nix-ci.yaml (4) - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `cachix/install-nix-action v31.11.0@630ae543ea3a38a9a4166f03376c02c50f408342` → [Updates: `v31.11.1`] - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `cachix/install-nix-action v31.11.0@630ae543ea3a38a9a4166f03376c02c50f408342` → [Updates: `v31.11.1`]
.github/workflows/operator-bundle.yaml (2) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`]
.github/workflows/operator-check-prepare-release-commit.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/operator-release-please.yml (4) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `googleapis/release-please-action v5.0.0@45996ed1f6d02564a971a2fa1b5860e934307cf7` - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/operator-reusable-hub-release.yml (4) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `fjogeleit/yaml-update-action v0.17.0@dffe9a5223d84653c13374032382f6bb5de8e5ef`
.github/workflows/operator-reusable-image-build.yml (5) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a`
.github/workflows/operator-scorecard.yaml (3) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc`
.github/workflows/operator.yaml (12) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `golangci/golangci-lint-action v9.2@1e7e51e771db61008b38414a730f564565cf7c20` → [Updates: `v9.3.0`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `golangci/golangci-lint v2.12.2` → [Updates: `v2.12.2`]
.github/workflows/patch-release-pr.yml (49) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/querytee-images.yml (4) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c`
.github/workflows/release.yml (9) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `node 24`
.github/workflows/relyance.yml (2) - `actions/checkout v6.1.0@d23441a4 > ✂ **Note** > > PR body was truncated to here.", "url": "https://github.com/grafana/loki/issues/23439", "createdAt": "2026-07-23T03:41:50Z", "updatedAt": "2026-08-13T15:11:18Z", "timestamp": "2026-08-13T15:11:18Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:issue:23890", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Sharded avg_over_time(... | unwrap ...) with grouping under-reports the average", "text": "## What happens With query sharding enabled, `avg_over_time(... | unwrap ...)` with a `by`/`without` grouping returns a value that is too low whenever some log lines in the range produce no unwrapped sample (missing field, non-numeric value). The unsharded path returns the correct value, so the same query gives two different answers depending on sharding. ## Reproduction Logs within a `[1m]` window: ``` {app=\"a\"} v=2 {app=\"a\"} v=4 {app=\"a\"} hello # no `v` field ``` Query: ```logql avg_over_time({app=\"a\"} | logfmt | unwrap v [1m]) by (app) ``` - Without sharding: `(2 + 4) / 2 = 3` (correct) - With sharding: `(2 + 4) / 3 = 2` (wrong) ## Root cause The shard mapper rewrites ```logql avg_over_time(E | unwrap x [r]) by (g) ``` into ```logql sum by (g) (sum_over_time(E | unwrap x [r])) / sum by (g) (count_over_time(E [r])) ``` and strips the unwrap from the `count_over_time` denominator. `count_over_time` then counts log **lines**, while the `sum_over_time` numerator sums only unwrapped **samples**. Any line that yields no sample inflates the denominator, so the average comes out too low. Without grouping the query shards by plain concatenation (no denominator is computed), so it stays correct. `LogRangeExpr.WithoutUnwrap()` also drops the unwrap's post filters, so `avg_over_time(E | unwrap x | status=\"200\" [r]) by (g)` is wrong for a second reason: the denominator counts lines the numerator never saw. ## Possible fixes **(a) Count unwrapped samples in the denominator.** Allow `count_over_time` to carry an unwrap, meaning \"count the extracted samples\", and keep the unwrap on the count leg of the decomposition. The sharded result then matches the unsharded one. Trade-offs: `count_over_time(... | unwrap x)` becomes valid LogQL (currently `unwrap` can't be used with `count_over_time()`), and since `RangeAggregationExpr.validate()` runs on the querier, every querier must accept the new shape before the frontend can emit it — so it needs a rollout gate like `ShardQuantileOverTime`. **(b) Do not shard this shape.** When `avg_over_time` has an unwrap together with a grouping/label-reduction, run it unsharded on a single querier. Correct and minimal, but a performance regression for a common query shape (grouped averages over large ranges) even when every line carries the field — the mapper cannot tell at plan time whether any line is missing it. **(c) Express the unwrap as a label filter on the count leg.** A line yields an unwrapped sample exactly when the pipeline keeps it, the identifier resolves to a non-empty label, and the post filters keep it (`streamLabelSampleExtractor.Process`). All three are expressible as pipeline stages, so the count leg becomes: ```logql sum by (g) (sum_over_time(E | unwrap x | f [r])) / sum by (g) (count_over_time(E | x != \"\" | f [r])) ``` `| x != \"\"` resolves the value through `labelValue()` -> `LabelsBuilder.Get()`, the same call the extractor makes, so this is exact rather than an approximation. Trade-offs: - No new LogQL surface and no grammar change: the emitted plan is ordinary LogQL that any existing querier already understands, so no version-skew gate is needed. - Roughly the same cost as (a): both make the count leg extract `x` (one extra parser hint), and (a) additionally runs the float/duration/bytes conversion per line. - Also fixes the dropped post filters, and the related cases where the unwrapped field is a stream label missing from some streams, or is present but empty. - Does not cover a post filter on `__error__` (`| unwrap x | __error__=\"\"`). Only the unwrap conversion sets that label, and a pipeline filter cannot test whether a string parses as a float. This is not a regression — the current code gets that shape wrong too — but it can be closed by declining to shard when a post filter references `__error__`/`__error_details__`, which is option (b) applied to a far narrower shape. Measured against ground truth with 3 shards: | case | unsharded | sharded today | sharded with (c) | |---|---|---|---| | missing field, `by (app)` | 5.333 | **3.2** | 5.333 | | missing field, `without (index)` | 5.333 | **3.2** | 5.333 | | `unwrap duration(d)`, missing field | 3 | **2** | 3 | | post filter `\\| unwrap v \\| lvl=\"info\"` | 3 | **2** | 3 | | unwrap on a stream label some streams lack | 3 | **2** | 3 | | `v=` (present but empty) | 3 | **2** | 3 | | `\\| unwrap v \\| __error__=\"\"` with `v=abc` | 3 | **2** | **2** (or unsharded, with the guard) |", "url": "https://github.com/grafana/loki/issues/23890", "createdAt": "2026-08-10T16:11:48Z", "updatedAt": "2026-08-13T08:29:58Z", "timestamp": "2026-08-13T08:29:58Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "type/bug" ], "author": "pracucci", "state": "closed", "assignees": [ "pracucci" ] }, { "id": "github:grafana/loki:issue:6994", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "grafana-loki lacks basic feature of extracting nested json labels", "text": " **Is your feature request related to a problem? Please describe.** I am running a java spring-boot application on AWS ECS and want to ship logs to loki/grafana. In order to have the java stack trace as a single log line in grafana I log as json to console using ```xml ``` The resulting json from AWS ECS looks like this: ```json { \"container_id\": \"ea7b47de37024af8a71629fc4c435e09-285964202\", \"container_name\": \"backend\", \"ecs_cluster\": \"dev-fargate\", \"ecs_task_arn\": \"arn:aws:ecs:eu-central-1:xxx:task/dev-fargate/ea7b47de37024af8a71629fc4c435e09\", \"ecs_task_definition\": \"dev-backend:72\", \"log\": { \"@timestamp\": \"2022-08-29T08:13:22.893Z\", \"@version\": \"1\", \"message\": \"Running with Spring Boot v2.7.3, Spring v5.3.22\", \"logger_name\": \"com.example.Application\", \"thread_name\": \"main\", \"level\": \"DEBUG\", \"level_value\": 10000 } } ``` **Describe the solution you'd like** I want to extract also lables from the log element, i.e. log level, logger name, ... and only keep the log.message as the log text. So therefore I need configuration like this (cloudformation yaml config), which is currently not working/supported: ```yaml ... LogConfiguration: LogDriver: awsfirelens Options: Name: grafana-loki Url: https://loki:3000/loki/api/v1/push Labels: \"{source=\\\"console\\\"}\" LabelKeys: container_id,ecs_task_arn,ecs_task_definition,ecs_cluster,container_name,log.level,log.logger_name,log.thread_name RemoveKeys: source,log.level_value,log.@version LineFormat: key_value insecure_skip_verify: true SecretOptions: - Name: TenantID ValueFrom: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/config/loki/tenant-id - Name: log_router Image: grafana/fluent-bit-plugin-loki:2.6.1-amd64 Essential: false Memory: 512 Cpu: 256 FirelensConfiguration: Type: fluentbit Options: enable-ecs-log-metadata: true LogConfiguration: LogDriver: awslogs Options: awslogs-stream-prefix: firelens awslogs-group: !Ref LogGroup awslogs-region: !Ref AWS::Region ... ``` **Describe alternatives you've considered** A clear and concise description of any alternative solutions or features you've considered. I have also tried using LabelMapPath, but this didn't work either. Also tried LineFormat=json but has same result. **Additional context** This is really a basic feature I bet a lot of people need! And maybe another option would be great to specify the final message target, i.e. \"log.message\" in my case... and other properties should be ignored. Would extremly ease the config avoiding the need of specifying tons of \"RemoveKeys\"...", "url": "https://github.com/grafana/loki/issues/6994", "createdAt": "2022-08-29T08:42:40Z", "updatedAt": "2026-08-13T16:32:58Z", "timestamp": "2026-08-13T16:32:58Z", "metrics": { "reactions": 9, "comments": 12 }, "labels": [ "type/feature", "good first issue", "component/fluent-bit-plugin" ], "author": "sschmiedleitner", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:19059", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(CI): release scripts add newline", "text": "**What this PR does / why we need it**: I previously tried to fix this in https://github.com/grafana/loki/pull/19011 but I now realize that it wasn't 100% correct. It solved an ephemeral issue that was remedied on the next release. Long term we need another newline in the release script. Demonstrated through a git-diff of the output. ``` ## Unreleased + ## 6.38.0 ``` **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - **Note** that Promtail is considered to be feature complete, and future development for logs collection will be in [Grafana Alloy](https://github.com/grafana/alloy). As such, `feat` PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior. - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/19059", "createdAt": "2025-08-28T16:49:40Z", "updatedAt": "2026-08-13T16:23:27Z", "timestamp": "2026-08-13T16:23:27Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "size/XS" ], "author": "TheRealNoob", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:21719", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(kafka): support configurable SASL mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512)", "text": "## What this PR does / why we need it Loki's Kafka client hardcodes **SASL PLAIN** as the only authentication mechanism. Brokers configured with `sasl.enabled.mechanisms=SCRAM-SHA-256` or `SCRAM-SHA-512` only (e.g., AWS MSK, Confluent Cloud) immediately reject the handshake with `UNSUPPORTED_SASL_MECHANISM`, making Loki impossible to use with those providers. This PR adds a new optional `kafka.sasl_mechanism` configuration parameter, allowing operators to choose between: - `PLAIN` (default, backward-compatible) - `SCRAM-SHA-256` - `SCRAM-SHA-512` ## Which issue(s) this PR fixes Fixes #21712 ## Changes ### Core Implementation - Added `SASLMechanism` field and validation constants to `pkg/kafka/config.go` - Updated `commonKafkaClientOptions` in `pkg/kafka/client/writer_client.go` to conditionally apply the configured SASL mechanism via switch statement - Vendored `github.com/twmb/franz-go/pkg/sasl/scram` sub-package (v1.20.7, already an indirect dependency) ### Tests (TDD approach) - Added `TestSASLMechanismValidation` in `pkg/kafka/config_test.go` to validate allowed mechanisms and reject invalid ones - Added `TestNewReaderClientSCRAMAuthentication` in `pkg/kafka/client/reader_client_test.go` with SCRAM-SHA-256 and SCRAM-SHA-512 subtests - Added `TestNewWriterClientSCRAMAuthentication` in `pkg/kafka/client/writer_client_test.go` with SCRAM-SHA-256 and SCRAM-SHA-512 subtests - Refactored existing reader/writer client tests to use explicit `SASLMechanism` field for clarity ### Documentation - Updated config reference in `docs/sources/shared/configuration.md` with the new `sasl_mechanism` parameter - Added upgrade note in `docs/sources/setup/upgrade/_index.md` explaining the new parameter, default behavior, and use cases - Added troubleshooting guidance in `docs/sources/operations/troubleshooting/troubleshoot-operations.md` for `UNSUPPORTED_SASL_MECHANISM` errors ### Text Consistency - Updated flag help text in `pkg/kafka/config.go` to remove outdated \"PLAIN-only\" wording - Updated generated docs to match the new, mechanism-agnostic descriptions ## Special notes for your reviewer 1. **Backward Compatibility**: The default value is `PLAIN`, preserving full backward compatibility. No action is required for existing deployments. 2. **Testing**: All tests follow table-driven patterns with explicit mechanism values. SCRAM tests create fresh clusters per mechanism to isolate setup. 3. **Vendor**: The `scram` sub-package was already available transitively; only needed to copy it into vendor and update `modules.txt`. 4. **TDD**: Implementation follows TDD: failing tests → production code → all tests pass. ## Checklist - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide - [x] Documentation added (config reference, upgrade guide, troubleshooting) - [x] Tests updated (config validation + reader/writer SCRAM authentication) - [x] Title follows conventional commits format: `feat(kafka): ...` - [x] Upgrade guide updated: `docs/sources/setup/upgrade/_index.md` - [x] No deprecated/deleted config changes required --- > [!NOTE] > **Medium Risk** > Touches Kafka authentication and client initialization; while default remains `PLAIN`, misconfiguration or vendor/mechanism selection issues could prevent Loki components from connecting to Kafka at startup. > > **Overview** > Adds a new Kafka config/flag `sasl_mechanism` to select SASL auth (`PLAIN` default, `SCRAM-SHA-256`, `SCRAM-SHA-512`), including validation that rejects unsupported values. > > Updates Kafka client option wiring to negotiate SCRAM when selected (in `commonKafkaClientOptions`), and extends tests to cover SCRAM end-to-end for reader/writer clients and the partition `ReaderService`. > > Documentation is updated with the new parameter, an upgrade note, and troubleshooting guidance for `UNSUPPORTED_SASL_MECHANISM`; the franz-go SCRAM SASL implementation is vendored and `vendor/modules.txt` updated accordingly. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 345367966f93875e7afc080aa03de3615a325eb6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot). ", "url": "https://github.com/grafana/loki/pull/21719", "createdAt": "2026-04-28T02:12:27Z", "updatedAt": "2026-08-12T16:51:01Z", "timestamp": "2026-08-12T16:51:01Z", "metrics": { "reactions": 1, "comments": 0 }, "labels": [ "size/L", "kafka" ], "author": "titaneric", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:22436", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(operator): Watch object storage Services for NetworkPolicy updates and surface ports in status", "text": "**What this PR does / why we need it**: - Consolidates port determination logic from `manifest` package to `handlers` - Adds Service watcher that triggers reconciliation when object storage Services change - NetworkPolicies now update automatically when Service ports change **Which issue(s) this PR fixes**: Fixes [LOG-8768](https://redhat.atlassian.net/browse/LOG-8768) **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/)", "url": "https://github.com/grafana/loki/pull/22436", "createdAt": "2026-06-16T12:28:08Z", "updatedAt": "2026-08-13T08:59:33Z", "timestamp": "2026-08-13T08:59:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "sig/operator" ], "author": "btaani", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:22574", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module go.etcd.io/etcd/api/v3 to v3.7.1 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/etcd/api/v3](https://redirect.github.com/etcd-io/etcd) | `v3.6.14` → `v3.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fetcd%2fapi%2fv3/v3.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fetcd%2fapi%2fv3/v3.6.14/v3.7.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
etcd-io/etcd (go.etcd.io/etcd/api/v3) ### [`v3.7.1`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.1) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.7.0...v3.7.1) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.1 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ``` ### [`v3.7.0`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.6.14...v3.7.0) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.0 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ```
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/22574", "createdAt": "2026-06-24T11:17:13Z", "updatedAt": "2026-08-13T00:09:05Z", "timestamp": "2026-08-13T00:09:05Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:22575", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/etcd/client/pkg/v3](https://redirect.github.com/etcd-io/etcd) | `v3.6.14` → `v3.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fetcd%2fclient%2fpkg%2fv3/v3.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fetcd%2fclient%2fpkg%2fv3/v3.6.14/v3.7.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
etcd-io/etcd (go.etcd.io/etcd/client/pkg/v3) ### [`v3.7.1`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.1) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.7.0...v3.7.1) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.1 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ``` ### [`v3.7.0`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.6.14...v3.7.0) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.0 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ```
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/22575", "createdAt": "2026-06-24T11:17:42Z", "updatedAt": "2026-08-13T00:09:07Z", "timestamp": "2026-08-13T00:09:07Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:22967", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update Terraform google to v7.43.0 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [google](https://registry.terraform.io/providers/hashicorp/google) ([source](https://redirect.github.com/hashicorp/terraform-provider-google)) | required_provider | minor | `7.38.0` → `7.43.0` | `7.44.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
hashicorp/terraform-provider-google (google) ### [`v7.43.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7430-Unreleased) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.42.0...v7.43.0) ### [`v7.42.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7420-July-28-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.41.0...v7.42.0) NOTES: - compute: migrated `google_compute_region_instance_template` resource to use direct HTTP rather than a client library ([#​28431](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28431)) DEPRECATIONS: - vertexai: deprecated `google_vertex_ai_schedule`, an accidentally-added duplicate resource; use `google_colab_schedule` instead. ([#​28406](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28406)) FEATURES: - **New Data Source:** `google_cloud_quotas_quota_adjuster_settings` ([#​28383](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28383)) - **New List Resource:** `google_service_account_key` ([#​28430](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28430)) - **New Resource:** `google_agent_identity_auth_provider` ([#​28447](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28447)) - **New Resource:** `google_apihub_runtime_project_attachment` ([#​28449](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28449)) - **New Resource:** `google_chronicle_big_query_export` ([#​28403](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28403)) - **New Resource:** `google_compute_global_vm_extension_policy` ([#​28445](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28445)) - **New Resource:** `google_compute_rollout_plan` ([#​28445](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28445)) - **New Resource:** `google_vector_search_data_object` ([#​28434](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28434)) - **New Resource:** `google_vertex_ai_persistent_resource` ([#​28435](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28435)) IMPROVEMENTS: - bigquery: added `table_type` field to `google_bigquery_routine` resource ([#​28446](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28446)) - cloudrunv2: added `start_execution_token` and `run_execution_token` fields to `google_cloud_run_v2_job`resource ([#​28384](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28384)) - colab: added `catch_up`, `create_pipeline_job_request`, `create_time`, `last_pause_time`, `last_resume_time`, `last_scheduled_run_response`, `max_concurrent_active_run_count`, `next_run_time`, `started_run_count`, and `update_time` fields, and sub-fields under `create_notebook_execution_job_request.notebook_execution_job` (`create_time`, `custom_environment_spec`, `encryption_spec`, `job_state`, `kernel_name`, `labels`, `name`, `schedule_resource_name`, `workbench_runtime`) and under `create_notebook_execution_job_request` (`notebook_execution_job_id`, `parent`) to `google_colab_schedule` resource ([#​28406](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28406)) - compute: added `effective_location` field to `google_compute_interconnect` resource ([#​28416](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28416)) - compute: added `request_headers` and `response_headers` fields to `log_config` on `google_compute_backend_service` and `google_compute_region_backend_service` resources ([#​28421](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28421)) - compute: added identity support to `google_compute_instance`, allowing resource import using an `identity` block ([#​28433](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28433)) - compute: changed `location` field to mutable for `google_compute_interconnect` resource ([#​28416](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28416)) - container: added `addons_config.node_readiness_config` field to `google_container_cluster` resource ([#​28417](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28417)) - container: added `rollback_safe_upgrade`, `desired_emulated_version`, and `emulated_version` fields to `google_container_cluster` resource ([#​28442](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28442)) - container: increased default timeout to 2 hours for `google_container_node_pool`resource ([#​28382](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28382)) - dataproc: added `confidential_instance_type` field to `google_dataproc_cluster` resource ([#​28371](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28371)) - gkehub: added `min_control_plane_version`, `min_node_version`, `target_control_plane_version`, `target_node_version`, and `operational_state` fields to `google_gke_hub_rollout_sequence` resource ([#​28429](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28429)) - hypercomputecluster: increased default timeouts for `google_hypercomputecluster_cluster` to 120 minutes ([#​28448](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28448)) - modelarmor: added field `template_metadata.filter_version_selector` to `google_model_armor_template` resource ([#​28402](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28402)) - sql: added identity support to `google_sql_user` for `terraform query` support ([#​28428](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28428)) BUG FIXES: - bigtable: fixed an issue where `bigtable_custom_endpoint` and `universe_domain` were ignored when creating Bigtable resources ([#​28404](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28404)) - compute: fixed an issue where diffs in `google_compute_security_policy` were not detected ([#​28420](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28420)) - gkehub: fixed `rollout_creation_scope` and `upgrade_types` fields in `google_gke_hub_rollout_sequence` resource ([#​28429](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28429)) - osconfig: added client-side validation to ensure `resource_hierarchy_selector` and `location_selector` are not set at the same time in `google_os_config_v2_policy_orchestrator`, `google_os_config_v2_policy_orchestrator_for_folder`, and `google_os_config_v2_policy_orchestrator_for_organization` ([#​28407](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28407)) - secretmanager: fixed an issue where `google_secret_manager_secret_version` would fail at apply time if neither `secret_data` nor `secret_data_wo` was set ([#​28419](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28419)) - sql: fixed issue where updates to `settings.ip_configuration.psc_config.allowed_consumer_projects` in `google_sql_database_instance` were silently ignored on in-place updates ([#​28444](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28444)) - vertexai: fixed `google_vertex_ai_endpoint_with_model_garden_deployment` destroying and recreating the endpoint when `min_replica_count`, `max_replica_count`, `required_replica_count`, or `autoscaling_metric_specs` changed ([#​28401](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28401)) ### [`v7.41.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7410-July-17-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.40.0...v7.41.0) FEATURES: - **New Resource:** `google_chronicle_environment_group` ([#​28338](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28338)) - **New Resource:** `google_compute_router_named_set` ([#​28326](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28326)) - **New List Resource:** `google_compute_backend_bucket_signed_url_key` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_backend_service_signed_url_key` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_network_firewall_policy` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_network_firewall_policy_association` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_network_firewall_policy_packet_mirroring_rule` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_preview_feature` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_public_advertised_prefix` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_region_backend_bucket` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_region_network_firewall_policy` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) IMPROVEMENTS: - accesscontextmanager: added `allowed_service_patterns` and `service_patterns_enforcement_scopes` fields to `google_access_context_manager_service_perimeter` to support VPC Service Controls for non-GCP APIs. ([#​28349](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28349)) - accesscontextmanager: added `pscEndpoint` to `sources` in `ingress_from` and `egress_from` under resources `google_access_context_manager_service_perimeter` and variants ([#​28307](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28307)) - backupdr: added `backup_blocked_by_vault_access_restriction` to `data.google_backup_dr_data_source` resource ([#​28361](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28361)) - backupdr: added `force_update_access_restriction` to `google_backup_dr_backup_vault` resource ([#​28361](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28361)) - backupdr: added update support for `access_restriction` to `google_backup_dr_backup_vault` resource ([#​28361](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28361)) - certificatemanager: added in-place update support for the `self_managed` certificate data (`pem_certificate` / `pem_private_key`) on `google_certificate_manager_certificate`; changing the certificate data is now applied via update instead of forcing recreation ([#​28337](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28337)) - cloudrunv2: added `tags` field to `google_cloud_run_v2_service` and `google_cloud_run_v2_job` resources to allow setting tags for services and jobs at creation time. ([#​28328](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28328)) - cloudsql: added `max_custom_on_demand_retention_days` to create backup\\_plan example for sqladmin ([#​28343](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28343)) - compute: added 3500GB and 7000GB SSD partition size to `google_compute_instance_template` resource ([#​28352](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28352)) - compute: added `FLEX_START` and `RESERVATION_BOUND` support to `google_compute_instance`, `google_compute_instance_template`, and `google_compute_region_instance_template` resources ([#​28365](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28365)) - container: added the support for updating `node_image_config` and `image_type` fields at the same time ([#​28283](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28283)) - dataproc: added `confidential_instance_type` to `google_dataproc_cluster` resource ([#​28371](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28371)) - dataproc: added `instance_selection.disk_config` field to `google_dataproc_cluster` resource ([#​28339](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28339)) - discoveryengine: added `enable_llm_layout_parsing` and `enable_get_processed_document` fields to `google_discovery_engine_data_store` resource ([#​28284](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28284)) - sql: added `instance_auto_dns_status` and `write_endpoint_auto_dns_status` output fields to `psc_auto_connections` block in `google_sql_database_instance` resource ([#​28331](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28331)) - sql: added `include_replicas_for_major_version_upgrade` field to `google_sql_database_instance` resource ([#​28345](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28345)) - sql: added `switch_transaction_logs_to_cloud_storage_enabled` field to `google_sql_database_instance` resource ([#​28318](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28318)) - vertexai: promoted `google_vertex_ai_semantic_governance_policy_engine` resource to GA ([#​28347](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28347)) - workbench: added `enable_deletion_protection` field to `google_workbench_instance` resource ([#​28355](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28355)) - workbench: added `resource_policies` field to `google_workbench_instance` resource ([#​28354](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28354)) - workbench: added support for `min_cpu_platform` in `google_workbench_instance` resource ([#​28369](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28369)) - workstations: added `instance_metadata` field to `google_workstations_workstation_config` resource ([#​28342](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28342)) BUG FIXES: - compute: fixed bug where a permadiff on `google_compute_reservation_region_commitment.existing_reservations` would persist after upgrading ([#​28353](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28353)) - compute: fixed permadiff on `keepalive_interval` for `google_compute_router` `bgp` block when set to default value ([#​28285](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28285)) - resourcemanager: fixed validation of `target_service_account` and `delegates` in the `google_service_account_access_token`, `google_service_account_id_token`, and `google_service_account_jwt` data sources, and of `name` in the `google_service_account_key` data source, to reject identifiers that contain path separators ([#​28308](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28308)) - securityposture: fixed a bug where the `enforce` field in `google_securityposture_posture` was always set, causing failures for list constraints. ([#​28359](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28359)) - vmwareengine: added correct `update_mask` value to `google_vmwareengine_private_cloud` updates ([#​28360](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28360)) ### [`v7.40.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7400-July-14-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.39.0...v7.40.0) DEPRECATIONS: - storage: the `admit-on-second-miss` value for `google_storage_anywhere_cache.admission_policy` is deprecated and will be removed in a future major release. The backend will ignore this attribute and treat it as `admit-on-first-miss`. ([#​28210](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28210)) NOTES: - compute: migrated `google_compute_instance` code related to advanced machine features to use direct HTTP rather than a client library ([#​28160](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28160)) FEATURES: - **New Data Source:** `google_data_catalog_taxonomy` ([#​28237](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28237)) - **New Data Source:** `google_oracle_database_exascale_db_storage_vault` ([#​28260](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28260)) - **New List Resource:** 'google\\_project' ([#​28041](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28041)) - **New List Resource:** `google_compute_instant_snapshot` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_instant_snapshot` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_target_http_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_target_tcp_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_url_map` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_rollout_plan` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_grpc_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_http_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_ssl_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_tcp_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_dns_managed_zone` ([#​28257](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28257)) - **New List Resource:** `google_oracle_database_exascale_db_storage_vaults` ([#​28260](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28260)) - **New Resource:** `google_chronicle_findings_refinement_deployment` ([#​28240](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28240)) - **New Resource:** `google_chronicle_soar_domain` ([#​28214](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28214)) - **New Resource:** `google_iap_agent_registry_agent_iam_binding` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_agent_iam_member` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_agent_iam_policy` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_endpoint_iam_binding` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_endpoint_iam_member` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_endpoint_iam_policy` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_mcp_server_iam_binding` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_mcp_server_iam_member` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_mcp_server_iam_policy` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_tags_tag_binding_collection` ([#​28180](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28180)) - **New Resource:** `google_vector_search_index` ([#​28238](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28238)) - **New Resource:** `google_chronicle_environment` ([#​28206](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28206)) - **New Resource:** `google_chronicle_data_export` ([#​28239](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28239)) IMPROVEMENTS: - agentregistry: added `name` field to `google_agent_registry_binding` resource ([#​28207](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28207)) - agentregistry: added `name` field to `google_agent_registry_service` resource ([#​28207](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28207)) - appengine: added `app_engine_bundled_services` field to `google_app_engine_standard_app_version` resource ([#​28213](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28213)) - biglakeiceberg: add support for `CATALOG_TYPE_FEDERATED` with `federated_catalog_options` to `google_biglake_iceberg_catalog` ([#​28241](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28241)) - compute: added `target_type` and `target_forwarding_rules` to `google_compute_region_network_firewall_policy_with_rules` resource ([#​28061](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28061)) - compute: added `workload_identity_config` fields to `google_compute_instance` and `google_compute_instance_template` resources ([#​28266](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28266)) - compute: added `instance_lifecycle_policy.on_repair.allow_changing_zone` field to `google_compute_instance_group_manager` and `google_compute_instance_region_group_manager`. ([#​28174](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28174)) - container: added `ANY_RESERVATION_THEN_FAIL` option to `consume_reservation_type` field in `google_container_cluster` and `google_container_node_pool` resources ([#​28060](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28060)) - container: added `custom_node_init` configuration block to `node_config` (supporting Cloud Storage and Secret Manager) for both `google_container_cluster` and `google_container_node_pool` resources. ([#​28262](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28262)) - container: added `maintenance_policy` field to `google_container_node_pool` resource ([#​28217](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28217)) - container: added `recurring_maintenance_window` field to `google_container_cluster` resource ([#​28227](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28227)) - dataplex: added `catalog_publishing_enabled` field to `google_dataplex_datascan` resource ([#​28232](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28232)) - dlp: added `inspect_config.min_likelihood_per_info_type` to `google_data_loss_prevention_inspect_template` ([#​28236](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28236)) - firestore: added `skip_wait` field to `google_firestore_field` resource, skipping the wait for index creation ([#​28222](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28222)) - oracledatabase: added support for configuring Exascale-based VM clusters on top of dedicated storage vaults via the `exascale_db_storage_vault` parameter and `storage_management_type` to determine if VM Cluster is ASM or EXASCALE in `google_oracle_database_cloud_vm_cluster` ([#​28197](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28197)) - oracledatabase: added `exadata_infrastructure` field to `google_oracle_database_exascale_db_storage_vault` resource ([#​28177](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28177)) - oracledatabase: added `exascale_db_storage_vault` and `storage_management_type` fields to `google_oracle_database_cloud_vm_clusters` data source ([#​28260](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28260)) - sql: added `enforce_new_sql_network_architecture` field to `google_sql_database_instance` resource ([#​28233](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28233)) - sql: added `psc_auto_connection_policy_enabled` field and output-only `service_connection_policy` and `service_connection_policy_creation_result` fields to `google_sql_database_instance` resource ([#​28225](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28225)) - storagetransfer: added `private_network_service` to resource `google_storage_transfer_job` ([#​28178](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28178)) BUG FIXES: - bigtable: fixed a bug where `row_affinity` updates did not persist on `google_bigtable_app_profile` ([#​28215](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28215)) - bug: fixed labels diff in `google_project` ([#​28229](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28229)) - chronicle: suppressed a permadiff on `google_chronicle_rule.text` caused by the Chronicle API appending a trailing newline to every stored rule body ([#​28216](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28216)) - cloudscheudler: added retries for \"409: sync mutate calls cannot be queued\" error for `google_cloud_scheduler_job` ([#​28164](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28164)) - compute: fixed an issue where `preview = false` updates for `google_compute_organization_security_policy_rule` were omitted from API requests. ([#​28223](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28223)) - compute: fixed bug where it wasn't possible to disable `enable_proxy_protocol` on `google_compute_service_attachment` resource ([#​28264](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28264)) - datastream: fixed a bug in update functionality in `google_datastream_connection_profile` `mongodb_profile.additional_options` ([#​28254](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28254)) - eventarc: fixed a type mismatch when an `google_eventarc_trigger` resource returns non-empty `conditions`. ([#​28226](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28226)) - filestore: aligned `google_filestore_instance` resource timeouts with the Filestore service instance operations TTLs ([#​28208](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28208)) - gemini: fixed truncated timeouts in `google_gemini_code_tools_setting`, `google_gemini_data_sharing_with_google_setting_binding`, `google_gemini_gemini_gcp_enablement_setting_binding`, and `google_gemini_release_channel_setting_binding` ([#​28220](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28220)) - hypercomputecluster: fixed 20-minute timeout limit during `google_hypercomputecluster_cluster` resource creation ([#​28182](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28182)) - logging: fixed an issue where errors on update would not be propagated in `google_logging_project_bucket_config` ([#​28055](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28055)) - observability: fixed unintentionally long timeouts in `google_observability_folder_settings`, `google_observability_organization_settings`, and `google_observability_project_settings` ([#​28220](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28220)) - oracledatabase: fixed early client-side timeouts and aligned default schema timeouts with backend async polling limits on `google_oracle_database_exadb_vm_cluster`, `google_oracle_database_odb_network`, `google_oracle_database_odb_subnet`, `google_oracle_database_goldengate_connection`, `google_oracle_database_goldengate_deployment`, and `google_oracle_database_goldengate_connection_assignment`. ([#​28228](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28228)) - oracledatabase: fixed truncated timeouts in `google_oracle_database_exadb_vm_cluster`, `google_oracle_database_goldengate_connection`, and `google_oracle_database_odb_subnet` ([#​28220](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28220)) - privilegedaccessmanager: fixed a permadiff on `google_privileged_access_manager_entitlement` for entitlements created without an approval workflow ([#​28224](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28224)) - provider: fixed validation of `external_credentials.identity_token` to reject malformed JWTs containing empty segments ([#​28258](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28258)) ### [`v7.39.0`](https://redirect.github.com/hashicorp/terraform-provider-google/releases/tag/v7.39.0) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.38.0...v7.39.0) NOTES: - compute: migrated `google_compute_instance_template` resource partially to use direct HTTP rather than a client library ([#​28010](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28010)) - compute: migrated `google_compute_network_peering` resource to use direct HTTP rather than a client library ([#​28021](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28021)) - compute: migrated metadata handling to use direct HTTP rather than a client library ([#​27968](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27968)) FEATURES: - **New Data Source:** `google_agent_registry_agent` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Data Source:** `google_agent_registry_endpoint` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Data Source:** `google_agent_registry_mcp_server` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Data Source:** `google_compute_instance_groups` ([#​27981](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27981)) - **New Data Source:** `google_storage_control_folder_intelligence_findings_summary` ([#​28019](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28019)) - **New Data Source:** `google_storage_control_organization_intelligence_findings_summary` ([#​28019](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28019)) - **New Data Source:** `google_storage_control_project_intelligence_findings_summary` ([#​28019](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28019)) - **New Resource:** `google_agent_registry_binding` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Resource:** `google_agent_registry_service` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Resource:** `google_artifact_registry_project_config` ([#​28009](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28009)) - **New Resource:** `google_chronicle_findings_refinement` ([#​28035](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28035)) - **New Resource:** `google_compute_bulk_per_instance_config` ([#​28031](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28031)) - **New Resource:** `google_compute_firewall_policy_iam_binding` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_firewall_policy_iam_member` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_firewall_policy_iam_policy` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_network_firewall_policy_iam_binding` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_network_firewall_policy_iam_member` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_network_firewall_policy_iam_policy` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_network_firewall_policy_iam_binding` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_network_firewall_policy_iam_member` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_network_firewall_policy_iam_policy` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_resize_request` ([#​27984](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27984)) - **New Resource:** `google_compute_zone_vm_extension_policy` ([#​28034](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28034)) - **New Resource:** `google_gke_hub_rollout_sequence` ([#​28007](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28007)) - **New Resource:** `google_iap_agent_registry_iam_binding` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_agent_registry_iam_member` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_agent_registry_iam_policy` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_location_web_iam_binding` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_location_web_iam_member` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_location_web_iam_policy` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_oracle_database_cloud_exadata_infrastructure_exascale_config` ([#​28033](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28033)) - **New List Resource:** `google_bigquery_dataset` ([#​28005](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28005)) - **New List Resource:** `google_compute_cross_site_network` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_external_vpn_gateway` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_global_network_endpoint_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_ha_vpn_gateway` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_interconnect_attachment_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_interconnect_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_public_delegated_prefix` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_region_commitment` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_region_network_endpoint_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_vpn_gateway` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_wire_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_folder_iam_member` ([#​27993](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27993)) - **New List Resource:** `google_kms_crypto_key_version` ([#​28006](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28006)) - **New List Resource:** `google_project` ([#​28041](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28041)) - **New List Resource:** `google_project_service` ([#​27989](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27989)) IMPROVEMENTS: - bigquery: added `external_runtime_options.container_request_concurrency` field to `google_bigquery_routine` resource ([#​28029](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28029)) - compute: added `instance_lifecycle_policy.on_failed_health_check` field in resources `google_compute_instance_group_manager` and `google_compute_region_instance_group_manager` (ga) ([#​27992](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27992)) - container: added new fields `shutdown_grace_period_seconds` and `shutdown_grace_period_critical_pods_seconds` to `node_kubelet_config` block. ([#​28015](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28015)) - container: promoted `agent_sandbox_config` addon field under `addons_config` in `google_container_cluster` to GA ([#​28017](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28017)) - dataplex: added `icon` field to `google_dataplex_data_product` resource ([#​27986](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27986)) - dataplex: added `name` field to `google_dataplex_data_product_data_asset` resource ([#​28020](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28020)) - dlp: added `allow_limited_availability_info_types` to `google_data_loss_prevention_inspect_template` ([#​28024](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28024)) - networkservices: added `forward_attributes` field to `google_network_services_lb_edge_extension`, `google_network_services_lb_route_extension`, and `google_network_services_lb_traffic_extension` resources ([#​28012](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28012)) BUG FIXES: - compute: fixed a panic in `google_compute_project_metadata` and `google_compute_project_metadata_item` when project common instance metadata items contain null/empty values. ([#​28008](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28008)) - compute: fixed a validation error on `google_compute_instance` (`Provisioned IOPS cannot be specified with disk type pd-balanced`) that occurred during updates on instances with Hyperdisk Balanced boot disks. ([#​27975](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27975)) - dataproc: fixed a bug where changing `policy_id` on `google_dataproc_autoscaling_policy` planned an in-place update and failed; it now correctly forces resource replacement (destroy and recreate). ([#​28036](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28036)) - firestore: added retries on 409 errors in `google_firestore_user_creds` resource ([#​27972](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27972)) - iam: fixed ephemeral `google_service_account_key` producing a 404 due to duplicate `/keys` in the URL when `fetch_key = true` and `name` is provided ([#​27980](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27980))
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/22967", "createdAt": "2026-07-04T01:13:24Z", "updatedAt": "2026-08-13T03:09:22Z", "timestamp": "2026-08-13T03:09:22Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23000", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module go.etcd.io/etcd/client/v3 to v3.7.1 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/etcd/client/v3](https://redirect.github.com/etcd-io/etcd) | `v3.6.14` → `v3.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fetcd%2fclient%2fv3/v3.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fetcd%2fclient%2fv3/v3.6.14/v3.7.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
etcd-io/etcd (go.etcd.io/etcd/client/v3) ### [`v3.7.1`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.1) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.7.0...v3.7.1) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.1 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ``` ### [`v3.7.0`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.6.14...v3.7.0) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.0 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ```
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23000", "createdAt": "2026-07-05T01:12:55Z", "updatedAt": "2026-08-13T00:09:10Z", "timestamp": "2026-08-13T00:09:10Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23349", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(querier): Prevent sample query plan marshal race 🤖🤖🤖", "text": "**What this PR does / why we need it**: Concurrent sample queries can share one `QueryPlan` AST between ingester fan-out and store evaluation. `DoUntilQuorum` may return while canceled ingester RPCs are still serializing the request. Store-side extractor construction sorts grouping slices in place, so protobuf sizing and marshaling can observe different AST states and panic with a negative slice index. This change copies the query plan and deep-clones its AST once at the ingester boundary. The in-flight ingester request is then isolated from store and evaluator mutations without cloning once per replica. A regression test verifies plan isolation and exercises concurrent caller-plan mutation and ingester-request marshaling. **Which issue(s) this PR fixes**: Fixes #15816 **Special notes for your reviewer**: Before the fix, the regression test deterministically showed that the caller and ingester shared a plan, that caller mutation changed ingester marshal bytes, and that concurrent mutation and marshaling could panic with `slice bounds out of range [-161:]`. Under the race detector, the same test reported grouping writes racing with reads through `syntax.encodeGrouping -> QueryPlan.Size -> SampleQueryRequest.Marshal`. Validation after the fix: - `go test -count=1 ./pkg/querier -run '^(TestQuerier_SelectSamplesClonesPlanForIngesters|TestQuerier_RequestingIngesters)$'` - `go test -race -count=1 ./pkg/querier -run '^TestQuerier_SelectSamplesClonesPlanForIngesters$'` - `go test -count=1 ./pkg/querier/... ./pkg/logql/syntax ./pkg/querier/plan` - `go test -race -count=1 ./pkg/querier` - `go test ./pkg/...` - `golangci-lint run --new-from-rev=origin/main ./...` (`0 issues`) **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added (not applicable; this is an internal race fix with no user-facing configuration change) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory (not applicable)", "url": "https://github.com/grafana/loki/pull/23349", "createdAt": "2026-07-19T23:09:00Z", "updatedAt": "2026-08-13T09:54:39Z", "timestamp": "2026-08-13T09:54:39Z", "metrics": { "reactions": 0, "comments": 4 }, "labels": [], "author": "cplieger", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23357", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(querier): Prevent log query plan marshal race 🤖🤖🤖", "text": "**What this PR does / why we need it**: `SingleTenantQuerier.SelectLogs` copied `QueryRequest` before splitting ingester and store intervals, but the copy still shared its `QueryPlan`. Store pipeline construction mutates that AST in place through `reorderStages` and `combineFilters`. A canceled or hedged ingester request can still be serializing the same plan after quorum returns, which makes those writes race with protobuf marshaling. This change copies the plan and clones its AST once at the ingester boundary. The ingester fanout owns the clone, while the original remains available for store pipeline construction. The regression test proves the ownership boundary without relying on scheduler timing. Before the fix, the ingester and caller share the same plan, caller mutation changes ingester marshal output, and the race detector reports `LineFilterExpr.Left` writes racing with `QueryRequest.Marshal` reads. **Which issue(s) this PR fixes**: No matching issue was found. This is related to #23349 and surfaced while testing that fix. The two bugs share the same plan-aliasing and late-serialization mechanism, but this PR covers `SelectLogs`, `QueryRequest`, and pipeline filter reordering. **Special notes for your reviewer**: Validation completed: - `go test -race -count=1 ./pkg/querier` - `go test -count=1 ./pkg/querier/... ./pkg/logql/syntax ./pkg/querier/plan` - `golangci-lint run --new-from-rev=origin/main ./...` **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added (not applicable; this is an internal ownership fix with no user-facing documentation change) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15) (not applicable)", "url": "https://github.com/grafana/loki/pull/23357", "createdAt": "2026-07-20T11:58:09Z", "updatedAt": "2026-08-13T09:54:35Z", "timestamp": "2026-08-13T09:54:35Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "cplieger", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23397", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/tjhop/slog-gokit to v0.2.2 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/tjhop/slog-gokit](https://redirect.github.com/tjhop/slog-gokit) | `v0.2.0` → `v0.2.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2ftjhop%2fslog-gokit/v0.2.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2ftjhop%2fslog-gokit/v0.2.0/v0.2.2?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
tjhop/slog-gokit (github.com/tjhop/slog-gokit) ### [`v0.2.2`](https://redirect.github.com/tjhop/slog-gokit/releases/tag/v0.2.2) [Compare Source](https://redirect.github.com/tjhop/slog-gokit/compare/v0.2.1...v0.2.2) #### Changelog ##### Other Changes - [`bc090d7`](https://redirect.github.com/tjhop/slog-gokit/commit/bc090d763b62fc52cfa8f398c3f5a1cac153c6b3) perf(handler): append string attr values unboxed - [`85d7801`](https://redirect.github.com/tjhop/slog-gokit/commit/85d780159b539cf4961773841ad3a8708324e9f4) perf(handler): cache resolved caller strings by record PC - [`d331051`](https://redirect.github.com/tjhop/slog-gokit/commit/d331051bbcf137e19fb531c8b35a45b9d0262a98) perf(handler): no more group expansion buffer, size pairs exactly - [`03d53ee`](https://redirect.github.com/tjhop/slog-gokit/commit/03d53eef6d384d6f2a7a690a0fe32ddadd7f0e8b) perf(handler): only resolve LogValuer attrs, add fastpaths ### [`v0.2.1`](https://redirect.github.com/tjhop/slog-gokit/releases/tag/v0.2.1) [Compare Source](https://redirect.github.com/tjhop/slog-gokit/compare/v0.2.0...v0.2.1) #### Changelog ##### Other Changes - [`8245546`](https://redirect.github.com/tjhop/slog-gokit/commit/824554675262bdaa5c5145f6b9817f23a030b815) build(deps): Bump actions/checkout from 6 to 7 - [`be4a15c`](https://redirect.github.com/tjhop/slog-gokit/commit/be4a15cbd55850f0a45745070c2a5950bc8a57f9) perf(handler): resolve caller from slog record, ditch log.Caller() - [`ec40dd6`](https://redirect.github.com/tjhop/slog-gokit/commit/ec40dd6ab164a82b229d6dde837ed5280462db97) perf: have handler write level kv directly, drop leveled loggers
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23397", "createdAt": "2026-07-22T03:28:04Z", "updatedAt": "2026-08-13T12:10:10Z", "timestamp": "2026-08-13T12:10:10Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-patch" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23454", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Recognise thanos/minio S3 throttling errors as retryable and add backoff", "text": "**What this PR does / why we need it**: S3 throttling responses (`SlowDown`, `503`, `429`) were not being treated as retryable when the object client runs on the thanos/objstore backend (`use_thanos_objstore: true`), which is the default for our object stores. `IsStorageThrottledErr` only matched the AWS SDK's `smithy.APIError`, but the thanos S3 client is backed by minio-go, which returns `minio.ErrorResponse`. As a result, on throttling: - congestion control classified the error as non-retryable, - so it never retried, and its AIMD controller never backed off, and - every throttle surfaced immediately as a `failed downloading chunks` error. This PR makes `IsStorageThrottledErr` also recognise `minio.ErrorResponse` throttling/5xx codes (with an HTTP-status fallback for 429 / any 5xx), so both the legacy AWS-SDK client and the thanos/minio client share one retryability definition. Retries and AIMD back-off now engage as designed, absorbing transient throttles instead of failing the chunk fetch. **Why backoff is needed between congestion-control retries** This PR disables the retry inside the S3 and GCS clients. Instead, the congestion-control retrier does the retries. After this change, the congestion-control retrier is the only retry path for these backends. Before this fix, the congestion-control retrier had no delay between attempts. It relied on the backoff inside the S3 or GCS client for that delay. This PR also disables that backoff, along with the retry of the client. As a result, retries fired immediately, one after another, into a backend that just signaled overload (for example, an S3 SlowDown error or a 503 status). This defeated the purpose of congestion control. It made the overload worse, not better. This PR also adds two new settings: - a minimum backoff period - a maximum backoff period The retrier waits a time between these two limits before each retry. The default values are 200 ms and 1s. These values match the backoff profile of the client that this fix replaces. The wait uses the backoff package from dskit. The wait also checks the request context. If the request is canceled, the retrier stops the wait and returns the error immediately. **Special notes for your reviewer**: - The fix lives in `IsStorageThrottledErr`, which is the single retryability entry point used by *both* the legacy S3 client and the thanos `ObjectClientAdapter` (`storeType == s3` → `aws.IsRetryableErr`), so both paths benefit, and there's no duplicated code-list. - `errors.As` is used so wrapped errors (thanos wraps with `pkg/errors`) are still matched. - Tests, in increasing scope: - unit: `TestIsRetryableErr` — minio `SlowDown`/`ServiceUnavailable`/`InternalError`/`TooManyRequests`, wrapped errors, status-only fallback, and negatives (`NoSuchKey`, `AccessDenied`). - wiring: `TestObjectClientAdapter_IsRetryableErr_S3Minio` — locks `storeType == s3` → minio-aware retryability. - end-to-end: `TestCongestionControl_S3Throttling_*` — drive the real AIMD controller → LimitedRetrier → thanos adapter → minio-go → fake S3 returning `503 SlowDown`, asserting retries fire, AIMD backs off, `non_retryable_errors == 0`, and a transient throttle is absorbed. - No config or API changes; behaviour only changes for previously misclassified throttling errors. **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory.", "url": "https://github.com/grafana/loki/pull/23454", "createdAt": "2026-07-23T11:59:55Z", "updatedAt": "2026-08-13T07:53:16Z", "timestamp": "2026-08-13T07:53:16Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs" ], "author": "sandeepsukhani", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23495", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Include query and query_hash in byte-limit rejection log lines", "text": "**What this PR does / why we need it**: When the query-frontend rejects a query for exceeding `max_query_bytes_read` (`MaxQueryBytesRead`) or `MaxQuerierBytesRead`, it logs a `Query exceeds limits` warning containing `limit_name`, `limit_bytes`, and `resolved_bytes` - but not the query itself or its hash. Because the rejection happens before execution, no `metrics.go` stats line is emitted either. As a result there is no way to tell *which* query was rejected: alerts built on these log lines can report that queries were rejected and how large they were, but not what they were, which makes them non-actionable. This adds `query` and `query_hash` to both rejection log lines. The `query_hash` is computed with `util.HashedQuery`, the same hash used on the `executing query` log line and in `metrics.go`, so a rejection can be correlated directly with the query that triggered it. Changes: - `pkg/querier/queryrange/limits.go` - add `query`/`query_hash` to the `MaxQueryBytesRead` rejection line. - `pkg/querier/queryrange/querysharding.go` - add `query`/`query_hash` to the `MaxQuerierBytesRead` rejection line. - Tests for both paths, and an upgrade-guide note. **Special notes for your reviewer**: - Purely additive: the existing fields on both log lines are unchanged. - The `MaxQuerierBytesRead` rejection (and matching \"within limits\" debug) lines in querysharding.go previously logged on the bare `ast.logger`, so they lacked tenant/ trace context. Switched them to a context-aware logger (`util_log.WithContext`), so the rejection line now carries `org_id`/`traceID` - matching the keys on the `executing query` line it correlates with. - While adding coverage for the `MaxQuerierBytesRead` path I found that the existing `\"Non shardable query too big\"` case in `Test_astMapper_QuerySizeLimits` never actually exercised a rejection: its query used `{job=\"foo\"}`, but the test's stats handler only assigns bytes to `app=\"foo\"`/`app=\"bar\"`, so it resolved to 0 bytes and never rejected - the `if err != nil` guard silently skipped the error assertion. Separately, `avg_over_time(... | unwrap ...)` is shardable, so the case's expected *unshardable* template never matched either. I fixed the case to use `quantile_over_time(...)`, which is unshardable unless enabled via `shardAggregation` (the test passes an empty list), so it now genuinely rejects via the unshardable path, and restructured the assertions to require an error whenever one is expected. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] N/A - not deprecating/removing a configuration option", "url": "https://github.com/grafana/loki/pull/23495", "timestamp": "2026-08-12T13:16:16Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "dcoppa", "assignees": [], "change": "new" }, { "id": "github:grafana/loki:pull_request:23627", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update github.com/prometheus/prometheus digest to 3c82a95 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/prometheus/prometheus](https://redirect.github.com/prometheus/prometheus) | require | digest | `ab225f6` → `3c82a95` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23627", "createdAt": "2026-07-28T12:12:32Z", "updatedAt": "2026-08-13T15:08:37Z", "timestamp": "2026-08-13T15:08:37Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23641", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "[DO NOT MERGE] LogQL metric queries with stream-first iteration (prototype)", "text": "**What this PR does / why we need it**: _This draft PR is not intended to be proposed for merge, but just to show a prototype I'm working on and run tests in CI._ In this prototype I'm introducing a different order to consume samples when running LogQL metric queries (currently focused on `_over_time()` cases). See `docs/internal/logql-engine/stream-first-execution.md` to learn more about how it works. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [ ] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23641", "createdAt": "2026-07-29T11:38:46Z", "updatedAt": "2026-08-13T10:57:43Z", "timestamp": "2026-08-13T10:57:43Z", "metrics": { "reactions": 0, "comments": 5 }, "labels": [ "type/docs" ], "author": "pracucci", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23663", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat: Introduce tsdb.shipper.index-reader-mode feature flag", "text": "- Default mode is mmap (existing implementation) - New mode is stream - New mode is not yet implemented - it delegates all calls to mmap implementation. - Extract Reader interface, renaming existing implementation to ByteSliceReader and adding new StreamReader. - This is a PR that doesn't do much because it's a lot of plumbing! **What this PR does / why we need it**: First step of migrating away from mmap. Mmap can be problematic for the operational stability of index gateways. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23663", "createdAt": "2026-07-30T13:37:39Z", "updatedAt": "2026-08-12T16:11:15Z", "timestamp": "2026-08-12T16:11:15Z", "metrics": { "reactions": 0, "comments": 3 }, "labels": [ "type/docs" ], "author": "DanHopperGrafana", "state": "closed", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23696", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of header and TOC", "text": "**What this PR does / why we need it**: Implement streaming reading of header and TOC as part of the process of moving away from mmap in the index gateway. I have run this in a pre-production environment for a few minutes and not seen any noticeable changes in latency, resource usage, etc. **Special notes for your reviewer**: This PR is best reviewed commit-by-commit. The first commit copies across some files from mimir's equivalent. The second commit makes those files compile and pass linting rules within the context of loki. The third commit is \"the actual change\". Commit messages should be clear. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23696", "createdAt": "2026-07-31T15:16:44Z", "updatedAt": "2026-08-12T19:42:01Z", "timestamp": "2026-08-12T19:42:01Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23710", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(storage): Add OCI Thanos object store backend", "text": "## Problem Loki does not currently expose OCI Object Storage as a supported Thanos object-store backend. OCI users therefore have to use the S3-compatible API and static Customer Secret Keys. This prevents using OCI-native authentication mechanisms such as: - OKE Workload Identity - Instance Principal ## Proposed solution Add `oci` to Loki's Thanos object-store backends by reusing the OCI provider from Thanos objstore. Proposed configuration: ``` storage_config: use_thanos_objstore: true object_store: oci: provider: instance-principal bucket: loki-data region: ap-tokyo-1 max_request_retries: 3 request_retry_interval: 1 schema_config: configs: - from: 2026-08-01 store: tsdb object_store: oci schema: v13 index: prefix: index_ period: 24h ``` ## Security benefit No OCI Customer Secret Key needs to be stored in Loki configuration or Kubernetes Secrets. ## Scope - Loki TSDB object storage - Instance Principal - Unit tests - OCI/OKE integration test documentation Named stores and Helm chart support can be submitted separately. ## Validation A standalone Thanos OCI client has already been validated successfully against OCI Object Storage from OKE using Instance Principal. Fixes #23687", "url": "https://github.com/grafana/loki/pull/23710", "createdAt": "2026-08-02T02:57:59Z", "updatedAt": "2026-08-13T10:04:58Z", "timestamp": "2026-08-13T10:04:58Z", "metrics": { "reactions": 0, "comments": 8 }, "labels": [], "author": "felix0102", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23721", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(chunks-inspect): Report block parse errors and drop the duplicate time.go", "text": "**What this PR does / why we need it**: This PR tidies up two things left over from #23681, which folded `chunks-inspect` into the root Go module and listed both of these as deliberate follow-ups. * Reports per-block parse errors instead of quietly dropping them, and returns the entries recovered before the corruption. * Adds some basic test coverage for said corruption * Deletes `cmd/chunks-inspect/time.go`, a verbatim copy of `prometheus/common/model.Time`. **The block error handling.** `parseLokiChunk` assigned the result of `parseLokiBlock` to the shared `err` variable and never checked it. Because `readUvarint` and `readVarint` take the previous error and short-circuit on it, that stale error leaked into the next iteration's metadata reads, so a single crook block took the whole chunk down and the failure was reported against a block the parser had not reached yet. When the failing block happened to be the last one, the error was dropped altogether and the block was listed as empty with nothing to say it had failed. Both outcomes are not great for a tool whose whole job is squinting at dodgy chunks. On a chunk with a corrupt middle block, `chunks-inspect` used to stop dead after the labels: ``` Chunks file: corrupt-block.chunk ... Labels: __name__ = logs job = test 2026/08/03 10:13:53 corrupt-block.chunk: not enough line data, need 268435455, got 337 ``` No format, no encoding, no checksums, no block table, and not one of the 30 perfectly readable log lines. Now the block owns its error and everything else still prints: ``` Format (Version): 3 Encoding: none Blocks Metadata Checksum: 499f2749 OK Found 4 block(s), use -b to show block details ... Block 1: FAILED to parse, recovered 1 of 11 entries: not enough line data, need 268435455, got 337 ``` **`time.go`.** Redundant ever since the tool joined the root module, which already depends on `prometheus/common`. The copy had also fallen behind an upstream fix: where the fractional part follows a non-zero integer part, the sign was only applied when the integer part was zero, so a `from` of `-1.5` decoded as -0.5 seconds. Chunk headers hold timestamps well after the epoch so nothing in practice was hitting it, but there is no reason to keep carrying it. **Which issue(s) this PR fixes**: None. Follow-up to #23681. **Special notes for your reviewer**: `chunks-inspect` is a developer tool. It is not packaged or shipped anywhere — `dist` builds only Loki, logcli, canary and lokitool, and `nfpm.sh` packages only loki, canary, logcli and promtail — so there is no release-artefact impact and no changelog entry. **One known hole left open.** For v4 chunks, `parseLokiBlock` indexes `symbols[nameIdx]` and `symbols[valIdx]` without validating either index, so a corrupt structured metadata section panics rather than becoming a `parseErr`. Reproduced against this branch: `index out of range [127] with length 41`. It is pre-existing and orthogonal to the error plumbing here, but it does mean the failure mode this PR improves is still reachable as a crash on current-format chunks. I have left it for its own change rather than growing this one; happy to fold it in here instead if you would rather it landed together. The same goes for `cmd/chunks-inspect/labels.go`, the other duplicate flagged in #23681. Swapping it for `prometheus/prometheus/model/labels` needs `Labels.Range` rather than a plain `range`, so it compiles under the `stringlabels` build tag. Out of scope here. Testing done beyond CI: * `go test -race -count=1 ./cmd/chunks-inspect/...` — 31 subtests, all passing. Every supported codec across chunk formats v2, v3 and v4, plus corrupt-block cases in the first, a middle and the last block position, plus a block that cannot be decompressed. * The corrupt-block tests repair the block checksum after damaging the entry stream, so the damage can only be found by parsing the entries. Left alone, the checksum would come up BAD and mask the thing under test. * Mutation-tested the new tests, since they cannot simply run against the old code. Reverting the metadata error scoping fails the first and middle positions; reverting the partial-entry recovery fails all three; discarding the block error fails all three plus the decompression case. * For the `model.Time` swap, compared old and new binaries on chunk files built with `chunkenc` and wrapped in the real on-disk header framing. Byte-for-byte identical output for whole-second and fractional headers. The negative fractional header differs, and the new output is the correct one: `1969-12-31 23:59:58.500000` where the old printed `23:59:59.500000`. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23721", "createdAt": "2026-08-03T06:03:14Z", "updatedAt": "2026-08-13T07:20:23Z", "timestamp": "2026-08-13T07:20:23Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "jnewbigin", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23730", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of symbols section", "text": "- Remove Symbols() and SymbolTableSize() from Reader interface as it's not actually used - Implement streamSymbols - Test that it behaves the same as Symbols in index.go **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: This is a reimplementation of index.go's Symbols, so might be useful to compare to that. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23730", "createdAt": "2026-08-03T15:01:19Z", "updatedAt": "2026-08-13T08:35:52Z", "timestamp": "2026-08-13T08:35:52Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23741", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update github.com/grafana/objstore digest to ec72e5a (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/grafana/objstore](https://redirect.github.com/grafana/objstore) | replace | digest | `becd33c` → `ec72e5a` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23741", "createdAt": "2026-08-03T21:10:23Z", "updatedAt": "2026-08-13T12:11:38Z", "timestamp": "2026-08-13T12:11:38Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23757", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update logstash:9.4.4 Docker digest to bdb7d35 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [logstash](https://hub.docker.com/_/logstash) ([source](https://redirect.github.com/elastic/dockerfiles)) | final | digest | `7bf7931` → `bdb7d35` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23757", "createdAt": "2026-08-05T00:09:07Z", "updatedAt": "2026-08-12T21:07:30Z", "timestamp": "2026-08-12T21:07:30Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "docker" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23762", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update golang:1.26.5 Docker digest to 705e964 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `3aff665` → `705e964` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23762", "createdAt": "2026-08-05T06:06:23Z", "updatedAt": "2026-08-13T09:08:20Z", "timestamp": "2026-08-13T09:08:20Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "sig/operator", "docker" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23767", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of postings offset table", "text": "- Remove PostingsRanges() from interface as it's unused - Implement Postings for cases where a fingerprint filter isn't given - All is derivative of existing implementation, so can be reviewed against that. And also is tested against the existing implementation so we know it behaves similarly. **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: Can be compared to the existing implementation in index.go. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23767", "createdAt": "2026-08-05T09:23:03Z", "updatedAt": "2026-08-13T08:35:51Z", "timestamp": "2026-08-13T08:35:51Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23768", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of fingerprint offsets table", "text": "- Read it into memory on open (like existing mmap implementation). - Implement Postings(...) for non-nil fingerprint filters. - Test against existing implementation. - Second commit makes changes across a few of the files I've been working on to prevent leaking file descriptors when creating a decbuf fails. This problem was identified by cursor's review of this PR. **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: Can be compared to existing implementation in index.go. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23768", "createdAt": "2026-08-05T10:11:14Z", "updatedAt": "2026-08-13T08:35:52Z", "timestamp": "2026-08-13T08:35:52Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23777", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Add Thanos storage examples 🤖🤖🤖", "text": "**What this PR does / why we need it**: Updates the sample storage examples to include Thanos configuration format using `object_store` as requested by @bboreham. This PR - Adds four new examples of Thanos storage configuration files - Updates existing examples to better indicate - Removes some extra lines **Special notes for your reviewer**: Planned with AI (Sonnet 5) Written with AI (Sonnet 5) Validated with a different model (Opus 5) Since storage.md has already been updated for the next release, we won't backport this update either, although it will be available in `next` until the next release.", "url": "https://github.com/grafana/loki/pull/23777", "createdAt": "2026-08-05T15:51:28Z", "updatedAt": "2026-08-12T21:30:06Z", "timestamp": "2026-08-12T21:30:06Z", "metrics": { "reactions": 0, "comments": 3 }, "labels": [ "type/docs" ], "author": "JStickler", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23790", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of series", "text": "- Add optimisation to FilePoolDecbufFactory to cache fileSize - Cache all label names in memory in streamSymbols (same as mmap) - Add isLabelName to streamPostings, used to populate that cache in streamSymbols - These two optimisations make the new Series and ChunkStats implementations more efficient. **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A. **Special notes for your reviewer**: Second commit can be reviewed separately - it's a small refactor over tests added during this project. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23790", "createdAt": "2026-08-06T10:41:44Z", "updatedAt": "2026-08-13T08:35:55Z", "timestamp": "2026-08-13T08:35:55Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23792", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/IBM/ibm-cos-sdk-go to v1.15.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/IBM/ibm-cos-sdk-go](https://redirect.github.com/IBM/ibm-cos-sdk-go) | `v1.14.1` → `v1.15.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fIBM%2fibm-cos-sdk-go/v1.15.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fIBM%2fibm-cos-sdk-go/v1.14.1/v1.15.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
IBM/ibm-cos-sdk-go (github.com/IBM/ibm-cos-sdk-go) ### [`v1.15.0`](https://redirect.github.com/IBM/ibm-cos-sdk-go/releases/tag/v1.15.0): Release 1.15.0 [Compare Source](https://redirect.github.com/IBM/ibm-cos-sdk-go/compare/v1.14.1...v1.15.0) #### Content ##### Features - Support for streaming data through pipes ##### Defect Fixes - Internal fixes and improvements
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23792", "createdAt": "2026-08-06T12:13:10Z", "updatedAt": "2026-08-13T12:11:49Z", "timestamp": "2026-08-13T12:11:49Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23802", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of label methods", "text": "- Implement LabelValues, LabelNames, LabelValueFor and LabelNamesFor - Test these against the existing implementation - Remove mmap fallback from stream_reader.go as it's no longer needed **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A. **Special notes for your reviewer**: This is all very close to the existing implementation and can be reviewed against it. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23802", "createdAt": "2026-08-06T15:02:12Z", "updatedAt": "2026-08-13T08:35:55Z", "timestamp": "2026-08-13T08:35:55Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23806", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/redis/go-redis/v9 to v9.22.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/redis/go-redis/v9](https://redirect.github.com/redis/go-redis) | `v9.21.0` → `v9.22.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fredis%2fgo-redis%2fv9/v9.22.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fredis%2fgo-redis%2fv9/v9.21.0/v9.22.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
redis/go-redis (github.com/redis/go-redis/v9) ### [`v9.22.0`](https://redirect.github.com/redis/go-redis/releases/tag/v9.22.0): 9.22.0 [Compare Source](https://redirect.github.com/redis/go-redis/compare/v9.21.0...v9.22.0) This is a minor release introducing two flagship (experimental) features — **client-side caching** and **automatic pipelining** — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade. ⚠️ Two changes to be aware of when upgrading from 9.21.0: - **Default configuration values changed** ([#​3918](https://redirect.github.com/redis/go-redis/pull/3918)): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected. - **`WaitAOF` return type corrected** ([#​3888](https://redirect.github.com/redis/go-redis/pull/3888)): `WaitAOF` now returns `*IntSliceCmd`, matching the two-integer reply of `WAITAOF` (previously `*IntCmd`, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update. ##### 🚀 Highlights ##### Client-Side Caching (Experimental) The standalone `Client` gains server-assisted client-side caching built on RESP3 `CLIENT TRACKING`. Enable it by setting `ClientSideCacheConfig` in `Options` (or supply your own cache via `ClientSideCache` — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads. The invalidation architecture is selected by `ClientSideCacheStrategy`; the default (and currently only) strategy is `CSCStrategySharedTracking`: one shared cache, every pool connection runs plain `CLIENT TRACKING ON`, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (`Protocol: 3`), standalone client, DB 0 only; commands that would change the connection identity (`SELECT`, `AUTH`, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed `Username`/`Password` work and are namespaced). See the README's [client-side caching section](README.md#client-side-caching) and the runnable [example](example/client-side-caching). **Experimental:** the API may change in a minor release. ([#​3941](https://redirect.github.com/redis/go-redis/pull/3941)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) ##### Automatic Pipelining (Experimental) `AutoPipeliner` is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on `Client` and `ClusterClient` (and configurable via `Options.AutoPipelineOptions` / `UniversalOptions.AutoPipelineOptions`): - **`AutoPipeline()`** — the blocking face: a drop-in `Cmdable` where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: \\~1M+ SET/sec vs \\~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved. - **`AsyncAutoPipeline()`** — the deferred face: command calls return immediately and every typed result accessor (`Val`/`Result`/`Err`/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (\\~2–3M SET/sec locally; indicative). `AutoPipelineOptions` controls batching: `MaxBatchSize` (soft target, default 200; the blocking face's preset uses 300), `MaxBatchBytes` (approximate payload cap so huge values flush as several bounded writes), `MaxFlushDelay` with optional `AdaptiveDelay` (delay scales down as the queue fills), and `MaxConcurrentBatches` (default 1 = a single ordered batch stream; raising it requires `Unordered: true`, so ordering is never lost by accident — `Validate()` rejects the combination otherwise). A usage tour and throughput comparison live in [`example/autopipeline`](example/autopipeline). **Experimental:** the API may change in a future release — pin your go-redis version if you adopt it. ([#​3942](https://redirect.github.com/redis/go-redis/pull/3942)) by [@​ndyakov](https://redirect.github.com/ndyakov), with help from [@​cxljs](https://redirect.github.com/cxljs) ##### Redis 8.10 Support This release adds support for **Redis 8.10**. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the `redislabs/client-libs-test:8.10.0` image by default ([#​3920](https://redirect.github.com/redis/go-redis/pull/3920), [#​3940](https://redirect.github.com/redis/go-redis/pull/3940)). Coverage for the new commands and options that ship with Redis 8.10: - **`HIMPORT`** ([#​3919](https://redirect.github.com/redis/go-redis/pull/3919)) — bulk hash import via server-side fieldsets, exposed as `HImportPrepare`, `HImportSet`, `HImportDiscard`, and `HImportDiscardAll`. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the `PREPARE` on whichever pooled connection executes a `SET` that needs it, at most once per connection, with no extra round trip (the `PREPARE` is injected into the same write as the `SET`). - **`LMOVEM` / `BLMOVEM`** ([#​3913](https://redirect.github.com/redis/go-redis/pull/3913)) — move multiple elements between lists in one call. - **`SUNIONCARD` / `SDIFFCARD`** ([#​3897](https://redirect.github.com/redis/go-redis/pull/3897)) — cardinality of set union/difference without materializing the result. - **`XREAD` / `XREADGROUP` `MAXCOUNT` and `MAXSIZE`** ([#​3898](https://redirect.github.com/redis/go-redis/pull/3898)) — bound how much data a stream read returns. - **`TS.READ`** ([#​3896](https://redirect.github.com/redis/go-redis/pull/3896)), **`TS.QUERYLABELS`** ([#​3926](https://redirect.github.com/redis/go-redis/pull/3926)), **`TS.NRANGE` / `TS.NREVRANGE`** ([#​3870](https://redirect.github.com/redis/go-redis/pull/3870)) with multiple aggregators per key ([#​3937](https://redirect.github.com/redis/go-redis/pull/3937)), and **`EXCLUDEEMPTY`** on `TS.MRANGE` / `TS.MREVRANGE` ([#​3912](https://redirect.github.com/redis/go-redis/pull/3912)) — new time-series query surface. - **`FT.ALIASLIST`** ([#​3925](https://redirect.github.com/redis/go-redis/pull/3925)), **`COLLECT` reducer for `FT.AGGREGATE`** ([#​3886](https://redirect.github.com/redis/go-redis/pull/3886)), **`RERANK` on HNSW vector fields in `FT.CREATE`** ([#​3927](https://redirect.github.com/redis/go-redis/pull/3927)), and **`FT.HYBRID` timeout warnings** ([#​3911](https://redirect.github.com/redis/go-redis/pull/3911)) — search coverage. ##### Cross-SDK Aligned Defaults Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries ([#​3918](https://redirect.github.com/redis/go-redis/pull/3918)): | Setting | Old default | New default | | ------------------------------ | ----------- | --------------------------------------------------------- | | `ReadTimeout` / `WriteTimeout` | 3s | 5s | | Retry backoff (min/max) | 8ms / 512ms | 10ms / 1s | | Cluster state reload interval | 10s | 60s | | TCP keep-alive | 5min period | 30s idle / 5s interval / 3 probes (`net.KeepAliveConfig`) | Applications that set these values explicitly are unaffected; applications relying on the old defaults inherit the new ones. ##### Data-Race and Parser Hardening Sweep A systematic audit fixed data races across the client — hooks (`AddHook`, [#​3868](https://redirect.github.com/redis/go-redis/pull/3868)), `Ring.SetAddrs` ([#​3862](https://redirect.github.com/redis/go-redis/pull/3862)), cluster node slices ([#​3861](https://redirect.github.com/redis/go-redis/pull/3861)), pub/sub reconnect ([#​3906](https://redirect.github.com/redis/go-redis/pull/3906)), maintenance notifications ([#​3894](https://redirect.github.com/redis/go-redis/pull/3894), [#​3872](https://redirect.github.com/redis/go-redis/pull/3872)), pool handoff ([#​3876](https://redirect.github.com/redis/go-redis/pull/3876)), and `redisotel` ([#​3881](https://redirect.github.com/redis/go-redis/pull/3881)) — and hardened the RESP parsers against malformed or unexpected replies: over-reads on nil replies ([#​3874](https://redirect.github.com/redis/go-redis/pull/3874)), integer overflow when skipping map/attribute bodies ([#​3877](https://redirect.github.com/redis/go-redis/pull/3877)), unhashable RESP3 map keys ([#​3873](https://redirect.github.com/redis/go-redis/pull/3873)), odd-length flat replies ([#​3900](https://redirect.github.com/redis/go-redis/pull/3900)), mismatched declared array lengths ([#​3907](https://redirect.github.com/redis/go-redis/pull/3907)), unexpected extra reply frames ([#​3884](https://redirect.github.com/redis/go-redis/pull/3884)), and nil elements in numeric/bool slice replies ([#​3922](https://redirect.github.com/redis/go-redis/pull/3922)). ##### PubSub `Receive` Hang Fix `PeekPushNotificationName` blocked until 36 bytes were buffered, so a short subscribe confirmation (channel name of six or fewer characters) on an otherwise idle connection hung `PubSub.Receive` forever — a regression introduced in 9.20.1 by [#​3842](https://redirect.github.com/redis/go-redis/pull/3842). The peek now parses whatever is already buffered and only waits for one more byte when the frame prefix is valid but incomplete. Fixes [#​3935](https://redirect.github.com/redis/go-redis/issues/3935). ([#​3936](https://redirect.github.com/redis/go-redis/pull/3936)) by [@​ndyakov](https://redirect.github.com/ndyakov) ##### Correct Cluster Transaction Retries The cluster transaction pipeline treated a `MULTI`...`EXEC` block as independently retryable commands, which could scatter a transaction across nodes or send malformed transactions on retry. Redirects (`MOVED`/`ASK`/`TRYAGAIN`) and aborts are now handled at the whole-transaction level, matching Redis transaction semantics: the transaction is re-routed and retried as a unit, never partially ([#​3909](https://redirect.github.com/redis/go-redis/pull/3909)) by [@​cxljs](https://redirect.github.com/cxljs). ##### Credential Redaction in Command Tracing `rediscmd.AppendCmd` — used by `redisotel` and `rediscensus` to render commands into span attributes — now redacts credential arguments as ``: `AUTH`, `HELLO ... AUTH`, `CONFIG SET` of `requirepass` / `masterauth` / TLS key passphrases, `ACL SETUSER` password rules, and `MIGRATE ... AUTH`/`AUTH2`. The client sends `HELLO ... AUTH` on every handshake and `AUTH` on every streaming-credentials rotation through the regular hook chain, so tracing hooks previously captured credentials even when the application never issued an auth command itself ([#​3939](https://redirect.github.com/redis/go-redis/pull/3939)) by [@​saddamr3e](https://redirect.github.com/saddamr3e). ##### ✨ New Features - **Client-side caching**: server-assisted caching for the standalone client via `ClientSideCacheConfig` / `ClientSideCache`, with the `CSCStrategySharedTracking` invalidation strategy ([#​3941](https://redirect.github.com/redis/go-redis/pull/3941)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **Automatic pipelining**: `AutoPipeline()` (blocking) and `AsyncAutoPipeline()` (deferred results) on `Client` and `ClusterClient`, configured via `AutoPipelineOptions` ([#​3942](https://redirect.github.com/redis/go-redis/pull/3942)) by [@​ndyakov](https://redirect.github.com/ndyakov), with help from [@​cxljs](https://redirect.github.com/cxljs) - **`HIMPORT` command family**: `HImportPrepare` / `HImportSet` / `HImportDiscard` / `HImportDiscardAll` with lazy per-connection fieldset prepare replay ([#​3919](https://redirect.github.com/redis/go-redis/pull/3919)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`LMOVEM` / `BLMOVEM`**: move multiple list elements in one call, with `COUNT` (up to N) or `EXACTLY` (all-or-nothing) semantics via `LMoveMArgs` ([#​3913](https://redirect.github.com/redis/go-redis/pull/3913)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`SUnionCard` / `SDiffCard`**: cardinality of set union/difference ([#​3897](https://redirect.github.com/redis/go-redis/pull/3897)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`XRead` / `XReadGroup` `MAXCOUNT` / `MAXSIZE`**: bound stream read responses by entry count or payload size ([#​3898](https://redirect.github.com/redis/go-redis/pull/3898)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`TS.READ`**: read samples from a series starting at a given timestamp, with `TSReadEarliest` (`-`), `TSReadLatest` (`+`), and `TSReadNew` (`$`) sentinels ([#​3896](https://redirect.github.com/redis/go-redis/pull/3896)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`TS.QUERYLABELS`**: query label names/values across time series ([#​3926](https://redirect.github.com/redis/go-redis/pull/3926)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`TS.NRANGE` / `TS.NREVRANGE`**: range queries across multiple series ([#​3870](https://redirect.github.com/redis/go-redis/pull/3870)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa), with multiple aggregators per key ([#​3937](https://redirect.github.com/redis/go-redis/pull/3937)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`TS.MRANGE` / `TS.MREVRANGE` `EXCLUDEEMPTY`**: skip series with no samples in the result ([#​3912](https://redirect.github.com/redis/go-redis/pull/3912)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`FT.ALIASLIST`**: list all index aliases ([#​3925](https://redirect.github.com/redis/go-redis/pull/3925)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`FT.AGGREGATE` `COLLECT` reducer**: collect grouped values into an array ([#​3886](https://redirect.github.com/redis/go-redis/pull/3886)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`FT.CREATE` `RERANK`**: `RERANK` parameter on HNSW vector field definitions ([#​3927](https://redirect.github.com/redis/go-redis/pull/3927)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`FT.HYBRID` timeout warnings**: timeout warnings are now populated in hybrid search results ([#​3911](https://redirect.github.com/redis/go-redis/pull/3911)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`FT.HYBRID` KNN `SHARD_K_RATIO`** (Redis 8.8+): per-shard K ratio for KNN clauses ([#​3841](https://redirect.github.com/redis/go-redis/pull/3841)) by [@​ndyakov](https://redirect.github.com/ndyakov) ##### 🐛 Bug Fixes - **PubSub `Receive` hang**: peek push-notification names without demanding 36 buffered bytes, fixing a hang on short subscribe confirmations (fixes [#​3935](https://redirect.github.com/redis/go-redis/issues/3935), regression from 9.20.1) ([#​3936](https://redirect.github.com/redis/go-redis/pull/3936)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **Cluster transactions**: re-route the whole tx pipeline on redirect/abort instead of per-command ([#​3909](https://redirect.github.com/redis/go-redis/pull/3909)) by [@​cxljs](https://redirect.github.com/cxljs) - **Credential leak in traces**: `rediscmd.AppendCmd` redacts credential arguments (`AUTH`, `HELLO ... AUTH`, `CONFIG SET` secret params, `ACL SETUSER` password rules, `MIGRATE AUTH`/`AUTH2`), so `redisotel` / `rediscensus` span attributes no longer contain passwords ([#​3939](https://redirect.github.com/redis/go-redis/pull/3939)) by [@​saddamr3e](https://redirect.github.com/saddamr3e) - **`WaitAOF` return type**: returns `*IntSliceCmd` matching the two-integer `WAITAOF` reply ([#​3888](https://redirect.github.com/redis/go-redis/pull/3888)) by [@​CipherN9](https://redirect.github.com/CipherN9) - **`Ring.Publish` routing**: publish to the shard that owns the topic instead of a round-robined one ([#​3893](https://redirect.github.com/redis/go-redis/pull/3893)) by [@​dkindel](https://redirect.github.com/dkindel) - **Pool `OnRemove` hooks**: fire `OnRemove` on `putConn` eviction paths so removal hooks see every evicted connection ([#​3932](https://redirect.github.com/redis/go-redis/pull/3932)) by [@​cxljs](https://redirect.github.com/cxljs) - **`UniversalClient` `InfoMap`**: added `InfoMap` to the `Cmdable` interface ([#​3904](https://redirect.github.com/redis/go-redis/pull/3904)) by [@​nazarli-shabnam](https://redirect.github.com/nazarli-shabnam) - **`SlowLogGet` context**: pass the caller's context instead of a background one ([#​3915](https://redirect.github.com/redis/go-redis/pull/3915)) by [@​sonnemusk](https://redirect.github.com/sonnemusk) - **`ModuleLoadex` nil config**: return an error instead of panicking on nil config ([#​3916](https://redirect.github.com/redis/go-redis/pull/3916)) by [@​sonnemusk](https://redirect.github.com/sonnemusk) - **`ParseURL` IPv6 hosts**: keep single brackets for IPv6 hosts without a port ([#​3882](https://redirect.github.com/redis/go-redis/pull/3882)) by [@​sueun-dev](https://redirect.github.com/sueun-dev) - **`ParseURL` durations**: treat unit durations `<= 0` as disabled ([#​3866](https://redirect.github.com/redis/go-redis/pull/3866)) by [@​sueun-dev](https://redirect.github.com/sueun-dev) - **Nil `*uint8` encoding**: encode nil `*uint8` as `\"0\"` like other numeric pointers ([#​3869](https://redirect.github.com/redis/go-redis/pull/3869)) by [@​sueun-dev](https://redirect.github.com/sueun-dev) - **`JSONSliceCmd` read errors**: return the read error from `readReply` instead of swallowing it ([#​3903](https://redirect.github.com/redis/go-redis/pull/3903)) by [@​saddamr3e](https://redirect.github.com/saddamr3e) - **RESP parser hardening**: reconcile declared entry-array lengths ([#​3907](https://redirect.github.com/redis/go-redis/pull/3907)), handle nil elements in int/uint/bool slice parsers ([#​3922](https://redirect.github.com/redis/go-redis/pull/3922)), drain unexpected reply frames ([#​3884](https://redirect.github.com/redis/go-redis/pull/3884)), reject odd-length flat replies in Z/KeyValue parsers ([#​3900](https://redirect.github.com/redis/go-redis/pull/3900)), avoid int overflow when skipping map/attr bodies ([#​3877](https://redirect.github.com/redis/go-redis/pull/3877)), don't over-read nil replies in `Reader.Discard` ([#​3874](https://redirect.github.com/redis/go-redis/pull/3874)) by [@​saddamr3e](https://redirect.github.com/saddamr3e); reject unhashable keys in RESP3 map parsing ([#​3873](https://redirect.github.com/redis/go-redis/pull/3873)) by [@​iabdullah215](https://redirect.github.com/iabdullah215) - **Data races**: hook state during `AddHook` ([#​3868](https://redirect.github.com/redis/go-redis/pull/3868)), `onNewNode` during `Ring.SetAddrs` ([#​3862](https://redirect.github.com/redis/go-redis/pull/3862)), shared masters/slaves slices in cluster ([#​3861](https://redirect.github.com/redis/go-redis/pull/3861)), shared `opt.Addr` during pub/sub reconnect ([#​3906](https://redirect.github.com/redis/go-redis/pull/3906)), `clusterStateReloadCallback` in maintnotifications ([#​3894](https://redirect.github.com/redis/go-redis/pull/3894)), conn reader in `isHealthyConn` during handoff ([#​3876](https://redirect.github.com/redis/go-redis/pull/3876)) by [@​saddamr3e](https://redirect.github.com/saddamr3e); handoff race window in maintnotifications ([#​3872](https://redirect.github.com/redis/go-redis/pull/3872)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`redisotel`**: use `ObservableCounter` for cumulative pool stats ([#​3914](https://redirect.github.com/redis/go-redis/pull/3914)) by [@​Solaris-star](https://redirect.github.com/Solaris-star); avoid a data race on shared attributes during `MinIdleConns` warmup ([#​3881](https://redirect.github.com/redis/go-redis/pull/3881)) by [@​ndyakov](https://redirect.github.com/ndyakov) ##### 🧰 Maintenance - **Cross-SDK default alignment**: new defaults for timeouts, retry backoff, cluster state reload, and TCP keep-alive ([#​3918](https://redirect.github.com/redis/go-redis/pull/3918)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **CI on Redis 8.10**: 8.10 made the default test version ([#​3920](https://redirect.github.com/redis/go-redis/pull/3920)) with version gating by major.minor ([#​3908](https://redirect.github.com/redis/go-redis/pull/3908)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa); the test stack now runs the GA `redislabs/client-libs-test:8.10.0` image and 8.8 was dropped from the CI matrix ([#​3940](https://redirect.github.com/redis/go-redis/pull/3940)) - **Type-safe atomics**: use typed `sync/atomic` value types ([#​3860](https://redirect.github.com/redis/go-redis/pull/3860)) and remove the dead `assertUnstableCommand` RESP3 path ([#​3928](https://redirect.github.com/redis/go-redis/pull/3928)) by [@​cxljs](https://redirect.github.com/cxljs) - **Docs**: clarify that `ExpireTime` / `PExpireTime` return Unix timestamps ([#​3917](https://redirect.github.com/redis/go-redis/pull/3917)) by [@​sonnemusk](https://redirect.github.com/sonnemusk); remove a duplicate example step ([#​3875](https://redirect.github.com/redis/go-redis/pull/3875)) by [@​andy-stark-redis](https://redirect.github.com/andy-stark-redis) ##### 👥 Contributors We'd like to thank all the contributors who worked on this release! [@​andy-stark-redis](https://redirect.github.com/andy-stark-redis), [@​CipherN9](https://redirect.github.com/CipherN9), [@​cxljs](https://redirect.github.com/cxljs), [@​dkindel](https://redirect.github.com/dkindel), [@​iabdullah215](https://redirect.github.com/iabdullah215), [@​nazarli-shabnam](https://redirect.github.com/nazarli-shabnam), [@​ndyakov](https://redirect.github.com/ndyakov), [@​ofekshenawa](https://redirect.github.com/ofekshenawa), [@​saddamr3e](https://redirect.github.com/saddamr3e), [@​Solaris-star](https://redirect.github.com/Solaris-star), [@​sonnemusk](https://redirect.github.com/sonnemusk), [@​sueun-dev](https://redirect.github.com/sueun-dev) *** **Full Changelog**:
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23806", "createdAt": "2026-08-06T18:11:24Z", "updatedAt": "2026-08-13T15:10:33Z", "timestamp": "2026-08-13T15:10:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23864", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Large requests returned 400 instead 413", "text": "**What this PR does / why we need it**: This pull request fixes a number of cases where large requests were failed with a 400 instead of a 413 status code. This seems inconsequential, but it meant a number of these cases were invisible on provisioned Grafana Cloud dashboards that customers use to track their ingest. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23864", "createdAt": "2026-08-09T14:05:07Z", "updatedAt": "2026-08-13T08:23:16Z", "timestamp": "2026-08-13T08:23:16Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "grobinson-grafana", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23870", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.106.5` → `v1.107.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fs3/v1.107.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fs3/v1.106.5/v1.107.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/s3) ### [`v1.107.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2026-08-06) #### General Highlights - **Dependency Update**: Updated to the latest SDK module versions #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/agentregistry`: [v1.0.0](service/agentregistry/CHANGELOG.md#v100-2026-08-06) - **Release**: New AWS service client module - **Feature**: Agent Registry's Public Preview release - `github.com/aws/aws-sdk-go-v2/service/agentregistrycontrol`: [v1.0.0](service/agentregistrycontrol/CHANGELOG.md#v100-2026-08-06) - **Release**: New AWS service client module - **Feature**: Agent Registry's Public Preview release - `github.com/aws/aws-sdk-go-v2/service/autoscaling`: [v1.71.0](service/autoscaling/CHANGELOG.md#v1710-2026-08-06) - **Feature**: EC2 Auto Scaling now supports being managed by other AWS services via the operator field. - `github.com/aws/aws-sdk-go-v2/service/backup`: [v1.60.0](service/backup/CHANGELOG.md#v1600-2026-08-06) - **Feature**: AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore`: [v1.37.0](service/bedrockagentcore/CHANGELOG.md#v1370-2026-08-06) - **Feature**: Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol`: [v1.55.0](service/bedrockagentcorecontrol/CHANGELOG.md#v1550-2026-08-06) - **Feature**: Add support for Gateway rate limits and Runtime instances in Amazon Bedrock AgentCore. Customers can now configure rate limits scoped to control request rates, token consumption rates, and active connection rates. Customers can now create capacity providers to launch runtimes on their EC2 instances. - `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs`: [v1.82.0](service/cloudwatchlogs/CHANGELOG.md#v1820-2026-08-06) - **Feature**: This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes. - `github.com/aws/aws-sdk-go-v2/service/devicefarm`: [v1.42.0](service/devicefarm/CHANGELOG.md#v1420-2026-08-06) - **Feature**: Adds support for service generated insights across runs, jobs, and tests. - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.320.0](service/ec2/CHANGELOG.md#v13200-2026-08-06) - **Feature**: Adds a new optional IncludeLocalZones parameter to the Spot Placement Score API that defaults to false. When set to true, the Spot Placement Score API will consider the relevant Local Zones with Spot capacity when computing the Spot Placement Score. - `github.com/aws/aws-sdk-go-v2/service/gamelift`: [v1.61.0](service/gamelift/CHANGELOG.md#v1610-2026-08-06) - **Feature**: Adds support for C8a, C8i, C9g, M8a, M8i, and M9g EC2 instance type families for managed EC2 and container fleets. Also adds explicit anchors on most string regexes. - `github.com/aws/aws-sdk-go-v2/service/kafka`: [v1.58.0](service/kafka/CHANGELOG.md#v1580-2026-08-06) - **Feature**: MSK Clusters can now deliver authorizer logs alongside broker logs to the destinations defined by you - `github.com/aws/aws-sdk-go-v2/service/marketplaceagreement`: [v1.20.0](service/marketplaceagreement/CHANGELOG.md#v1200-2026-08-06) - **Feature**: GetAgreementTerms now returns a new term variant in AcceptedTerm, netPaymentTerm, with a paymentDuePeriod field (example \"P30D\"). - `github.com/aws/aws-sdk-go-v2/service/marketplacediscovery`: [v1.4.0](service/marketplacediscovery/CHANGELOG.md#v140-2026-08-06) - **Feature**: GetOfferTerms now returns netPaymentTerm in offerTerms, specifying payment due period after invoice date. The paymentDuePeriod field uses ISO 8601 duration format (e.g., \"P30D\" for net 30 days). This is a backward-compatible addition. See API documentation for full structure and examples. - `github.com/aws/aws-sdk-go-v2/service/mediatailor`: [v1.64.0](service/mediatailor/CHANGELOG.md#v1640-2026-08-06) - **Feature**: AWS Elemental MediaTailor now supports concurrent function execution. The new Concurrent Executor function type runs multiple independent child functions in parallel within a single lifecycle hook, reducing pipeline latency to the duration of the slowest call instead of the sum of all calls. - `github.com/aws/aws-sdk-go-v2/service/s3`: [v1.107.0](service/s3/CHANGELOG.md#v11070-2026-08-06) - **Feature**: AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. - `github.com/aws/aws-sdk-go-v2/service/sagemaker`: [v1.264.0](service/sagemaker/CHANGELOG.md#v12640-2026-08-06) - **Feature**: Releases new Model Customization SequenceLength parameter for Training and g7 instance types for Training and Processing. - `github.com/aws/aws-sdk-go-v2/service/securityhub`: [v1.76.0](service/securityhub/CHANGELOG.md#v1760-2026-08-06) - **Feature**: Security Hub is adding a new public API, ListFreeTrialStatusesV2 to describe the free trial statuses of the Security Hub service and its opt-in features. - `github.com/aws/aws-sdk-go-v2/service/socialmessaging`: [v1.14.0](service/socialmessaging/CHANGELOG.md#v1140-2026-08-06) - **Feature**: Add support for WhatsApp Conversions APIs.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23870", "createdAt": "2026-08-09T21:10:16Z", "updatedAt": "2026-08-13T12:11:43Z", "timestamp": "2026-08-13T12:11:43Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23884", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(operator): Remove BoltDB alerts, recording rules, and Grafana dashboards", "text": "**What this PR does / why we need it**: - Removes `LokiStorageSlowWrite` and `LokiStorageSlowRead` alerts - Removes the `job_le_namespace_operation:loki_boltdb_shipper_request_duration_seconds_bucket` recording rule - Rewrites the retention dashboard compaction panels from `loki_boltdb_shipper_compact_tables_operation_*` to `loki_compactor_apply_retention_*` metrics - Removes dashboard rows for BoltDB-specific marker/sweeper panels - Updates alert test data to match the new rules **Which issue(s) this PR fixes**: Fixes [LOG-9666](https://redhat.atlassian.net/browse/LOG-9666) **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/)", "url": "https://github.com/grafana/loki/pull/23884", "createdAt": "2026-08-10T12:40:03Z", "updatedAt": "2026-08-13T11:28:01Z", "timestamp": "2026-08-13T11:28:01Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "btaani", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23899", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Update Helm Charts docs 🤖🤖🤖", "text": "**What this PR does / why we need it**: Updates the Loki Helm charts to keep pace with updates in the Grafana-community repo. Regenerates the Helm Reference file. Replaces relative links with full URLs. **Special notes for your reviewer**: Planned with AI (Sonnet 5) Written with AI (Sonnet 5) Validated with a different model (Opus 5)", "url": "https://github.com/grafana/loki/pull/23899", "createdAt": "2026-08-10T21:26:34Z", "updatedAt": "2026-08-12T18:56:17Z", "timestamp": "2026-08-12T18:56:17Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs", "backport release-3.7.x" ], "author": "JStickler", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23902", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "test(logql): Expand logqltest label filter coverage and correct the docs", "text": "**What this PR does / why we need it**: The existing `label_filters.logqltest` scenarios covered the happy path of each label filter kind, but stopped short of the operators, value forms and error paths where the behaviour is least obvious. Filling those gaps turned up three statements in the docs that the engine contradicts, so this corrects them and pins each one with a test. Docs corrections: - `and` is evaluated before `or`, not left to right, and a `|` starts a new stage rather than another predicate — so the two forms the docs listed as equivalent are not. - Only a string filter can test `__error__`. A converting filter cannot read it, so `| __error__ > 0` silently matches nothing. - An `ip()` label filter keeps a line that already carries an `__error__` label, whichever operation is used. **Which issue(s) this PR fixes**: Relates to #23892, found while writing these tests. That fix is deliberately out of scope here, and no scenario pins the affected behaviour. **Special notes for your reviewer**: N/A **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23902", "createdAt": "2026-08-11T04:13:20Z", "updatedAt": "2026-08-13T08:25:07Z", "timestamp": "2026-08-13T08:25:07Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs" ], "author": "pracucci", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23906", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(logql): Count unwrapped samples in the sharded avg_over_time denominator", "text": "**What this PR does / why we need it**: With sharding enabled, a grouped `avg_over_time(... | unwrap x)` returns a value that is too low whenever a log line yields no unwrapped sample. The shard mapper decomposes the average into a sum leg over samples divided by a count leg over lines, and the count leg counts lines the numerator never saw. A line yields an unwrapped sample exactly when the pipeline keeps it, the identifier resolves to a non-empty label, and the post filters keep it. All three are expressible as pipeline stages, so the count leg becomes `count_over_time(E | x != \"\" | f [r])`. The `| x != \"\"` filter resolves the value through the same `LabelsBuilder.Get()` call the sample extractor makes, so this matches the unsharded result rather than approximating it. The emitted plan stays ordinary LogQL, so no querier-side changes and no rollout gate are needed. This also fixes two related divergences: `WithoutUnwrap()` dropped the unwrap's post filters entirely, and an unwrap on a stream label absent from some streams was counted as if present. One shape is left unsharded instead: a post filter on `__error__`. Only the unwrap conversion sets that label, so a pipeline filter cannot reproduce it. **Which issue(s) this PR fixes**: Fixes #23890 **Special notes for your reviewer**: More tests have been added in https://github.com/grafana/loki/pull/23909, where I've also cherry-picked the changes in this PR. I have a chicken-egg problem: logqltest on query-frontend fail without with PR, but logqltest on query-frontend is not yet supported in `main` (because they fail), so that's why the the PRs are related together. The issue describes two other options and why this one was preferred over them. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23906", "createdAt": "2026-08-11T07:33:54Z", "updatedAt": "2026-08-13T08:29:59Z", "timestamp": "2026-08-13T08:29:59Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "pracucci", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23907", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: deduplicate log lines split across stream shards", "text": "**What this PR does / why we need it**: Automatic stream sharding splits one stream into shards by adding an internal label (`__stream_shard__`, and `__time_shard__` for time-based sharding). When a client resends a log line, the copy can be assigned to a different shard, so the two copies land in different streams and are not deduplicated at query time (#18760). Drop the two sharding labels from a stream's query-time identity in `pipeline.ForStream` and in the sample extractors, which the ingester and store query paths both use. Shards of one stream then share one stream hash and one set of base labels, so the merge iterators drop the duplicate lines and samples. Streams without a sharding label are unaffected, and other reserved (`__`-prefixed) labels that identify a distinct stream, such as `__aggregated_metric__` and `__pattern__`, are left in place. Sharing the hash alone is not enough for metric queries: the per-sample line hash is computed from the result labels string (`sample.Hash` in `sampleBufferedIterator`), so a shard label left in the labels still blocks sample dedup. Dropping the labels from the identity covers both. It also keeps the identity independent of which shard a querier happens to see first: `BaseLabelsBuilder.ForLabels` caches the labels result by hash, so hashing shards together while keeping their own labels would return the first shard's labels for the others. Deduplication also has to handle duplicates that arrive within one iterator, because store and ingester paths sort-merge the shard streams before the querier sees them. The querier no longer skips the merge iterator for a single input (the entry merge iterator already deduplicates within one input), and the sample merge iterator now scans the whole buffered group in all three of its phases: the multi-iterator loop compared a sample only against the other iterators' samples, so a duplicate following its original inside the same iterator survived while several sources were active. As a result the sharding labels no longer appear in query results. That matches how they are already treated elsewhere: the label browser, query builder, and autocomplete hide `__`-prefixed internal labels, and #13095 reports them showing up in results as confusing. **Which issue(s) this PR fixes**: Fixes #18760 **Special notes for your reviewer**: #7005 fixed this the same way (dropping the shard label at query time) and was reverted in #7031 for a simpler version that was never opened. This keeps the change in `ForStream`, so it applies to the ingester, store, and tail paths without touching the iterators. The two sharding labels are defined once in `pkg/util/constants` and referenced from the ingester and distributor. The revert of #7005 was about cost, so the common path stays cheap. The cost is per `ForStream` call (once per stream/chunk iterator, not per line): ``` BenchmarkForStreamShardStrip/unsharded-14 18868245 62.71 ns/op 0 B/op 0 allocs/op BenchmarkForStreamShardStrip/sharded-14 6412525 196.1 ns/op 336 B/op 3 allocs/op ``` Behavior notes: - Lines are dropped only when they are identical (same timestamp, line, and structured metadata) and belong to shards of the same stream, so streams that genuinely differ are never merged. There is a chunk-level test that merges two shards and verifies one entry for log queries and one sample for metric queries, in the multi-iterator shape and in the single sorted iterator shape that store-only queries produce; the sample cases fail without the extractor and fast-path changes. - Single-source log queries now go through the merge iterator instead of returning the raw iterator. The sample fast path keeps its shape (no heap operations) and only adds a timestamp comparison per sample when there are no duplicates. The doc comments on the two merge constructors said they do not deduplicate within a single iterator; the entry iterator already did, so they now describe the actual behavior. - Every deduplication comparison in the codebase (one in the entry merge iterator, three in the sample merge iterator) now scans the full buffered group of a timestamp and stream hash, regardless of which iterator a sample came from. - One known gap remains for index-sharded metric queries: partial aggregations are evaluated per index shard, and the shards of a stream have different fingerprints, so they can fall into different index shards where their duplicates never meet a merge iterator. That is a property of fingerprint-based index sharding and out of scope here. - A label filter or grouping on `__stream_shard__` no longer matches, since the label is not part of the stream's identity anymore. Selector matchers are unaffected (they are applied before the pipeline runs), and so is the deletion path, which matches on the original labels. - Tailing without a filter keeps its existing fast path that forwards streams untouched, so those responses still carry the shard label. - `Test_StructuredMetadata` in the ingester asserted that tail responses echo the shard label back; it now expects the label to be dropped. cc @trevorwhitney @monxas, who discussed the approach on the issue. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23907", "createdAt": "2026-08-11T09:51:04Z", "updatedAt": "2026-08-13T08:33:58Z", "timestamp": "2026-08-13T08:33:58Z", "metrics": { "reactions": 0, "comments": 7 }, "labels": [], "author": "17billion", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23908", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(distributor): add -distributor.extend-writes to keep write quorum during ingester scale-down", "text": "**What this PR does / why we need it**: The distributor always builds the ingester write set with `ring.WriteNoExtend`. When an ingester is briefly non-`ACTIVE` (for example `LEAVING` during a graceful scale-down or a rollout) it is dropped from the replica set with no replacement. If there is no quorum slack (RF=2, or RF=3 when several ingesters change at once), `ring.Get` returns `at least N live replicas required` and the write fails with 5xx even though the shutdown was graceful. With ingester autoscaling this shows up as constant write retries from clients. This adds `-distributor.extend-writes` (`extend_writes`), off by default so nothing changes for existing setups. When enabled the distributor uses `ring.Write`, which replaces the `LEAVING`/`JOINING` ingester with the next healthy one and keeps write quorum while the ring changes. Mimir already exposes the same flag, and dskit's lifecycler references it in the `-unregister-on-shutdown` flag help, but Loki never wired it up. Reads are unaffected: `ring.Read` already includes `LEAVING` instances and extends, so anything written to the extension target is still queried, and `maxExpectedReplicationSet` already leaves room for the extra instance. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: Opt-in only; the default keeps `WriteNoExtend`, so behavior is unchanged unless the flag is set. `writeRingOp` isolates the selection and has a unit test. The config reference was regenerated with `make doc`. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory.", "url": "https://github.com/grafana/loki/pull/23908", "createdAt": "2026-08-11T10:03:38Z", "updatedAt": "2026-08-13T08:26:18Z", "timestamp": "2026-08-13T08:26:18Z", "metrics": { "reactions": 0, "comments": 5 }, "labels": [], "author": "17billion", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23909", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "test(logql): Run logqltest scripts through query-frontend and query-scheduler", "text": "**What this PR does / why we need it**: Runs every `.logqltest` correctness script through three execution stacks and compares the results: - `direct` — the v1 engine over the chunk store - `query-frontend + query-scheduler (no sharding)` - `query-frontend + query-scheduler (sharding)` All three run end-to-end over real gRPC, so query sharding and the frontend/scheduler roundtrip are covered, not just the direct engine. Also addressed: - **`skip values-comparison on \"\"` directive.** Some stacks return values that legitimately differ. The clearest case is sharded `quantile_over_time`, whose DDSketch is approximate and diverges from the exact interpolated quantile on small sample sets. The directive skips only the float value check for the named stack, while still asserting series count, sample count, and timestamps. Every other stack stays exact, so we spot real regressions without pinning an approximate value. - **avg_over_time grouping scenarios** (logfmt and json), exercising the sharded-denominator fix. - **Script epoch moved to 2026**, fixing a sub-second range-vector-duration misparse: the query-range codec sends timestamps as bare integer nanoseconds, and values with 10 or fewer digits were read as Unix seconds. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23909", "createdAt": "2026-08-11T11:02:21Z", "updatedAt": "2026-08-13T15:55:42Z", "timestamp": "2026-08-13T15:55:42Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23910", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Treat objects as runs in compaction planning", "text": "**What this PR does / why we need it**: This updates compaction planning to treat objects are pre-existing indivisible runs when planning. * It isn't possible to consistently re-detect Runs from just looking at the sections, which meant that the planning phase tends to move data around rather than compact it. Said differently, without this change, compaction does not converge because it constantly shuffles data from overlapping objects around instead of consistently minimising it.", "url": "https://github.com/grafana/loki/pull/23910", "createdAt": "2026-08-11T11:06:29Z", "updatedAt": "2026-08-12T15:52:43Z", "timestamp": "2026-08-12T15:52:43Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "benclive", "state": "open", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23913", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Run index merge phase multiple times per log merge phase", "text": "**What this PR does / why we need it**: This runs 3x index compactions for every log merge we do. Each merge reduces Runs by K, but each log merge increases it again by K * (The K can be different for index & log merge, but in reality they are in the same ballpark) This means index-compaction doesn't make progress if it flip-flops 1-1. This PR improves that behaviour by running 3x index merges to reduce index runs by K^3 per each log-merge. This is enough to converge the index files to a single Run in most environments.", "url": "https://github.com/grafana/loki/pull/23913", "createdAt": "2026-08-11T15:13:17Z", "updatedAt": "2026-08-12T15:52:45Z", "timestamp": "2026-08-12T15:52:45Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "benclive", "state": "open", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23914", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Wire up a separate logsobj builder config", "text": "**What this PR does / why we need it**: Wires up a separate configuration for logsobj vs indexobj so we don't need to use the same for both. From experience, these are similar but we use smaller page sizes on index objects I updated the defaults against the latest recommendations. This ends up wiring all the way through multiple layers so there a lot of small changes in many files.", "url": "https://github.com/grafana/loki/pull/23914", "createdAt": "2026-08-11T16:03:36Z", "updatedAt": "2026-08-12T15:52:49Z", "timestamp": "2026-08-12T15:52:49Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "benclive", "state": "open", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23916", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update github.com/go-openapi/analysis (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-openapi/analysis](https://redirect.github.com/go-openapi/analysis) | `v0.25.5` → `v0.26.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-openapi%2fanalysis/v0.26.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-openapi%2fanalysis/v0.25.5/v0.26.0?slim=true) | | [github.com/go-openapi/validate](https://redirect.github.com/go-openapi/validate) | `v0.26.1` → `v0.26.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-openapi%2fvalidate/v0.26.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-openapi%2fvalidate/v0.26.1/v0.26.3?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
go-openapi/analysis (github.com/go-openapi/analysis) ### [`v0.26.0`](https://redirect.github.com/go-openapi/analysis/releases/tag/v0.26.0) [Compare Source](https://redirect.github.com/go-openapi/analysis/compare/v0.25.5...v0.26.0) #### [0.26.0](https://redirect.github.com/go-openapi/analysis/tree/v0.26.0) - 2026-08-08 **Full Changelog**: 7 commits in this release. *** ##### Implemented enhancements - feat: expose where each $ref is declared by [@​fredbi](https://redirect.github.com/fredbi) in [#​228](https://redirect.github.com/go-openapi/analysis/pull/228) [...](https://redirect.github.com/go-openapi/analysis/commit/d5b5620f90cc98bae2513cc21254f0220010c345) ##### Documentation - doc: updated contributors file by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​226](https://redirect.github.com/go-openapi/analysis/pull/226) [...](https://redirect.github.com/go-openapi/analysis/commit/e16df1ef0a6d5600111cb7b22c5cea5ca67f1c85) ##### Miscellaneous tasks - chore: prepare release v0.26.0 by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​229](https://redirect.github.com/go-openapi/analysis/pull/229) [...](https://redirect.github.com/go-openapi/analysis/commit/9e6d165cb9d8e606ccb80a039b5b6845871ad941) ##### Updates - chore(deps): Bump the development-dependencies group with 10 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​227](https://redirect.github.com/go-openapi/analysis/pull/227) [...](https://redirect.github.com/go-openapi/analysis/commit/53c5d6bcb220bebf70746704483632bfc1ae662b) - chore(deps): Bump the go-openapi-dependencies group with 3 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​225](https://redirect.github.com/go-openapi/analysis/pull/225) [...](https://redirect.github.com/go-openapi/analysis/commit/0c72b289a3582fc4957e2691cd1561b265d23fd8) - chore(deps): Bump the development-dependencies group across 1 directory with 11 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​224](https://redirect.github.com/go-openapi/analysis/pull/224) [...](https://redirect.github.com/go-openapi/analysis/commit/7cd64af8687e75f365e6a5f3471edbb419302ffd) - chore(deps): Bump the go-openapi-dependencies group with 2 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​223](https://redirect.github.com/go-openapi/analysis/pull/223) [...](https://redirect.github.com/go-openapi/analysis/commit/578bf0a62523f1671001808dd9504cbcdbc93054) *** ##### People who contributed to this release - [@​fredbi](https://redirect.github.com/fredbi) *** **[analysis](https://redirect.github.com/go-openapi/analysis) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-openapi/analysis/?tab=Apache-2.0-1-ov-file#readme ### Per-module changes *** #### internal/testintegration (0.26.0) ##### Miscellaneous tasks - chore: prepare release v0.26.0 by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​229](https://redirect.github.com/go-openapi/analysis/pull/229) [...](https://redirect.github.com/go-openapi/analysis/commit/9e6d165cb9d8e606ccb80a039b5b6845871ad941) ##### Updates - chore(deps): Bump the go-openapi-dependencies group with 3 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​225](https://redirect.github.com/go-openapi/analysis/pull/225) [...](https://redirect.github.com/go-openapi/analysis/commit/0c72b289a3582fc4957e2691cd1561b265d23fd8) - chore(deps): Bump the go-openapi-dependencies group with 2 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​223](https://redirect.github.com/go-openapi/analysis/pull/223) [...](https://redirect.github.com/go-openapi/analysis/commit/578bf0a62523f1671001808dd9504cbcdbc93054)
go-openapi/validate (github.com/go-openapi/validate) ### [`v0.26.3`](https://redirect.github.com/go-openapi/validate/releases/tag/v0.26.3) [Compare Source](https://redirect.github.com/go-openapi/validate/compare/v0.26.2...v0.26.3) #### [0.26.3](https://redirect.github.com/go-openapi/validate/tree/v0.26.3) - 2026-08-09 **Full Changelog**: 8 commits in this release. *** ##### Implemented enhancements - feat: check required entries of nested schemas, not only of a definition by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/7cdf3d90d2de2f47f95abc3af706fe33aae5e2f0) ##### Fixed bugs - fix: report the same findings, in the same order, on every run by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/78c71e928bd0c23e10fa6bcdec3d4fd641dfd016) - refact: recycle objects through swag/pools by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/65f13f3563ce1a72ec76d3d477eb8323993cfe94) ##### Miscellaneous tasks - ci: enable poolsdebug on separate test lane by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/2bf3c27ce032479d022c1d577581afe435755e9d) - fix: point every finding at a node the document contains by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/62ecb2e8ac32732666c26ab28457c441c9b7fd74) - ci: disabled the parallel pool testing on windows and darwin by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/5540162954ab2ee3d72364e95f1dbbf89462f7b9) ##### Other (technical) - Fix/pointer gaps by [@​fredbi](https://redirect.github.com/fredbi) in [#​281](https://redirect.github.com/go-openapi/validate/pull/281) [...](https://redirect.github.com/go-openapi/validate/commit/39098ef86786d960cd85b24baf09bff2bd88ebc1) - refact: recycle objects through swag/pools by [@​fredbi](https://redirect.github.com/fredbi) in [#​280](https://redirect.github.com/go-openapi/validate/pull/280) [...](https://redirect.github.com/go-openapi/validate/commit/02b8f946d49b339c3ee48f292546b8c7976d0e89) *** ##### People who contributed to this release - [@​fredbi](https://redirect.github.com/fredbi) *** **[validate](https://redirect.github.com/go-openapi/validate) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-openapi/validate/?tab=Apache-2.0-1-ov-file#readme ### [`v0.26.2`](https://redirect.github.com/go-openapi/validate/releases/tag/v0.26.2) [Compare Source](https://redirect.github.com/go-openapi/validate/compare/v0.26.1...v0.26.2) #### [0.26.2](https://redirect.github.com/go-openapi/validate/tree/v0.26.2) - 2026-08-09 **Full Changelog**: 15 commits in this release. *** ##### Implemented enhancements - feat: point required-property findings at the offending entry by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/9b2c7461cb94da6f1bda614f62b9f13fa7a5f77c) - feat: locate the $ref diagnostics in the document by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/97d6cca06030c5b1c2d1dda639fb8fcf04598aa7) - feat: report the JSON pointer of each validation error by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/4c5522394dc866bc2a9c1ecb977a21cd1fc9e8f8) ##### Fixed bugs - fix: locate parameters by the index the document addresses them at by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/8512f1a7b9caa472272e8f8e822e9fa15d3b3621) ##### Documentation - doc: updated contributors file by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​277](https://redirect.github.com/go-openapi/validate/pull/277) [...](https://redirect.github.com/go-openapi/validate/commit/3d392443e20f2737ab74af7ccee01beff87b77fb) ##### Miscellaneous tasks - fix: point at nodes a document actually contains by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/db684105efecf5aca7b7daac5e4935217cb531c1) - refact: take $ref locations from the analyzer by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/324f4345c102032addf35796823840f6a8ed62a0) - fix: do not read $ref declarations out of default values by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/db6c34d8e374c08928b75c55141878aee789322e) - fix: correct the locations reported by validation errors by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/ffd33821234fdd4eff41ace357388a0aab73ed07) - tests: make schema fixtures deterministic by [@​HNO3Miracle](https://redirect.github.com/HNO3Miracle) in [#​273](https://redirect.github.com/go-openapi/validate/pull/273) [...](https://redirect.github.com/go-openapi/validate/commit/7e0ebfa099ab64dacef32ebd6a7a97e93734f71d) ##### Updates - chore(deps): bump the development-dependencies group with 9 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​278](https://redirect.github.com/go-openapi/validate/pull/278) [...](https://redirect.github.com/go-openapi/validate/commit/502a33439000c8143b49cccb60b4294266aa372f) - chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 in the other-dependencies group across 1 directory by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​276](https://redirect.github.com/go-openapi/validate/pull/276) [...](https://redirect.github.com/go-openapi/validate/commit/af06d7e6d68691ffb93ef15942bf68376cd73fe7) - chore(deps): bump the go-openapi-dependencies group with 5 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​275](https://redirect.github.com/go-openapi/validate/pull/275) [...](https://redirect.github.com/go-openapi/validate/commit/8322d28d1459ff0bcdd97ed2941485650f24b3b1) - chore(deps): bump the development-dependencies group with 9 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​274](https://redirect.github.com/go-openapi/validate/pull/274) [...](https://redirect.github.com/go-openapi/validate/commit/770313b9776e26d14eb2031148516bb394fa77a1) ##### Other (technical) - Fix/error location as jsonpointer by [@​fredbi](https://redirect.github.com/fredbi) in [#​279](https://redirect.github.com/go-openapi/validate/pull/279) [...](https://redirect.github.com/go-openapi/validate/commit/83d7d4e7f01228c53f2d6d5b6aec3c965cadd9b3) *** ##### People who contributed to this release - [@​HNO3Miracle](https://redirect.github.com/HNO3Miracle) - [@​fredbi](https://redirect.github.com/fredbi) *** ##### New Contributors - [@​HNO3Miracle](https://redirect.github.com/HNO3Miracle) made their first contribution in [#​273](https://redirect.github.com/go-openapi/validate/pull/273) *** **[validate](https://redirect.github.com/go-openapi/validate) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-openapi/validate/?tab=Apache-2.0-1-ov-file#readme
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23916", "createdAt": "2026-08-11T21:09:19Z", "updatedAt": "2026-08-12T15:09:48Z", "timestamp": "2026-08-12T15:09:48Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-patch", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23917", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module github.com/oschwald/maxminddb-golang/v2 to v2.5.0 (main) - autoclosed", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/oschwald/maxminddb-golang/v2](https://redirect.github.com/oschwald/maxminddb-golang) | `v2.4.1` → `v2.5.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2foschwald%2fmaxminddb-golang%2fv2/v2.5.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2foschwald%2fmaxminddb-golang%2fv2/v2.4.1/v2.5.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
oschwald/maxminddb-golang (github.com/oschwald/maxminddb-golang/v2) ### [`v2.5.0`](https://redirect.github.com/oschwald/maxminddb-golang/releases/tag/v2.5.0): 2.5.0 [Compare Source](https://redirect.github.com/oschwald/maxminddb-golang/compare/v2.4.1...v2.5.0) 2.5.0 - Deprecated the legacy `mmdbdata.Unmarshaler` callback, `UnmarshalMaxMindDB(*mmdbdata.Decoder) error`. It remains supported throughout v2, but new handwritten decoders should implement `mmdbdata.CursorUnmarshaler` so nested decoding can return a proven successor without rescanning the value. When a type implements both interfaces, the cursor callback takes precedence. Removal is planned for v3. GitHub [#​224](https://redirect.github.com/oschwald/maxminddb-golang/issues/224). Legacy callbacks must not retain the supplied decoder or its iterators after returning; decoder instances may now be pooled and reused. - Added the optional `maxminddb-gen` command for reproducible generation of reflection-free decoders for application-owned types, together with cursor primitives that avoid rescanning completely consumed containers and a pool-free cursor unmarshaling interface whose opaque successor supports single-pass nested custom decoding. The command discovers exported structs in its input source file and writes a matching `_maxminddb.go` file by default while preserving build constraints and recognized filename build suffixes. Generated struct decoders use lightweight counted map traversal and compact pointer-string fast paths. Output-path migrations ignore superseded generated methods while analyzing replacements, MaxMind tag validation remains isolated from unrelated tags, and output replacement requires an exact generated ownership marker. - Fixed valid four-byte data pointers whose ignored high address bits produce control values 29 through 31 so they are not misread as extended value sizes. - Fixed the string cache so overlapping string encodings that share a payload offset remain distinct and cannot return the wrong cached string or map key. - Fixed nested struct fields containing a non-map value so decoding reports the correct type error at the field offset instead of retrying from the record root. - Reduced IPv4 and IPv6 lookup time for databases with 28-bit search-tree records. - Reduced allocations when recurring decoded strings share a primary cache slot. - Reduced struct decoding time by using compact field-name fingerprints before falling back to full string hashing. - Rejected impossible or malformed large container sizes before allocating destination maps and slices, while reducing preflight overhead for common strings and booleans and avoiding preflight when caller-provided slice capacity already prevents an allocation. - Kept readers reachable through memory-mapped lookup, decode, and iteration operations so runtime cleanup cannot unmap active data. - Reduced opening memory by decoding metadata without a string cache and added `DisableStringCache` for readers that favor lower memory over repeated-decode allocation savings. - Released decoder-owned data and cache references when a reader is closed. - Rejected invalid `netip.Addr` lookup values. - Made verification reject invalid UTF-8 strings and made empty-value filtering reject pointer-to-pointer records consistently with other decoder paths. - Corrected cold-cache and concurrent-lookup benchmarks so they measure steady cache misses and lookup work rather than warm caches and goroutine setup.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23917", "createdAt": "2026-08-11T21:09:55Z", "updatedAt": "2026-08-13T09:19:59Z", "timestamp": "2026-08-13T09:19:59Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23918", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/oschwald/geoip2-golang/v2 to v2.3.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/oschwald/geoip2-golang/v2](https://redirect.github.com/oschwald/geoip2-golang) | `v2.2.0` → `v2.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2foschwald%2fgeoip2-golang%2fv2/v2.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2foschwald%2fgeoip2-golang%2fv2/v2.2.0/v2.3.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
oschwald/geoip2-golang (github.com/oschwald/geoip2-golang/v2) ### [`v2.3.0`](https://redirect.github.com/oschwald/geoip2-golang/releases/tag/v2.3.0): 2.3.0 - Updated `github.com/oschwald/maxminddb-golang/v2` to `v2.5.0` and switched all exported database model structs to generated decoders. This substantially reduces City and Enterprise lookup latency and allocations while preserving the existing lookup APIs and decoded results.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23918", "createdAt": "2026-08-11T21:11:22Z", "updatedAt": "2026-08-13T07:08:44Z", "timestamp": "2026-08-13T07:08:44Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23921", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(iter): Fix error handling and resource leaks in chained sample and entry iterators", "text": "**What this PR does / why we need it**: Fixes three related bugs in `pkg/iter`'s chaining iterators where a failing or drained sub-iterator was silently dropped instead of being surfaced or closed: 1. `nonOverlappingIterator`/`nonOverlappingSampleIterator.Next()` advanced past a sub-iterator that failed with a real read error instead of stopping, and `Err()` only ever reflected the last-visited sub-iterator. Once iteration finished normally, the earlier error was gone: the query completed successfully but silently dropped all data from the point of failure onward. These iterators sit under both the ingester read path (per in-memory chunk) and the querier read path (per stored chunk), both funneling through `MemChunk`'s block-level iterator, which returns real errors on decompression failures and corrupt/truncated block data — exactly what a corrupted or truncated chunk raises in production. `Next()` now stops and surfaces the error through `Err()`; `Close()` closes every remaining sub-iterator and aggregates their close errors instead of discarding them. 2. Some sub-iterators (e.g. the chunk block iterator) return their stored read error from `Close` too, as a fallback for callers that only check the `Close` return value. Without accounting for that, fix (1) reported the same failure a second time as a spurious close error. `Close` now skips it once the read error already surfaced through `Err`. 3. `mergeSampleIterator`/`sortSampleIterator` dropped fully-drained sources from the heap without closing them, and `Close` returned on the first sub-iterator close error, so any source drained during iteration, or left over after an early stop, was never closed. A source whose `Close` releases resources (e.g. the data-object reader releasing its object cache and folding read bytes into query stats) leaked, and its stats were lost. **Which issue(s) this PR fixes**: **Special notes for your reviewer**: (1) and (2) apply the same fix to both `pkg/iter/entry_iterator.go` and `pkg/iter/sample_iterator.go` — the entry and sample iterator types are structurally identical. (3) only affects the sample-iterator side (`mergeSampleIterator`/`sortSampleIterator`); their entry-iterator equivalents were not part of this change. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23921", "createdAt": "2026-08-12T10:07:35Z", "updatedAt": "2026-08-12T15:36:46Z", "timestamp": "2026-08-12T15:36:46Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23922", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Always close decbufs and do it the less verbose way", "text": "Addresses some PR feedback: - https://github.com/grafana/loki/pull/23663#discussion_r3765416195 - https://github.com/grafana/loki/pull/23730#discussion_r3765503011 - https://github.com/grafana/loki/pull/23730#discussion_r3765472943 **What this PR does / why we need it**: Just a little clean-up and avoiding leaking resources in some error cases. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23922", "createdAt": "2026-08-12T10:42:49Z", "updatedAt": "2026-08-13T10:09:36Z", "timestamp": "2026-08-13T10:09:36Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23923", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat: Update Loki / Write Resources dashboard", "text": "**What this PR does / why we need it**: This pull request updates the `Loki / Write Resources` dashboard. \"Screenshot \"Screenshot \"Screenshot

The optional **Cortex Gateway (Internal)** row is hidden if there are no series with `container=\"cortex-gw-internal\"`. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [ ] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23923", "createdAt": "2026-08-12T10:44:31Z", "updatedAt": "2026-08-12T14:21:01Z", "timestamp": "2026-08-12T14:21:01Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "area/helm" ], "author": "grobinson-grafana", "state": "open", "assignees": [], "change": "updated" }, { "id": "github:grafana/loki:pull_request:23924", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Configuration best practices had \"Simple Storage Storage\" mistake", "text": "**What this PR does / why we need it**: fix a minor mistake in the configuration best practices doc (S3 was described as \"Simple Storage Storage\", should be \"Simple Storage Service\" **Which issue(s) this PR fixes**: Fixes no issues **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [ ] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23924", "createdAt": "2026-08-12T11:27:09Z", "updatedAt": "2026-08-12T20:09:30Z", "timestamp": "2026-08-12T20:09:30Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs" ], "author": "kleinarne", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23925", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Add meaningful chunk fetch loss metrics", "text": "**What this PR does / why we need it**: `Fetcher.FetchChunks` logs an object store error and then returns a nil error. The query gets fewer log lines, HTTP 200, and no signal. We do not measure how often this occurs yet. This PR adds `loki_chunk_fetcher_failures_total{source,reason}`. It counts each lost chunk and the reason for the loss. This PR yet doesn't change the end-user behavior yet. It only addresses the propagation of metrics downstream. Also, a cache decode failure no longer reports `msg=\"failed downloading chunks\"`, because that call never used storage. Currently, the counter over-reports. Query iterators fetch one batch ahead and do not join that batch on close, so a query that stops early still counts that batch. Most of that is `reason=canceled`. Use `reason!~\"canceled|deadline\"` for the data loss signal. Subsequent PRs to extend these will follow. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [ ] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23925", "createdAt": "2026-08-12T11:30:23Z", "updatedAt": "2026-08-13T10:16:48Z", "timestamp": "2026-08-13T10:16:48Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "shantanualsi", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23927", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(docs): correct broken 'pipeline errors' link in log queries", "text": "Fixes #20051 The \"pipeline errors\" link in the label filter expression section pointed to `../#pipeline-errors`, which resolves to a non-existent anchor. The actual section heading in this file is `## Log pipeline`, so the correct link anchor is `#log-pipeline`. This is a one-character fix in the markdown link target.", "url": "https://github.com/grafana/loki/pull/23927", "createdAt": "2026-08-12T12:10:30Z", "updatedAt": "2026-08-12T21:26:29Z", "timestamp": "2026-08-12T21:26:29Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs", "backport release-3.6.x", "backport release-3.7.x" ], "author": "mmustafasenoglu", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23928", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(loki): Fix flaky test", "text": "**What this PR does / why we need it**: TestTCPErrs was failing from time to time because its outcome depends on what timeout happens first. I remove the dependency on time from the test.", "url": "https://github.com/grafana/loki/pull/23928", "createdAt": "2026-08-12T12:51:16Z", "updatedAt": "2026-08-12T16:33:40Z", "timestamp": "2026-08-12T16:33:40Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "ivkalita", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23929", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Fix flaky test TestTCPErrs", "text": "This test was failing occasionally in CI due to racing wall-clock timers. In this PR I propose that we stop mocking out an http server and instead mock out the http transport to return the error that would've been returned by the error case. We could also have tweaked the numbers to make it less likely for timers to trigger in the wrong order - I'd be happy to change to that approach if that's what people prefer. Another approach I tried was using testing/synctest, but wasn't able to get it working because then the timer would trigger at exactly the deadline and we'd end up in the wrong branch here https://github.com/golang/go/blob/go1.26.5/src/net/http/client.go#L372 because of the strict inequality. In reality we'd wave up slightly after the deadline rather than exactly at that moment. Flaky test failure I've seen in CI: ``` === FAIL: pkg/storage/chunk/client/gcp TestTCPErrs/transport_connect_timeout_exceeded,_retryable (0.04s) gcs_object_client_test.go:232: Error Trace: /__w/loki/loki/release/pkg/storage/chunk/client/gcp/gcs_object_client_test.go:232 Error: Not equal: expected: true actual : false Test: TestTCPErrs/transport_connect_timeout_exceeded,_retryable ``` **What this PR does / why we need it**: Fixes a flaky test. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23929", "createdAt": "2026-08-12T14:08:20Z", "updatedAt": "2026-08-12T16:33:55Z", "timestamp": "2026-08-12T16:33:55Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "DanHopperGrafana", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23930", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Update Helm Charts docs 🤖🤖🤖 [release-3.7.x]", "text": "Backport ee9a1b8f26e19e7224b167190aec93e1b0f69ef9 from #23899 [job run](https://github.com/grafana/loki/actions/runs/31630100757) --- **What this PR does / why we need it**: Updates the Loki Helm charts to keep pace with updates in the Grafana-community repo. Regenerates the Helm Reference file. Replaces relative links with full URLs. **Special notes for your reviewer**: Planned with AI (Sonnet 5) Written with AI (Sonnet 5) Validated with a different model (Opus 5)", "url": "https://github.com/grafana/loki/pull/23930", "createdAt": "2026-08-12T18:59:09Z", "updatedAt": "2026-08-12T19:14:06Z", "timestamp": "2026-08-12T19:14:06Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "backport", "type/docs" ], "author": "loki-gh-app[bot]", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23931", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module github.com/knadh/koanf/maps to v0.1.3 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/knadh/koanf/maps](https://redirect.github.com/knadh/koanf) | `v0.1.2` → `v0.1.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fknadh%2fkoanf%2fmaps/v0.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fknadh%2fkoanf%2fmaps/v0.1.2/v0.1.3?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23931", "createdAt": "2026-08-12T21:08:37Z", "updatedAt": "2026-08-12T21:08:39Z", "timestamp": "2026-08-12T21:08:39Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-patch" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23932", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(indexgateway): Add admission control to bound concurrent requests", "text": "## Summary The index gateway has no bound on concurrent request execution: in-flight requests pile up until the process locks up and can no longer schedule readiness probes or error responses. This PR ports the admission-control mechanism Mimir runs on its store-gateway, using the same dskit building blocks: at most N requests execute at once, excess requests park in a FIFO queue, and requests that wait longer than a timeout are rejected with a retryable gRPC `Unavailable` that the existing gateway client already handles by failing over to the next replica. Disabled by default (`-index-gateway.max-concurrent=0`); recommended starting values are documented (`200` / `5s`, Mimir's production defaults).", "url": "https://github.com/grafana/loki/pull/23932", "createdAt": "2026-08-12T22:40:42Z", "updatedAt": "2026-08-13T15:16:13Z", "timestamp": "2026-08-13T15:16:13Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs" ], "author": "trevorwhitney", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23933", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/parquet-go/parquet-go to v0.31.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/parquet-go/parquet-go](https://redirect.github.com/parquet-go/parquet-go) | `v0.30.1` → `v0.31.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fparquet-go%2fparquet-go/v0.31.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fparquet-go%2fparquet-go/v0.30.1/v0.31.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
parquet-go/parquet-go (github.com/parquet-go/parquet-go) ### [`v0.31.0`](https://redirect.github.com/parquet-go/parquet-go/releases/tag/v0.31.0) [Compare Source](https://redirect.github.com/parquet-go/parquet-go/compare/v0.30.2...v0.31.0) #### What's Changed ##### Other changes - feat: add BE128/UUID direct read and write interfaces by [@​T-J-L](https://redirect.github.com/T-J-L) in [#​533](https://redirect.github.com/parquet-go/parquet-go/pull/533) - schema: panic on unrecognized parquet struct tag options by [@​jacob-mckenzie](https://redirect.github.com/jacob-mckenzie) in [#​534](https://redirect.github.com/parquet-go/parquet-go/pull/534) - fix: skip zero-length runs in RLE int32 and boolean decoders by [@​savak1990](https://redirect.github.com/savak1990) in [#​531](https://redirect.github.com/parquet-go/parquet-go/pull/531) - fix: GenericWriter drops values after dictionary fallback to PLAIN encoding by [@​lukaskratzel](https://redirect.github.com/lukaskratzel) in [#​536](https://redirect.github.com/parquet-go/parquet-go/pull/536) - perf: avoid per-row allocations when writing time columns by [@​perfloop-agent](https://redirect.github.com/perfloop-agent) in [#​542](https://redirect.github.com/parquet-go/parquet-go/pull/542) - Check data capacity by [@​khepin](https://redirect.github.com/khepin) in [#​540](https://redirect.github.com/parquet-go/parquet-go/pull/540) - Validate page headers, return errors instead of panic by [@​khepin](https://redirect.github.com/khepin) in [#​538](https://redirect.github.com/parquet-go/parquet-go/pull/538) - Validate and error on invalid row counts in file & rowgroup footers by [@​khepin](https://redirect.github.com/khepin) in [#​539](https://redirect.github.com/parquet-go/parquet-go/pull/539) - perf: make Value level mutation inlinable and add in-place setters by [@​achille-roussel](https://redirect.github.com/achille-roussel) in [#​546](https://redirect.github.com/parquet-go/parquet-go/pull/546) - perf: specialize single-column row comparator to bypass interface dispatch by [@​perfloop-agent](https://redirect.github.com/perfloop-agent) in [#​547](https://redirect.github.com/parquet-go/parquet-go/pull/547) - fix(bloomfilter): correct offset calculation for section reads by [@​T-J-L](https://redirect.github.com/T-J-L) in [#​548](https://redirect.github.com/parquet-go/parquet-go/pull/548) - perf: optimize variant.Marshal via direct reflect-walk serialization by [@​perfloop-agent](https://redirect.github.com/perfloop-agent) in [#​550](https://redirect.github.com/parquet-go/parquet-go/pull/550) - fix(variant): binary codec spec conformance and input validation by [@​ryanworl](https://redirect.github.com/ryanworl) in [#​551](https://redirect.github.com/parquet-go/parquet-go/pull/551) - Fix encoding handling for schemas derived from legacy files by [@​ryanworl](https://redirect.github.com/ryanworl) in [#​555](https://redirect.github.com/parquet-go/parquet-go/pull/555) #### New Contributors - [@​jacob-mckenzie](https://redirect.github.com/jacob-mckenzie) made their first contribution in [#​534](https://redirect.github.com/parquet-go/parquet-go/pull/534) - [@​lukaskratzel](https://redirect.github.com/lukaskratzel) made their first contribution in [#​536](https://redirect.github.com/parquet-go/parquet-go/pull/536) - [@​khepin](https://redirect.github.com/khepin) made their first contribution in [#​540](https://redirect.github.com/parquet-go/parquet-go/pull/540) **Full Changelog**: ### [`v0.30.2`](https://redirect.github.com/parquet-go/parquet-go/releases/tag/v0.30.2) [Compare Source](https://redirect.github.com/parquet-go/parquet-go/compare/v0.30.1...v0.30.2) #### What's Changed ##### Other changes - fix: skip zero-length runs when decoding RLE/Hybrid levels by [@​savak1990](https://redirect.github.com/savak1990) in [#​528](https://redirect.github.com/parquet-go/parquet-go/pull/528) - fix: convert oob levels panic by [@​wardady](https://redirect.github.com/wardady) in [#​527](https://redirect.github.com/parquet-go/parquet-go/pull/527) - fix(buffer\\_pool): handle short reads in readerAt by [@​T-J-L](https://redirect.github.com/T-J-L) in [#​532](https://redirect.github.com/parquet-go/parquet-go/pull/532) #### New Contributors - [@​wardady](https://redirect.github.com/wardady) made their first contribution in [#​527](https://redirect.github.com/parquet-go/parquet-go/pull/527) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23933", "createdAt": "2026-08-13T00:11:04Z", "updatedAt": "2026-08-13T07:09:25Z", "timestamp": "2026-08-13T07:09:25Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23934", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Add Apache APISIX to third-party clients 🤖🤖🤖", "text": "**What this PR does / why we need it**: Adds Apache APISIX `loki-logger` to the third-party clients list. The existing APISIX plugin sends batched request and response logs to Loki through the Loki HTTP push API, and the link points to the official APISIX plugin documentation. **Which issue(s) this PR fixes**: None. **Special notes for your reviewer**: This is a one-line documentation-only change. The contribution was prepared with automated assistance and is submitted through Loki's agent review path. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated (not applicable; documentation-only change) - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15) (not applicable)", "url": "https://github.com/grafana/loki/pull/23934", "createdAt": "2026-08-13T03:35:15Z", "updatedAt": "2026-08-13T15:49:34Z", "timestamp": "2026-08-13T15:49:34Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs" ], "author": "Yilialinn", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23935", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(logql): One extractor per sample expression", "text": "**What this PR does / why we need it**: First simplification step after the `variants()` removal (#23823, #23889, #23905). A sample expression has produced exactly one extractor since the consolidated variants extractor landed in #17149, so the plumbing that carried several was already unreachable code. - `SampleExpr.Extractors() ([]SampleExtractor, error)` → `Extractor() (SampleExtractor, error)` - The `...log.StreamSampleExtractor` variadics collapse to a single parameter across `chunkenc`, `storage` and `ingester` - Deletes `pkg/chunkenc/variants.go`, whose `multiExtractorSampleBufferedIterator` `newSampleIterator` only reached when handed more than one extractor **Which issue(s) this PR fixes**: Step 4 of grafana/loki-private#2750. **Special notes for your reviewer**: **Review changes with \"hide whitespaces\" enabled** **The one behavioural change worth your attention is a panic fix.** `LiteralExpr` and `VectorExpr` produce samples without reading logs, so they have no extractor. They used to return an empty slice, which callers collapsed into a no-op iterator via `len(extractors) == 0`; they now return nil. Left unguarded, the storage and ingester call sites dereference that nil: ``` panic: runtime error: invalid memory address or nil pointer dereference pkg/ingester/instance.go:565 (*instance).querySample.func1 ``` This is reachable, not theoretical: the query plan arrives over gRPC and `SelectSampleParams.Expr()` only type-asserts to `syntax.SampleExpr`, which both types satisfy. So a request carrying `vector(0)` panics the ingester, where `main` today returns an empty result. Both call sites now nil-check, and the check has to sit **before** `deletion.SetupExtractor` — with deletes present that wraps the nil into a *non-nil* filtering extractor, and a later check would not fire. Covered by `Test_QuerySampleWithoutExtractor` (both expressions, with and without deletes). I verified it fails for the right reason by removing the guard and watching it panic. **`TestHeadBlockSampleHashesMatchAcrossFormats` needed strengthening, not just adapting.** It used two extractors to get two samples per line with different labels, which single-extractor iterators can no longer produce. Naively reducing it to one extractor over 10 identical-label lines silently weakened it: it then only proved the hash covers the *line*, and a hash that dropped the label component passed. That matters because `logproto.Sample.Hash` is a wire field used for cross-replica dedup, so a label-blind hash silently drops samples from distinct streams. It now collects the same lines under a second stream label set and asserts 20 distinct hashes — verified to fail against exactly that mutation. **Query stats are deliberately untouched.** `AddPostFilterLines` counts exactly what it counted before in all four sample paths, including the two that count lines the extractor rejected. The three sample paths disagree with each other and this issue will be fixed in a follow up PR. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23935", "createdAt": "2026-08-13T06:09:04Z", "updatedAt": "2026-08-13T07:15:29Z", "timestamp": "2026-08-13T07:15:29Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "pracucci", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23936", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(compression): Export Codecs() and de-duplicate test codec lists", "text": "**What this PR does / why we need it**: Follow-up to #23721. During review, `@pracucci` pointed out that the new `testCodecs` list in `cmd/chunks-inspect/loki_test.go` duplicates `compression`'s internal, unexported `supportedCodecs` list. This PR adds `compression.Codecs()` (a clone of `supportedCodecs`, so callers can't mutate the package's internal state) and swaps it in wherever a test file was hand-listing the full codec set: * `cmd/chunks-inspect/loki_test.go`'s `testCodecs` * `pkg/chunkenc/memchunk_test.go`'s `testEncodings` * `pkg/storage/stores/shipper/bloomshipper/client_test.go`'s `supportedCompressions` Each was a verbatim copy that would silently go stale if a codec were ever added or removed. `pkg/storage/bloom/v1/builder_test.go`'s `blockEncodings` is left as-is — it's a deliberate 5-of-9 subset, not a duplicate of the full list. Also adds `TestCodecs` covering both membership and that the returned slice is a copy, not an alias. **Which issue(s) this PR fixes**: None. Follow-up to #23721. **Special notes for your reviewer**: Adversarially reviewed with Codex — no correctness findings; the one gap it flagged (no direct test for `Codecs()`) is fixed in this PR. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23936", "createdAt": "2026-08-13T07:38:37Z", "updatedAt": "2026-08-13T07:53:44Z", "timestamp": "2026-08-13T07:53:44Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "jnewbigin", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23937", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(logql): One sample per log line", "text": "**What this PR does / why we need it**: Last step of the `variants()` removal (#23823, #23889, #23905, #23935). `variants()` was the only thing that ever derived more than one sample from a single log line, so the plumbing that carried several is now dead weight. - `StreamSampleExtractor.Process`/`ProcessString` return `(ExtractedSample, bool)` instead of `([]ExtractedSample, bool)` - `sampleBufferedIterator` holds one sample again instead of a slice it shifted down across `Next()` calls - The per-sample loops in `headBlock.SampleIterator`, `unorderedHeadBlock.SampleIterator` and `processSeries` are gone - Callers lose the redundant `len(samples) == 0` half of their guard, since arity is now a compile-time fact Side benefit: the old code allocated a one-element slice per log line that produced a sample, on the hot path of every metric query, and returned it through an interface method so it always escaped. **Which issue(s) this PR fixes**: Step 5 of grafana/loki-private#2750. **Special notes for your reviewer**: **Review changes with \"hide whitespaces\" enabled.** **`logproto.Sample.Hash` is deliberately untouched, and that is the invariant to check.** It is a wire field that `MergeSampleIterator` dedups on, so changing it during a rolling upgrade silently drops or duplicates samples. **One comment was rewritten because it stated the wrong mechanism.** The old rationale for including labels in the sample hash claimed it keeps two *streams* carrying the same line text distinct. The real reason is within one stream — two entries can share a timestamp and line text but extract different labels, for instance when their structured metadata differs. **`At()` after exhaustion now returns the last sample instead of panicking**, because the slice bounds that used to panic are gone. This is a deliberate decision. **Two test defects fixed, both of which made assertions unreachable** (pre-existing issues, but in files this PR changes): - `Test_ParserHints` returned early on a failed extraction, skipping the zero-sample assertion its own table already described. All three `expectOk: false` rows declare `expectVal: 0, expectLbs: \"\"` — exactly the zero sample. - `Test_labelSampleExtractor_ExtractError` used `return` instead of `continue`, so it only ever checked the first line of each case and never reached its zero-sample assertion. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23937", "createdAt": "2026-08-13T08:16:51Z", "updatedAt": "2026-08-13T10:18:25Z", "timestamp": "2026-08-13T10:18:25Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23938", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Rename variables to include reader", "text": "**What this PR does / why we need it**: Opened in a follow up PR so I can merge the original and start running it. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23938", "createdAt": "2026-08-13T08:25:17Z", "updatedAt": "2026-08-13T08:33:35Z", "timestamp": "2026-08-13T08:33:35Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "grobinson-grafana", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23939", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update github.com/thanos-io/objstore digest to 9ad2de9 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/thanos-io/objstore](https://redirect.github.com/thanos-io/objstore) | require | digest | `fb6fd3a` → `9ad2de9` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23939", "createdAt": "2026-08-13T09:10:44Z", "updatedAt": "2026-08-13T09:27:06Z", "timestamp": "2026-08-13T09:27:06Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23940", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(logql): Fix ip() line filter matching inside \"or\" chains", "text": "**What this PR does / why we need it**: `ip()` line filters combined with `or` (e.g. `|= ip(a) or ip(b)`) silently degraded to a literal substring/regex match on the raw pattern text instead of matching real addresses, because the `or` chain compiler ignored each filter node's `Op` field. Example: `{app=\"foo\"} |= ip(\"10.0.0.0/8\") or ip(\"192.168.0.0/16\")` never matched a line like `connection from 10.5.3.2 accepted`, even though `10.5.3.2` is inside `10.0.0.0/8`. It was actually compiled as \"line contains the literal text `10.0.0.0/8`\" OR \"line contains the literal text `192.168.0.0/16`\", which real log lines essentially never do. A related, independent bug in the same code path could also silently drop an operand from a chain of three or more `or` operands whenever `ip()` needed to continue the chain past the second position, since the parser attaches operands one at a time in that case and the old code overwrote any existing `Or` chain instead of appending to it. Example: `{app=\"foo\"} |= ip(\"10.0.0.0/8\") or ip(\"192.168.0.0/16\") or \"error\"` silently parsed (confirmed via `.String()`) as `ip(\"10.0.0.0/8\") or \"error\"` — the `ip(\"192.168.0.0/16\")` check vanished entirely, with no error. A line containing only a `192.168.0.0/16` address (no `10.x` address, no `\"error\"` text) would incorrectly fail to match. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: The new v2 query engine (`pkg/engine/internal/planner/logical/planner.go`) has an independent instance of the same class of bug — `convertLineFilter` never inspects `filter.Op`, so any `ip()` line filter routed there (with or without `or`) is silently compiled to a literal substring/regex match. Left out of this PR since it's a different engine/code path. **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23940", "createdAt": "2026-08-13T14:14:04Z", "updatedAt": "2026-08-13T14:29:13Z", "timestamp": "2026-08-13T14:29:13Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23941", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module google.golang.org/protobuf to v1.36.12 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/protobuf](https://go.googlesource.com/protobuf) | `v1.36.12-0.20260120151049-f2248ac996af` → `v1.36.12` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.36.12?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.36.12-0.20260120151049-f2248ac996af/v1.36.12?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23941", "createdAt": "2026-08-13T15:09:29Z", "updatedAt": "2026-08-13T15:26:56Z", "timestamp": "2026-08-13T15:26:56Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-patch" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23942", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(logql): Avoid data race in sharded avg_over_time grouping", "text": "**What this PR does / why we need it**: Sharded `avg_over_time(...) by (...)` decomposes into `sum_over_time() / count_over_time()`, and the two legs are evaluated concurrently. Both `newVectorAggEvaluator` and `RangeAggregationExpr.extractor` sorted `Grouping.Groups` in place, and the two legs can share the same backing array, so `go test -race` flags a data race on that slice. This PR sorts a private copy in both places instead of mutating the AST node, and documents on `Grouping` that `Groups` must not be mutated in place, since it can be shared across concurrently evaluated expressions. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: This is a data race, that I've found while working on logqltest and locally running them with `-race` (CI still doesn't run tests with `-race`). **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23942", "createdAt": "2026-08-13T15:47:21Z", "updatedAt": "2026-08-13T15:52:36Z", "timestamp": "2026-08-13T15:52:36Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23943", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(chunkenc): Stop counting filtered-out lines in post_filter_lines", "text": "**What this PR does / why we need it**: `post_filter_lines` reports how many lines matched a query's filters — that is how it is documented at `docs/sources/operations/meta-monitoring/_index.md:96`. Two of the three sample paths incremented it *before* asking the extractor, so a filtered metric query reported every line it read and looked as though its filter matched everything. `sampleBufferedIterator` is the path that serves stored chunks, so that is what most queries reported. This moves the call after the extractor check in `headBlock.SampleIterator` and `sampleBufferedIterator.Next`. All six call sites now count a line only once the pipeline or the extractor accepts it, matching the three log paths and `unorderedHeadBlock.SampleIterator`, which were already correct. The docs needed no change: the code was violating them. Confirmed against `5b16c0be7d^` that all four sites counted after the check before the `variants()` work moved two of them ahead of it. **Which issue(s) this PR fixes**: Item 7 of grafana/loki-private#2750. It does not close it — see the note on the v2 engine below. **Special notes for your reviewer**: **What the statistic now means, precisely.** A single bool carries every reason the extractor declines a line, so `post_filter_lines` counts lines that *produced a sample*. Measured, not assumed: | query over the same 4 lines | `post_filter_lines` | |---|---| | `count_over_time({app=\"foo\"} \\| json [5m])` | 4 — a line that failed to parse still counts, because the pipeline records `__error__` and carries on | | `sum_over_time({app=\"foo\"} \\| json \\| unwrap latency [5m])` | 2 — lines with no `latency` label do not count, even though no filter excluded them | The second row is a narrowing for `unwrap` queries versus what the compressed path reported before. It is the semantic `unorderedHeadBlock.SampleIterator` has always had, and the chunk iterator cannot distinguish \"filter rejected\" from \"no unwrap label\" because `Process` returns one bool. `TestPostFilterLinesCountsLinesThatProducedSamples` pins both rows so the choice is explicit rather than accidental. **Two things deliberately left out of scope:** - **The v2/dataobj engine still over-reports.** `Summary.TotalPostFilterLines` also sums `Dataobj.PostFilterRows`, set at `pkg/engine/engine.go:368` under an existing `// TODO: this will report the wrong value if the plan has a filter stage`. So dataobj-backed queries are unchanged by this PR, and a split range hitting both engines sums two semantics. - **`headBlock.SampleIterator` still has no per-entry time filter** (`memchunk.go:1348`) where its log counterpart does (`:1279`), so it counts matching lines outside the query range that the time-ranged wrapper later discards. That is a missing time filter rather than a misplaced counter, and fixing it would move `AddHeadChunkBytes`/`AddHeadChunkLines` too. Reachability is near-zero: ordered head blocks exist only for chunk format below v3, which no schema produces — so the production fix here is `memchunk.go:1812`, and `:1355` is effectively test-only. **The counter in `unorderedHeadBlock.SampleIterator` also moved**, from the end of the callback to immediately after its own check. Provably a no-op — nothing between the two positions returns — but having all six sites read alike stops a later early return from silently skipping it. **`AddPostFilterLines` now has a doc comment.** This is the durable part of the fix: the bug was not a logic error, it was two call sites reading an undocumented counter. **On testing.** Nothing anywhere asserted a non-zero `post_filter_lines` before this PR, which is why the bug survived. The new `TestPostFilterLinesCountsMatchingLinesOnly` runs a log query and an equivalent metric query over the same data and requires they agree, across all four chunk/head-block pairings and both the head-block and cut-block paths. It fails on the unfixed code with `expected: 3, actual: 10`, and each path is independently guarded — breaking any one of the six call sites fails a specific, identifiable pair of subtests. It also asserts `total_lines`, so the read-versus-kept ratio is pinned; that ratio collapsing to 1.0 is what the bug looked like. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23943", "createdAt": "2026-08-13T16:12:28Z", "updatedAt": "2026-08-13T16:12:33Z", "timestamp": "2026-08-13T16:12:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [] }, { "id": "github:grafana/loki:pull_request:23944", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "perf: Lazy instantiation of drains for pattern ingesters", "text": "**What this PR does / why we need it**: Lazily create per-`detected_level` Drain trees in the pattern ingester instead of always allocating all 8 at stream creation. Most streams only see 1–3 levels; unused trees previously paid idle RSS (root node, LRU, tokenizer) for every owned stream. Unknown/custom levels still fall back to the unknown Drain; observing all 8 known levels still creates all 8. **Which issue(s) this PR fixes**: Pattern-ingester OOMs track retained Drain state per owned stream. Cutting the per-stream floor (especially for single-level streams) reduces steady-state working set. **Special notes for your reviewer**: ``` BenchmarkStreamMemory_LazyDrain/single_level 1.000 drains/stream ~1024 retained_B/stream BenchmarkStreamMemory_LazyDrain/all_levels 8.000 drains/stream ~34816 retained_B/stream ``` **Checklist** - [X] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [X] Tests updated - [X] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23944", "createdAt": "2026-08-13T17:53:53Z", "updatedAt": "2026-08-13T17:54:33Z", "timestamp": "2026-08-13T17:54:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "paul1r", "state": "open", "assignees": [], "change": "new" } ], "events": [ { "id": "event:2622af4e2e90ca7e1f0e", "signalId": "github:grafana/loki:pull_request:23932", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23932", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(indexgateway): Add admission control to bound concurrent requests", "text": "## Summary The index gateway has no bound on concurrent request execution: in-flight requests pile up until the process locks up and can no longer schedule readiness probes or error responses. This PR ports the admission-control mechanism Mimir runs on its store-gateway, using the same dskit building blocks: at most N requests execute at once, excess requests park in a FIFO queue, and requests that wait longer than a timeout are rejected with a retryable gRPC `Unavailable` that the existing gateway client already handles by failing over to the next replica. Disabled by default (`-index-gateway.max-concurrent=0`); recommended starting values are documented (`200` / `5s`, Mimir's production defaults).", "url": "https://github.com/grafana/loki/pull/23932", "createdAt": "2026-08-12T22:40:42Z", "updatedAt": "2026-08-13T13:47:09Z", "timestamp": "2026-08-13T13:47:09Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs" ], "author": "trevorwhitney", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:20cbb791af5665d1da62", "signalId": "github:grafana/loki:pull_request:23627", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23627", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update github.com/prometheus/prometheus digest to 762bc8a (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/prometheus/prometheus](https://redirect.github.com/prometheus/prometheus) | require | digest | `ab225f6` → `762bc8a` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23627", "createdAt": "2026-07-28T12:12:32Z", "updatedAt": "2026-08-13T12:14:12Z", "timestamp": "2026-08-13T12:14:12Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:54164e8a6d565aad9191", "signalId": "github:grafana/loki:issue:23439", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:issue:23439", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Dependency Dashboard", "text": "> ℹ️ **Note** > > This PR body was truncated due to platform limits. This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - ⚠️ WARN: GitHub failure: secondary rate limit - ⚠️ WARN: Package lookup failures - ⚠️ WARN: Error updating branch: update failure ## Abandoned Dependencies The following dependencies have not received updates for an extended period and may be unmaintained.
View abandoned dependencies (173) > [!NOTE] Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity. > | Datasource | Package | Last Updated | |------------|------|-------------| | bundler | [fluent-plugin-multi-format-parser](https://redirect.github.com/repeatedly/fluent-plugin-multi-format-parser) | `2023-11-29` | | gomod | [github.com/DmitriyVTitov/size](https://redirect.github.com/DmitriyVTitov/size) | `2022-04-11` | | gomod | [github.com/MasslessParticle/azure-storage-blob-go](https://redirect.github.com/MasslessParticle/azure-storage-blob-go) | `2021-07-02` | | gomod | [github.com/Masterminds/goutils](https://redirect.github.com/Masterminds/goutils) | `2021-02-04` | | gomod | [github.com/NYTimes/gziphandler](https://redirect.github.com/NYTimes/gziphandler) | `2019-02-21` | | gomod | [github.com/ViaQ/logerr/v2](https://redirect.github.com/ViaQ/logerr) | `2022-06-10` | | gomod | [github.com/alecthomas/kingpin/v2](https://redirect.github.com/alecthomas/kingpin) | `2023-09-30` | | gomod | [github.com/aliyun/aliyun-oss-go-sdk](https://redirect.github.com/aliyun/aliyun-oss-go-sdk) | `2023-12-28` | | gomod | [github.com/antlr4-go/antlr/v4](https://redirect.github.com/antlr4-go/antlr) | `2024-05-15` | | gomod | [github.com/atotto/clipboard](https://redirect.github.com/atotto/clipboard) | `2021-02-24` | | gomod | [github.com/bboreham/go-loser](https://redirect.github.com/bboreham/go-loser) | `2023-09-20` | | gomod | [github.com/beorn7/perks](https://redirect.github.com/beorn7/perks) | `2019-07-31` | | gomod | [github.com/blang/semver/v4](https://redirect.github.com/blang/semver) | `2020-05-24` | | gomod | [github.com/c2h5oh/datasize](https://redirect.github.com/c2h5oh/datasize) | `2023-12-15` | | gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` | | gomod | [github.com/containerd/fifo](https://redirect.github.com/containerd/fifo) | `2023-02-17` | | gomod | [github.com/containerd/log](https://redirect.github.com/containerd/log) | `2023-09-09` | | gomod | [github.com/coreos/go-semver](https://redirect.github.com/coreos/go-semver) | `2023-01-16` | | gomod | [github.com/coreos/go-systemd](https://redirect.github.com/coreos/go-systemd) | `2019-11-04` | | gomod | [github.com/cristalhq/hedgedhttp](https://redirect.github.com/cristalhq/hedgedhttp) | `2023-09-15` | | gomod | [github.com/d4l3k/messagediff](https://redirect.github.com/d4l3k/messagediff) | `2017-08-07` | | gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` | | gomod | [github.com/dennwc/varint](https://redirect.github.com/dennwc/varint) | `2019-06-16` | | gomod | [github.com/dgryski/go-rendezvous](https://redirect.github.com/dgryski/go-rendezvous) | `2020-08-23` | | gomod | [github.com/distribution/reference](https://redirect.github.com/distribution/reference) | `2024-03-20` | | gomod | [github.com/docker/go-metrics](https://redirect.github.com/docker/go-metrics) | `2019-08-28` | | gomod | [github.com/docker/go-plugins-helpers](https://redirect.github.com/docker/go-plugins-helpers) | `2024-07-01` | | gomod | [github.com/docker/go-units](https://redirect.github.com/docker/go-units) | `2022-05-17` | | gomod | [github.com/dolthub/maphash](https://redirect.github.com/dolthub/maphash) | `2023-04-03` | | gomod | [github.com/dolthub/swiss](https://redirect.github.com/dolthub/swiss) | `2023-08-28` | | gomod | [github.com/drone/envsubst](https://redirect.github.com/drone/envsubst) | `2021-06-16` | | gomod | [github.com/dustin/go-humanize](https://redirect.github.com/dustin/go-humanize) | `2023-01-10` | | gomod | [github.com/facette/natsort](https://redirect.github.com/facette/natsort) | `2018-12-10` | | gomod | [github.com/go-kit/log](https://redirect.github.com/go-kit/log) | `2022-04-27` | | gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-14` | | gomod | [github.com/go-ole/go-ole](https://redirect.github.com/go-ole/go-ole) | `2023-08-04` | | gomod | [github.com/go-playground/locales](https://redirect.github.com/go-playground/locales) | `2023-01-05` | | gomod | [github.com/go-playground/universal-translator](https://redirect.github.com/go-playground/universal-translator) | `2023-01-30` | | gomod | [github.com/gobwas/glob](https://redirect.github.com/gobwas/glob) | `2018-02-08` | | gomod | [github.com/gogo/googleapis](https://redirect.github.com/gogo/googleapis) | `2021-03-10` | | gomod | [github.com/gogo/protobuf](https://redirect.github.com/gogo/protobuf) | `2021-01-10` | | gomod | [github.com/gogo/status](https://redirect.github.com/gogo/status) | `2022-04-23` | | gomod | [github.com/golang/protobuf](https://redirect.github.com/golang/protobuf) | `2024-03-06` | | gomod | [github.com/golang/snappy](https://redirect.github.com/golang/snappy) | `2023-12-25` | | gomod | [github.com/google/gofuzz](https://redirect.github.com/google/gofuzz) | `2020-08-04` | | gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` | | gomod | [github.com/gorilla/mux](https://redirect.github.com/gorilla/mux) | `2023-10-18` | | gomod | [github.com/gorilla/websocket](https://redirect.github.com/gorilla/websocket) | `2024-06-14` | | gomod | [github.com/grafana/memberlist](https://redirect.github.com/grafana/memberlist) | `2021-11-12` | | gomod | [github.com/hashicorp/errwrap](https://redirect.github.com/hashicorp/errwrap) | `2020-07-14` | | gomod | [github.com/hashicorp/go-cleanhttp](https://redirect.github.com/hashicorp/go-cleanhttp) | `2021-02-03` | | gomod | [github.com/hashicorp/go-hclog](https://redirect.github.com/hashicorp/go-hclog) | `2024-04-01` | | gomod | [github.com/hashicorp/go-immutable-radix](https://redirect.github.com/hashicorp/go-immutable-radix) | `2023-11-21` | | gomod | [github.com/hashicorp/go-multierror](https://redirect.github.com/hashicorp/go-multierror) | `2021-03-11` | | gomod | [github.com/hashicorp/go-rootcerts](https://redirect.github.com/hashicorp/go-rootcerts) | `2019-12-10` | | gomod | [github.com/hashicorp/golang-lru](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-21` | | gomod | [github.com/hashicorp/golang-lru/v2](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-21` | | gomod | [github.com/huandu/xstrings](https://redirect.github.com/huandu/xstrings) | `2024-06-06` | | gomod | [github.com/inconshreveable/mousetrap](https://redirect.github.com/inconshreveable/mousetrap) | `2022-11-27` | | gomod | [github.com/influxdata/tdigest](https://redirect.github.com/influxdata/tdigest) | `2019-10-30` | | gomod | [github.com/jmespath/go-jmespath](https://redirect.github.com/jmespath/go-jmespath) | `2020-09-18` | | gomod | [github.com/joshdk/go-junit](https://redirect.github.com/joshdk/go-junit) | `2021-02-26` | | gomod | [github.com/jpillora/backoff](https://redirect.github.com/jpillora/backoff) | `2019-10-03` | | gomod | [github.com/json-iterator/go](https://redirect.github.com/json-iterator/go) | `2021-09-11` | | gomod | [github.com/klauspost/pgzip](https://redirect.github.com/klauspost/pgzip) | `2022-09-30` | | gomod | [github.com/kylelemons/godebug](https://redirect.github.com/kylelemons/godebug) | `2019-05-05` | | gomod | [github.com/mattn/go-ieproxy](https://redirect.github.com/mattn/go-ieproxy) | `2024-05-22` | | gomod | [github.com/mfridman/interpolate](https://redirect.github.com/mfridman/interpolate) | `2023-12-22` | | gomod | [github.com/minio/md5-simd](https://redirect.github.com/minio/md5-simd) | `2021-01-07` | | gomod | [github.com/mitchellh/colorstring](https://redirect.github.com/mitchellh/colorstring) | `2019-02-13` | | gomod | [github.com/mitchellh/copystructure](https://redirect.github.com/mitchellh/copystructure) | `2021-05-05` | | gomod | [github.com/mitchellh/go-homedir](https://redirect.github.com/mitchellh/go-homedir) | `2019-01-27` | | gomod | [github.com/mitchellh/go-wordwrap](https://redirect.github.com/mitchellh/go-wordwrap) | `2020-09-25` | | gomod | [github.com/mitchellh/mapstructure](https://redirect.github.com/mitchellh/mapstructure) | `2022-04-20` | | gomod | [github.com/mitchellh/reflectwalk](https://redirect.github.com/mitchellh/reflectwalk) | `2021-05-03` | | gomod | [github.com/moby/docker-image-spec](https://redirect.github.com/moby/docker-image-spec) | `2024-02-09` | | gomod | [github.com/modern-go/concurrent](https://redirect.github.com/modern-go/concurrent) | `2018-03-06` | | gomod | [github.com/modern-go/reflect2](https://redirect.github.com/modern-go/reflect2) | `2021-09-11` | | gomod | [github.com/muesli/cancelreader](https://redirect.github.com/muesli/cancelreader) | `2022-06-22` | | gomod | [github.com/munnerz/goautoneg](https://redirect.github.com/munnerz/goautoneg) | `2019-10-10` | | gomod | [github.com/mwitkow/go-conntrack](https://redirect.github.com/mwitkow/go-conntrack) | `2019-07-16` | | gomod | [github.com/opencontainers/go-digest](https://redirect.github.com/opencontainers/go-digest) | `2020-05-14` | | gomod | [github.com/opentracing/opentracing-go](https://redirect.github.com/opentracing/opentracing-go) | `2020-07-01` | | gomod | [github.com/pkg/browser](https://redirect.github.com/pkg/browser) | `2024-01-02` | | gomod | [github.com/pkg/errors](https://redirect.github.com/pkg/errors) | `2020-01-14` | | gomod | [github.com/planetscale/vtprotobuf](https://redirect.github.com/planetscale/vtprotobuf) | `2024-01-29` | | gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` | | gomod | [github.com/remyoudompheng/bigfft](https://redirect.github.com/remyoudompheng/bigfft) | `2023-01-29` | | gomod | [github.com/richardartoul/molecule](https://redirect.github.com/richardartoul/molecule) | `2021-12-17` | | gomod | [github.com/rivo/uniseg](https://redirect.github.com/rivo/uniseg) | `2024-02-08` | | gomod | [github.com/sean-/seed](https://redirect.github.com/sean-/seed) | `2017-03-13` | | gomod | [github.com/segmentio/fasthash](https://redirect.github.com/segmentio/fasthash) | `2020-05-27` | | gomod | [github.com/shopspring/decimal](https://redirect.github.com/shopspring/decimal) | `2024-04-12` | | gomod | [github.com/uber/jaeger-client-go](https://redirect.github.com/uber/jaeger-client-go) | `2021-12-07` | | gomod | [github.com/uber/jaeger-lib](https://redirect.github.com/uber/jaeger-lib) | `2021-03-29` | | gomod | [github.com/x448/float16](https://redirect.github.com/x448/float16) | `2020-01-17` | | gomod | [github.com/xhit/go-str2duration/v2](https://redirect.github.com/xhit/go-str2duration) | `2022-12-07` | | gomod | [github.com/yusufpapurcu/wmi](https://redirect.github.com/yusufpapurcu/wmi) | `2024-01-28` | | gomod | [github.com/zeebo/assert](https://redirect.github.com/zeebo/assert) | `2022-07-21` | | gomod | [go.opentelemetry.io/otel/exporters/jaeger](https://redirect.github.com/open-telemetry/opentelemetry-go) | `2023-08-28` | | gomod | [go.uber.org/atomic](https://redirect.github.com/uber-go/atomic) | `2023-05-03` | | gomod | [go.uber.org/goleak](https://redirect.github.com/uber-go/goleak) | `2023-10-24` | | gomod | [go.uber.org/multierr](https://redirect.github.com/uber-go/multierr) | `2023-03-29` | | gomod | [go4.org/netipx](https://redirect.github.com/go4org/netipx) | `2023-11-29` | | gomod | [gopkg.in/inf.v0](https://redirect.github.com/go-inf/inf) | `2018-03-26` | | gomod | [gopkg.in/yaml.v2](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` | | gomod | [gopkg.in/yaml.v3](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` | | gomod | [gotest.tools](https://redirect.github.com/gotestyourself/gotest.tools) | `2018-11-11` |
## Errored The following updates encountered an error and will be retried. To force a retry now, click on a checkbox below. - [ ] chore(deps): Pin dependencies (main) (`actions/checkout`, `actions/setup-go`, `apache/kafka`, `confluentinc/cp-kafka`, `confluentinc/cp-zookeeper`, `fluent/fluentd`, `gcr.io/distroless/base-nossl`, `gcr.io/distroless/static`, `github.com/grafana/grafonnet-lib/grafonnet`, `github.com/grafana/jsonnet-libs/consul`, `github.com/grafana/jsonnet-libs/enterprise-metrics`, `github.com/grafana/jsonnet-libs/grafana`, `github.com/grafana/jsonnet-libs/grafana-builder`, `github.com/grafana/jsonnet-libs/jaeger-agent-mixin`, `github.com/grafana/jsonnet-libs/ksonnet-util`, `github.com/grafana/jsonnet-libs/memcached`, `github.com/grafana/jsonnet-libs/mixin-utils`, `github.com/grafana/jsonnet-libs/tanka-util`, `github.com/grafana/loki/production/ksonnet/loki`, `github.com/grafana/loki/production/loki-mixin`, `github.com/grafana/mimir/operations/mimir-mixin`, `github.com/jsonnet-libs/k8s-libsonnet/1.18`, `github.com/jsonnet-libs/k8s-libsonnet/1.20`, `github.com/prometheus-operator/kube-prometheus/jsonnet/kube-prometheus/lib`, `golang`, `golangci/golangci-lint`, `grafana/alloy`, `grafana/docs-base`, `grafana/grafana`, `grafana/grafana-enterprise`, `grafana/loki`, `grafana/promtail`, `grafana/security-github-actions`, `grafana/writers-toolkit`, `hashicorp/consul`, `helm`, `mingrammer/flog`, `minio/minio`, `nginx`, `nixpkgs`, `nixpkgs-unstable`, `pgsty/mc`, `pgsty/minio`, `prom/prometheus`, `provectuslabs/kafka-ui`, `theperiklis/log-generator`, `theperiklis/loki`, `wurstmeister/kafka`, `wurstmeister/zookeeper`) ## PR Edited (Blocked) The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below. - [ ] [fix(security/UNKNOWN/operator/api/loki): Update module golang.org/x/net to v0.56.0 [SECURITY] (main)](../pull/23146) - [ ] [fix(security/UNKNOWN/operator/api/loki): Update module golang.org/x/text to v0.39.0 [SECURITY] (main)](../pull/23390) - [ ] [chore(deps): Update operator/website/themes/doks digest to 4370737 (main)](../pull/23731) ## Pending Status Checks The following updates await pending status checks. To force their creation now, click on a checkbox below. - [ ] chore(deps): Update github.com/charmbracelet/ultraviolet digest to 68fa937 (main) - [ ] chore(deps): Update golang.org/x/exp digest to 3d80eb7 (main) - [ ] [chore(deps): Update google.golang.org/genproto digest to ec0a776 (main)](../pull/22963) - [ ] [chore(deps): Update google.golang.org/genproto/googleapis/api digest to ec0a776 (main)](../pull/23804) - [ ] fix(deps): Update github.com/prometheus/client_golang/exp digest to 0c5dccd (main) - [ ] [fix(deps): Update github.com/twmb/franz-go/pkg/kfake digest to c7ff005 (main)](../pull/22534) - [ ] [fix(deps): Update google.golang.org/genproto/googleapis/rpc digest to ec0a776 (main)](../pull/23805) - [ ] chore(deps): Update dependency github.com/grafana/loki/production/loki-mixin to v3.7.6 (main) - [ ] chore(deps): Update module github.com/charmbracelet/x/ansi to v0.11.8 (main) - [ ] chore(deps): Update module github.com/containerd/containerd/v2 to v2.3.4 (main) - [ ] chore(deps): Update module github.com/googleapis/enterprise-certificate-proxy to v0.3.21 (main) - [ ] chore(deps): Update module github.com/parquet-go/bitpack to v1.0.1 (main) - [ ] fix(deps): Update module charm.land/lipgloss/v2 to v2.0.6 (main) - [ ] fix(deps): Update module google.golang.org/protobuf to v1.36.12 (main) - [ ] chore(deps): Update logstash Docker tag to v9.5.1 (main) - [ ] chore(deps): Update module github.com/moby/sys/userns to v0.2.0 (main) - [ ] chore(deps): Update module golang.org/x/mod to v0.39.0 (main) - [ ] fix(deps): Update module github.com/Azure/azure-sdk-for-go/sdk/azcore to v1.23.0 (main) - [ ] fix(deps): Update module github.com/parquet-go/parquet-go to v0.32.0 (main) - [ ] fix(deps): Update module golang.org/x/crypto to v0.55.0 (main) - [ ] fix(deps): Update module golang.org/x/net to v0.58.0 (main) - [ ] fix(deps): Update module golang.org/x/text to v0.41.0 (main) - [ ] fix(deps): Update module google.golang.org/api to v0.293.0 (main) - [ ] chore(deps): Update module github.com/xo/terminfo to v1 (main) - [ ] chore(deps): Update nix to nixos-26.05 (main) --- > [!WARNING] > Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package anthropics/claude-code-action)`, `Could not determine new digest for update (github-tags package golangci/golangci-lint-action)`, `Could not determine new digest for update (github-tags package grafana/shared-workflows)`. > > Files affected: `.github/workflows/claude-code-review.yml`, `.github/workflows/claude.yml`, `.github/workflows/operator.yaml`, `.github/workflows/relyance.yml` --- ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [fix(security/UNKNOWN/operator): Update go toolchain directive to v1.26.5 [SECURITY] (main)](../pull/23128) - [ ] [chore(deps): Update actions/checkout digest to d23441a (main)](../pull/23363) - [ ] [chore(deps): Update github.com/grafana/objstore digest to ec72e5a (main)](../pull/23741) - [ ] [chore(deps): Update github.com/Microsoft/go-winio digest to 7561016 (main)](../pull/22789) - [ ] [chore(deps): Update github.com/planetscale/vtprotobuf digest to 8ae5a48 (main)](../pull/22919) - [ ] [chore(deps): Update golang:1.26.5 Docker digest to 705e964 (main)](../pull/23762) - [ ] [chore(deps): Update logstash:9.4.4 Docker digest to bdb7d35 (main)](../pull/23757) - [ ] [chore(deps): Update ruby:4.0.6 Docker digest to c400c1e (main)](../pull/23763) - [ ] [fix(deps): Update github.com/prometheus/prometheus digest to 762bc8a (main)](../pull/23627) - [ ] [chore(deps): Update dependency helm to v4.2.3 (main)](../pull/23240) - [ ] [chore(deps): Update Helm release rollout-operator to v0.50.1 (main)](../pull/23342) - [ ] [chore(deps): Update module github.com/knadh/koanf/maps to v0.1.3 (main)](../pull/23931) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/samplers/jaegerremote to v0.37.2 (main)](../pull/23842) - [ ] [fix(deps): Update module github.com/tjhop/slog-gokit to v0.2.2 (main)](../pull/23397) - [ ] [fix(deps): Update module github.com/twmb/franz-go to v1.21.5 (main)](../pull/22714) - [ ] [chore(deps): Update github.com/go-openapi/analysis (main)](../pull/23916) (`github.com/go-openapi/analysis`, `github.com/go-openapi/validate`) - [ ] [chore(deps): Update golangci/golangci-lint-action action to v9.3.0 (main)](../pull/22916) - [ ] [chore(deps): Update module github.com/armon/go-metrics to v0.6.1 (main)](../pull/22586) - [ ] [chore(deps): Update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 (main)](../pull/23856) - [ ] [chore(deps): Update module go.etcd.io/etcd/api/v3 to v3.7.1 (main)](../pull/22574) - [ ] [chore(deps): Update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 (main)](../pull/22575) - [ ] [chore(deps): Update module go.etcd.io/etcd/client/v3 to v3.7.1 (main)](../pull/23000) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/bridges/prometheus to v0.70.0 (main)](../pull/23846) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/detectors/gcp to v1.45.0 (main)](../pull/23847) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/exporters/autoexport to v0.70.0 (main)](../pull/23848) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 (main)](../pull/23810) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.21.0 (main)](../pull/23811) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc to v1.45.0 (main)](../pull/23812) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.45.0 (main)](../pull/23814) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 (main)](../pull/23815) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 (main)](../pull/23816) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 (main)](../pull/23817) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/prometheus to v0.67.0 (main)](../pull/23818) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdoutlog to v0.21.0 (main)](../pull/23819) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdoutmetric to v1.45.0 (main)](../pull/23820) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdouttrace to v1.45.0 (main)](../pull/23826) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/log to v0.21.0 (main)](../pull/23827) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/sdk/log to v0.21.0 (main)](../pull/23830) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/sdk/metric to v1.45.0 (main)](../pull/23831) - [ ] [chore(deps): Update module modernc.org/libc to v1.75.3 (main)](../pull/23868) - [ ] [chore(deps): Update Terraform google to v7.43.0 (main)](../pull/22967) - [ ] [fix(deps): Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 (main)](../pull/23870) - [ ] [fix(deps): Update module github.com/IBM/ibm-cos-sdk-go to v1.15.0 (main)](../pull/23792) - [ ] [fix(deps): Update module github.com/redis/go-redis/v9 to v9.22.0 (main)](../pull/23806) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.70.0 (main)](../pull/23850) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.70.0 (main)](../pull/23851) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.70.0 (main)](../pull/23852) - [ ] [fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.45.0 (main)](../pull/23853) - [ ] [chore(deps): Update actions/checkout action to v7 (main)](../pull/22485) - [ ] [chore(deps): Update actions/labeler action to v7 (main)](../pull/23375) - [ ] [chore(deps): Update actions/setup-go action to v7 (main)](../pull/23344) - [ ] [chore(deps): Update module github.com/cenkalti/backoff/v5 to v7 (main)](../pull/22683) - [ ] [chore(deps): Update module github.com/hashicorp/consul/api to v2 (main)](../pull/22684) - [ ] [chore(deps): Update module github.com/hashicorp/go-immutable-radix to v2 (main)](../pull/22686) - [ ] [chore(deps): Update module github.com/hashicorp/golang-lru to v2 (main)](../pull/22687) - [ ] [chore(deps): Update module github.com/ncw/swift to v2 (main)](../pull/22688) - [ ] [chore(deps): Update module go.yaml.in/yaml/v2 to v3 (main)](../pull/23677) - [ ] [chore(deps): Update module gopkg.in/yaml.v2 to v3 (main)](../pull/22823) - [ ] [chore(deps): Update module modernc.org/libc to v2 (main)](../pull/22695) - [ ] [fix(deps): Update module github.com/twmb/franz-go/pkg/kmsg to v2 (main)](../pull/23871) - [ ] [fix(deps): Lock file maintenance (main)](../pull/23351) - [ ] [fix(security/UNKNOWN/pkg/push): Update module golang.org/x/net to v0.56.0 [SECURITY] (release-3.7.x)](../pull/23422) - [ ] [fix(security/UNKNOWN/pkg/push): Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x)](../pull/23423) - [ ] [fix(security/UNKNOWN/pkg/push): Update module google.golang.org/grpc to v1.82.1 [SECURITY] (release-3.7.x)](../pull/23416) - [ ] **Click on this checkbox to rebase all open PRs at once** ## Vulnerabilities > [!IMPORTANT] > `18`/`20` CVEs have Renovate fixes.
gomod
go.mod
golang.org/x/crypto
- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
operator/api/loki/go.mod
golang.org/x/net
- [GHSA-5cv4-jp36-h3mw](https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw) (fixed in >= 0.55.0) - [GHSA-qxp5-gwg8-xv66](https://osv.dev/vulnerability/GHSA-qxp5-gwg8-xv66) (fixed in >= 0.36.0) - [GHSA-vvgc-356p-c3xw](https://osv.dev/vulnerability/GHSA-vvgc-356p-c3xw) (fixed in >= 0.38.0) - [GO-2025-3503](https://osv.dev/vulnerability/GO-2025-3503) (fixed in >= 0.36.0) - [GO-2025-3595](https://osv.dev/vulnerability/GO-2025-3595) (fixed in >= 0.38.0) - [GO-2026-4440](https://osv.dev/vulnerability/GO-2026-4440) (fixed in >= 0.45.0) - [GO-2026-4441](https://osv.dev/vulnerability/GO-2026-4441) (fixed in >= 0.45.0) - [GO-2026-4918](https://osv.dev/vulnerability/GO-2026-4918) (fixed in >= 0.53.0) - [GO-2026-5025](https://osv.dev/vulnerability/GO-2026-5025) (fixed in >= 0.55.0) - [GO-2026-5026](https://osv.dev/vulnerability/GO-2026-5026) (fixed in >= 0.55.0) - [GO-2026-5027](https://osv.dev/vulnerability/GO-2026-5027) (fixed in >= 0.55.0) - [GO-2026-5028](https://osv.dev/vulnerability/GO-2026-5028) (fixed in >= 0.55.0) - [GO-2026-5029](https://osv.dev/vulnerability/GO-2026-5029) (fixed in >= 0.55.0) - [GO-2026-5030](https://osv.dev/vulnerability/GO-2026-5030) (fixed in >= 0.55.0) - [GO-2026-5942](https://osv.dev/vulnerability/GO-2026-5942) (fixed in >= 0.56.0)
golang.org/x/text
- [GO-2026-5970](https://osv.dev/vulnerability/GO-2026-5970) (fixed in >= 0.39.0)
operator/go.mod
go
- [GO-2026-4970](https://osv.dev/vulnerability/GO-2026-4970) (fixed in >= 1.26.5) - [GO-2026-5856](https://osv.dev/vulnerability/GO-2026-5856) (fixed in >= 1.26.5)
golang.org/x/crypto
- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated
bundler (3)
clients/cmd/fluentd/docker/Gemfile (2) - `fluentd '1.19.3'` - `fluent-plugin-multi-format-parser '~>1.1.0'`
clients/cmd/fluentd/Gemfile
clients/cmd/logstash/Gemfile (1) - `webmock \"~> 3.8\"`
devcontainer (1)
.devcontainer/devcontainer.json (1) - `grafana/loki-build-image 0.35.2`
docker-compose (15)
clients/cmd/docker-driver/docker-compose.yaml (1) - `grafana/grafana unknown version` → [Updates: `undefined`]
clients/cmd/fluentd/docker/docker-compose.yml (1) - `fluent/fluent-bit 5.1@sha256:bf09d620b6b45c080b4da86ac5d98fd3739c1213a148f93dec884fdcc64084cb`
cmd/logql-analyzer/docker-compose.yaml (1) - `grafana/docs-base latest` → [Updates: `latest`]
debug/docker-compose.yaml (3) - `grafana/loki-debug latest` - `grafana/promtail-debug latest` - `grafana/grafana master` → [Updates: `master`]
examples/getting-started/docker-compose.yaml (8) - `grafana/loki latest` → [Updates: `latest`] - `grafana/loki latest` → [Updates: `latest`] - `grafana/alloy latest` → [Updates: `latest`] - `minio/minio unknown version` → [Updates: `undefined`] - `grafana/grafana latest` → [Updates: `latest`] - `grafana/loki latest` → [Updates: `latest`] - `nginx latest` → [Updates: `latest`] - `mingrammer/flog unknown version` → [Updates: `undefined`]
examples/ha-monolithic/docker-compose.yaml (4) - `pgsty/minio latest` → [Updates: `latest`] - `pgsty/mc latest` → [Updates: `latest`] - `nginx alpine` → [Updates: `alpine`] - `grafana/loki 3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952`
production/docker/docker-compose.yaml (8) - `grafana/grafana 13.1.3@sha256:ab5cb380e3ff3172d6c8bd2e7cfd31cce977d2881b260e1f5bc089bf0b759b43` - `prom/prometheus v3.13.2@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69` - `mingrammer/flog unknown version` → [Updates: `undefined`] - `grafana/promtail latest` → [Updates: `latest`] - `minio/minio unknown version` → [Updates: `undefined`] - `nginx latest` → [Updates: `latest`] - `prom/alertmanager v0.33.1@sha256:9e082985f56f4c8c9f724e18f2288c6708f472e56a5286b8863d080434ea065d` - `grafana/loki 3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952`
tools/dev/kafka/docker-compose.yaml (5) - `grafana/grafana-enterprise latest` → [Updates: `latest`] - `prom/prometheus latest` → [Updates: `latest`] - `provectuslabs/kafka-ui latest` → [Updates: `latest`] - `apache/kafka latest` → [Updates: `latest`] - `theperiklis/log-generator latest` → [Updates: `latest`]
tools/dev/loki-tsdb-storage-s3/docker-compose.yml (7) - `hashicorp/consul unknown version` → [Updates: `undefined`] - `minio/minio RELEASE.2024-02-24T17-11-14Z` → [Updates: `RELEASE.2024-02-24T17-11-14Z`] - `memcached 1.6.45-alpine@sha256:c29847751abb41f4c268c84fb3087fee05d4edcbda44409ccb5086e26148e8a7` - `jaegertracing/all-in-one 1.76.0@sha256:ab6f1a1f0fb49ea08bcd19f6b84f6081d0d44b364b6de148e1798eb5816bacac` - `grafana/grafana unknown version` → [Updates: `undefined`] - `mingrammer/flog unknown version` → [Updates: `undefined`] - `mingrammer/flog unknown version` → [Updates: `undefined`]
tools/kafka/plain/docker-compose.yml (2) - `wurstmeister/zookeeper unknown version` → [Updates: `undefined`] - `wurstmeister/kafka unknown version` → [Updates: `undefined`]
tools/kafka/sasl-plain/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/sasl-scram/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/sasl-ssl/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/ssl/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/stream-generator/docker-compose.yaml (3) - `provectuslabs/kafka-ui latest` → [Updates: `latest`] - `apache/kafka latest` → [Updates: `latest`] - `theperiklis/loki feat-usage-tracker-293aed8` → [Updates: `feat-usage-tracker-293aed8`]
dockerfile (21)
clients/cmd/docker-driver/Dockerfile (2) - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
clients/cmd/fluent-bit/Dockerfile (2) - `golang 1.26.5-bookworm` → [Updates: `1.26.5-bookworm`] - `fluent/fluent-bit 5.1.0@sha256:bf09d620b6b45c080b4da86ac5d98fd3739c1213a148f93dec884fdcc64084cb`
clients/cmd/fluentd/Dockerfile (2) - `ruby 4.0.6@sha256:d9a5d26be31a40fb043069f816ba39139c1f38758aea530341eb7e2c153e4ab4` → [Updates: `4.0.6`] - `fluent/fluentd v1.19-debian-1` → [Updates: `v1.19-debian-1`]
clients/cmd/logstash/Dockerfile (1) - `logstash 9.4.4@sha256:7bf793131b910ce62b4683ae6dc304c15b6981688c38b50e953ce931bfa2c6cf` → [Updates: `9.5.1`, `9.4.4`]
cmd/logcli/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/logql-analyzer/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki-canary-boringcrypto/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/base-nossl debug` → [Updates: `debug`]
cmd/loki-canary/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki-canary/Dockerfile.cross (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki/Dockerfile (3) - `golang 1.26` → [Updates: `1.26`] - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
cmd/loki/Dockerfile.cross (3) - `golang 1.26` → [Updates: `1.26`] - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
cmd/loki/Dockerfile.debug (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/base-nossl debug` → [Updates: `debug`]
cmd/migrate/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/querytee/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
loki-build-image/Dockerfile
operator/calculator.Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
operator/Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
operator/passthrough-gateway.Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
production/helm/loki/src/helm-test/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
tools/dev/loki-tsdb-storage-s3/dev.dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
tools/stream-generator/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
git-submodules (1)
.gitmodules (1) - `operator/website/themes/doks 14fe597271d6efc7d77461798f22a6af068300d2` → [Updates: `undefined`]
github-actions (33)
.github/workflows/backport.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/build-loki-binary.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go ${{ env.GO_VERSION }}`
.github/workflows/claude-code-review.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `anthropics/claude-code-action 1.0@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4`
.github/workflows/claude.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `anthropics/claude-code-action 1.0@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4`
.github/workflows/conventional-commits.yml (1) - `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50`
.github/workflows/deploy-pr-preview.yml (1) - `grafana/writers-toolkit main` → [Updates: `main`]
.github/workflows/govulncheck.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go ${{ env.GO_VERSION }}`
.github/workflows/helm-ci.yml (14) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97` - `helm/chart-testing-action v2.8.0@6ec842c01de15ebb84c8627d2744a0c2f2755c9f` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `fluxcd/flux2 v2.9.4@889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm v4.2.2` → [Updates: `v4.2.3`, `v4.2.2`] - `python 3.13` - `helm v4.2.2` → [Updates: `v4.2.3`, `v4.2.2`]
.github/workflows/helm-diff-ci.yml (5) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
.github/workflows/helm-release.yaml
.github/workflows/helm-tagged-release-pr.yaml (3) - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `peter-evans/create-pull-request v8@5f6978faf089d4d20b00c7766989d076bb2fc7f1`
.github/workflows/images.yml (5) - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/labeler.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/labeler v6.2.0@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d` → [Updates: `v7.0.0`]
.github/workflows/lint-jsonnet.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go 1.26.5`
.github/workflows/logql-bench.yml (9) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` - `go 1.26.5`
.github/workflows/logql-correctness.yml (9) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` - `go 1.26.5`
.github/workflows/minor-release-pr.yml (49) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/nix-ci.yaml (4) - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `cachix/install-nix-action v31.11.0@630ae543ea3a38a9a4166f03376c02c50f408342` - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `cachix/install-nix-action v31.11.0@630ae543ea3a38a9a4166f03376c02c50f408342`
.github/workflows/operator-bundle.yaml (2) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`]
.github/workflows/operator-check-prepare-release-commit.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/operator-release-please.yml (4) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `googleapis/release-please-action v5.0.0@45996ed1f6d02564a971a2fa1b5860e934307cf7` - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/operator-reusable-hub-release.yml (4) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `fjogeleit/yaml-update-action v0.17.0@dffe9a5223d84653c13374032382f6bb5de8e5ef`
.github/workflows/operator-reusable-image-build.yml (5) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a`
.github/workflows/operator-scorecard.yaml (3) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc`
.github/workflows/operator.yaml (12) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `golangci/golangci-lint-action v9.2@1e7e51e771db61008b38414a730f564565cf7c20` → [Updates: `v9.3.0`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `golangci/golangci-lint v2.12.2` → [Updates: `v2.12.2`]
.github/workflows/patch-release-pr.yml (49) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/querytee-images.yml (4) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c`
.github/workflows/release.yml (9) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `node 24`
.github/workflows/relyance.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `grafana/shared-workflows v1.0.0@7d18a46aafb8b875ed76a0bc98852d74b91e7f91`
.github/workflows/secret-scanning.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1` > ✂ **Note** > > PR body was truncated to here.", "url": "https://github.com/grafana/loki/issues/23439", "createdAt": "2026-07-23T03:41:50Z", "updatedAt": "2026-08-13T12:12:44Z", "timestamp": "2026-08-13T12:12:44Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:3604486dc2d7efb54eb0", "signalId": "github:grafana/loki:pull_request:23792", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23792", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/IBM/ibm-cos-sdk-go to v1.15.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/IBM/ibm-cos-sdk-go](https://redirect.github.com/IBM/ibm-cos-sdk-go) | `v1.14.1` → `v1.15.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fIBM%2fibm-cos-sdk-go/v1.15.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fIBM%2fibm-cos-sdk-go/v1.14.1/v1.15.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
IBM/ibm-cos-sdk-go (github.com/IBM/ibm-cos-sdk-go) ### [`v1.15.0`](https://redirect.github.com/IBM/ibm-cos-sdk-go/releases/tag/v1.15.0): Release 1.15.0 [Compare Source](https://redirect.github.com/IBM/ibm-cos-sdk-go/compare/v1.14.1...v1.15.0) #### Content ##### Features - Support for streaming data through pipes ##### Defect Fixes - Internal fixes and improvements
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23792", "createdAt": "2026-08-06T12:13:10Z", "updatedAt": "2026-08-13T12:11:49Z", "timestamp": "2026-08-13T12:11:49Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:1eaa9e26768ca231e99e", "signalId": "github:grafana/loki:pull_request:23870", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23870", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.106.5` → `v1.107.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fs3/v1.107.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fs3/v1.106.5/v1.107.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/s3) ### [`v1.107.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2026-08-06) #### General Highlights - **Dependency Update**: Updated to the latest SDK module versions #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/agentregistry`: [v1.0.0](service/agentregistry/CHANGELOG.md#v100-2026-08-06) - **Release**: New AWS service client module - **Feature**: Agent Registry's Public Preview release - `github.com/aws/aws-sdk-go-v2/service/agentregistrycontrol`: [v1.0.0](service/agentregistrycontrol/CHANGELOG.md#v100-2026-08-06) - **Release**: New AWS service client module - **Feature**: Agent Registry's Public Preview release - `github.com/aws/aws-sdk-go-v2/service/autoscaling`: [v1.71.0](service/autoscaling/CHANGELOG.md#v1710-2026-08-06) - **Feature**: EC2 Auto Scaling now supports being managed by other AWS services via the operator field. - `github.com/aws/aws-sdk-go-v2/service/backup`: [v1.60.0](service/backup/CHANGELOG.md#v1600-2026-08-06) - **Feature**: AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore`: [v1.37.0](service/bedrockagentcore/CHANGELOG.md#v1370-2026-08-06) - **Feature**: Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol`: [v1.55.0](service/bedrockagentcorecontrol/CHANGELOG.md#v1550-2026-08-06) - **Feature**: Add support for Gateway rate limits and Runtime instances in Amazon Bedrock AgentCore. Customers can now configure rate limits scoped to control request rates, token consumption rates, and active connection rates. Customers can now create capacity providers to launch runtimes on their EC2 instances. - `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs`: [v1.82.0](service/cloudwatchlogs/CHANGELOG.md#v1820-2026-08-06) - **Feature**: This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes. - `github.com/aws/aws-sdk-go-v2/service/devicefarm`: [v1.42.0](service/devicefarm/CHANGELOG.md#v1420-2026-08-06) - **Feature**: Adds support for service generated insights across runs, jobs, and tests. - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.320.0](service/ec2/CHANGELOG.md#v13200-2026-08-06) - **Feature**: Adds a new optional IncludeLocalZones parameter to the Spot Placement Score API that defaults to false. When set to true, the Spot Placement Score API will consider the relevant Local Zones with Spot capacity when computing the Spot Placement Score. - `github.com/aws/aws-sdk-go-v2/service/gamelift`: [v1.61.0](service/gamelift/CHANGELOG.md#v1610-2026-08-06) - **Feature**: Adds support for C8a, C8i, C9g, M8a, M8i, and M9g EC2 instance type families for managed EC2 and container fleets. Also adds explicit anchors on most string regexes. - `github.com/aws/aws-sdk-go-v2/service/kafka`: [v1.58.0](service/kafka/CHANGELOG.md#v1580-2026-08-06) - **Feature**: MSK Clusters can now deliver authorizer logs alongside broker logs to the destinations defined by you - `github.com/aws/aws-sdk-go-v2/service/marketplaceagreement`: [v1.20.0](service/marketplaceagreement/CHANGELOG.md#v1200-2026-08-06) - **Feature**: GetAgreementTerms now returns a new term variant in AcceptedTerm, netPaymentTerm, with a paymentDuePeriod field (example \"P30D\"). - `github.com/aws/aws-sdk-go-v2/service/marketplacediscovery`: [v1.4.0](service/marketplacediscovery/CHANGELOG.md#v140-2026-08-06) - **Feature**: GetOfferTerms now returns netPaymentTerm in offerTerms, specifying payment due period after invoice date. The paymentDuePeriod field uses ISO 8601 duration format (e.g., \"P30D\" for net 30 days). This is a backward-compatible addition. See API documentation for full structure and examples. - `github.com/aws/aws-sdk-go-v2/service/mediatailor`: [v1.64.0](service/mediatailor/CHANGELOG.md#v1640-2026-08-06) - **Feature**: AWS Elemental MediaTailor now supports concurrent function execution. The new Concurrent Executor function type runs multiple independent child functions in parallel within a single lifecycle hook, reducing pipeline latency to the duration of the slowest call instead of the sum of all calls. - `github.com/aws/aws-sdk-go-v2/service/s3`: [v1.107.0](service/s3/CHANGELOG.md#v11070-2026-08-06) - **Feature**: AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. - `github.com/aws/aws-sdk-go-v2/service/sagemaker`: [v1.264.0](service/sagemaker/CHANGELOG.md#v12640-2026-08-06) - **Feature**: Releases new Model Customization SequenceLength parameter for Training and g7 instance types for Training and Processing. - `github.com/aws/aws-sdk-go-v2/service/securityhub`: [v1.76.0](service/securityhub/CHANGELOG.md#v1760-2026-08-06) - **Feature**: Security Hub is adding a new public API, ListFreeTrialStatusesV2 to describe the free trial statuses of the Security Hub service and its opt-in features. - `github.com/aws/aws-sdk-go-v2/service/socialmessaging`: [v1.14.0](service/socialmessaging/CHANGELOG.md#v1140-2026-08-06) - **Feature**: Add support for WhatsApp Conversions APIs.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23870", "createdAt": "2026-08-09T21:10:16Z", "updatedAt": "2026-08-13T12:11:43Z", "timestamp": "2026-08-13T12:11:43Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:c4e6fc99400abe446a36", "signalId": "github:grafana/loki:pull_request:23741", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23741", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update github.com/grafana/objstore digest to ec72e5a (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/grafana/objstore](https://redirect.github.com/grafana/objstore) | replace | digest | `becd33c` → `ec72e5a` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23741", "createdAt": "2026-08-03T21:10:23Z", "updatedAt": "2026-08-13T12:11:38Z", "timestamp": "2026-08-13T12:11:38Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:64631d46b1812f92a7a6", "signalId": "github:grafana/loki:pull_request:23397", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23397", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/tjhop/slog-gokit to v0.2.2 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/tjhop/slog-gokit](https://redirect.github.com/tjhop/slog-gokit) | `v0.2.0` → `v0.2.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2ftjhop%2fslog-gokit/v0.2.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2ftjhop%2fslog-gokit/v0.2.0/v0.2.2?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
tjhop/slog-gokit (github.com/tjhop/slog-gokit) ### [`v0.2.2`](https://redirect.github.com/tjhop/slog-gokit/releases/tag/v0.2.2) [Compare Source](https://redirect.github.com/tjhop/slog-gokit/compare/v0.2.1...v0.2.2) #### Changelog ##### Other Changes - [`bc090d7`](https://redirect.github.com/tjhop/slog-gokit/commit/bc090d763b62fc52cfa8f398c3f5a1cac153c6b3) perf(handler): append string attr values unboxed - [`85d7801`](https://redirect.github.com/tjhop/slog-gokit/commit/85d780159b539cf4961773841ad3a8708324e9f4) perf(handler): cache resolved caller strings by record PC - [`d331051`](https://redirect.github.com/tjhop/slog-gokit/commit/d331051bbcf137e19fb531c8b35a45b9d0262a98) perf(handler): no more group expansion buffer, size pairs exactly - [`03d53ee`](https://redirect.github.com/tjhop/slog-gokit/commit/03d53eef6d384d6f2a7a690a0fe32ddadd7f0e8b) perf(handler): only resolve LogValuer attrs, add fastpaths ### [`v0.2.1`](https://redirect.github.com/tjhop/slog-gokit/releases/tag/v0.2.1) [Compare Source](https://redirect.github.com/tjhop/slog-gokit/compare/v0.2.0...v0.2.1) #### Changelog ##### Other Changes - [`8245546`](https://redirect.github.com/tjhop/slog-gokit/commit/824554675262bdaa5c5145f6b9817f23a030b815) build(deps): Bump actions/checkout from 6 to 7 - [`be4a15c`](https://redirect.github.com/tjhop/slog-gokit/commit/be4a15cbd55850f0a45745070c2a5950bc8a57f9) perf(handler): resolve caller from slog record, ditch log.Caller() - [`ec40dd6`](https://redirect.github.com/tjhop/slog-gokit/commit/ec40dd6ab164a82b229d6dde837ed5280462db97) perf: have handler write level kv directly, drop leveled loggers
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23397", "createdAt": "2026-07-22T03:28:04Z", "updatedAt": "2026-08-13T12:10:10Z", "timestamp": "2026-08-13T12:10:10Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-patch" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:2cec6c599f83143877de", "signalId": "github:grafana/loki:pull_request:23909", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23909", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "test(logql): Run logqltest scripts through query-frontend and query-scheduler", "text": "**What this PR does / why we need it**: Runs every `.logqltest` correctness script through three execution stacks and compares the results: - `direct` — the v1 engine over the chunk store - `query-frontend + query-scheduler (no sharding)` - `query-frontend + query-scheduler (sharding)` All three run end-to-end over real gRPC, so query sharding and the frontend/scheduler roundtrip are covered, not just the direct engine. Also addressed: - **`skip values-comparison on \"\"` directive.** Some stacks return values that legitimately differ. The clearest case is sharded `quantile_over_time`, whose DDSketch is approximate and diverges from the exact interpolated quantile on small sample sets. The directive skips only the float value check for the named stack, while still asserting series count, sample count, and timestamps. Every other stack stays exact, so we spot real regressions without pinning an approximate value. - **avg_over_time grouping scenarios** (logfmt and json), exercising the sharded-denominator fix. - **Script epoch moved to 2026**, fixing a sub-second range-vector-duration misparse: the query-range codec sends timestamps as bare integer nanoseconds, and values with 10 or fewer digits were read as Unix seconds. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23909", "createdAt": "2026-08-11T11:02:21Z", "updatedAt": "2026-08-13T11:50:02Z", "timestamp": "2026-08-13T11:50:02Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:f0c5c3d7ef3ecbdcdff7", "signalId": "github:grafana/loki:pull_request:23884", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23884", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(operator): Remove BoltDB alerts, recording rules, and Grafana dashboards", "text": "**What this PR does / why we need it**: - Removes `LokiStorageSlowWrite` and `LokiStorageSlowRead` alerts - Removes the `job_le_namespace_operation:loki_boltdb_shipper_request_duration_seconds_bucket` recording rule - Rewrites the retention dashboard compaction panels from `loki_boltdb_shipper_compact_tables_operation_*` to `loki_compactor_apply_retention_*` metrics - Removes dashboard rows for BoltDB-specific marker/sweeper panels - Updates alert test data to match the new rules **Which issue(s) this PR fixes**: Fixes [LOG-9666](https://redhat.atlassian.net/browse/LOG-9666) **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/)", "url": "https://github.com/grafana/loki/pull/23884", "createdAt": "2026-08-10T12:40:03Z", "updatedAt": "2026-08-13T11:28:01Z", "timestamp": "2026-08-13T11:28:01Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "btaani", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:9a068fbe857bb16b7d49", "signalId": "github:grafana/loki:pull_request:23641", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23641", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "[DO NOT MERGE] LogQL metric queries with stream-first iteration (prototype)", "text": "**What this PR does / why we need it**: _This draft PR is not intended to be proposed for merge, but just to show a prototype I'm working on and run tests in CI._ In this prototype I'm introducing a different order to consume samples when running LogQL metric queries (currently focused on `_over_time()` cases). See `docs/internal/logql-engine/stream-first-execution.md` to learn more about how it works. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [ ] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23641", "createdAt": "2026-07-29T11:38:46Z", "updatedAt": "2026-08-13T10:57:43Z", "timestamp": "2026-08-13T10:57:43Z", "metrics": { "reactions": 0, "comments": 5 }, "labels": [ "type/docs" ], "author": "pracucci", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:79a2947a780c08a85e3a", "signalId": "github:grafana/loki:pull_request:23937", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23937", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(logql): One sample per log line", "text": "**What this PR does / why we need it**: Last step of the `variants()` removal (#23823, #23889, #23905, #23935). `variants()` was the only thing that ever derived more than one sample from a single log line, so the plumbing that carried several is now dead weight. - `StreamSampleExtractor.Process`/`ProcessString` return `(ExtractedSample, bool)` instead of `([]ExtractedSample, bool)` - `sampleBufferedIterator` holds one sample again instead of a slice it shifted down across `Next()` calls - The per-sample loops in `headBlock.SampleIterator`, `unorderedHeadBlock.SampleIterator` and `processSeries` are gone - Callers lose the redundant `len(samples) == 0` half of their guard, since arity is now a compile-time fact Side benefit: the old code allocated a one-element slice per log line that produced a sample, on the hot path of every metric query, and returned it through an interface method so it always escaped. **Which issue(s) this PR fixes**: Step 5 of grafana/loki-private#2750. **Special notes for your reviewer**: **Review changes with \"hide whitespaces\" enabled.** **`logproto.Sample.Hash` is deliberately untouched, and that is the invariant to check.** It is a wire field that `MergeSampleIterator` dedups on, so changing it during a rolling upgrade silently drops or duplicates samples. **One comment was rewritten because it stated the wrong mechanism.** The old rationale for including labels in the sample hash claimed it keeps two *streams* carrying the same line text distinct. The real reason is within one stream — two entries can share a timestamp and line text but extract different labels, for instance when their structured metadata differs. **`At()` after exhaustion now returns the last sample instead of panicking**, because the slice bounds that used to panic are gone. This is a deliberate decision. **Two test defects fixed, both of which made assertions unreachable** (pre-existing issues, but in files this PR changes): - `Test_ParserHints` returned early on a failed extraction, skipping the zero-sample assertion its own table already described. All three `expectOk: false` rows declare `expectVal: 0, expectLbs: \"\"` — exactly the zero sample. - `Test_labelSampleExtractor_ExtractError` used `return` instead of `continue`, so it only ever checked the first line of each case and never reached its zero-sample assertion. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23937", "createdAt": "2026-08-13T08:16:51Z", "updatedAt": "2026-08-13T10:18:25Z", "timestamp": "2026-08-13T10:18:25Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:50e898a133657bbb9948", "signalId": "github:grafana/loki:pull_request:23925", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23925", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Add meaningful chunk fetch loss metrics", "text": "**What this PR does / why we need it**: `Fetcher.FetchChunks` logs an object store error and then returns a nil error. The query gets fewer log lines, HTTP 200, and no signal. We do not measure how often this occurs yet. This PR adds `loki_chunk_fetcher_failures_total{source,reason}`. It counts each lost chunk and the reason for the loss. This PR yet doesn't change the end-user behavior yet. It only addresses the propagation of metrics downstream. Also, a cache decode failure no longer reports `msg=\"failed downloading chunks\"`, because that call never used storage. Currently, the counter over-reports. Query iterators fetch one batch ahead and do not join that batch on close, so a query that stops early still counts that batch. Most of that is `reason=canceled`. Use `reason!~\"canceled|deadline\"` for the data loss signal. Subsequent PRs to extend these will follow. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [ ] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23925", "createdAt": "2026-08-12T11:30:23Z", "updatedAt": "2026-08-13T10:16:48Z", "timestamp": "2026-08-13T10:16:48Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "shantanualsi", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:1554dde3b4b521a54b79", "signalId": "github:grafana/loki:pull_request:23922", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23922", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Always close decbufs and do it the less verbose way", "text": "Addresses some PR feedback: - https://github.com/grafana/loki/pull/23663#discussion_r3765416195 - https://github.com/grafana/loki/pull/23730#discussion_r3765503011 - https://github.com/grafana/loki/pull/23730#discussion_r3765472943 **What this PR does / why we need it**: Just a little clean-up and avoiding leaking resources in some error cases. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23922", "createdAt": "2026-08-12T10:42:49Z", "updatedAt": "2026-08-13T10:09:36Z", "timestamp": "2026-08-13T10:09:36Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:6bb231f27249637087bb", "signalId": "github:grafana/loki:pull_request:23710", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23710", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(storage): Add OCI Thanos object store backend", "text": "## Problem Loki does not currently expose OCI Object Storage as a supported Thanos object-store backend. OCI users therefore have to use the S3-compatible API and static Customer Secret Keys. This prevents using OCI-native authentication mechanisms such as: - OKE Workload Identity - Instance Principal ## Proposed solution Add `oci` to Loki's Thanos object-store backends by reusing the OCI provider from Thanos objstore. Proposed configuration: ``` storage_config: use_thanos_objstore: true object_store: oci: provider: instance-principal bucket: loki-data region: ap-tokyo-1 max_request_retries: 3 request_retry_interval: 1 schema_config: configs: - from: 2026-08-01 store: tsdb object_store: oci schema: v13 index: prefix: index_ period: 24h ``` ## Security benefit No OCI Customer Secret Key needs to be stored in Loki configuration or Kubernetes Secrets. ## Scope - Loki TSDB object storage - Instance Principal - Unit tests - OCI/OKE integration test documentation Named stores and Helm chart support can be submitted separately. ## Validation A standalone Thanos OCI client has already been validated successfully against OCI Object Storage from OKE using Instance Principal. Fixes #23687", "url": "https://github.com/grafana/loki/pull/23710", "createdAt": "2026-08-02T02:57:59Z", "updatedAt": "2026-08-13T10:04:58Z", "timestamp": "2026-08-13T10:04:58Z", "metrics": { "reactions": 0, "comments": 8 }, "labels": [], "author": "felix0102", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:78fae084cef5ce2b8f0b", "signalId": "github:grafana/loki:pull_request:23349", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23349", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(querier): Prevent sample query plan marshal race 🤖🤖🤖", "text": "**What this PR does / why we need it**: Concurrent sample queries can share one `QueryPlan` AST between ingester fan-out and store evaluation. `DoUntilQuorum` may return while canceled ingester RPCs are still serializing the request. Store-side extractor construction sorts grouping slices in place, so protobuf sizing and marshaling can observe different AST states and panic with a negative slice index. This change copies the query plan and deep-clones its AST once at the ingester boundary. The in-flight ingester request is then isolated from store and evaluator mutations without cloning once per replica. A regression test verifies plan isolation and exercises concurrent caller-plan mutation and ingester-request marshaling. **Which issue(s) this PR fixes**: Fixes #15816 **Special notes for your reviewer**: Before the fix, the regression test deterministically showed that the caller and ingester shared a plan, that caller mutation changed ingester marshal bytes, and that concurrent mutation and marshaling could panic with `slice bounds out of range [-161:]`. Under the race detector, the same test reported grouping writes racing with reads through `syntax.encodeGrouping -> QueryPlan.Size -> SampleQueryRequest.Marshal`. Validation after the fix: - `go test -count=1 ./pkg/querier -run '^(TestQuerier_SelectSamplesClonesPlanForIngesters|TestQuerier_RequestingIngesters)$'` - `go test -race -count=1 ./pkg/querier -run '^TestQuerier_SelectSamplesClonesPlanForIngesters$'` - `go test -count=1 ./pkg/querier/... ./pkg/logql/syntax ./pkg/querier/plan` - `go test -race -count=1 ./pkg/querier` - `go test ./pkg/...` - `golangci-lint run --new-from-rev=origin/main ./...` (`0 issues`) **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added (not applicable; this is an internal race fix with no user-facing configuration change) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory (not applicable)", "url": "https://github.com/grafana/loki/pull/23349", "createdAt": "2026-07-19T23:09:00Z", "updatedAt": "2026-08-13T09:54:39Z", "timestamp": "2026-08-13T09:54:39Z", "metrics": { "reactions": 0, "comments": 4 }, "labels": [], "author": "cplieger", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:7fe7bacf582c72639ced", "signalId": "github:grafana/loki:pull_request:23357", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23357", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(querier): Prevent log query plan marshal race 🤖🤖🤖", "text": "**What this PR does / why we need it**: `SingleTenantQuerier.SelectLogs` copied `QueryRequest` before splitting ingester and store intervals, but the copy still shared its `QueryPlan`. Store pipeline construction mutates that AST in place through `reorderStages` and `combineFilters`. A canceled or hedged ingester request can still be serializing the same plan after quorum returns, which makes those writes race with protobuf marshaling. This change copies the plan and clones its AST once at the ingester boundary. The ingester fanout owns the clone, while the original remains available for store pipeline construction. The regression test proves the ownership boundary without relying on scheduler timing. Before the fix, the ingester and caller share the same plan, caller mutation changes ingester marshal output, and the race detector reports `LineFilterExpr.Left` writes racing with `QueryRequest.Marshal` reads. **Which issue(s) this PR fixes**: No matching issue was found. This is related to #23349 and surfaced while testing that fix. The two bugs share the same plan-aliasing and late-serialization mechanism, but this PR covers `SelectLogs`, `QueryRequest`, and pipeline filter reordering. **Special notes for your reviewer**: Validation completed: - `go test -race -count=1 ./pkg/querier` - `go test -count=1 ./pkg/querier/... ./pkg/logql/syntax ./pkg/querier/plan` - `golangci-lint run --new-from-rev=origin/main ./...` **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added (not applicable; this is an internal ownership fix with no user-facing documentation change) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15) (not applicable)", "url": "https://github.com/grafana/loki/pull/23357", "createdAt": "2026-07-20T11:58:09Z", "updatedAt": "2026-08-13T09:54:35Z", "timestamp": "2026-08-13T09:54:35Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "cplieger", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:07ff47cc38a71ff8a0f6", "signalId": "github:grafana/loki:pull_request:23939", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23939", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update github.com/thanos-io/objstore digest to 9ad2de9 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/thanos-io/objstore](https://redirect.github.com/thanos-io/objstore) | require | digest | `fb6fd3a` → `9ad2de9` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23939", "createdAt": "2026-08-13T09:10:44Z", "updatedAt": "2026-08-13T09:27:06Z", "timestamp": "2026-08-13T09:27:06Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:411a61489840b223fff9", "signalId": "github:grafana/loki:pull_request:23917", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23917", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module github.com/oschwald/maxminddb-golang/v2 to v2.5.0 (main) - autoclosed", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/oschwald/maxminddb-golang/v2](https://redirect.github.com/oschwald/maxminddb-golang) | `v2.4.1` → `v2.5.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2foschwald%2fmaxminddb-golang%2fv2/v2.5.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2foschwald%2fmaxminddb-golang%2fv2/v2.4.1/v2.5.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
oschwald/maxminddb-golang (github.com/oschwald/maxminddb-golang/v2) ### [`v2.5.0`](https://redirect.github.com/oschwald/maxminddb-golang/releases/tag/v2.5.0): 2.5.0 [Compare Source](https://redirect.github.com/oschwald/maxminddb-golang/compare/v2.4.1...v2.5.0) 2.5.0 - Deprecated the legacy `mmdbdata.Unmarshaler` callback, `UnmarshalMaxMindDB(*mmdbdata.Decoder) error`. It remains supported throughout v2, but new handwritten decoders should implement `mmdbdata.CursorUnmarshaler` so nested decoding can return a proven successor without rescanning the value. When a type implements both interfaces, the cursor callback takes precedence. Removal is planned for v3. GitHub [#​224](https://redirect.github.com/oschwald/maxminddb-golang/issues/224). Legacy callbacks must not retain the supplied decoder or its iterators after returning; decoder instances may now be pooled and reused. - Added the optional `maxminddb-gen` command for reproducible generation of reflection-free decoders for application-owned types, together with cursor primitives that avoid rescanning completely consumed containers and a pool-free cursor unmarshaling interface whose opaque successor supports single-pass nested custom decoding. The command discovers exported structs in its input source file and writes a matching `_maxminddb.go` file by default while preserving build constraints and recognized filename build suffixes. Generated struct decoders use lightweight counted map traversal and compact pointer-string fast paths. Output-path migrations ignore superseded generated methods while analyzing replacements, MaxMind tag validation remains isolated from unrelated tags, and output replacement requires an exact generated ownership marker. - Fixed valid four-byte data pointers whose ignored high address bits produce control values 29 through 31 so they are not misread as extended value sizes. - Fixed the string cache so overlapping string encodings that share a payload offset remain distinct and cannot return the wrong cached string or map key. - Fixed nested struct fields containing a non-map value so decoding reports the correct type error at the field offset instead of retrying from the record root. - Reduced IPv4 and IPv6 lookup time for databases with 28-bit search-tree records. - Reduced allocations when recurring decoded strings share a primary cache slot. - Reduced struct decoding time by using compact field-name fingerprints before falling back to full string hashing. - Rejected impossible or malformed large container sizes before allocating destination maps and slices, while reducing preflight overhead for common strings and booleans and avoiding preflight when caller-provided slice capacity already prevents an allocation. - Kept readers reachable through memory-mapped lookup, decode, and iteration operations so runtime cleanup cannot unmap active data. - Reduced opening memory by decoding metadata without a string cache and added `DisableStringCache` for readers that favor lower memory over repeated-decode allocation savings. - Released decoder-owned data and cache references when a reader is closed. - Rejected invalid `netip.Addr` lookup values. - Made verification reject invalid UTF-8 strings and made empty-value filtering reject pointer-to-pointer records consistently with other decoder paths. - Corrected cold-cache and concurrent-lookup benchmarks so they measure steady cache misses and lookup work rather than warm caches and goroutine setup.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23917", "createdAt": "2026-08-11T21:09:55Z", "updatedAt": "2026-08-13T09:19:59Z", "timestamp": "2026-08-13T09:19:59Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:0675e9f75867b82ad26f", "signalId": "github:grafana/loki:pull_request:23762", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23762", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update golang:1.26.5 Docker digest to 705e964 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `3aff665` → `705e964` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23762", "createdAt": "2026-08-05T06:06:23Z", "updatedAt": "2026-08-13T09:08:20Z", "timestamp": "2026-08-13T09:08:20Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "sig/operator", "docker" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:64d81f62648b6dc748da", "signalId": "github:grafana/loki:pull_request:22436", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:22436", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(operator): Watch object storage Services for NetworkPolicy updates and surface ports in status", "text": "**What this PR does / why we need it**: - Consolidates port determination logic from `manifest` package to `handlers` - Adds Service watcher that triggers reconciliation when object storage Services change - NetworkPolicies now update automatically when Service ports change **Which issue(s) this PR fixes**: Fixes [LOG-8768](https://redhat.atlassian.net/browse/LOG-8768) **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/)", "url": "https://github.com/grafana/loki/pull/22436", "createdAt": "2026-06-16T12:28:08Z", "updatedAt": "2026-08-13T08:59:33Z", "timestamp": "2026-08-13T08:59:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "sig/operator" ], "author": "btaani", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:81abdb8d163839a531f9", "signalId": "github:grafana/loki:pull_request:23802", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23802", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of label methods", "text": "- Implement LabelValues, LabelNames, LabelValueFor and LabelNamesFor - Test these against the existing implementation - Remove mmap fallback from stream_reader.go as it's no longer needed **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A. **Special notes for your reviewer**: This is all very close to the existing implementation and can be reviewed against it. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23802", "createdAt": "2026-08-06T15:02:12Z", "updatedAt": "2026-08-13T08:35:55Z", "timestamp": "2026-08-13T08:35:55Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:c814ff8262aee25ee889", "signalId": "github:grafana/loki:pull_request:23790", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23790", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of series", "text": "- Add optimisation to FilePoolDecbufFactory to cache fileSize - Cache all label names in memory in streamSymbols (same as mmap) - Add isLabelName to streamPostings, used to populate that cache in streamSymbols - These two optimisations make the new Series and ChunkStats implementations more efficient. **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A. **Special notes for your reviewer**: Second commit can be reviewed separately - it's a small refactor over tests added during this project. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23790", "createdAt": "2026-08-06T10:41:44Z", "updatedAt": "2026-08-13T08:35:55Z", "timestamp": "2026-08-13T08:35:55Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:9c5dd841e85a461a98a3", "signalId": "github:grafana/loki:pull_request:23768", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23768", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of fingerprint offsets table", "text": "- Read it into memory on open (like existing mmap implementation). - Implement Postings(...) for non-nil fingerprint filters. - Test against existing implementation. - Second commit makes changes across a few of the files I've been working on to prevent leaking file descriptors when creating a decbuf fails. This problem was identified by cursor's review of this PR. **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: Can be compared to existing implementation in index.go. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23768", "createdAt": "2026-08-05T10:11:14Z", "updatedAt": "2026-08-13T08:35:52Z", "timestamp": "2026-08-13T08:35:52Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:6aaaca32940f3e6d9055", "signalId": "github:grafana/loki:pull_request:23730", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23730", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of symbols section", "text": "- Remove Symbols() and SymbolTableSize() from Reader interface as it's not actually used - Implement streamSymbols - Test that it behaves the same as Symbols in index.go **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: This is a reimplementation of index.go's Symbols, so might be useful to compare to that. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23730", "createdAt": "2026-08-03T15:01:19Z", "updatedAt": "2026-08-13T08:35:52Z", "timestamp": "2026-08-13T08:35:52Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:e98c32071aa9e331f578", "signalId": "github:grafana/loki:pull_request:23767", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23767", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of postings offset table", "text": "- Remove PostingsRanges() from interface as it's unused - Implement Postings for cases where a fingerprint filter isn't given - All is derivative of existing implementation, so can be reviewed against that. And also is tested against the existing implementation so we know it behaves similarly. **What this PR does / why we need it**: Part of our effort to move away from mmap in index gateways. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: Can be compared to the existing implementation in index.go. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23767", "createdAt": "2026-08-05T09:23:03Z", "updatedAt": "2026-08-13T08:35:51Z", "timestamp": "2026-08-13T08:35:51Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:01b305383212b1b6e388", "signalId": "github:grafana/loki:pull_request:23907", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23907", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: deduplicate log lines split across stream shards", "text": "**What this PR does / why we need it**: Automatic stream sharding splits one stream into shards by adding an internal label (`__stream_shard__`, and `__time_shard__` for time-based sharding). When a client resends a log line, the copy can be assigned to a different shard, so the two copies land in different streams and are not deduplicated at query time (#18760). Drop the two sharding labels from a stream's query-time identity in `pipeline.ForStream` and in the sample extractors, which the ingester and store query paths both use. Shards of one stream then share one stream hash and one set of base labels, so the merge iterators drop the duplicate lines and samples. Streams without a sharding label are unaffected, and other reserved (`__`-prefixed) labels that identify a distinct stream, such as `__aggregated_metric__` and `__pattern__`, are left in place. Sharing the hash alone is not enough for metric queries: the per-sample line hash is computed from the result labels string (`sample.Hash` in `sampleBufferedIterator`), so a shard label left in the labels still blocks sample dedup. Dropping the labels from the identity covers both. It also keeps the identity independent of which shard a querier happens to see first: `BaseLabelsBuilder.ForLabels` caches the labels result by hash, so hashing shards together while keeping their own labels would return the first shard's labels for the others. Deduplication also has to handle duplicates that arrive within one iterator, because store and ingester paths sort-merge the shard streams before the querier sees them. The querier no longer skips the merge iterator for a single input (the entry merge iterator already deduplicates within one input), and the sample merge iterator now scans the whole buffered group in all three of its phases: the multi-iterator loop compared a sample only against the other iterators' samples, so a duplicate following its original inside the same iterator survived while several sources were active. As a result the sharding labels no longer appear in query results. That matches how they are already treated elsewhere: the label browser, query builder, and autocomplete hide `__`-prefixed internal labels, and #13095 reports them showing up in results as confusing. **Which issue(s) this PR fixes**: Fixes #18760 **Special notes for your reviewer**: #7005 fixed this the same way (dropping the shard label at query time) and was reverted in #7031 for a simpler version that was never opened. This keeps the change in `ForStream`, so it applies to the ingester, store, and tail paths without touching the iterators. The two sharding labels are defined once in `pkg/util/constants` and referenced from the ingester and distributor. The revert of #7005 was about cost, so the common path stays cheap. The cost is per `ForStream` call (once per stream/chunk iterator, not per line): ``` BenchmarkForStreamShardStrip/unsharded-14 18868245 62.71 ns/op 0 B/op 0 allocs/op BenchmarkForStreamShardStrip/sharded-14 6412525 196.1 ns/op 336 B/op 3 allocs/op ``` Behavior notes: - Lines are dropped only when they are identical (same timestamp, line, and structured metadata) and belong to shards of the same stream, so streams that genuinely differ are never merged. There is a chunk-level test that merges two shards and verifies one entry for log queries and one sample for metric queries, in the multi-iterator shape and in the single sorted iterator shape that store-only queries produce; the sample cases fail without the extractor and fast-path changes. - Single-source log queries now go through the merge iterator instead of returning the raw iterator. The sample fast path keeps its shape (no heap operations) and only adds a timestamp comparison per sample when there are no duplicates. The doc comments on the two merge constructors said they do not deduplicate within a single iterator; the entry iterator already did, so they now describe the actual behavior. - Every deduplication comparison in the codebase (one in the entry merge iterator, three in the sample merge iterator) now scans the full buffered group of a timestamp and stream hash, regardless of which iterator a sample came from. - One known gap remains for index-sharded metric queries: partial aggregations are evaluated per index shard, and the shards of a stream have different fingerprints, so they can fall into different index shards where their duplicates never meet a merge iterator. That is a property of fingerprint-based index sharding and out of scope here. - A label filter or grouping on `__stream_shard__` no longer matches, since the label is not part of the stream's identity anymore. Selector matchers are unaffected (they are applied before the pipeline runs), and so is the deletion path, which matches on the original labels. - Tailing without a filter keeps its existing fast path that forwards streams untouched, so those responses still carry the shard label. - `Test_StructuredMetadata` in the ingester asserted that tail responses echo the shard label back; it now expects the label to be dropped. cc @trevorwhitney @monxas, who discussed the approach on the issue. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23907", "createdAt": "2026-08-11T09:51:04Z", "updatedAt": "2026-08-13T08:33:58Z", "timestamp": "2026-08-13T08:33:58Z", "metrics": { "reactions": 0, "comments": 7 }, "labels": [], "author": "17billion", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:c73ecddaac2cee3f5748", "signalId": "github:grafana/loki:pull_request:23938", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23938", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Rename variables to include reader", "text": "**What this PR does / why we need it**: Opened in a follow up PR so I can merge the original and start running it. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23938", "createdAt": "2026-08-13T08:25:17Z", "updatedAt": "2026-08-13T08:33:35Z", "timestamp": "2026-08-13T08:33:35Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "grobinson-grafana", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:e91c6df28c8430684919", "signalId": "github:grafana/loki:pull_request:23906", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23906", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(logql): Count unwrapped samples in the sharded avg_over_time denominator", "text": "**What this PR does / why we need it**: With sharding enabled, a grouped `avg_over_time(... | unwrap x)` returns a value that is too low whenever a log line yields no unwrapped sample. The shard mapper decomposes the average into a sum leg over samples divided by a count leg over lines, and the count leg counts lines the numerator never saw. A line yields an unwrapped sample exactly when the pipeline keeps it, the identifier resolves to a non-empty label, and the post filters keep it. All three are expressible as pipeline stages, so the count leg becomes `count_over_time(E | x != \"\" | f [r])`. The `| x != \"\"` filter resolves the value through the same `LabelsBuilder.Get()` call the sample extractor makes, so this matches the unsharded result rather than approximating it. The emitted plan stays ordinary LogQL, so no querier-side changes and no rollout gate are needed. This also fixes two related divergences: `WithoutUnwrap()` dropped the unwrap's post filters entirely, and an unwrap on a stream label absent from some streams was counted as if present. One shape is left unsharded instead: a post filter on `__error__`. Only the unwrap conversion sets that label, so a pipeline filter cannot reproduce it. **Which issue(s) this PR fixes**: Fixes #23890 **Special notes for your reviewer**: More tests have been added in https://github.com/grafana/loki/pull/23909, where I've also cherry-picked the changes in this PR. I have a chicken-egg problem: logqltest on query-frontend fail without with PR, but logqltest on query-frontend is not yet supported in `main` (because they fail), so that's why the the PRs are related together. The issue describes two other options and why this one was preferred over them. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23906", "createdAt": "2026-08-11T07:33:54Z", "updatedAt": "2026-08-13T08:29:59Z", "timestamp": "2026-08-13T08:29:59Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "pracucci", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:a5cbefb8567a8d73ec7f", "signalId": "github:grafana/loki:issue:23890", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:issue:23890", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Sharded avg_over_time(... | unwrap ...) with grouping under-reports the average", "text": "## What happens With query sharding enabled, `avg_over_time(... | unwrap ...)` with a `by`/`without` grouping returns a value that is too low whenever some log lines in the range produce no unwrapped sample (missing field, non-numeric value). The unsharded path returns the correct value, so the same query gives two different answers depending on sharding. ## Reproduction Logs within a `[1m]` window: ``` {app=\"a\"} v=2 {app=\"a\"} v=4 {app=\"a\"} hello # no `v` field ``` Query: ```logql avg_over_time({app=\"a\"} | logfmt | unwrap v [1m]) by (app) ``` - Without sharding: `(2 + 4) / 2 = 3` (correct) - With sharding: `(2 + 4) / 3 = 2` (wrong) ## Root cause The shard mapper rewrites ```logql avg_over_time(E | unwrap x [r]) by (g) ``` into ```logql sum by (g) (sum_over_time(E | unwrap x [r])) / sum by (g) (count_over_time(E [r])) ``` and strips the unwrap from the `count_over_time` denominator. `count_over_time` then counts log **lines**, while the `sum_over_time` numerator sums only unwrapped **samples**. Any line that yields no sample inflates the denominator, so the average comes out too low. Without grouping the query shards by plain concatenation (no denominator is computed), so it stays correct. `LogRangeExpr.WithoutUnwrap()` also drops the unwrap's post filters, so `avg_over_time(E | unwrap x | status=\"200\" [r]) by (g)` is wrong for a second reason: the denominator counts lines the numerator never saw. ## Possible fixes **(a) Count unwrapped samples in the denominator.** Allow `count_over_time` to carry an unwrap, meaning \"count the extracted samples\", and keep the unwrap on the count leg of the decomposition. The sharded result then matches the unsharded one. Trade-offs: `count_over_time(... | unwrap x)` becomes valid LogQL (currently `unwrap` can't be used with `count_over_time()`), and since `RangeAggregationExpr.validate()` runs on the querier, every querier must accept the new shape before the frontend can emit it — so it needs a rollout gate like `ShardQuantileOverTime`. **(b) Do not shard this shape.** When `avg_over_time` has an unwrap together with a grouping/label-reduction, run it unsharded on a single querier. Correct and minimal, but a performance regression for a common query shape (grouped averages over large ranges) even when every line carries the field — the mapper cannot tell at plan time whether any line is missing it. **(c) Express the unwrap as a label filter on the count leg.** A line yields an unwrapped sample exactly when the pipeline keeps it, the identifier resolves to a non-empty label, and the post filters keep it (`streamLabelSampleExtractor.Process`). All three are expressible as pipeline stages, so the count leg becomes: ```logql sum by (g) (sum_over_time(E | unwrap x | f [r])) / sum by (g) (count_over_time(E | x != \"\" | f [r])) ``` `| x != \"\"` resolves the value through `labelValue()` -> `LabelsBuilder.Get()`, the same call the extractor makes, so this is exact rather than an approximation. Trade-offs: - No new LogQL surface and no grammar change: the emitted plan is ordinary LogQL that any existing querier already understands, so no version-skew gate is needed. - Roughly the same cost as (a): both make the count leg extract `x` (one extra parser hint), and (a) additionally runs the float/duration/bytes conversion per line. - Also fixes the dropped post filters, and the related cases where the unwrapped field is a stream label missing from some streams, or is present but empty. - Does not cover a post filter on `__error__` (`| unwrap x | __error__=\"\"`). Only the unwrap conversion sets that label, and a pipeline filter cannot test whether a string parses as a float. This is not a regression — the current code gets that shape wrong too — but it can be closed by declining to shard when a post filter references `__error__`/`__error_details__`, which is option (b) applied to a far narrower shape. Measured against ground truth with 3 shards: | case | unsharded | sharded today | sharded with (c) | |---|---|---|---| | missing field, `by (app)` | 5.333 | **3.2** | 5.333 | | missing field, `without (index)` | 5.333 | **3.2** | 5.333 | | `unwrap duration(d)`, missing field | 3 | **2** | 3 | | post filter `\\| unwrap v \\| lvl=\"info\"` | 3 | **2** | 3 | | unwrap on a stream label some streams lack | 3 | **2** | 3 | | `v=` (present but empty) | 3 | **2** | 3 | | `\\| unwrap v \\| __error__=\"\"` with `v=abc` | 3 | **2** | **2** (or unsharded, with the guard) |", "url": "https://github.com/grafana/loki/issues/23890", "createdAt": "2026-08-10T16:11:48Z", "updatedAt": "2026-08-13T08:29:58Z", "timestamp": "2026-08-13T08:29:58Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "type/bug" ], "author": "pracucci", "state": "closed", "assignees": [ "pracucci" ], "change": "updated" } }, { "id": "event:9e61b8046aef28872c05", "signalId": "github:grafana/loki:pull_request:23908", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23908", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(distributor): add -distributor.extend-writes to keep write quorum during ingester scale-down", "text": "**What this PR does / why we need it**: The distributor always builds the ingester write set with `ring.WriteNoExtend`. When an ingester is briefly non-`ACTIVE` (for example `LEAVING` during a graceful scale-down or a rollout) it is dropped from the replica set with no replacement. If there is no quorum slack (RF=2, or RF=3 when several ingesters change at once), `ring.Get` returns `at least N live replicas required` and the write fails with 5xx even though the shutdown was graceful. With ingester autoscaling this shows up as constant write retries from clients. This adds `-distributor.extend-writes` (`extend_writes`), off by default so nothing changes for existing setups. When enabled the distributor uses `ring.Write`, which replaces the `LEAVING`/`JOINING` ingester with the next healthy one and keeps write quorum while the ring changes. Mimir already exposes the same flag, and dskit's lifecycler references it in the `-unregister-on-shutdown` flag help, but Loki never wired it up. Reads are unaffected: `ring.Read` already includes `LEAVING` instances and extends, so anything written to the extension target is still queried, and `maxExpectedReplicationSet` already leaves room for the extra instance. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: Opt-in only; the default keeps `WriteNoExtend`, so behavior is unchanged unless the flag is set. `writeRingOp` isolates the selection and has a unit test. The config reference was regenerated with `make doc`. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory.", "url": "https://github.com/grafana/loki/pull/23908", "createdAt": "2026-08-11T10:03:38Z", "updatedAt": "2026-08-13T08:26:18Z", "timestamp": "2026-08-13T08:26:18Z", "metrics": { "reactions": 0, "comments": 5 }, "labels": [], "author": "17billion", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:202a1c0c4b8eb6c7b340", "signalId": "github:grafana/loki:issue:18760", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:issue:18760", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Duplicate log lines can be introduced by automatic stream sharding", "text": "There may be other issues describing this but with a brief search I didn't find any. Loki currently has de-duplication logic which follows these rules: Lines are removed from results as duplicates when: * Are in the same stream * They have the exact same timestamp to the nanosecond * Have the exact same log content Not related to this issue directly but a different bug also exists #15425 where that logic also needs to be extended to compare if the structured metadata is the same or not. The problem here though is there are a number of situations where a log can be accepted by Loki but re-sent by a client and by the nature of how automatic stream sharding works, end up in a different stream. Auto stream sharding will add a label e.g. `__stream_shard__=1`, but when the log is resent it may end up in a different stream e.g. `__stream_shard__=5` This will result in these log lines not being de-duplicated properly in results.", "url": "https://github.com/grafana/loki/issues/18760", "createdAt": "2025-08-07T18:23:28Z", "updatedAt": "2026-08-13T08:26:15Z", "timestamp": "2026-08-13T08:26:15Z", "metrics": { "reactions": 13, "comments": 3 }, "labels": [ "type/bug" ], "author": "slim-bean", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:a9e2b810442bc7ae7a3c", "signalId": "github:grafana/loki:pull_request:23902", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23902", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "test(logql): Expand logqltest label filter coverage and correct the docs", "text": "**What this PR does / why we need it**: The existing `label_filters.logqltest` scenarios covered the happy path of each label filter kind, but stopped short of the operators, value forms and error paths where the behaviour is least obvious. Filling those gaps turned up three statements in the docs that the engine contradicts, so this corrects them and pins each one with a test. Docs corrections: - `and` is evaluated before `or`, not left to right, and a `|` starts a new stage rather than another predicate — so the two forms the docs listed as equivalent are not. - Only a string filter can test `__error__`. A converting filter cannot read it, so `| __error__ > 0` silently matches nothing. - An `ip()` label filter keeps a line that already carries an `__error__` label, whichever operation is used. **Which issue(s) this PR fixes**: Relates to #23892, found while writing these tests. That fix is deliberately out of scope here, and no scenario pins the affected behaviour. **Special notes for your reviewer**: N/A **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23902", "createdAt": "2026-08-11T04:13:20Z", "updatedAt": "2026-08-13T08:25:07Z", "timestamp": "2026-08-13T08:25:07Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs" ], "author": "pracucci", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:ed6cb8ddb269f09d0a3a", "signalId": "github:grafana/loki:pull_request:23864", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23864", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Large requests returned 400 instead 413", "text": "**What this PR does / why we need it**: This pull request fixes a number of cases where large requests were failed with a 400 instead of a 413 status code. This seems inconsequential, but it meant a number of these cases were invisible on provisioned Grafana Cloud dashboards that customers use to track their ingest. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23864", "createdAt": "2026-08-09T14:05:07Z", "updatedAt": "2026-08-13T08:23:16Z", "timestamp": "2026-08-13T08:23:16Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "grobinson-grafana", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:f13a4105987bbfddb3ac", "signalId": "github:grafana/loki:pull_request:23936", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23936", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(compression): Export Codecs() and de-duplicate test codec lists", "text": "**What this PR does / why we need it**: Follow-up to #23721. During review, `@pracucci` pointed out that the new `testCodecs` list in `cmd/chunks-inspect/loki_test.go` duplicates `compression`'s internal, unexported `supportedCodecs` list. This PR adds `compression.Codecs()` (a clone of `supportedCodecs`, so callers can't mutate the package's internal state) and swaps it in wherever a test file was hand-listing the full codec set: * `cmd/chunks-inspect/loki_test.go`'s `testCodecs` * `pkg/chunkenc/memchunk_test.go`'s `testEncodings` * `pkg/storage/stores/shipper/bloomshipper/client_test.go`'s `supportedCompressions` Each was a verbatim copy that would silently go stale if a codec were ever added or removed. `pkg/storage/bloom/v1/builder_test.go`'s `blockEncodings` is left as-is — it's a deliberate 5-of-9 subset, not a duplicate of the full list. Also adds `TestCodecs` covering both membership and that the returned slice is a copy, not an alias. **Which issue(s) this PR fixes**: None. Follow-up to #23721. **Special notes for your reviewer**: Adversarially reviewed with Codex — no correctness findings; the one gap it flagged (no direct test for `Codecs()`) is fixed in this PR. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23936", "createdAt": "2026-08-13T07:38:37Z", "updatedAt": "2026-08-13T07:53:44Z", "timestamp": "2026-08-13T07:53:44Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "jnewbigin", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:f02a4b4f1b4077aac6bc", "signalId": "github:grafana/loki:pull_request:23454", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23454", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix: Recognise thanos/minio S3 throttling errors as retryable and add backoff", "text": "**What this PR does / why we need it**: S3 throttling responses (`SlowDown`, `503`, `429`) were not being treated as retryable when the object client runs on the thanos/objstore backend (`use_thanos_objstore: true`), which is the default for our object stores. `IsStorageThrottledErr` only matched the AWS SDK's `smithy.APIError`, but the thanos S3 client is backed by minio-go, which returns `minio.ErrorResponse`. As a result, on throttling: - congestion control classified the error as non-retryable, - so it never retried, and its AIMD controller never backed off, and - every throttle surfaced immediately as a `failed downloading chunks` error. This PR makes `IsStorageThrottledErr` also recognise `minio.ErrorResponse` throttling/5xx codes (with an HTTP-status fallback for 429 / any 5xx), so both the legacy AWS-SDK client and the thanos/minio client share one retryability definition. Retries and AIMD back-off now engage as designed, absorbing transient throttles instead of failing the chunk fetch. **Why backoff is needed between congestion-control retries** This PR disables the retry inside the S3 and GCS clients. Instead, the congestion-control retrier does the retries. After this change, the congestion-control retrier is the only retry path for these backends. Before this fix, the congestion-control retrier had no delay between attempts. It relied on the backoff inside the S3 or GCS client for that delay. This PR also disables that backoff, along with the retry of the client. As a result, retries fired immediately, one after another, into a backend that just signaled overload (for example, an S3 SlowDown error or a 503 status). This defeated the purpose of congestion control. It made the overload worse, not better. This PR also adds two new settings: - a minimum backoff period - a maximum backoff period The retrier waits a time between these two limits before each retry. The default values are 200 ms and 1s. These values match the backoff profile of the client that this fix replaces. The wait uses the backoff package from dskit. The wait also checks the request context. If the request is canceled, the retrier stops the wait and returns the error immediately. **Special notes for your reviewer**: - The fix lives in `IsStorageThrottledErr`, which is the single retryability entry point used by *both* the legacy S3 client and the thanos `ObjectClientAdapter` (`storeType == s3` → `aws.IsRetryableErr`), so both paths benefit, and there's no duplicated code-list. - `errors.As` is used so wrapped errors (thanos wraps with `pkg/errors`) are still matched. - Tests, in increasing scope: - unit: `TestIsRetryableErr` — minio `SlowDown`/`ServiceUnavailable`/`InternalError`/`TooManyRequests`, wrapped errors, status-only fallback, and negatives (`NoSuchKey`, `AccessDenied`). - wiring: `TestObjectClientAdapter_IsRetryableErr_S3Minio` — locks `storeType == s3` → minio-aware retryability. - end-to-end: `TestCongestionControl_S3Throttling_*` — drive the real AIMD controller → LimitedRetrier → thanos adapter → minio-go → fake S3 returning `503 SlowDown`, asserting retries fire, AIMD backs off, `non_retryable_errors == 0`, and a transient throttle is absorbed. - No config or API changes; behaviour only changes for previously misclassified throttling errors. **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory.", "url": "https://github.com/grafana/loki/pull/23454", "createdAt": "2026-07-23T11:59:55Z", "updatedAt": "2026-08-13T07:53:16Z", "timestamp": "2026-08-13T07:53:16Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs" ], "author": "sandeepsukhani", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:04fecec42407730d7625", "signalId": "github:grafana/loki:pull_request:23721", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23721", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(chunks-inspect): Report block parse errors and drop the duplicate time.go", "text": "**What this PR does / why we need it**: This PR tidies up two things left over from #23681, which folded `chunks-inspect` into the root Go module and listed both of these as deliberate follow-ups. * Reports per-block parse errors instead of quietly dropping them, and returns the entries recovered before the corruption. * Adds some basic test coverage for said corruption * Deletes `cmd/chunks-inspect/time.go`, a verbatim copy of `prometheus/common/model.Time`. **The block error handling.** `parseLokiChunk` assigned the result of `parseLokiBlock` to the shared `err` variable and never checked it. Because `readUvarint` and `readVarint` take the previous error and short-circuit on it, that stale error leaked into the next iteration's metadata reads, so a single crook block took the whole chunk down and the failure was reported against a block the parser had not reached yet. When the failing block happened to be the last one, the error was dropped altogether and the block was listed as empty with nothing to say it had failed. Both outcomes are not great for a tool whose whole job is squinting at dodgy chunks. On a chunk with a corrupt middle block, `chunks-inspect` used to stop dead after the labels: ``` Chunks file: corrupt-block.chunk ... Labels: __name__ = logs job = test 2026/08/03 10:13:53 corrupt-block.chunk: not enough line data, need 268435455, got 337 ``` No format, no encoding, no checksums, no block table, and not one of the 30 perfectly readable log lines. Now the block owns its error and everything else still prints: ``` Format (Version): 3 Encoding: none Blocks Metadata Checksum: 499f2749 OK Found 4 block(s), use -b to show block details ... Block 1: FAILED to parse, recovered 1 of 11 entries: not enough line data, need 268435455, got 337 ``` **`time.go`.** Redundant ever since the tool joined the root module, which already depends on `prometheus/common`. The copy had also fallen behind an upstream fix: where the fractional part follows a non-zero integer part, the sign was only applied when the integer part was zero, so a `from` of `-1.5` decoded as -0.5 seconds. Chunk headers hold timestamps well after the epoch so nothing in practice was hitting it, but there is no reason to keep carrying it. **Which issue(s) this PR fixes**: None. Follow-up to #23681. **Special notes for your reviewer**: `chunks-inspect` is a developer tool. It is not packaged or shipped anywhere — `dist` builds only Loki, logcli, canary and lokitool, and `nfpm.sh` packages only loki, canary, logcli and promtail — so there is no release-artefact impact and no changelog entry. **One known hole left open.** For v4 chunks, `parseLokiBlock` indexes `symbols[nameIdx]` and `symbols[valIdx]` without validating either index, so a corrupt structured metadata section panics rather than becoming a `parseErr`. Reproduced against this branch: `index out of range [127] with length 41`. It is pre-existing and orthogonal to the error plumbing here, but it does mean the failure mode this PR improves is still reachable as a crash on current-format chunks. I have left it for its own change rather than growing this one; happy to fold it in here instead if you would rather it landed together. The same goes for `cmd/chunks-inspect/labels.go`, the other duplicate flagged in #23681. Swapping it for `prometheus/prometheus/model/labels` needs `Labels.Range` rather than a plain `range`, so it compiles under the `stringlabels` build tag. Out of scope here. Testing done beyond CI: * `go test -race -count=1 ./cmd/chunks-inspect/...` — 31 subtests, all passing. Every supported codec across chunk formats v2, v3 and v4, plus corrupt-block cases in the first, a middle and the last block position, plus a block that cannot be decompressed. * The corrupt-block tests repair the block checksum after damaging the entry stream, so the damage can only be found by parsing the entries. Left alone, the checksum would come up BAD and mask the thing under test. * Mutation-tested the new tests, since they cannot simply run against the old code. Reverting the metadata error scoping fails the first and middle positions; reverting the partial-entry recovery fails all three; discarding the block error fails all three plus the decompression case. * For the `model.Time` swap, compared old and new binaries on chunk files built with `chunkenc` and wrapped in the real on-disk header framing. Byte-for-byte identical output for whole-second and fractional headers. The negative fractional header differs, and the new output is the correct one: `1969-12-31 23:59:58.500000` where the old printed `23:59:59.500000`. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23721", "createdAt": "2026-08-03T06:03:14Z", "updatedAt": "2026-08-13T07:20:23Z", "timestamp": "2026-08-13T07:20:23Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "jnewbigin", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:6f31190f5ff92cc38cad", "signalId": "github:grafana/loki:pull_request:23935", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23935", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "refactor(logql): One extractor per sample expression", "text": "**What this PR does / why we need it**: First simplification step after the `variants()` removal (#23823, #23889, #23905). A sample expression has produced exactly one extractor since the consolidated variants extractor landed in #17149, so the plumbing that carried several was already unreachable code. - `SampleExpr.Extractors() ([]SampleExtractor, error)` → `Extractor() (SampleExtractor, error)` - The `...log.StreamSampleExtractor` variadics collapse to a single parameter across `chunkenc`, `storage` and `ingester` - Deletes `pkg/chunkenc/variants.go`, whose `multiExtractorSampleBufferedIterator` `newSampleIterator` only reached when handed more than one extractor **Which issue(s) this PR fixes**: Step 4 of grafana/loki-private#2750. **Special notes for your reviewer**: **Review changes with \"hide whitespaces\" enabled** **The one behavioural change worth your attention is a panic fix.** `LiteralExpr` and `VectorExpr` produce samples without reading logs, so they have no extractor. They used to return an empty slice, which callers collapsed into a no-op iterator via `len(extractors) == 0`; they now return nil. Left unguarded, the storage and ingester call sites dereference that nil: ``` panic: runtime error: invalid memory address or nil pointer dereference pkg/ingester/instance.go:565 (*instance).querySample.func1 ``` This is reachable, not theoretical: the query plan arrives over gRPC and `SelectSampleParams.Expr()` only type-asserts to `syntax.SampleExpr`, which both types satisfy. So a request carrying `vector(0)` panics the ingester, where `main` today returns an empty result. Both call sites now nil-check, and the check has to sit **before** `deletion.SetupExtractor` — with deletes present that wraps the nil into a *non-nil* filtering extractor, and a later check would not fire. Covered by `Test_QuerySampleWithoutExtractor` (both expressions, with and without deletes). I verified it fails for the right reason by removing the guard and watching it panic. **`TestHeadBlockSampleHashesMatchAcrossFormats` needed strengthening, not just adapting.** It used two extractors to get two samples per line with different labels, which single-extractor iterators can no longer produce. Naively reducing it to one extractor over 10 identical-label lines silently weakened it: it then only proved the hash covers the *line*, and a hash that dropped the label component passed. That matters because `logproto.Sample.Hash` is a wire field used for cross-replica dedup, so a label-blind hash silently drops samples from distinct streams. It now collects the same lines under a second stream label set and asserts 20 distinct hashes — verified to fail against exactly that mutation. **Query stats are deliberately untouched.** `AddPostFilterLines` counts exactly what it counted before in all four sample paths, including the two that count lines the extractor rejected. The three sample paths disagree with each other and this issue will be fixed in a follow up PR. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23935", "createdAt": "2026-08-13T06:09:04Z", "updatedAt": "2026-08-13T07:15:29Z", "timestamp": "2026-08-13T07:15:29Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "pracucci", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:67990f50104576c011ee", "signalId": "github:grafana/loki:pull_request:23933", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23933", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/parquet-go/parquet-go to v0.31.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/parquet-go/parquet-go](https://redirect.github.com/parquet-go/parquet-go) | `v0.30.1` → `v0.31.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fparquet-go%2fparquet-go/v0.31.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fparquet-go%2fparquet-go/v0.30.1/v0.31.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
parquet-go/parquet-go (github.com/parquet-go/parquet-go) ### [`v0.31.0`](https://redirect.github.com/parquet-go/parquet-go/releases/tag/v0.31.0) [Compare Source](https://redirect.github.com/parquet-go/parquet-go/compare/v0.30.2...v0.31.0) #### What's Changed ##### Other changes - feat: add BE128/UUID direct read and write interfaces by [@​T-J-L](https://redirect.github.com/T-J-L) in [#​533](https://redirect.github.com/parquet-go/parquet-go/pull/533) - schema: panic on unrecognized parquet struct tag options by [@​jacob-mckenzie](https://redirect.github.com/jacob-mckenzie) in [#​534](https://redirect.github.com/parquet-go/parquet-go/pull/534) - fix: skip zero-length runs in RLE int32 and boolean decoders by [@​savak1990](https://redirect.github.com/savak1990) in [#​531](https://redirect.github.com/parquet-go/parquet-go/pull/531) - fix: GenericWriter drops values after dictionary fallback to PLAIN encoding by [@​lukaskratzel](https://redirect.github.com/lukaskratzel) in [#​536](https://redirect.github.com/parquet-go/parquet-go/pull/536) - perf: avoid per-row allocations when writing time columns by [@​perfloop-agent](https://redirect.github.com/perfloop-agent) in [#​542](https://redirect.github.com/parquet-go/parquet-go/pull/542) - Check data capacity by [@​khepin](https://redirect.github.com/khepin) in [#​540](https://redirect.github.com/parquet-go/parquet-go/pull/540) - Validate page headers, return errors instead of panic by [@​khepin](https://redirect.github.com/khepin) in [#​538](https://redirect.github.com/parquet-go/parquet-go/pull/538) - Validate and error on invalid row counts in file & rowgroup footers by [@​khepin](https://redirect.github.com/khepin) in [#​539](https://redirect.github.com/parquet-go/parquet-go/pull/539) - perf: make Value level mutation inlinable and add in-place setters by [@​achille-roussel](https://redirect.github.com/achille-roussel) in [#​546](https://redirect.github.com/parquet-go/parquet-go/pull/546) - perf: specialize single-column row comparator to bypass interface dispatch by [@​perfloop-agent](https://redirect.github.com/perfloop-agent) in [#​547](https://redirect.github.com/parquet-go/parquet-go/pull/547) - fix(bloomfilter): correct offset calculation for section reads by [@​T-J-L](https://redirect.github.com/T-J-L) in [#​548](https://redirect.github.com/parquet-go/parquet-go/pull/548) - perf: optimize variant.Marshal via direct reflect-walk serialization by [@​perfloop-agent](https://redirect.github.com/perfloop-agent) in [#​550](https://redirect.github.com/parquet-go/parquet-go/pull/550) - fix(variant): binary codec spec conformance and input validation by [@​ryanworl](https://redirect.github.com/ryanworl) in [#​551](https://redirect.github.com/parquet-go/parquet-go/pull/551) - Fix encoding handling for schemas derived from legacy files by [@​ryanworl](https://redirect.github.com/ryanworl) in [#​555](https://redirect.github.com/parquet-go/parquet-go/pull/555) #### New Contributors - [@​jacob-mckenzie](https://redirect.github.com/jacob-mckenzie) made their first contribution in [#​534](https://redirect.github.com/parquet-go/parquet-go/pull/534) - [@​lukaskratzel](https://redirect.github.com/lukaskratzel) made their first contribution in [#​536](https://redirect.github.com/parquet-go/parquet-go/pull/536) - [@​khepin](https://redirect.github.com/khepin) made their first contribution in [#​540](https://redirect.github.com/parquet-go/parquet-go/pull/540) **Full Changelog**: ### [`v0.30.2`](https://redirect.github.com/parquet-go/parquet-go/releases/tag/v0.30.2) [Compare Source](https://redirect.github.com/parquet-go/parquet-go/compare/v0.30.1...v0.30.2) #### What's Changed ##### Other changes - fix: skip zero-length runs when decoding RLE/Hybrid levels by [@​savak1990](https://redirect.github.com/savak1990) in [#​528](https://redirect.github.com/parquet-go/parquet-go/pull/528) - fix: convert oob levels panic by [@​wardady](https://redirect.github.com/wardady) in [#​527](https://redirect.github.com/parquet-go/parquet-go/pull/527) - fix(buffer\\_pool): handle short reads in readerAt by [@​T-J-L](https://redirect.github.com/T-J-L) in [#​532](https://redirect.github.com/parquet-go/parquet-go/pull/532) #### New Contributors - [@​wardady](https://redirect.github.com/wardady) made their first contribution in [#​527](https://redirect.github.com/parquet-go/parquet-go/pull/527) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23933", "createdAt": "2026-08-13T00:11:04Z", "updatedAt": "2026-08-13T07:09:25Z", "timestamp": "2026-08-13T07:09:25Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:26ff938f72a1319e90b0", "signalId": "github:grafana/loki:pull_request:23918", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23918", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/oschwald/geoip2-golang/v2 to v2.3.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/oschwald/geoip2-golang/v2](https://redirect.github.com/oschwald/geoip2-golang) | `v2.2.0` → `v2.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2foschwald%2fgeoip2-golang%2fv2/v2.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2foschwald%2fgeoip2-golang%2fv2/v2.2.0/v2.3.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
oschwald/geoip2-golang (github.com/oschwald/geoip2-golang/v2) ### [`v2.3.0`](https://redirect.github.com/oschwald/geoip2-golang/releases/tag/v2.3.0): 2.3.0 - Updated `github.com/oschwald/maxminddb-golang/v2` to `v2.5.0` and switched all exported database model structs to generated decoders. This substantially reduces City and Enterprise lookup latency and allocations while preserving the existing lookup APIs and decoded results.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23918", "createdAt": "2026-08-11T21:11:22Z", "updatedAt": "2026-08-13T07:08:44Z", "timestamp": "2026-08-13T07:08:44Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:af3282c93044038bfaf3", "signalId": "github:grafana/loki:pull_request:23934", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23934", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Add Apache APISIX to third-party clients 🤖🤖🤖", "text": "**What this PR does / why we need it**: Adds Apache APISIX `loki-logger` to the third-party clients list. The existing APISIX plugin sends batched request and response logs to Loki through the Loki HTTP push API, and the link points to the official APISIX plugin documentation. **Which issue(s) this PR fixes**: None. **Special notes for your reviewer**: This is a one-line documentation-only change. The contribution was prepared with automated assistance and is submitted through Loki's agent review path. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated (not applicable; documentation-only change) - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15) (not applicable)", "url": "https://github.com/grafana/loki/pull/23934", "createdAt": "2026-08-13T03:35:15Z", "updatedAt": "2026-08-13T03:49:42Z", "timestamp": "2026-08-13T03:49:42Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "Yilialinn", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:549b5c67694c30ce312b", "signalId": "github:grafana/loki:pull_request:22967", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:22967", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update Terraform google to v7.43.0 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [google](https://registry.terraform.io/providers/hashicorp/google) ([source](https://redirect.github.com/hashicorp/terraform-provider-google)) | required_provider | minor | `7.38.0` → `7.43.0` | `7.44.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
hashicorp/terraform-provider-google (google) ### [`v7.43.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7430-Unreleased) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.42.0...v7.43.0) ### [`v7.42.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7420-July-28-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.41.0...v7.42.0) NOTES: - compute: migrated `google_compute_region_instance_template` resource to use direct HTTP rather than a client library ([#​28431](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28431)) DEPRECATIONS: - vertexai: deprecated `google_vertex_ai_schedule`, an accidentally-added duplicate resource; use `google_colab_schedule` instead. ([#​28406](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28406)) FEATURES: - **New Data Source:** `google_cloud_quotas_quota_adjuster_settings` ([#​28383](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28383)) - **New List Resource:** `google_service_account_key` ([#​28430](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28430)) - **New Resource:** `google_agent_identity_auth_provider` ([#​28447](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28447)) - **New Resource:** `google_apihub_runtime_project_attachment` ([#​28449](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28449)) - **New Resource:** `google_chronicle_big_query_export` ([#​28403](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28403)) - **New Resource:** `google_compute_global_vm_extension_policy` ([#​28445](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28445)) - **New Resource:** `google_compute_rollout_plan` ([#​28445](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28445)) - **New Resource:** `google_vector_search_data_object` ([#​28434](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28434)) - **New Resource:** `google_vertex_ai_persistent_resource` ([#​28435](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28435)) IMPROVEMENTS: - bigquery: added `table_type` field to `google_bigquery_routine` resource ([#​28446](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28446)) - cloudrunv2: added `start_execution_token` and `run_execution_token` fields to `google_cloud_run_v2_job`resource ([#​28384](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28384)) - colab: added `catch_up`, `create_pipeline_job_request`, `create_time`, `last_pause_time`, `last_resume_time`, `last_scheduled_run_response`, `max_concurrent_active_run_count`, `next_run_time`, `started_run_count`, and `update_time` fields, and sub-fields under `create_notebook_execution_job_request.notebook_execution_job` (`create_time`, `custom_environment_spec`, `encryption_spec`, `job_state`, `kernel_name`, `labels`, `name`, `schedule_resource_name`, `workbench_runtime`) and under `create_notebook_execution_job_request` (`notebook_execution_job_id`, `parent`) to `google_colab_schedule` resource ([#​28406](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28406)) - compute: added `effective_location` field to `google_compute_interconnect` resource ([#​28416](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28416)) - compute: added `request_headers` and `response_headers` fields to `log_config` on `google_compute_backend_service` and `google_compute_region_backend_service` resources ([#​28421](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28421)) - compute: added identity support to `google_compute_instance`, allowing resource import using an `identity` block ([#​28433](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28433)) - compute: changed `location` field to mutable for `google_compute_interconnect` resource ([#​28416](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28416)) - container: added `addons_config.node_readiness_config` field to `google_container_cluster` resource ([#​28417](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28417)) - container: added `rollback_safe_upgrade`, `desired_emulated_version`, and `emulated_version` fields to `google_container_cluster` resource ([#​28442](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28442)) - container: increased default timeout to 2 hours for `google_container_node_pool`resource ([#​28382](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28382)) - dataproc: added `confidential_instance_type` field to `google_dataproc_cluster` resource ([#​28371](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28371)) - gkehub: added `min_control_plane_version`, `min_node_version`, `target_control_plane_version`, `target_node_version`, and `operational_state` fields to `google_gke_hub_rollout_sequence` resource ([#​28429](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28429)) - hypercomputecluster: increased default timeouts for `google_hypercomputecluster_cluster` to 120 minutes ([#​28448](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28448)) - modelarmor: added field `template_metadata.filter_version_selector` to `google_model_armor_template` resource ([#​28402](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28402)) - sql: added identity support to `google_sql_user` for `terraform query` support ([#​28428](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28428)) BUG FIXES: - bigtable: fixed an issue where `bigtable_custom_endpoint` and `universe_domain` were ignored when creating Bigtable resources ([#​28404](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28404)) - compute: fixed an issue where diffs in `google_compute_security_policy` were not detected ([#​28420](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28420)) - gkehub: fixed `rollout_creation_scope` and `upgrade_types` fields in `google_gke_hub_rollout_sequence` resource ([#​28429](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28429)) - osconfig: added client-side validation to ensure `resource_hierarchy_selector` and `location_selector` are not set at the same time in `google_os_config_v2_policy_orchestrator`, `google_os_config_v2_policy_orchestrator_for_folder`, and `google_os_config_v2_policy_orchestrator_for_organization` ([#​28407](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28407)) - secretmanager: fixed an issue where `google_secret_manager_secret_version` would fail at apply time if neither `secret_data` nor `secret_data_wo` was set ([#​28419](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28419)) - sql: fixed issue where updates to `settings.ip_configuration.psc_config.allowed_consumer_projects` in `google_sql_database_instance` were silently ignored on in-place updates ([#​28444](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28444)) - vertexai: fixed `google_vertex_ai_endpoint_with_model_garden_deployment` destroying and recreating the endpoint when `min_replica_count`, `max_replica_count`, `required_replica_count`, or `autoscaling_metric_specs` changed ([#​28401](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28401)) ### [`v7.41.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7410-July-17-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.40.0...v7.41.0) FEATURES: - **New Resource:** `google_chronicle_environment_group` ([#​28338](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28338)) - **New Resource:** `google_compute_router_named_set` ([#​28326](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28326)) - **New List Resource:** `google_compute_backend_bucket_signed_url_key` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_backend_service_signed_url_key` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_network_firewall_policy` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_network_firewall_policy_association` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_network_firewall_policy_packet_mirroring_rule` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_preview_feature` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_public_advertised_prefix` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_region_backend_bucket` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) - **New List Resource:** `google_compute_region_network_firewall_policy` ([#​28357](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28357)) IMPROVEMENTS: - accesscontextmanager: added `allowed_service_patterns` and `service_patterns_enforcement_scopes` fields to `google_access_context_manager_service_perimeter` to support VPC Service Controls for non-GCP APIs. ([#​28349](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28349)) - accesscontextmanager: added `pscEndpoint` to `sources` in `ingress_from` and `egress_from` under resources `google_access_context_manager_service_perimeter` and variants ([#​28307](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28307)) - backupdr: added `backup_blocked_by_vault_access_restriction` to `data.google_backup_dr_data_source` resource ([#​28361](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28361)) - backupdr: added `force_update_access_restriction` to `google_backup_dr_backup_vault` resource ([#​28361](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28361)) - backupdr: added update support for `access_restriction` to `google_backup_dr_backup_vault` resource ([#​28361](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28361)) - certificatemanager: added in-place update support for the `self_managed` certificate data (`pem_certificate` / `pem_private_key`) on `google_certificate_manager_certificate`; changing the certificate data is now applied via update instead of forcing recreation ([#​28337](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28337)) - cloudrunv2: added `tags` field to `google_cloud_run_v2_service` and `google_cloud_run_v2_job` resources to allow setting tags for services and jobs at creation time. ([#​28328](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28328)) - cloudsql: added `max_custom_on_demand_retention_days` to create backup\\_plan example for sqladmin ([#​28343](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28343)) - compute: added 3500GB and 7000GB SSD partition size to `google_compute_instance_template` resource ([#​28352](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28352)) - compute: added `FLEX_START` and `RESERVATION_BOUND` support to `google_compute_instance`, `google_compute_instance_template`, and `google_compute_region_instance_template` resources ([#​28365](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28365)) - container: added the support for updating `node_image_config` and `image_type` fields at the same time ([#​28283](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28283)) - dataproc: added `confidential_instance_type` to `google_dataproc_cluster` resource ([#​28371](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28371)) - dataproc: added `instance_selection.disk_config` field to `google_dataproc_cluster` resource ([#​28339](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28339)) - discoveryengine: added `enable_llm_layout_parsing` and `enable_get_processed_document` fields to `google_discovery_engine_data_store` resource ([#​28284](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28284)) - sql: added `instance_auto_dns_status` and `write_endpoint_auto_dns_status` output fields to `psc_auto_connections` block in `google_sql_database_instance` resource ([#​28331](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28331)) - sql: added `include_replicas_for_major_version_upgrade` field to `google_sql_database_instance` resource ([#​28345](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28345)) - sql: added `switch_transaction_logs_to_cloud_storage_enabled` field to `google_sql_database_instance` resource ([#​28318](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28318)) - vertexai: promoted `google_vertex_ai_semantic_governance_policy_engine` resource to GA ([#​28347](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28347)) - workbench: added `enable_deletion_protection` field to `google_workbench_instance` resource ([#​28355](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28355)) - workbench: added `resource_policies` field to `google_workbench_instance` resource ([#​28354](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28354)) - workbench: added support for `min_cpu_platform` in `google_workbench_instance` resource ([#​28369](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28369)) - workstations: added `instance_metadata` field to `google_workstations_workstation_config` resource ([#​28342](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28342)) BUG FIXES: - compute: fixed bug where a permadiff on `google_compute_reservation_region_commitment.existing_reservations` would persist after upgrading ([#​28353](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28353)) - compute: fixed permadiff on `keepalive_interval` for `google_compute_router` `bgp` block when set to default value ([#​28285](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28285)) - resourcemanager: fixed validation of `target_service_account` and `delegates` in the `google_service_account_access_token`, `google_service_account_id_token`, and `google_service_account_jwt` data sources, and of `name` in the `google_service_account_key` data source, to reject identifiers that contain path separators ([#​28308](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28308)) - securityposture: fixed a bug where the `enforce` field in `google_securityposture_posture` was always set, causing failures for list constraints. ([#​28359](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28359)) - vmwareengine: added correct `update_mask` value to `google_vmwareengine_private_cloud` updates ([#​28360](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28360)) ### [`v7.40.0`](https://redirect.github.com/hashicorp/terraform-provider-google/blob/HEAD/CHANGELOG.md#7400-July-14-2026) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.39.0...v7.40.0) DEPRECATIONS: - storage: the `admit-on-second-miss` value for `google_storage_anywhere_cache.admission_policy` is deprecated and will be removed in a future major release. The backend will ignore this attribute and treat it as `admit-on-first-miss`. ([#​28210](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28210)) NOTES: - compute: migrated `google_compute_instance` code related to advanced machine features to use direct HTTP rather than a client library ([#​28160](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28160)) FEATURES: - **New Data Source:** `google_data_catalog_taxonomy` ([#​28237](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28237)) - **New Data Source:** `google_oracle_database_exascale_db_storage_vault` ([#​28260](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28260)) - **New List Resource:** 'google\\_project' ([#​28041](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28041)) - **New List Resource:** `google_compute_instant_snapshot` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_instant_snapshot` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_target_http_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_target_tcp_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_region_url_map` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_rollout_plan` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_grpc_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_http_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_ssl_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_compute_target_tcp_proxy` ([#​28256](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28256)) - **New List Resource:** `google_dns_managed_zone` ([#​28257](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28257)) - **New List Resource:** `google_oracle_database_exascale_db_storage_vaults` ([#​28260](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28260)) - **New Resource:** `google_chronicle_findings_refinement_deployment` ([#​28240](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28240)) - **New Resource:** `google_chronicle_soar_domain` ([#​28214](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28214)) - **New Resource:** `google_iap_agent_registry_agent_iam_binding` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_agent_iam_member` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_agent_iam_policy` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_endpoint_iam_binding` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_endpoint_iam_member` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_endpoint_iam_policy` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_mcp_server_iam_binding` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_mcp_server_iam_member` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_iap_agent_registry_mcp_server_iam_policy` ([#​28231](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28231)) - **New Resource:** `google_tags_tag_binding_collection` ([#​28180](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28180)) - **New Resource:** `google_vector_search_index` ([#​28238](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28238)) - **New Resource:** `google_chronicle_environment` ([#​28206](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28206)) - **New Resource:** `google_chronicle_data_export` ([#​28239](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28239)) IMPROVEMENTS: - agentregistry: added `name` field to `google_agent_registry_binding` resource ([#​28207](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28207)) - agentregistry: added `name` field to `google_agent_registry_service` resource ([#​28207](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28207)) - appengine: added `app_engine_bundled_services` field to `google_app_engine_standard_app_version` resource ([#​28213](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28213)) - biglakeiceberg: add support for `CATALOG_TYPE_FEDERATED` with `federated_catalog_options` to `google_biglake_iceberg_catalog` ([#​28241](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28241)) - compute: added `target_type` and `target_forwarding_rules` to `google_compute_region_network_firewall_policy_with_rules` resource ([#​28061](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28061)) - compute: added `workload_identity_config` fields to `google_compute_instance` and `google_compute_instance_template` resources ([#​28266](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28266)) - compute: added `instance_lifecycle_policy.on_repair.allow_changing_zone` field to `google_compute_instance_group_manager` and `google_compute_instance_region_group_manager`. ([#​28174](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28174)) - container: added `ANY_RESERVATION_THEN_FAIL` option to `consume_reservation_type` field in `google_container_cluster` and `google_container_node_pool` resources ([#​28060](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28060)) - container: added `custom_node_init` configuration block to `node_config` (supporting Cloud Storage and Secret Manager) for both `google_container_cluster` and `google_container_node_pool` resources. ([#​28262](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28262)) - container: added `maintenance_policy` field to `google_container_node_pool` resource ([#​28217](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28217)) - container: added `recurring_maintenance_window` field to `google_container_cluster` resource ([#​28227](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28227)) - dataplex: added `catalog_publishing_enabled` field to `google_dataplex_datascan` resource ([#​28232](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28232)) - dlp: added `inspect_config.min_likelihood_per_info_type` to `google_data_loss_prevention_inspect_template` ([#​28236](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28236)) - firestore: added `skip_wait` field to `google_firestore_field` resource, skipping the wait for index creation ([#​28222](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28222)) - oracledatabase: added support for configuring Exascale-based VM clusters on top of dedicated storage vaults via the `exascale_db_storage_vault` parameter and `storage_management_type` to determine if VM Cluster is ASM or EXASCALE in `google_oracle_database_cloud_vm_cluster` ([#​28197](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28197)) - oracledatabase: added `exadata_infrastructure` field to `google_oracle_database_exascale_db_storage_vault` resource ([#​28177](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28177)) - oracledatabase: added `exascale_db_storage_vault` and `storage_management_type` fields to `google_oracle_database_cloud_vm_clusters` data source ([#​28260](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28260)) - sql: added `enforce_new_sql_network_architecture` field to `google_sql_database_instance` resource ([#​28233](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28233)) - sql: added `psc_auto_connection_policy_enabled` field and output-only `service_connection_policy` and `service_connection_policy_creation_result` fields to `google_sql_database_instance` resource ([#​28225](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28225)) - storagetransfer: added `private_network_service` to resource `google_storage_transfer_job` ([#​28178](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28178)) BUG FIXES: - bigtable: fixed a bug where `row_affinity` updates did not persist on `google_bigtable_app_profile` ([#​28215](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28215)) - bug: fixed labels diff in `google_project` ([#​28229](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28229)) - chronicle: suppressed a permadiff on `google_chronicle_rule.text` caused by the Chronicle API appending a trailing newline to every stored rule body ([#​28216](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28216)) - cloudscheudler: added retries for \"409: sync mutate calls cannot be queued\" error for `google_cloud_scheduler_job` ([#​28164](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28164)) - compute: fixed an issue where `preview = false` updates for `google_compute_organization_security_policy_rule` were omitted from API requests. ([#​28223](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28223)) - compute: fixed bug where it wasn't possible to disable `enable_proxy_protocol` on `google_compute_service_attachment` resource ([#​28264](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28264)) - datastream: fixed a bug in update functionality in `google_datastream_connection_profile` `mongodb_profile.additional_options` ([#​28254](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28254)) - eventarc: fixed a type mismatch when an `google_eventarc_trigger` resource returns non-empty `conditions`. ([#​28226](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28226)) - filestore: aligned `google_filestore_instance` resource timeouts with the Filestore service instance operations TTLs ([#​28208](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28208)) - gemini: fixed truncated timeouts in `google_gemini_code_tools_setting`, `google_gemini_data_sharing_with_google_setting_binding`, `google_gemini_gemini_gcp_enablement_setting_binding`, and `google_gemini_release_channel_setting_binding` ([#​28220](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28220)) - hypercomputecluster: fixed 20-minute timeout limit during `google_hypercomputecluster_cluster` resource creation ([#​28182](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28182)) - logging: fixed an issue where errors on update would not be propagated in `google_logging_project_bucket_config` ([#​28055](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28055)) - observability: fixed unintentionally long timeouts in `google_observability_folder_settings`, `google_observability_organization_settings`, and `google_observability_project_settings` ([#​28220](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28220)) - oracledatabase: fixed early client-side timeouts and aligned default schema timeouts with backend async polling limits on `google_oracle_database_exadb_vm_cluster`, `google_oracle_database_odb_network`, `google_oracle_database_odb_subnet`, `google_oracle_database_goldengate_connection`, `google_oracle_database_goldengate_deployment`, and `google_oracle_database_goldengate_connection_assignment`. ([#​28228](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28228)) - oracledatabase: fixed truncated timeouts in `google_oracle_database_exadb_vm_cluster`, `google_oracle_database_goldengate_connection`, and `google_oracle_database_odb_subnet` ([#​28220](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28220)) - privilegedaccessmanager: fixed a permadiff on `google_privileged_access_manager_entitlement` for entitlements created without an approval workflow ([#​28224](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28224)) - provider: fixed validation of `external_credentials.identity_token` to reject malformed JWTs containing empty segments ([#​28258](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28258)) ### [`v7.39.0`](https://redirect.github.com/hashicorp/terraform-provider-google/releases/tag/v7.39.0) [Compare Source](https://redirect.github.com/hashicorp/terraform-provider-google/compare/v7.38.0...v7.39.0) NOTES: - compute: migrated `google_compute_instance_template` resource partially to use direct HTTP rather than a client library ([#​28010](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28010)) - compute: migrated `google_compute_network_peering` resource to use direct HTTP rather than a client library ([#​28021](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28021)) - compute: migrated metadata handling to use direct HTTP rather than a client library ([#​27968](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27968)) FEATURES: - **New Data Source:** `google_agent_registry_agent` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Data Source:** `google_agent_registry_endpoint` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Data Source:** `google_agent_registry_mcp_server` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Data Source:** `google_compute_instance_groups` ([#​27981](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27981)) - **New Data Source:** `google_storage_control_folder_intelligence_findings_summary` ([#​28019](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28019)) - **New Data Source:** `google_storage_control_organization_intelligence_findings_summary` ([#​28019](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28019)) - **New Data Source:** `google_storage_control_project_intelligence_findings_summary` ([#​28019](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28019)) - **New Resource:** `google_agent_registry_binding` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Resource:** `google_agent_registry_service` ([#​28028](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28028)) - **New Resource:** `google_artifact_registry_project_config` ([#​28009](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28009)) - **New Resource:** `google_chronicle_findings_refinement` ([#​28035](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28035)) - **New Resource:** `google_compute_bulk_per_instance_config` ([#​28031](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28031)) - **New Resource:** `google_compute_firewall_policy_iam_binding` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_firewall_policy_iam_member` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_firewall_policy_iam_policy` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_network_firewall_policy_iam_binding` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_network_firewall_policy_iam_member` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_network_firewall_policy_iam_policy` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_network_firewall_policy_iam_binding` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_network_firewall_policy_iam_member` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_network_firewall_policy_iam_policy` ([#​27978](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27978)) - **New Resource:** `google_compute_region_resize_request` ([#​27984](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27984)) - **New Resource:** `google_compute_zone_vm_extension_policy` ([#​28034](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28034)) - **New Resource:** `google_gke_hub_rollout_sequence` ([#​28007](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28007)) - **New Resource:** `google_iap_agent_registry_iam_binding` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_agent_registry_iam_member` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_agent_registry_iam_policy` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_location_web_iam_binding` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_location_web_iam_member` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_iap_location_web_iam_policy` ([#​28032](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28032)) - **New Resource:** `google_oracle_database_cloud_exadata_infrastructure_exascale_config` ([#​28033](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28033)) - **New List Resource:** `google_bigquery_dataset` ([#​28005](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28005)) - **New List Resource:** `google_compute_cross_site_network` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_external_vpn_gateway` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_global_network_endpoint_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_ha_vpn_gateway` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_interconnect_attachment_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_interconnect_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_public_delegated_prefix` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_region_commitment` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_region_network_endpoint_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_vpn_gateway` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_compute_wire_group` ([#​28018](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28018)) - **New List Resource:** `google_folder_iam_member` ([#​27993](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27993)) - **New List Resource:** `google_kms_crypto_key_version` ([#​28006](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28006)) - **New List Resource:** `google_project` ([#​28041](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28041)) - **New List Resource:** `google_project_service` ([#​27989](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27989)) IMPROVEMENTS: - bigquery: added `external_runtime_options.container_request_concurrency` field to `google_bigquery_routine` resource ([#​28029](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28029)) - compute: added `instance_lifecycle_policy.on_failed_health_check` field in resources `google_compute_instance_group_manager` and `google_compute_region_instance_group_manager` (ga) ([#​27992](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27992)) - container: added new fields `shutdown_grace_period_seconds` and `shutdown_grace_period_critical_pods_seconds` to `node_kubelet_config` block. ([#​28015](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28015)) - container: promoted `agent_sandbox_config` addon field under `addons_config` in `google_container_cluster` to GA ([#​28017](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28017)) - dataplex: added `icon` field to `google_dataplex_data_product` resource ([#​27986](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27986)) - dataplex: added `name` field to `google_dataplex_data_product_data_asset` resource ([#​28020](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28020)) - dlp: added `allow_limited_availability_info_types` to `google_data_loss_prevention_inspect_template` ([#​28024](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28024)) - networkservices: added `forward_attributes` field to `google_network_services_lb_edge_extension`, `google_network_services_lb_route_extension`, and `google_network_services_lb_traffic_extension` resources ([#​28012](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28012)) BUG FIXES: - compute: fixed a panic in `google_compute_project_metadata` and `google_compute_project_metadata_item` when project common instance metadata items contain null/empty values. ([#​28008](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28008)) - compute: fixed a validation error on `google_compute_instance` (`Provisioned IOPS cannot be specified with disk type pd-balanced`) that occurred during updates on instances with Hyperdisk Balanced boot disks. ([#​27975](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27975)) - dataproc: fixed a bug where changing `policy_id` on `google_dataproc_autoscaling_policy` planned an in-place update and failed; it now correctly forces resource replacement (destroy and recreate). ([#​28036](https://redirect.github.com/hashicorp/terraform-provider-google/pull/28036)) - firestore: added retries on 409 errors in `google_firestore_user_creds` resource ([#​27972](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27972)) - iam: fixed ephemeral `google_service_account_key` producing a 404 due to duplicate `/keys` in the URL when `fetch_key = true` and `name` is provided ([#​27980](https://redirect.github.com/hashicorp/terraform-provider-google/pull/27980))
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/22967", "createdAt": "2026-07-04T01:13:24Z", "updatedAt": "2026-08-13T03:09:22Z", "timestamp": "2026-08-13T03:09:22Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:201b707295c9214be50f", "signalId": "github:grafana/loki:pull_request:23000", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23000", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module go.etcd.io/etcd/client/v3 to v3.7.1 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/etcd/client/v3](https://redirect.github.com/etcd-io/etcd) | `v3.6.14` → `v3.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fetcd%2fclient%2fv3/v3.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fetcd%2fclient%2fv3/v3.6.14/v3.7.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
etcd-io/etcd (go.etcd.io/etcd/client/v3) ### [`v3.7.1`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.1) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.7.0...v3.7.1) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.1 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ``` ### [`v3.7.0`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.6.14...v3.7.0) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.0 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ```
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23000", "createdAt": "2026-07-05T01:12:55Z", "updatedAt": "2026-08-13T00:09:10Z", "timestamp": "2026-08-13T00:09:10Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:84c76e9fcf0e2e7a447f", "signalId": "github:grafana/loki:pull_request:22575", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:22575", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/etcd/client/pkg/v3](https://redirect.github.com/etcd-io/etcd) | `v3.6.14` → `v3.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fetcd%2fclient%2fpkg%2fv3/v3.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fetcd%2fclient%2fpkg%2fv3/v3.6.14/v3.7.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
etcd-io/etcd (go.etcd.io/etcd/client/pkg/v3) ### [`v3.7.1`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.1) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.7.0...v3.7.1) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.1 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ``` ### [`v3.7.0`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.6.14...v3.7.0) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.0 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ```
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/22575", "createdAt": "2026-06-24T11:17:42Z", "updatedAt": "2026-08-13T00:09:07Z", "timestamp": "2026-08-13T00:09:07Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:eb2d61537cded640a5de", "signalId": "github:grafana/loki:pull_request:22574", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:22574", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module go.etcd.io/etcd/api/v3 to v3.7.1 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/etcd/api/v3](https://redirect.github.com/etcd-io/etcd) | `v3.6.14` → `v3.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fetcd%2fapi%2fv3/v3.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fetcd%2fapi%2fv3/v3.6.14/v3.7.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
etcd-io/etcd (go.etcd.io/etcd/api/v3) ### [`v3.7.1`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.1) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.7.0...v3.7.1) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.1 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.1 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ``` ### [`v3.7.0`](https://redirect.github.com/etcd-io/etcd/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/etcd-io/etcd/compare/v3.6.14...v3.7.0) Please check out [CHANGELOG](https://redirect.github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.7.md) for a full list of changes. And make sure to read [upgrade guide](https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/) before upgrading etcd (there may be breaking changes). For installation guides, please check out [operating etcd](https://etcd.io/docs/v3.7/op-guide/). Latest support status for common architectures and operating systems can be found at [supported platforms](https://etcd.io/docs/v3.7/op-guide/supported-platform/). ###### Linux ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version # start a local etcd server /tmp/etcd-download-test/etcd # write,read to etcd /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar /tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo ``` ###### macOS (Darwin) ```sh ETCD_VER=v3.7.0 # choose either URL GOOGLE_URL=https://storage.googleapis.com/etcd GITHUB_URL=https://github.com/etcd-io/etcd/releases/download DOWNLOAD_URL=${GOOGLE_URL} rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64 /tmp/etcd-download-test/etcd --version /tmp/etcd-download-test/etcdctl version /tmp/etcd-download-test/etcdutl version ``` ###### Docker etcd uses [`gcr.io/etcd-development/etcd`](https://gcr.io/etcd-development/etcd) as a primary container registry, and [`quay.io/coreos/etcd`](https://quay.io/coreos/etcd) as secondary. ```sh ETCD_VER=v3.7.0 rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \\ docker rmi gcr.io/etcd-development/etcd:${ETCD_VER} || true && \\ docker run \\ -p 2379:2379 \\ -p 2380:2380 \\ --mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \\ --name etcd-gcr-${ETCD_VER} \\ gcr.io/etcd-development/etcd:${ETCD_VER} \\ /usr/local/bin/etcd \\ --name s1 \\ --data-dir /etcd-data \\ --listen-client-urls http://0.0.0.0:2379 \\ --advertise-client-urls http://0.0.0.0:2379 \\ --listen-peer-urls http://0.0.0.0:2380 \\ --initial-advertise-peer-urls http://0.0.0.0:2380 \\ --initial-cluster s1=http://0.0.0.0:2380 \\ --initial-cluster-token tkn \\ --initial-cluster-state new \\ --log-level info \\ --logger zap \\ --log-outputs stderr docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcd --version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdutl version docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl endpoint health docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl put foo bar docker exec etcd-gcr-${ETCD_VER} /usr/local/bin/etcdctl get foo ```
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/22574", "createdAt": "2026-06-24T11:17:13Z", "updatedAt": "2026-08-13T00:09:05Z", "timestamp": "2026-08-13T00:09:05Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:ed6395042b9fc5cb3c76", "signalId": "github:grafana/loki:pull_request:23777", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23777", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Add Thanos storage examples 🤖🤖🤖", "text": "**What this PR does / why we need it**: Updates the sample storage examples to include Thanos configuration format using `object_store` as requested by @bboreham. This PR - Adds four new examples of Thanos storage configuration files - Updates existing examples to better indicate - Removes some extra lines **Special notes for your reviewer**: Planned with AI (Sonnet 5) Written with AI (Sonnet 5) Validated with a different model (Opus 5) Since storage.md has already been updated for the next release, we won't backport this update either, although it will be available in `next` until the next release.", "url": "https://github.com/grafana/loki/pull/23777", "createdAt": "2026-08-05T15:51:28Z", "updatedAt": "2026-08-12T21:30:06Z", "timestamp": "2026-08-12T21:30:06Z", "metrics": { "reactions": 0, "comments": 3 }, "labels": [ "type/docs" ], "author": "JStickler", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:f7653890dafd96b2599a", "signalId": "github:grafana/loki:pull_request:23927", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23927", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(docs): correct broken 'pipeline errors' link in log queries", "text": "Fixes #20051 The \"pipeline errors\" link in the label filter expression section pointed to `../#pipeline-errors`, which resolves to a non-existent anchor. The actual section heading in this file is `## Log pipeline`, so the correct link anchor is `#log-pipeline`. This is a one-character fix in the markdown link target.", "url": "https://github.com/grafana/loki/pull/23927", "createdAt": "2026-08-12T12:10:30Z", "updatedAt": "2026-08-12T21:26:29Z", "timestamp": "2026-08-12T21:26:29Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs", "backport release-3.6.x", "backport release-3.7.x" ], "author": "mmustafasenoglu", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:68a408cedd0af8b9fe04", "signalId": "github:grafana/loki:pull_request:23931", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23931", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update module github.com/knadh/koanf/maps to v0.1.3 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/knadh/koanf/maps](https://redirect.github.com/knadh/koanf) | `v0.1.2` → `v0.1.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fknadh%2fkoanf%2fmaps/v0.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fknadh%2fkoanf%2fmaps/v0.1.2/v0.1.3?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23931", "createdAt": "2026-08-12T21:08:37Z", "updatedAt": "2026-08-12T21:08:39Z", "timestamp": "2026-08-12T21:08:39Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-patch" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:6b6d454343b64ae15275", "signalId": "github:grafana/loki:pull_request:23757", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23757", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update logstash:9.4.4 Docker digest to bdb7d35 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [logstash](https://hub.docker.com/_/logstash) ([source](https://redirect.github.com/elastic/dockerfiles)) | final | digest | `7bf7931` → `bdb7d35` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23757", "createdAt": "2026-08-05T00:09:07Z", "updatedAt": "2026-08-12T21:07:30Z", "timestamp": "2026-08-12T21:07:30Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "docker" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:44426003416b7a55dc57", "signalId": "github:grafana/loki:pull_request:23924", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23924", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Configuration best practices had \"Simple Storage Storage\" mistake", "text": "**What this PR does / why we need it**: fix a minor mistake in the configuration best practices doc (S3 was described as \"Simple Storage Storage\", should be \"Simple Storage Service\" **Which issue(s) this PR fixes**: Fixes no issues **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [ ] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23924", "createdAt": "2026-08-12T11:27:09Z", "updatedAt": "2026-08-12T20:09:30Z", "timestamp": "2026-08-12T20:09:30Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs" ], "author": "kleinarne", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:959d0d8a7544fd2f2279", "signalId": "github:grafana/loki:pull_request:23696", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23696", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Implement streaming reading of header and TOC", "text": "**What this PR does / why we need it**: Implement streaming reading of header and TOC as part of the process of moving away from mmap in the index gateway. I have run this in a pre-production environment for a few minutes and not seen any noticeable changes in latency, resource usage, etc. **Special notes for your reviewer**: This PR is best reviewed commit-by-commit. The first commit copies across some files from mimir's equivalent. The second commit makes those files compile and pass linting rules within the context of loki. The third commit is \"the actual change\". Commit messages should be clear. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23696", "createdAt": "2026-07-31T15:16:44Z", "updatedAt": "2026-08-12T19:42:01Z", "timestamp": "2026-08-12T19:42:01Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "DanHopperGrafana", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:3afdcad558a8431106f9", "signalId": "github:grafana/loki:pull_request:23930", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23930", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Update Helm Charts docs 🤖🤖🤖 [release-3.7.x]", "text": "Backport ee9a1b8f26e19e7224b167190aec93e1b0f69ef9 from #23899 [job run](https://github.com/grafana/loki/actions/runs/31630100757) --- **What this PR does / why we need it**: Updates the Loki Helm charts to keep pace with updates in the Grafana-community repo. Regenerates the Helm Reference file. Replaces relative links with full URLs. **Special notes for your reviewer**: Planned with AI (Sonnet 5) Written with AI (Sonnet 5) Validated with a different model (Opus 5)", "url": "https://github.com/grafana/loki/pull/23930", "createdAt": "2026-08-12T18:59:09Z", "updatedAt": "2026-08-12T19:14:06Z", "timestamp": "2026-08-12T19:14:06Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "backport", "type/docs" ], "author": "loki-gh-app[bot]", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:8376f0548c673ca82adf", "signalId": "github:grafana/loki:pull_request:23899", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23899", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Update Helm Charts docs 🤖🤖🤖", "text": "**What this PR does / why we need it**: Updates the Loki Helm charts to keep pace with updates in the Grafana-community repo. Regenerates the Helm Reference file. Replaces relative links with full URLs. **Special notes for your reviewer**: Planned with AI (Sonnet 5) Written with AI (Sonnet 5) Validated with a different model (Opus 5)", "url": "https://github.com/grafana/loki/pull/23899", "createdAt": "2026-08-10T21:26:34Z", "updatedAt": "2026-08-12T18:56:17Z", "timestamp": "2026-08-12T18:56:17Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs", "backport release-3.7.x" ], "author": "JStickler", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:597bdd23e6413257a5b7", "signalId": "github:grafana/loki:issue:21926", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:issue:21926", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "[Bug] PutObject fails with 400 InvalidArgument on non-AWS S3 (NetApp ONTAP, others) after PR #21848/#21849 - x-amz-content-sha256 PAYLOAD-TRAILER not supported", "text": "Summary PRs #21849 (3.7.2) and #21848 (3.6.11) introduced a regression that causes complete data loss on S3-compatible storage that does not support the STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER value in the x-amz-content-sha256 header. Ingesters fail to flush chunks to object storage after 8 retries and silently drop data. Affected versions ``` ┌──────────────┬──────────┬─────────────────────────────────────────────────────┐ │ Version │ Affected │ Reason │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.6.8–3.6.10 │ ✅ No │ AWS SDK v1, no checksum PR │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.6.11 │ ❌ Yes │ PR #21848 backport │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.7.0–3.7.1 │ ❌ Yes │ AWS SDK v2 migration (s3 >= v1.74.1, default CRC32) │ ├──────────────┼──────────┼─────────────────────────────────────────────────────┤ │ 3.7.2 │ ❌ Yes │ PR #21849 + SDK v2 │ └──────────────┴──────────┴─────────────────────────────────────────────────────┘ ``` Environment - Loki version: 3.7.2 (also reproduced on 3.7.1 and 3.6.11) - Deployment: Nomad, simple scalable mode (write/read/backend targets), replication_factor: 3 - Object storage: NetApp ONTAP 9.16.1P6 (S3-compatible API) - Schema: v13, TSDB store - Auth: SigV4, path-style requests (s3forcepathstyle: true), HTTPS with custom endpoint Error Every PutObject call fails: ``` level=error caller=flush.go:262 component=ingester loop=14 org_id=fake msg=\"failed to flush\" retries=8 err=\"failed to flush chunks: store put chunk: operation error S3: PutObject, https response error StatusCode: 400, RequestID: , HostID: , api error InvalidArgument: x-amz-content-sha256 must be UNSIGNED-PAYLOAD, STREAMING-AWS4-HMAC-SHA256-PAYLOAD or a valid sha256 value.\" ``` After 8 retries the chunk is permanently dropped. Data loss is immediate and affects all streams being flushed. Root cause PR #21849/#21848 hardcodes ChecksumAlgorithm: types.ChecksumAlgorithmSha256 directly in PutObjectInput in pkg/storage/chunk/client/aws/s3_storage_client.go: ``` // Added by PR #21849 input := &s3.PutObjectInput{ ... ChecksumAlgorithm: types.ChecksumAlgorithmSha256, // ← this } ``` When an explicit ChecksumAlgorithm is set in AWS SDK v2, the SDK switches to STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER signing mode (trailing checksums over HTTPS). Many S3-compatible implementations — including NetApp ONTAP 9.16.1P6 — do not support this signing variant and reject the request. The PR description states: | \"Non-Object-Lock buckets accept the extra header as well, so the change is safe for every target\" This assumption is incorrect for non-AWS S3 implementations. Additional note on 3.7.0/3.7.1 The 3.7.x series is also affected independently of the checksum PR: the AWS SDK v2 migration (s3 >= v1.74.1) enables RequestChecksumCalculation: WhenSupported by default, causing automatic CRC32 checksums on PutObject. This also results in STREAMING-UNSIGNED-PAYLOAD-TRAILER, which ONTAP rejects. Setting AWS_REQUEST_CHECKSUM_CALCULATION=WHEN_REQUIRED does not fix 3.7.2 or 3.6.11 because the explicit ChecksumAlgorithmSha256 field in PutObjectInput takes precedence over the global SDK setting. S3 config (for reference) ``` storage_config: aws: endpoint: https://s3.example.internal region: us-east-1 bucketnames: loki s3forcepathstyle: true insecure: false http_config: insecure_skip_verify: true # self-signed cert on internal endpoint storage_config: aws: endpoint: https://s3.example.internal region: us-east-1 bucketnames: loki s3forcepathstyle: true s3forcepathstyle: true insecure: false http_config: insecure_skip_verify: true # self-signed cert on internal endpoint ``` Proposed fix Gate ChecksumAlgorithm behind a new opt-in config flag, for example: ``` storage_config: aws: object_lock: true # default: false — only enable for actual Object Lock buckets ``` When object_lock: false (default), omit ChecksumAlgorithm from PutObjectInput, preserving the pre-3.6.11/3.7.2 behavior for non-AWS S3 users. Related - Original Object Lock bug this was meant to fix: #20088 - Identical pattern in another project with ONTAP: vmware-tanzu/velero#8152 - AWS SDK v2 default CRC32 behavior announcement: aws/aws-sdk-go-v2 discussion #2960", "url": "https://github.com/grafana/loki/issues/21926", "createdAt": "2026-05-15T11:06:29Z", "updatedAt": "2026-08-12T16:52:15Z", "timestamp": "2026-08-12T16:52:15Z", "metrics": { "reactions": 0, "comments": 9 }, "labels": [], "author": "adamw-linadm", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:088f1c28312cf28dec61", "signalId": "github:grafana/loki:pull_request:21719", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:21719", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(kafka): support configurable SASL mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512)", "text": "## What this PR does / why we need it Loki's Kafka client hardcodes **SASL PLAIN** as the only authentication mechanism. Brokers configured with `sasl.enabled.mechanisms=SCRAM-SHA-256` or `SCRAM-SHA-512` only (e.g., AWS MSK, Confluent Cloud) immediately reject the handshake with `UNSUPPORTED_SASL_MECHANISM`, making Loki impossible to use with those providers. This PR adds a new optional `kafka.sasl_mechanism` configuration parameter, allowing operators to choose between: - `PLAIN` (default, backward-compatible) - `SCRAM-SHA-256` - `SCRAM-SHA-512` ## Which issue(s) this PR fixes Fixes #21712 ## Changes ### Core Implementation - Added `SASLMechanism` field and validation constants to `pkg/kafka/config.go` - Updated `commonKafkaClientOptions` in `pkg/kafka/client/writer_client.go` to conditionally apply the configured SASL mechanism via switch statement - Vendored `github.com/twmb/franz-go/pkg/sasl/scram` sub-package (v1.20.7, already an indirect dependency) ### Tests (TDD approach) - Added `TestSASLMechanismValidation` in `pkg/kafka/config_test.go` to validate allowed mechanisms and reject invalid ones - Added `TestNewReaderClientSCRAMAuthentication` in `pkg/kafka/client/reader_client_test.go` with SCRAM-SHA-256 and SCRAM-SHA-512 subtests - Added `TestNewWriterClientSCRAMAuthentication` in `pkg/kafka/client/writer_client_test.go` with SCRAM-SHA-256 and SCRAM-SHA-512 subtests - Refactored existing reader/writer client tests to use explicit `SASLMechanism` field for clarity ### Documentation - Updated config reference in `docs/sources/shared/configuration.md` with the new `sasl_mechanism` parameter - Added upgrade note in `docs/sources/setup/upgrade/_index.md` explaining the new parameter, default behavior, and use cases - Added troubleshooting guidance in `docs/sources/operations/troubleshooting/troubleshoot-operations.md` for `UNSUPPORTED_SASL_MECHANISM` errors ### Text Consistency - Updated flag help text in `pkg/kafka/config.go` to remove outdated \"PLAIN-only\" wording - Updated generated docs to match the new, mechanism-agnostic descriptions ## Special notes for your reviewer 1. **Backward Compatibility**: The default value is `PLAIN`, preserving full backward compatibility. No action is required for existing deployments. 2. **Testing**: All tests follow table-driven patterns with explicit mechanism values. SCRAM tests create fresh clusters per mechanism to isolate setup. 3. **Vendor**: The `scram` sub-package was already available transitively; only needed to copy it into vendor and update `modules.txt`. 4. **TDD**: Implementation follows TDD: failing tests → production code → all tests pass. ## Checklist - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide - [x] Documentation added (config reference, upgrade guide, troubleshooting) - [x] Tests updated (config validation + reader/writer SCRAM authentication) - [x] Title follows conventional commits format: `feat(kafka): ...` - [x] Upgrade guide updated: `docs/sources/setup/upgrade/_index.md` - [x] No deprecated/deleted config changes required --- > [!NOTE] > **Medium Risk** > Touches Kafka authentication and client initialization; while default remains `PLAIN`, misconfiguration or vendor/mechanism selection issues could prevent Loki components from connecting to Kafka at startup. > > **Overview** > Adds a new Kafka config/flag `sasl_mechanism` to select SASL auth (`PLAIN` default, `SCRAM-SHA-256`, `SCRAM-SHA-512`), including validation that rejects unsupported values. > > Updates Kafka client option wiring to negotiate SCRAM when selected (in `commonKafkaClientOptions`), and extends tests to cover SCRAM end-to-end for reader/writer clients and the partition `ReaderService`. > > Documentation is updated with the new parameter, an upgrade note, and troubleshooting guidance for `UNSUPPORTED_SASL_MECHANISM`; the franz-go SCRAM SASL implementation is vendored and `vendor/modules.txt` updated accordingly. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 345367966f93875e7afc080aa03de3615a325eb6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot). ", "url": "https://github.com/grafana/loki/pull/21719", "createdAt": "2026-04-28T02:12:27Z", "updatedAt": "2026-08-12T16:51:01Z", "timestamp": "2026-08-12T16:51:01Z", "metrics": { "reactions": 1, "comments": 0 }, "labels": [ "size/L", "kafka" ], "author": "titaneric", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:fd75237a42f334c3dc29", "signalId": "github:grafana/loki:pull_request:23929", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23929", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Fix flaky test TestTCPErrs", "text": "This test was failing occasionally in CI due to racing wall-clock timers. In this PR I propose that we stop mocking out an http server and instead mock out the http transport to return the error that would've been returned by the error case. We could also have tweaked the numbers to make it less likely for timers to trigger in the wrong order - I'd be happy to change to that approach if that's what people prefer. Another approach I tried was using testing/synctest, but wasn't able to get it working because then the timer would trigger at exactly the deadline and we'd end up in the wrong branch here https://github.com/golang/go/blob/go1.26.5/src/net/http/client.go#L372 because of the strict inequality. In reality we'd wave up slightly after the deadline rather than exactly at that moment. Flaky test failure I've seen in CI: ``` === FAIL: pkg/storage/chunk/client/gcp TestTCPErrs/transport_connect_timeout_exceeded,_retryable (0.04s) gcs_object_client_test.go:232: Error Trace: /__w/loki/loki/release/pkg/storage/chunk/client/gcp/gcs_object_client_test.go:232 Error: Not equal: expected: true actual : false Test: TestTCPErrs/transport_connect_timeout_exceeded,_retryable ``` **What this PR does / why we need it**: Fixes a flaky test. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23929", "createdAt": "2026-08-12T14:08:20Z", "updatedAt": "2026-08-12T16:33:55Z", "timestamp": "2026-08-12T16:33:55Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [], "author": "DanHopperGrafana", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:7ce9eff052d6e49e4a9a", "signalId": "github:grafana/loki:pull_request:23928", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23928", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(loki): Fix flaky test", "text": "**What this PR does / why we need it**: TestTCPErrs was failing from time to time because its outcome depends on what timeout happens first. I remove the dependency on time from the test.", "url": "https://github.com/grafana/loki/pull/23928", "createdAt": "2026-08-12T12:51:16Z", "updatedAt": "2026-08-12T16:33:40Z", "timestamp": "2026-08-12T16:33:40Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "ivkalita", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:74c687f608b1ccd26792", "signalId": "github:grafana/loki:pull_request:23663", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23663", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat: Introduce tsdb.shipper.index-reader-mode feature flag", "text": "- Default mode is mmap (existing implementation) - New mode is stream - New mode is not yet implemented - it delegates all calls to mmap implementation. - Extract Reader interface, renaming existing implementation to ByteSliceReader and adding new StreamReader. - This is a PR that doesn't do much because it's a lot of plumbing! **What this PR does / why we need it**: First step of migrating away from mmap. Mmap can be problematic for the operational stability of index gateways. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23663", "createdAt": "2026-07-30T13:37:39Z", "updatedAt": "2026-08-12T16:11:15Z", "timestamp": "2026-08-12T16:11:15Z", "metrics": { "reactions": 0, "comments": 3 }, "labels": [ "type/docs" ], "author": "DanHopperGrafana", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:8a0e6a987841dca708c8", "signalId": "github:grafana/loki:pull_request:23914", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23914", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Wire up a separate logsobj builder config", "text": "**What this PR does / why we need it**: Wires up a separate configuration for logsobj vs indexobj so we don't need to use the same for both. From experience, these are similar but we use smaller page sizes on index objects I updated the defaults against the latest recommendations. This ends up wiring all the way through multiple layers so there a lot of small changes in many files.", "url": "https://github.com/grafana/loki/pull/23914", "createdAt": "2026-08-11T16:03:36Z", "updatedAt": "2026-08-12T15:52:49Z", "timestamp": "2026-08-12T15:52:49Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "benclive", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:29482ec68d6917f42c2d", "signalId": "github:grafana/loki:pull_request:23913", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23913", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Run index merge phase multiple times per log merge phase", "text": "**What this PR does / why we need it**: This runs 3x index compactions for every log merge we do. Each merge reduces Runs by K, but each log merge increases it again by K * (The K can be different for index & log merge, but in reality they are in the same ballpark) This means index-compaction doesn't make progress if it flip-flops 1-1. This PR improves that behaviour by running 3x index merges to reduce index runs by K^3 per each log-merge. This is enough to converge the index files to a single Run in most environments.", "url": "https://github.com/grafana/loki/pull/23913", "createdAt": "2026-08-11T15:13:17Z", "updatedAt": "2026-08-12T15:52:45Z", "timestamp": "2026-08-12T15:52:45Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "benclive", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:94f80e1c439268a0bdb5", "signalId": "github:grafana/loki:pull_request:23910", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23910", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore: Treat objects as runs in compaction planning", "text": "**What this PR does / why we need it**: This updates compaction planning to treat objects are pre-existing indivisible runs when planning. * It isn't possible to consistently re-detect Runs from just looking at the sections, which meant that the planning phase tends to move data around rather than compact it. Said differently, without this change, compaction does not converge because it constantly shuffles data from overlapping objects around instead of consistently minimising it.", "url": "https://github.com/grafana/loki/pull/23910", "createdAt": "2026-08-11T11:06:29Z", "updatedAt": "2026-08-12T15:52:43Z", "timestamp": "2026-08-12T15:52:43Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "benclive", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:47d118a4899d8d137a8e", "signalId": "github:grafana/loki:issue:20673", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:issue:20673", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Replace `go.uber.go/atomic` with Go standard library `sync/atomic`", "text": "## Summary We currently have a linter rule that blocks usage of `sync/atomic` and forces us to use `go.uber.go/atomic` instead. This rule was originally added because `sync/atomic` required atomic operations on primitive types, which was considered error-prone. However, since **Go 1.19**, the standard library `sync/atomic` package now includes typed wrappers (e.g., `atomic.Uint32`, `atomic.Int64`, `atomic.Bool`, etc.) that provide the same safety guarantees as `go.uber.go/atomic`. This makes the uber package redundant. ## Context Prometheus is also making this transition: - Issue: https://github.com/prometheus/prometheus/issues/14866 - PR: https://github.com/prometheus/prometheus/pull/18009 ## Proposed Changes 1. **Remove the linter rule** that blocks `sync/atomic` 2. **Migrate all `go.uber.go/atomic` usage** to the standard library `sync/atomic` typed wrappers 3. **Configure a linter rule** to block the old-style atomic functions that operate on primitive types (e.g., `atomic.AddInt64`, `atomic.LoadUint32`) to ensure we only use the new typed wrappers and avoid accidental misuse This approach gives us: - Fewer external dependencies - Alignment with the broader Go ecosystem - Same safety guarantees we had with uber/atomic ## References - Go 1.19 release notes on atomic types: https://tip.golang.org/doc/go1.19#atomic_types - `sync/atomic` package docs: https://pkg.go.dev/sync/atomic", "url": "https://github.com/grafana/loki/issues/20673", "createdAt": "2026-02-04T12:44:57Z", "updatedAt": "2026-08-12T15:39:16Z", "timestamp": "2026-08-12T15:39:16Z", "metrics": { "reactions": 0, "comments": 5 }, "labels": [ "good first issue" ], "author": "Segflow", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:fd4890fb56240a2a0a3e", "signalId": "github:grafana/loki:pull_request:23921", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23921", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(iter): Fix error handling and resource leaks in chained sample and entry iterators", "text": "**What this PR does / why we need it**: Fixes three related bugs in `pkg/iter`'s chaining iterators where a failing or drained sub-iterator was silently dropped instead of being surfaced or closed: 1. `nonOverlappingIterator`/`nonOverlappingSampleIterator.Next()` advanced past a sub-iterator that failed with a real read error instead of stopping, and `Err()` only ever reflected the last-visited sub-iterator. Once iteration finished normally, the earlier error was gone: the query completed successfully but silently dropped all data from the point of failure onward. These iterators sit under both the ingester read path (per in-memory chunk) and the querier read path (per stored chunk), both funneling through `MemChunk`'s block-level iterator, which returns real errors on decompression failures and corrupt/truncated block data — exactly what a corrupted or truncated chunk raises in production. `Next()` now stops and surfaces the error through `Err()`; `Close()` closes every remaining sub-iterator and aggregates their close errors instead of discarding them. 2. Some sub-iterators (e.g. the chunk block iterator) return their stored read error from `Close` too, as a fallback for callers that only check the `Close` return value. Without accounting for that, fix (1) reported the same failure a second time as a spurious close error. `Close` now skips it once the read error already surfaced through `Err`. 3. `mergeSampleIterator`/`sortSampleIterator` dropped fully-drained sources from the heap without closing them, and `Close` returned on the first sub-iterator close error, so any source drained during iteration, or left over after an early stop, was never closed. A source whose `Close` releases resources (e.g. the data-object reader releasing its object cache and folding read bytes into query stats) leaked, and its stats were lost. **Which issue(s) this PR fixes**: **Special notes for your reviewer**: (1) and (2) apply the same fix to both `pkg/iter/entry_iterator.go` and `pkg/iter/sample_iterator.go` — the entry and sample iterator types are structurally identical. (3) only affects the sample-iterator side (`mergeSampleIterator`/`sortSampleIterator`); their entry-iterator equivalents were not part of this change. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23921", "createdAt": "2026-08-12T10:07:35Z", "updatedAt": "2026-08-12T15:36:46Z", "timestamp": "2026-08-12T15:36:46Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:d22ef48c561d25f00abd", "signalId": "github:grafana/loki:pull_request:23916", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23916", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "chore(deps): Update github.com/go-openapi/analysis (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-openapi/analysis](https://redirect.github.com/go-openapi/analysis) | `v0.25.5` → `v0.26.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-openapi%2fanalysis/v0.26.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-openapi%2fanalysis/v0.25.5/v0.26.0?slim=true) | | [github.com/go-openapi/validate](https://redirect.github.com/go-openapi/validate) | `v0.26.1` → `v0.26.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-openapi%2fvalidate/v0.26.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-openapi%2fvalidate/v0.26.1/v0.26.3?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
go-openapi/analysis (github.com/go-openapi/analysis) ### [`v0.26.0`](https://redirect.github.com/go-openapi/analysis/releases/tag/v0.26.0) [Compare Source](https://redirect.github.com/go-openapi/analysis/compare/v0.25.5...v0.26.0) #### [0.26.0](https://redirect.github.com/go-openapi/analysis/tree/v0.26.0) - 2026-08-08 **Full Changelog**: 7 commits in this release. *** ##### Implemented enhancements - feat: expose where each $ref is declared by [@​fredbi](https://redirect.github.com/fredbi) in [#​228](https://redirect.github.com/go-openapi/analysis/pull/228) [...](https://redirect.github.com/go-openapi/analysis/commit/d5b5620f90cc98bae2513cc21254f0220010c345) ##### Documentation - doc: updated contributors file by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​226](https://redirect.github.com/go-openapi/analysis/pull/226) [...](https://redirect.github.com/go-openapi/analysis/commit/e16df1ef0a6d5600111cb7b22c5cea5ca67f1c85) ##### Miscellaneous tasks - chore: prepare release v0.26.0 by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​229](https://redirect.github.com/go-openapi/analysis/pull/229) [...](https://redirect.github.com/go-openapi/analysis/commit/9e6d165cb9d8e606ccb80a039b5b6845871ad941) ##### Updates - chore(deps): Bump the development-dependencies group with 10 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​227](https://redirect.github.com/go-openapi/analysis/pull/227) [...](https://redirect.github.com/go-openapi/analysis/commit/53c5d6bcb220bebf70746704483632bfc1ae662b) - chore(deps): Bump the go-openapi-dependencies group with 3 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​225](https://redirect.github.com/go-openapi/analysis/pull/225) [...](https://redirect.github.com/go-openapi/analysis/commit/0c72b289a3582fc4957e2691cd1561b265d23fd8) - chore(deps): Bump the development-dependencies group across 1 directory with 11 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​224](https://redirect.github.com/go-openapi/analysis/pull/224) [...](https://redirect.github.com/go-openapi/analysis/commit/7cd64af8687e75f365e6a5f3471edbb419302ffd) - chore(deps): Bump the go-openapi-dependencies group with 2 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​223](https://redirect.github.com/go-openapi/analysis/pull/223) [...](https://redirect.github.com/go-openapi/analysis/commit/578bf0a62523f1671001808dd9504cbcdbc93054) *** ##### People who contributed to this release - [@​fredbi](https://redirect.github.com/fredbi) *** **[analysis](https://redirect.github.com/go-openapi/analysis) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-openapi/analysis/?tab=Apache-2.0-1-ov-file#readme ### Per-module changes *** #### internal/testintegration (0.26.0) ##### Miscellaneous tasks - chore: prepare release v0.26.0 by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​229](https://redirect.github.com/go-openapi/analysis/pull/229) [...](https://redirect.github.com/go-openapi/analysis/commit/9e6d165cb9d8e606ccb80a039b5b6845871ad941) ##### Updates - chore(deps): Bump the go-openapi-dependencies group with 3 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​225](https://redirect.github.com/go-openapi/analysis/pull/225) [...](https://redirect.github.com/go-openapi/analysis/commit/0c72b289a3582fc4957e2691cd1561b265d23fd8) - chore(deps): Bump the go-openapi-dependencies group with 2 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​223](https://redirect.github.com/go-openapi/analysis/pull/223) [...](https://redirect.github.com/go-openapi/analysis/commit/578bf0a62523f1671001808dd9504cbcdbc93054)
go-openapi/validate (github.com/go-openapi/validate) ### [`v0.26.3`](https://redirect.github.com/go-openapi/validate/releases/tag/v0.26.3) [Compare Source](https://redirect.github.com/go-openapi/validate/compare/v0.26.2...v0.26.3) #### [0.26.3](https://redirect.github.com/go-openapi/validate/tree/v0.26.3) - 2026-08-09 **Full Changelog**: 8 commits in this release. *** ##### Implemented enhancements - feat: check required entries of nested schemas, not only of a definition by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/7cdf3d90d2de2f47f95abc3af706fe33aae5e2f0) ##### Fixed bugs - fix: report the same findings, in the same order, on every run by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/78c71e928bd0c23e10fa6bcdec3d4fd641dfd016) - refact: recycle objects through swag/pools by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/65f13f3563ce1a72ec76d3d477eb8323993cfe94) ##### Miscellaneous tasks - ci: enable poolsdebug on separate test lane by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/2bf3c27ce032479d022c1d577581afe435755e9d) - fix: point every finding at a node the document contains by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/62ecb2e8ac32732666c26ab28457c441c9b7fd74) - ci: disabled the parallel pool testing on windows and darwin by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/5540162954ab2ee3d72364e95f1dbbf89462f7b9) ##### Other (technical) - Fix/pointer gaps by [@​fredbi](https://redirect.github.com/fredbi) in [#​281](https://redirect.github.com/go-openapi/validate/pull/281) [...](https://redirect.github.com/go-openapi/validate/commit/39098ef86786d960cd85b24baf09bff2bd88ebc1) - refact: recycle objects through swag/pools by [@​fredbi](https://redirect.github.com/fredbi) in [#​280](https://redirect.github.com/go-openapi/validate/pull/280) [...](https://redirect.github.com/go-openapi/validate/commit/02b8f946d49b339c3ee48f292546b8c7976d0e89) *** ##### People who contributed to this release - [@​fredbi](https://redirect.github.com/fredbi) *** **[validate](https://redirect.github.com/go-openapi/validate) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-openapi/validate/?tab=Apache-2.0-1-ov-file#readme ### [`v0.26.2`](https://redirect.github.com/go-openapi/validate/releases/tag/v0.26.2) [Compare Source](https://redirect.github.com/go-openapi/validate/compare/v0.26.1...v0.26.2) #### [0.26.2](https://redirect.github.com/go-openapi/validate/tree/v0.26.2) - 2026-08-09 **Full Changelog**: 15 commits in this release. *** ##### Implemented enhancements - feat: point required-property findings at the offending entry by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/9b2c7461cb94da6f1bda614f62b9f13fa7a5f77c) - feat: locate the $ref diagnostics in the document by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/97d6cca06030c5b1c2d1dda639fb8fcf04598aa7) - feat: report the JSON pointer of each validation error by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/4c5522394dc866bc2a9c1ecb977a21cd1fc9e8f8) ##### Fixed bugs - fix: locate parameters by the index the document addresses them at by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/8512f1a7b9caa472272e8f8e822e9fa15d3b3621) ##### Documentation - doc: updated contributors file by [@​bot-go-openapi\\[bot\\]](https://redirect.github.com/bot-go-openapi\\[bot]) in [#​277](https://redirect.github.com/go-openapi/validate/pull/277) [...](https://redirect.github.com/go-openapi/validate/commit/3d392443e20f2737ab74af7ccee01beff87b77fb) ##### Miscellaneous tasks - fix: point at nodes a document actually contains by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/db684105efecf5aca7b7daac5e4935217cb531c1) - refact: take $ref locations from the analyzer by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/324f4345c102032addf35796823840f6a8ed62a0) - fix: do not read $ref declarations out of default values by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/db6c34d8e374c08928b75c55141878aee789322e) - fix: correct the locations reported by validation errors by [@​fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-openapi/validate/commit/ffd33821234fdd4eff41ace357388a0aab73ed07) - tests: make schema fixtures deterministic by [@​HNO3Miracle](https://redirect.github.com/HNO3Miracle) in [#​273](https://redirect.github.com/go-openapi/validate/pull/273) [...](https://redirect.github.com/go-openapi/validate/commit/7e0ebfa099ab64dacef32ebd6a7a97e93734f71d) ##### Updates - chore(deps): bump the development-dependencies group with 9 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​278](https://redirect.github.com/go-openapi/validate/pull/278) [...](https://redirect.github.com/go-openapi/validate/commit/502a33439000c8143b49cccb60b4294266aa372f) - chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 in the other-dependencies group across 1 directory by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​276](https://redirect.github.com/go-openapi/validate/pull/276) [...](https://redirect.github.com/go-openapi/validate/commit/af06d7e6d68691ffb93ef15942bf68376cd73fe7) - chore(deps): bump the go-openapi-dependencies group with 5 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​275](https://redirect.github.com/go-openapi/validate/pull/275) [...](https://redirect.github.com/go-openapi/validate/commit/8322d28d1459ff0bcdd97ed2941485650f24b3b1) - chore(deps): bump the development-dependencies group with 9 updates by [@​dependabot\\[bot\\]](https://redirect.github.com/dependabot\\[bot]) in [#​274](https://redirect.github.com/go-openapi/validate/pull/274) [...](https://redirect.github.com/go-openapi/validate/commit/770313b9776e26d14eb2031148516bb394fa77a1) ##### Other (technical) - Fix/error location as jsonpointer by [@​fredbi](https://redirect.github.com/fredbi) in [#​279](https://redirect.github.com/go-openapi/validate/pull/279) [...](https://redirect.github.com/go-openapi/validate/commit/83d7d4e7f01228c53f2d6d5b6aec3c965cadd9b3) *** ##### People who contributed to this release - [@​HNO3Miracle](https://redirect.github.com/HNO3Miracle) - [@​fredbi](https://redirect.github.com/fredbi) *** ##### New Contributors - [@​HNO3Miracle](https://redirect.github.com/HNO3Miracle) made their first contribution in [#​273](https://redirect.github.com/go-openapi/validate/pull/273) *** **[validate](https://redirect.github.com/go-openapi/validate) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-openapi/validate/?tab=Apache-2.0-1-ov-file#readme
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23916", "createdAt": "2026-08-11T21:09:19Z", "updatedAt": "2026-08-12T15:09:48Z", "timestamp": "2026-08-12T15:09:48Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-patch", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:8ef87d75b263d878f913", "signalId": "github:grafana/loki:pull_request:23923", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23923", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat: Update Loki / Write Resources dashboard", "text": "**What this PR does / why we need it**: This pull request updates the `Loki / Write Resources` dashboard. \"Screenshot \"Screenshot \"Screenshot

The optional **Cortex Gateway (Internal)** row is hidden if there are no series with `container=\"cortex-gw-internal\"`. **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [ ] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23923", "createdAt": "2026-08-12T10:44:31Z", "updatedAt": "2026-08-12T14:21:01Z", "timestamp": "2026-08-12T14:21:01Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "area/helm" ], "author": "grobinson-grafana", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:1b4d79f91631f1f6b397", "signalId": "github:grafana/loki:pull_request:23943", "event": "discovered", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23943", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(chunkenc): Stop counting filtered-out lines in post_filter_lines", "text": "**What this PR does / why we need it**: `post_filter_lines` reports how many lines matched a query's filters — that is how it is documented at `docs/sources/operations/meta-monitoring/_index.md:96`. Two of the three sample paths incremented it *before* asking the extractor, so a filtered metric query reported every line it read and looked as though its filter matched everything. `sampleBufferedIterator` is the path that serves stored chunks, so that is what most queries reported. This moves the call after the extractor check in `headBlock.SampleIterator` and `sampleBufferedIterator.Next`. All six call sites now count a line only once the pipeline or the extractor accepts it, matching the three log paths and `unorderedHeadBlock.SampleIterator`, which were already correct. The docs needed no change: the code was violating them. Confirmed against `5b16c0be7d^` that all four sites counted after the check before the `variants()` work moved two of them ahead of it. **Which issue(s) this PR fixes**: Item 7 of grafana/loki-private#2750. It does not close it — see the note on the v2 engine below. **Special notes for your reviewer**: **What the statistic now means, precisely.** A single bool carries every reason the extractor declines a line, so `post_filter_lines` counts lines that *produced a sample*. Measured, not assumed: | query over the same 4 lines | `post_filter_lines` | |---|---| | `count_over_time({app=\"foo\"} \\| json [5m])` | 4 — a line that failed to parse still counts, because the pipeline records `__error__` and carries on | | `sum_over_time({app=\"foo\"} \\| json \\| unwrap latency [5m])` | 2 — lines with no `latency` label do not count, even though no filter excluded them | The second row is a narrowing for `unwrap` queries versus what the compressed path reported before. It is the semantic `unorderedHeadBlock.SampleIterator` has always had, and the chunk iterator cannot distinguish \"filter rejected\" from \"no unwrap label\" because `Process` returns one bool. `TestPostFilterLinesCountsLinesThatProducedSamples` pins both rows so the choice is explicit rather than accidental. **Two things deliberately left out of scope:** - **The v2/dataobj engine still over-reports.** `Summary.TotalPostFilterLines` also sums `Dataobj.PostFilterRows`, set at `pkg/engine/engine.go:368` under an existing `// TODO: this will report the wrong value if the plan has a filter stage`. So dataobj-backed queries are unchanged by this PR, and a split range hitting both engines sums two semantics. - **`headBlock.SampleIterator` still has no per-entry time filter** (`memchunk.go:1348`) where its log counterpart does (`:1279`), so it counts matching lines outside the query range that the time-ranged wrapper later discards. That is a missing time filter rather than a misplaced counter, and fixing it would move `AddHeadChunkBytes`/`AddHeadChunkLines` too. Reachability is near-zero: ordered head blocks exist only for chunk format below v3, which no schema produces — so the production fix here is `memchunk.go:1812`, and `:1355` is effectively test-only. **The counter in `unorderedHeadBlock.SampleIterator` also moved**, from the end of the callback to immediately after its own check. Provably a no-op — nothing between the two positions returns — but having all six sites read alike stops a later early return from silently skipping it. **`AddPostFilterLines` now has a doc comment.** This is the durable part of the fix: the bug was not a logic error, it was two call sites reading an undocumented counter. **On testing.** Nothing anywhere asserted a non-zero `post_filter_lines` before this PR, which is why the bug survived. The new `TestPostFilterLinesCountsMatchingLinesOnly` runs a log query and an equivalent metric query over the same data and requires they agree, across all four chunk/head-block pairings and both the head-block and cut-block paths. It fails on the unfixed code with `expected: 3, actual: 10`, and each path is independently guarded — breaking any one of the six call sites fails a specific, identifiable pair of subtests. It also asserts `total_lines`, so the read-versus-kept ratio is pinned; that ratio collapsing to 1.0 is what the bug looked like. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23943", "createdAt": "2026-08-13T16:12:28Z", "updatedAt": "2026-08-13T16:12:33Z", "timestamp": "2026-08-13T16:12:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "new" } }, { "id": "event:42bced98c001b05ffd83", "signalId": "github:grafana/loki:pull_request:23909", "event": "changed", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [ "updatedAt" ], "signal": { "id": "github:grafana/loki:pull_request:23909", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "test(logql): Run logqltest scripts through query-frontend and query-scheduler", "text": "**What this PR does / why we need it**: Runs every `.logqltest` correctness script through three execution stacks and compares the results: - `direct` — the v1 engine over the chunk store - `query-frontend + query-scheduler (no sharding)` - `query-frontend + query-scheduler (sharding)` All three run end-to-end over real gRPC, so query sharding and the frontend/scheduler roundtrip are covered, not just the direct engine. Also addressed: - **`skip values-comparison on \"\"` directive.** Some stacks return values that legitimately differ. The clearest case is sharded `quantile_over_time`, whose DDSketch is approximate and diverges from the exact interpolated quantile on small sample sets. The directive skips only the float value check for the named stack, while still asserting series count, sample count, and timestamps. Every other stack stays exact, so we spot real regressions without pinning an approximate value. - **avg_over_time grouping scenarios** (logfmt and json), exercising the sharded-denominator fix. - **Script epoch moved to 2026**, fixing a sub-second range-vector-duration misparse: the query-range codec sends timestamps as bare integer nanoseconds, and values with 10 or fewer digits were read as Unix seconds. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: N/A **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23909", "createdAt": "2026-08-11T11:02:21Z", "updatedAt": "2026-08-13T15:55:42Z", "timestamp": "2026-08-13T15:55:42Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:19b843b3557be22f9720", "signalId": "github:grafana/loki:pull_request:23942", "event": "discovered", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23942", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(logql): Avoid data race in sharded avg_over_time grouping", "text": "**What this PR does / why we need it**: Sharded `avg_over_time(...) by (...)` decomposes into `sum_over_time() / count_over_time()`, and the two legs are evaluated concurrently. Both `newVectorAggEvaluator` and `RangeAggregationExpr.extractor` sorted `Grouping.Groups` in place, and the two legs can share the same backing array, so `go test -race` flags a data race on that slice. This PR sorts a private copy in both places instead of mutating the AST node, and documents on `Grouping` that `Groups` must not be mutated in place, since it can be shared across concurrently evaluated expressions. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: This is a data race, that I've found while working on logqltest and locally running them with `-race` (CI still doesn't run tests with `-race`). **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23942", "createdAt": "2026-08-13T15:47:21Z", "updatedAt": "2026-08-13T15:52:36Z", "timestamp": "2026-08-13T15:52:36Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "new" } }, { "id": "event:f783d0fc6ceb914698c1", "signalId": "github:grafana/loki:pull_request:23934", "event": "changed", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [ "updatedAt", "labels", "state" ], "signal": { "id": "github:grafana/loki:pull_request:23934", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "docs: Add Apache APISIX to third-party clients 🤖🤖🤖", "text": "**What this PR does / why we need it**: Adds Apache APISIX `loki-logger` to the third-party clients list. The existing APISIX plugin sends batched request and response logs to Loki through the Loki HTTP push API, and the link points to the official APISIX plugin documentation. **Which issue(s) this PR fixes**: None. **Special notes for your reviewer**: This is a one-line documentation-only change. The contribution was prepared with automated assistance and is submitted through Loki's agent review path. **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [x] Tests updated (not applicable; documentation-only change) - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [x] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` (not applicable) - [x] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15) (not applicable)", "url": "https://github.com/grafana/loki/pull/23934", "createdAt": "2026-08-13T03:35:15Z", "updatedAt": "2026-08-13T15:49:34Z", "timestamp": "2026-08-13T15:49:34Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "type/docs" ], "author": "Yilialinn", "state": "closed", "assignees": [], "change": "updated" } }, { "id": "event:c7b427e559efe89ed2a7", "signalId": "github:grafana/loki:pull_request:23941", "event": "discovered", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23941", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module google.golang.org/protobuf to v1.36.12 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/protobuf](https://go.googlesource.com/protobuf) | `v1.36.12-0.20260120151049-f2248ac996af` → `v1.36.12` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.36.12?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.36.12-0.20260120151049-f2248ac996af/v1.36.12?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23941", "createdAt": "2026-08-13T15:09:29Z", "updatedAt": "2026-08-13T15:26:56Z", "timestamp": "2026-08-13T15:26:56Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-patch" ], "author": "renovate-sh-app[bot]", "state": "closed", "assignees": [], "change": "new" } }, { "id": "event:dc5ed9a517ccdffcfc4d", "signalId": "github:grafana/loki:pull_request:23932", "event": "changed", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [ "updatedAt" ], "signal": { "id": "github:grafana/loki:pull_request:23932", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "feat(indexgateway): Add admission control to bound concurrent requests", "text": "## Summary The index gateway has no bound on concurrent request execution: in-flight requests pile up until the process locks up and can no longer schedule readiness probes or error responses. This PR ports the admission-control mechanism Mimir runs on its store-gateway, using the same dskit building blocks: at most N requests execute at once, excess requests park in a FIFO queue, and requests that wait longer than a timeout are rejected with a retryable gRPC `Unavailable` that the existing gateway client already handles by failing over to the next replica. Disabled by default (`-index-gateway.max-concurrent=0`); recommended starting values are documented (`200` / `5s`, Mimir's production defaults).", "url": "https://github.com/grafana/loki/pull/23932", "createdAt": "2026-08-12T22:40:42Z", "updatedAt": "2026-08-13T15:16:13Z", "timestamp": "2026-08-13T15:16:13Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [ "type/docs" ], "author": "trevorwhitney", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:98938da9f5597fb336ba", "signalId": "github:grafana/loki:issue:23439", "event": "changed", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [ "text", "updatedAt" ], "signal": { "id": "github:grafana/loki:issue:23439", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Dependency Dashboard", "text": "> ℹ️ **Note** > > This PR body was truncated due to platform limits. This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - ⚠️ WARN: GitHub failure: secondary rate limit - ⚠️ WARN: Package lookup failures - ⚠️ WARN: Error updating branch: update failure ## Abandoned Dependencies The following dependencies have not received updates for an extended period and may be unmaintained.
View abandoned dependencies (173) > [!NOTE] Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity. > | Datasource | Package | Last Updated | |------------|------|-------------| | bundler | [fluent-plugin-multi-format-parser](https://redirect.github.com/repeatedly/fluent-plugin-multi-format-parser) | `2023-11-29` | | gomod | [github.com/DmitriyVTitov/size](https://redirect.github.com/DmitriyVTitov/size) | `2022-04-11` | | gomod | [github.com/MasslessParticle/azure-storage-blob-go](https://redirect.github.com/MasslessParticle/azure-storage-blob-go) | `2021-07-02` | | gomod | [github.com/Masterminds/goutils](https://redirect.github.com/Masterminds/goutils) | `2021-02-04` | | gomod | [github.com/NYTimes/gziphandler](https://redirect.github.com/NYTimes/gziphandler) | `2019-02-21` | | gomod | [github.com/ViaQ/logerr/v2](https://redirect.github.com/ViaQ/logerr) | `2022-06-10` | | gomod | [github.com/alecthomas/kingpin/v2](https://redirect.github.com/alecthomas/kingpin) | `2023-09-30` | | gomod | [github.com/aliyun/aliyun-oss-go-sdk](https://redirect.github.com/aliyun/aliyun-oss-go-sdk) | `2023-12-28` | | gomod | [github.com/antlr4-go/antlr/v4](https://redirect.github.com/antlr4-go/antlr) | `2024-05-15` | | gomod | [github.com/atotto/clipboard](https://redirect.github.com/atotto/clipboard) | `2021-02-24` | | gomod | [github.com/bboreham/go-loser](https://redirect.github.com/bboreham/go-loser) | `2023-09-20` | | gomod | [github.com/beorn7/perks](https://redirect.github.com/beorn7/perks) | `2019-07-31` | | gomod | [github.com/blang/semver/v4](https://redirect.github.com/blang/semver) | `2020-05-24` | | gomod | [github.com/c2h5oh/datasize](https://redirect.github.com/c2h5oh/datasize) | `2023-12-15` | | gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` | | gomod | [github.com/containerd/fifo](https://redirect.github.com/containerd/fifo) | `2023-02-17` | | gomod | [github.com/containerd/log](https://redirect.github.com/containerd/log) | `2023-09-09` | | gomod | [github.com/coreos/go-semver](https://redirect.github.com/coreos/go-semver) | `2023-01-16` | | gomod | [github.com/coreos/go-systemd](https://redirect.github.com/coreos/go-systemd) | `2019-11-04` | | gomod | [github.com/cristalhq/hedgedhttp](https://redirect.github.com/cristalhq/hedgedhttp) | `2023-09-15` | | gomod | [github.com/d4l3k/messagediff](https://redirect.github.com/d4l3k/messagediff) | `2017-08-07` | | gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` | | gomod | [github.com/dennwc/varint](https://redirect.github.com/dennwc/varint) | `2019-06-16` | | gomod | [github.com/dgryski/go-rendezvous](https://redirect.github.com/dgryski/go-rendezvous) | `2020-08-23` | | gomod | [github.com/distribution/reference](https://redirect.github.com/distribution/reference) | `2024-03-20` | | gomod | [github.com/docker/go-metrics](https://redirect.github.com/docker/go-metrics) | `2019-08-28` | | gomod | [github.com/docker/go-plugins-helpers](https://redirect.github.com/docker/go-plugins-helpers) | `2024-07-01` | | gomod | [github.com/docker/go-units](https://redirect.github.com/docker/go-units) | `2022-05-17` | | gomod | [github.com/dolthub/maphash](https://redirect.github.com/dolthub/maphash) | `2023-04-03` | | gomod | [github.com/dolthub/swiss](https://redirect.github.com/dolthub/swiss) | `2023-08-28` | | gomod | [github.com/drone/envsubst](https://redirect.github.com/drone/envsubst) | `2021-06-16` | | gomod | [github.com/dustin/go-humanize](https://redirect.github.com/dustin/go-humanize) | `2023-01-10` | | gomod | [github.com/facette/natsort](https://redirect.github.com/facette/natsort) | `2018-12-10` | | gomod | [github.com/go-kit/log](https://redirect.github.com/go-kit/log) | `2022-04-27` | | gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-14` | | gomod | [github.com/go-ole/go-ole](https://redirect.github.com/go-ole/go-ole) | `2023-08-04` | | gomod | [github.com/go-playground/locales](https://redirect.github.com/go-playground/locales) | `2023-01-05` | | gomod | [github.com/go-playground/universal-translator](https://redirect.github.com/go-playground/universal-translator) | `2023-01-30` | | gomod | [github.com/gobwas/glob](https://redirect.github.com/gobwas/glob) | `2018-02-08` | | gomod | [github.com/gogo/googleapis](https://redirect.github.com/gogo/googleapis) | `2021-03-10` | | gomod | [github.com/gogo/protobuf](https://redirect.github.com/gogo/protobuf) | `2021-01-10` | | gomod | [github.com/gogo/status](https://redirect.github.com/gogo/status) | `2022-04-23` | | gomod | [github.com/golang/protobuf](https://redirect.github.com/golang/protobuf) | `2024-03-06` | | gomod | [github.com/golang/snappy](https://redirect.github.com/golang/snappy) | `2023-12-25` | | gomod | [github.com/google/gofuzz](https://redirect.github.com/google/gofuzz) | `2020-08-04` | | gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` | | gomod | [github.com/gorilla/mux](https://redirect.github.com/gorilla/mux) | `2023-10-18` | | gomod | [github.com/gorilla/websocket](https://redirect.github.com/gorilla/websocket) | `2024-06-14` | | gomod | [github.com/grafana/memberlist](https://redirect.github.com/grafana/memberlist) | `2021-11-12` | | gomod | [github.com/hashicorp/errwrap](https://redirect.github.com/hashicorp/errwrap) | `2020-07-14` | | gomod | [github.com/hashicorp/go-cleanhttp](https://redirect.github.com/hashicorp/go-cleanhttp) | `2021-02-03` | | gomod | [github.com/hashicorp/go-hclog](https://redirect.github.com/hashicorp/go-hclog) | `2024-04-01` | | gomod | [github.com/hashicorp/go-immutable-radix](https://redirect.github.com/hashicorp/go-immutable-radix) | `2023-11-21` | | gomod | [github.com/hashicorp/go-multierror](https://redirect.github.com/hashicorp/go-multierror) | `2021-03-11` | | gomod | [github.com/hashicorp/go-rootcerts](https://redirect.github.com/hashicorp/go-rootcerts) | `2019-12-10` | | gomod | [github.com/hashicorp/golang-lru](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-21` | | gomod | [github.com/hashicorp/golang-lru/v2](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-21` | | gomod | [github.com/huandu/xstrings](https://redirect.github.com/huandu/xstrings) | `2024-06-06` | | gomod | [github.com/inconshreveable/mousetrap](https://redirect.github.com/inconshreveable/mousetrap) | `2022-11-27` | | gomod | [github.com/influxdata/tdigest](https://redirect.github.com/influxdata/tdigest) | `2019-10-30` | | gomod | [github.com/jmespath/go-jmespath](https://redirect.github.com/jmespath/go-jmespath) | `2020-09-18` | | gomod | [github.com/joshdk/go-junit](https://redirect.github.com/joshdk/go-junit) | `2021-02-26` | | gomod | [github.com/jpillora/backoff](https://redirect.github.com/jpillora/backoff) | `2019-10-03` | | gomod | [github.com/json-iterator/go](https://redirect.github.com/json-iterator/go) | `2021-09-11` | | gomod | [github.com/klauspost/pgzip](https://redirect.github.com/klauspost/pgzip) | `2022-09-30` | | gomod | [github.com/kylelemons/godebug](https://redirect.github.com/kylelemons/godebug) | `2019-05-05` | | gomod | [github.com/mattn/go-ieproxy](https://redirect.github.com/mattn/go-ieproxy) | `2024-05-22` | | gomod | [github.com/mfridman/interpolate](https://redirect.github.com/mfridman/interpolate) | `2023-12-22` | | gomod | [github.com/minio/md5-simd](https://redirect.github.com/minio/md5-simd) | `2021-01-07` | | gomod | [github.com/mitchellh/colorstring](https://redirect.github.com/mitchellh/colorstring) | `2019-02-13` | | gomod | [github.com/mitchellh/copystructure](https://redirect.github.com/mitchellh/copystructure) | `2021-05-05` | | gomod | [github.com/mitchellh/go-homedir](https://redirect.github.com/mitchellh/go-homedir) | `2019-01-27` | | gomod | [github.com/mitchellh/go-wordwrap](https://redirect.github.com/mitchellh/go-wordwrap) | `2020-09-25` | | gomod | [github.com/mitchellh/mapstructure](https://redirect.github.com/mitchellh/mapstructure) | `2022-04-20` | | gomod | [github.com/mitchellh/reflectwalk](https://redirect.github.com/mitchellh/reflectwalk) | `2021-05-03` | | gomod | [github.com/moby/docker-image-spec](https://redirect.github.com/moby/docker-image-spec) | `2024-02-09` | | gomod | [github.com/modern-go/concurrent](https://redirect.github.com/modern-go/concurrent) | `2018-03-06` | | gomod | [github.com/modern-go/reflect2](https://redirect.github.com/modern-go/reflect2) | `2021-09-11` | | gomod | [github.com/muesli/cancelreader](https://redirect.github.com/muesli/cancelreader) | `2022-06-22` | | gomod | [github.com/munnerz/goautoneg](https://redirect.github.com/munnerz/goautoneg) | `2019-10-10` | | gomod | [github.com/mwitkow/go-conntrack](https://redirect.github.com/mwitkow/go-conntrack) | `2019-07-16` | | gomod | [github.com/opencontainers/go-digest](https://redirect.github.com/opencontainers/go-digest) | `2020-05-14` | | gomod | [github.com/opentracing/opentracing-go](https://redirect.github.com/opentracing/opentracing-go) | `2020-07-01` | | gomod | [github.com/pkg/browser](https://redirect.github.com/pkg/browser) | `2024-01-02` | | gomod | [github.com/pkg/errors](https://redirect.github.com/pkg/errors) | `2020-01-14` | | gomod | [github.com/planetscale/vtprotobuf](https://redirect.github.com/planetscale/vtprotobuf) | `2024-01-29` | | gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` | | gomod | [github.com/remyoudompheng/bigfft](https://redirect.github.com/remyoudompheng/bigfft) | `2023-01-29` | | gomod | [github.com/richardartoul/molecule](https://redirect.github.com/richardartoul/molecule) | `2021-12-17` | | gomod | [github.com/rivo/uniseg](https://redirect.github.com/rivo/uniseg) | `2024-02-08` | | gomod | [github.com/sean-/seed](https://redirect.github.com/sean-/seed) | `2017-03-13` | | gomod | [github.com/segmentio/fasthash](https://redirect.github.com/segmentio/fasthash) | `2020-05-27` | | gomod | [github.com/shopspring/decimal](https://redirect.github.com/shopspring/decimal) | `2024-04-12` | | gomod | [github.com/uber/jaeger-client-go](https://redirect.github.com/uber/jaeger-client-go) | `2021-12-07` | | gomod | [github.com/uber/jaeger-lib](https://redirect.github.com/uber/jaeger-lib) | `2021-03-29` | | gomod | [github.com/x448/float16](https://redirect.github.com/x448/float16) | `2020-01-17` | | gomod | [github.com/xhit/go-str2duration/v2](https://redirect.github.com/xhit/go-str2duration) | `2022-12-07` | | gomod | [github.com/yusufpapurcu/wmi](https://redirect.github.com/yusufpapurcu/wmi) | `2024-01-28` | | gomod | [github.com/zeebo/assert](https://redirect.github.com/zeebo/assert) | `2022-07-21` | | gomod | [go.opentelemetry.io/otel/exporters/jaeger](https://redirect.github.com/open-telemetry/opentelemetry-go) | `2023-08-28` | | gomod | [go.uber.org/atomic](https://redirect.github.com/uber-go/atomic) | `2023-05-03` | | gomod | [go.uber.org/goleak](https://redirect.github.com/uber-go/goleak) | `2023-10-24` | | gomod | [go.uber.org/multierr](https://redirect.github.com/uber-go/multierr) | `2023-03-29` | | gomod | [go4.org/netipx](https://redirect.github.com/go4org/netipx) | `2023-11-29` | | gomod | [gopkg.in/inf.v0](https://redirect.github.com/go-inf/inf) | `2018-03-26` | | gomod | [gopkg.in/yaml.v2](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` | | gomod | [gopkg.in/yaml.v3](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` | | gomod | [gotest.tools](https://redirect.github.com/gotestyourself/gotest.tools) | `2018-11-11` |
## Errored The following updates encountered an error and will be retried. To force a retry now, click on a checkbox below. - [ ] chore(deps): Pin dependencies (main) (`actions/checkout`, `actions/setup-go`, `apache/kafka`, `confluentinc/cp-kafka`, `confluentinc/cp-zookeeper`, `fluent/fluentd`, `gcr.io/distroless/base-nossl`, `gcr.io/distroless/static`, `github.com/grafana/grafonnet-lib/grafonnet`, `github.com/grafana/jsonnet-libs/consul`, `github.com/grafana/jsonnet-libs/enterprise-metrics`, `github.com/grafana/jsonnet-libs/grafana`, `github.com/grafana/jsonnet-libs/grafana-builder`, `github.com/grafana/jsonnet-libs/jaeger-agent-mixin`, `github.com/grafana/jsonnet-libs/ksonnet-util`, `github.com/grafana/jsonnet-libs/memcached`, `github.com/grafana/jsonnet-libs/mixin-utils`, `github.com/grafana/jsonnet-libs/tanka-util`, `github.com/grafana/loki/production/ksonnet/loki`, `github.com/grafana/loki/production/loki-mixin`, `github.com/grafana/mimir/operations/mimir-mixin`, `github.com/jsonnet-libs/k8s-libsonnet/1.18`, `github.com/jsonnet-libs/k8s-libsonnet/1.20`, `github.com/prometheus-operator/kube-prometheus/jsonnet/kube-prometheus/lib`, `golang`, `golangci/golangci-lint`, `grafana/alloy`, `grafana/docs-base`, `grafana/grafana`, `grafana/grafana-enterprise`, `grafana/loki`, `grafana/promtail`, `grafana/security-github-actions`, `grafana/writers-toolkit`, `hashicorp/consul`, `helm`, `mingrammer/flog`, `minio/minio`, `nginx`, `nixpkgs`, `nixpkgs-unstable`, `pgsty/mc`, `pgsty/minio`, `prom/prometheus`, `provectuslabs/kafka-ui`, `theperiklis/log-generator`, `theperiklis/loki`, `wurstmeister/kafka`, `wurstmeister/zookeeper`) ## PR Edited (Blocked) The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below. - [ ] [fix(security/UNKNOWN/operator/api/loki): Update module golang.org/x/net to v0.56.0 [SECURITY] (main)](../pull/23146) - [ ] [fix(security/UNKNOWN/operator/api/loki): Update module golang.org/x/text to v0.39.0 [SECURITY] (main)](../pull/23390) - [ ] [chore(deps): Update operator/website/themes/doks digest to 4370737 (main)](../pull/23731) ## Pending Status Checks The following updates await pending status checks. To force their creation now, click on a checkbox below. - [ ] chore(deps): Update github.com/charmbracelet/ultraviolet digest to 68fa937 (main) - [ ] chore(deps): Update golang.org/x/exp digest to 3d80eb7 (main) - [ ] [chore(deps): Update google.golang.org/genproto digest to ec0a776 (main)](../pull/22963) - [ ] [chore(deps): Update google.golang.org/genproto/googleapis/api digest to ec0a776 (main)](../pull/23804) - [ ] fix(deps): Update github.com/prometheus/client_golang/exp digest to 0c5dccd (main) - [ ] [fix(deps): Update github.com/twmb/franz-go/pkg/kfake digest to c7ff005 (main)](../pull/22534) - [ ] [fix(deps): Update google.golang.org/genproto/googleapis/rpc digest to ec0a776 (main)](../pull/23805) - [ ] chore(deps): Update cachix/install-nix-action action to v31.11.1 (main) - [ ] chore(deps): Update dependency github.com/grafana/loki/production/loki-mixin to v3.7.6 (main) - [ ] chore(deps): Update module github.com/charmbracelet/x/ansi to v0.11.8 (main) - [ ] chore(deps): Update module github.com/containerd/containerd/v2 to v2.3.4 (main) - [ ] chore(deps): Update module github.com/googleapis/enterprise-certificate-proxy to v0.3.21 (main) - [ ] chore(deps): Update module github.com/parquet-go/bitpack to v1.0.1 (main) - [ ] fix(deps): Update module charm.land/lipgloss/v2 to v2.0.6 (main) - [ ] chore(deps): Update logstash Docker tag to v9.5.1 (main) - [ ] chore(deps): Update module github.com/moby/sys/userns to v0.2.0 (main) - [ ] chore(deps): Update module golang.org/x/mod to v0.39.0 (main) - [ ] fix(deps): Update module github.com/Azure/azure-sdk-for-go/sdk/azcore to v1.23.0 (main) - [ ] fix(deps): Update module github.com/parquet-go/parquet-go to v0.32.0 (main) - [ ] fix(deps): Update module golang.org/x/crypto to v0.55.0 (main) - [ ] fix(deps): Update module golang.org/x/net to v0.58.0 (main) - [ ] fix(deps): Update module golang.org/x/text to v0.41.0 (main) - [ ] fix(deps): Update module google.golang.org/api to v0.293.0 (main) - [ ] chore(deps): Update module github.com/xo/terminfo to v1 (main) - [ ] chore(deps): Update nix to nixos-26.05 (main) --- > [!WARNING] > Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package anthropics/claude-code-action)`, `Could not determine new digest for update (github-tags package golangci/golangci-lint-action)`, `Could not determine new digest for update (github-tags package grafana/shared-workflows)`, `Failed to look up go package github.com/aws/aws-sdk-go-v2/service/sts: no-result`. > > Files affected: `.github/workflows/claude-code-review.yml`, `.github/workflows/claude.yml`, `.github/workflows/operator.yaml`, `.github/workflows/relyance.yml`, `go.mod` --- ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [fix(security/UNKNOWN/operator): Update go toolchain directive to v1.26.5 [SECURITY] (main)](../pull/23128) - [ ] [chore(deps): Update actions/checkout digest to d23441a (main)](../pull/23363) - [ ] [chore(deps): Update github.com/grafana/objstore digest to ec72e5a (main)](../pull/23741) - [ ] [chore(deps): Update github.com/Microsoft/go-winio digest to 7561016 (main)](../pull/22789) - [ ] [chore(deps): Update github.com/planetscale/vtprotobuf digest to 8ae5a48 (main)](../pull/22919) - [ ] [chore(deps): Update golang:1.26.5 Docker digest to 705e964 (main)](../pull/23762) - [ ] [chore(deps): Update logstash:9.4.4 Docker digest to bdb7d35 (main)](../pull/23757) - [ ] [chore(deps): Update ruby:4.0.6 Docker digest to c400c1e (main)](../pull/23763) - [ ] [fix(deps): Update github.com/prometheus/prometheus digest to 3c82a95 (main)](../pull/23627) - [ ] [chore(deps): Update dependency helm to v4.2.3 (main)](../pull/23240) - [ ] [chore(deps): Update Helm release rollout-operator to v0.50.1 (main)](../pull/23342) - [ ] [chore(deps): Update module github.com/knadh/koanf/maps to v0.1.3 (main)](../pull/23931) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/samplers/jaegerremote to v0.37.2 (main)](../pull/23842) - [ ] [fix(deps): Update module github.com/tjhop/slog-gokit to v0.2.2 (main)](../pull/23397) - [ ] [fix(deps): Update module github.com/twmb/franz-go to v1.21.5 (main)](../pull/22714) - [ ] [fix(deps): Update module google.golang.org/protobuf to v1.36.12 (main)](../pull/23941) - [ ] [chore(deps): Update github.com/go-openapi/analysis (main)](../pull/23916) (`github.com/go-openapi/analysis`, `github.com/go-openapi/validate`) - [ ] [chore(deps): Update golangci/golangci-lint-action action to v9.3.0 (main)](../pull/22916) - [ ] [chore(deps): Update module github.com/armon/go-metrics to v0.6.1 (main)](../pull/22586) - [ ] [chore(deps): Update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 (main)](../pull/23856) - [ ] [chore(deps): Update module go.etcd.io/etcd/api/v3 to v3.7.1 (main)](../pull/22574) - [ ] [chore(deps): Update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 (main)](../pull/22575) - [ ] [chore(deps): Update module go.etcd.io/etcd/client/v3 to v3.7.1 (main)](../pull/23000) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/bridges/prometheus to v0.70.0 (main)](../pull/23846) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/detectors/gcp to v1.45.0 (main)](../pull/23847) - [ ] [chore(deps): Update module go.opentelemetry.io/contrib/exporters/autoexport to v0.70.0 (main)](../pull/23848) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 (main)](../pull/23810) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.21.0 (main)](../pull/23811) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc to v1.45.0 (main)](../pull/23812) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.45.0 (main)](../pull/23814) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 (main)](../pull/23815) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 (main)](../pull/23816) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 (main)](../pull/23817) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/prometheus to v0.67.0 (main)](../pull/23818) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdoutlog to v0.21.0 (main)](../pull/23819) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdoutmetric to v1.45.0 (main)](../pull/23820) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/exporters/stdout/stdouttrace to v1.45.0 (main)](../pull/23826) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/log to v0.21.0 (main)](../pull/23827) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/sdk/log to v0.21.0 (main)](../pull/23830) - [ ] [chore(deps): Update module go.opentelemetry.io/otel/sdk/metric to v1.45.0 (main)](../pull/23831) - [ ] [chore(deps): Update module modernc.org/libc to v1.75.3 (main)](../pull/23868) - [ ] [chore(deps): Update Terraform google to v7.43.0 (main)](../pull/22967) - [ ] [fix(deps): Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 (main)](../pull/23870) - [ ] [fix(deps): Update module github.com/IBM/ibm-cos-sdk-go to v1.15.0 (main)](../pull/23792) - [ ] [fix(deps): Update module github.com/redis/go-redis/v9 to v9.22.0 (main)](../pull/23806) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.70.0 (main)](../pull/23850) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.70.0 (main)](../pull/23851) - [ ] [fix(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.70.0 (main)](../pull/23852) - [ ] [fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.45.0 (main)](../pull/23853) - [ ] [chore(deps): Update actions/checkout action to v7 (main)](../pull/22485) - [ ] [chore(deps): Update actions/labeler action to v7 (main)](../pull/23375) - [ ] [chore(deps): Update actions/setup-go action to v7 (main)](../pull/23344) - [ ] [chore(deps): Update module github.com/cenkalti/backoff/v5 to v7 (main)](../pull/22683) - [ ] [chore(deps): Update module github.com/hashicorp/consul/api to v2 (main)](../pull/22684) - [ ] [chore(deps): Update module github.com/hashicorp/go-immutable-radix to v2 (main)](../pull/22686) - [ ] [chore(deps): Update module github.com/hashicorp/golang-lru to v2 (main)](../pull/22687) - [ ] [chore(deps): Update module github.com/ncw/swift to v2 (main)](../pull/22688) - [ ] [chore(deps): Update module go.yaml.in/yaml/v2 to v3 (main)](../pull/23677) - [ ] [chore(deps): Update module gopkg.in/yaml.v2 to v3 (main)](../pull/22823) - [ ] [chore(deps): Update module modernc.org/libc to v2 (main)](../pull/22695) - [ ] [fix(deps): Update module github.com/twmb/franz-go/pkg/kmsg to v2 (main)](../pull/23871) - [ ] [fix(deps): Lock file maintenance (main)](../pull/23351) - [ ] [fix(security/UNKNOWN/pkg/push): Update module golang.org/x/net to v0.56.0 [SECURITY] (release-3.7.x)](../pull/23422) - [ ] [fix(security/UNKNOWN/pkg/push): Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x)](../pull/23423) - [ ] [fix(security/UNKNOWN/pkg/push): Update module google.golang.org/grpc to v1.82.1 [SECURITY] (release-3.7.x)](../pull/23416) - [ ] **Click on this checkbox to rebase all open PRs at once** ## Vulnerabilities > [!IMPORTANT] > `18`/`20` CVEs have Renovate fixes.
gomod
go.mod
golang.org/x/crypto
- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
operator/api/loki/go.mod
golang.org/x/net
- [GHSA-5cv4-jp36-h3mw](https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw) (fixed in >= 0.55.0) - [GHSA-qxp5-gwg8-xv66](https://osv.dev/vulnerability/GHSA-qxp5-gwg8-xv66) (fixed in >= 0.36.0) - [GHSA-vvgc-356p-c3xw](https://osv.dev/vulnerability/GHSA-vvgc-356p-c3xw) (fixed in >= 0.38.0) - [GO-2025-3503](https://osv.dev/vulnerability/GO-2025-3503) (fixed in >= 0.36.0) - [GO-2025-3595](https://osv.dev/vulnerability/GO-2025-3595) (fixed in >= 0.38.0) - [GO-2026-4440](https://osv.dev/vulnerability/GO-2026-4440) (fixed in >= 0.45.0) - [GO-2026-4441](https://osv.dev/vulnerability/GO-2026-4441) (fixed in >= 0.45.0) - [GO-2026-4918](https://osv.dev/vulnerability/GO-2026-4918) (fixed in >= 0.53.0) - [GO-2026-5025](https://osv.dev/vulnerability/GO-2026-5025) (fixed in >= 0.55.0) - [GO-2026-5026](https://osv.dev/vulnerability/GO-2026-5026) (fixed in >= 0.55.0) - [GO-2026-5027](https://osv.dev/vulnerability/GO-2026-5027) (fixed in >= 0.55.0) - [GO-2026-5028](https://osv.dev/vulnerability/GO-2026-5028) (fixed in >= 0.55.0) - [GO-2026-5029](https://osv.dev/vulnerability/GO-2026-5029) (fixed in >= 0.55.0) - [GO-2026-5030](https://osv.dev/vulnerability/GO-2026-5030) (fixed in >= 0.55.0) - [GO-2026-5942](https://osv.dev/vulnerability/GO-2026-5942) (fixed in >= 0.56.0)
golang.org/x/text
- [GO-2026-5970](https://osv.dev/vulnerability/GO-2026-5970) (fixed in >= 0.39.0)
operator/go.mod
go
- [GO-2026-4970](https://osv.dev/vulnerability/GO-2026-4970) (fixed in >= 1.26.5) - [GO-2026-5856](https://osv.dev/vulnerability/GO-2026-5856) (fixed in >= 1.26.5)
golang.org/x/crypto
- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated
bundler (3)
clients/cmd/fluentd/docker/Gemfile (2) - `fluentd '1.19.3'` - `fluent-plugin-multi-format-parser '~>1.1.0'`
clients/cmd/fluentd/Gemfile
clients/cmd/logstash/Gemfile (1) - `webmock \"~> 3.8\"`
devcontainer (1)
.devcontainer/devcontainer.json (1) - `grafana/loki-build-image 0.35.2`
docker-compose (15)
clients/cmd/docker-driver/docker-compose.yaml (1) - `grafana/grafana unknown version` → [Updates: `undefined`]
clients/cmd/fluentd/docker/docker-compose.yml (1) - `fluent/fluent-bit 5.1@sha256:bf09d620b6b45c080b4da86ac5d98fd3739c1213a148f93dec884fdcc64084cb`
cmd/logql-analyzer/docker-compose.yaml (1) - `grafana/docs-base latest` → [Updates: `latest`]
debug/docker-compose.yaml (3) - `grafana/loki-debug latest` - `grafana/promtail-debug latest` - `grafana/grafana master` → [Updates: `master`]
examples/getting-started/docker-compose.yaml (8) - `grafana/loki latest` → [Updates: `latest`] - `grafana/loki latest` → [Updates: `latest`] - `grafana/alloy latest` → [Updates: `latest`] - `minio/minio unknown version` → [Updates: `undefined`] - `grafana/grafana latest` → [Updates: `latest`] - `grafana/loki latest` → [Updates: `latest`] - `nginx latest` → [Updates: `latest`] - `mingrammer/flog unknown version` → [Updates: `undefined`]
examples/ha-monolithic/docker-compose.yaml (4) - `pgsty/minio latest` → [Updates: `latest`] - `pgsty/mc latest` → [Updates: `latest`] - `nginx alpine` → [Updates: `alpine`] - `grafana/loki 3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952`
production/docker/docker-compose.yaml (8) - `grafana/grafana 13.1.3@sha256:ab5cb380e3ff3172d6c8bd2e7cfd31cce977d2881b260e1f5bc089bf0b759b43` - `prom/prometheus v3.13.2@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69` - `mingrammer/flog unknown version` → [Updates: `undefined`] - `grafana/promtail latest` → [Updates: `latest`] - `minio/minio unknown version` → [Updates: `undefined`] - `nginx latest` → [Updates: `latest`] - `prom/alertmanager v0.33.1@sha256:9e082985f56f4c8c9f724e18f2288c6708f472e56a5286b8863d080434ea065d` - `grafana/loki 3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952`
tools/dev/kafka/docker-compose.yaml (5) - `grafana/grafana-enterprise latest` → [Updates: `latest`] - `prom/prometheus latest` → [Updates: `latest`] - `provectuslabs/kafka-ui latest` → [Updates: `latest`] - `apache/kafka latest` → [Updates: `latest`] - `theperiklis/log-generator latest` → [Updates: `latest`]
tools/dev/loki-tsdb-storage-s3/docker-compose.yml (7) - `hashicorp/consul unknown version` → [Updates: `undefined`] - `minio/minio RELEASE.2024-02-24T17-11-14Z` → [Updates: `RELEASE.2024-02-24T17-11-14Z`] - `memcached 1.6.45-alpine@sha256:c29847751abb41f4c268c84fb3087fee05d4edcbda44409ccb5086e26148e8a7` - `jaegertracing/all-in-one 1.76.0@sha256:ab6f1a1f0fb49ea08bcd19f6b84f6081d0d44b364b6de148e1798eb5816bacac` - `grafana/grafana unknown version` → [Updates: `undefined`] - `mingrammer/flog unknown version` → [Updates: `undefined`] - `mingrammer/flog unknown version` → [Updates: `undefined`]
tools/kafka/plain/docker-compose.yml (2) - `wurstmeister/zookeeper unknown version` → [Updates: `undefined`] - `wurstmeister/kafka unknown version` → [Updates: `undefined`]
tools/kafka/sasl-plain/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/sasl-scram/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/sasl-ssl/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/kafka/ssl/docker-compose.yml (2) - `confluentinc/cp-zookeeper latest` → [Updates: `latest`] - `confluentinc/cp-kafka latest` → [Updates: `latest`]
tools/stream-generator/docker-compose.yaml (3) - `provectuslabs/kafka-ui latest` → [Updates: `latest`] - `apache/kafka latest` → [Updates: `latest`] - `theperiklis/loki feat-usage-tracker-293aed8` → [Updates: `feat-usage-tracker-293aed8`]
dockerfile (21)
clients/cmd/docker-driver/Dockerfile (2) - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
clients/cmd/fluent-bit/Dockerfile (2) - `golang 1.26.5-bookworm` → [Updates: `1.26.5-bookworm`] - `fluent/fluent-bit 5.1.0@sha256:bf09d620b6b45c080b4da86ac5d98fd3739c1213a148f93dec884fdcc64084cb`
clients/cmd/fluentd/Dockerfile (2) - `ruby 4.0.6@sha256:d9a5d26be31a40fb043069f816ba39139c1f38758aea530341eb7e2c153e4ab4` → [Updates: `4.0.6`] - `fluent/fluentd v1.19-debian-1` → [Updates: `v1.19-debian-1`]
clients/cmd/logstash/Dockerfile (1) - `logstash 9.4.4@sha256:7bf793131b910ce62b4683ae6dc304c15b6981688c38b50e953ce931bfa2c6cf` → [Updates: `9.5.1`, `9.4.4`]
cmd/logcli/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/logql-analyzer/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki-canary-boringcrypto/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/base-nossl debug` → [Updates: `debug`]
cmd/loki-canary/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki-canary/Dockerfile.cross (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/loki/Dockerfile (3) - `golang 1.26` → [Updates: `1.26`] - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
cmd/loki/Dockerfile.cross (3) - `golang 1.26` → [Updates: `1.26`] - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
cmd/loki/Dockerfile.debug (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/base-nossl debug` → [Updates: `debug`]
cmd/migrate/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
cmd/querytee/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
loki-build-image/Dockerfile
operator/calculator.Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
operator/Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
operator/passthrough-gateway.Dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot` → [Updates: `nonroot`]
production/helm/loki/src/helm-test/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
tools/dev/loki-tsdb-storage-s3/dev.dockerfile (2) - `golang 1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647` → [Updates: `1.26.5`] - `alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
tools/stream-generator/Dockerfile (2) - `golang 1.26` → [Updates: `1.26`] - `gcr.io/distroless/static debug` → [Updates: `debug`]
git-submodules (1)
.gitmodules (1) - `operator/website/themes/doks 14fe597271d6efc7d77461798f22a6af068300d2` → [Updates: `undefined`]
github-actions (32)
.github/workflows/backport.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/build-loki-binary.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go ${{ env.GO_VERSION }}`
.github/workflows/claude-code-review.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `anthropics/claude-code-action 1.0@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4`
.github/workflows/claude.yml (2) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `anthropics/claude-code-action 1.0@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4`
.github/workflows/conventional-commits.yml (1) - `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50`
.github/workflows/deploy-pr-preview.yml (1) - `grafana/writers-toolkit main` → [Updates: `main`]
.github/workflows/govulncheck.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go ${{ env.GO_VERSION }}`
.github/workflows/helm-ci.yml (14) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97` - `helm/chart-testing-action v2.8.0@6ec842c01de15ebb84c8627d2744a0c2f2755c9f` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `fluxcd/flux2 v2.9.4@889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm v4.2.2` → [Updates: `v4.2.3`, `v4.2.2`] - `python 3.13` - `helm v4.2.2` → [Updates: `v4.2.3`, `v4.2.2`]
.github/workflows/helm-diff-ci.yml (5) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
.github/workflows/helm-release.yaml
.github/workflows/helm-tagged-release-pr.yaml (3) - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `peter-evans/create-pull-request v8@5f6978faf089d4d20b00c7766989d076bb2fc7f1`
.github/workflows/images.yml (5) - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/labeler.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/labeler v6.2.0@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d` → [Updates: `v7.0.0`]
.github/workflows/lint-jsonnet.yml (3) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `go 1.26.5`
.github/workflows/logql-bench.yml (9) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` - `go 1.26.5`
.github/workflows/logql-correctness.yml (9) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16` → [Updates: `v7.0.0`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` - `go 1.26.5`
.github/workflows/minor-release-pr.yml (49) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/nix-ci.yaml (4) - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `cachix/install-nix-action v31.11.0@630ae543ea3a38a9a4166f03376c02c50f408342` → [Updates: `v31.11.1`] - `actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v7`, `v6`] - `cachix/install-nix-action v31.11.0@630ae543ea3a38a9a4166f03376c02c50f408342` → [Updates: `v31.11.1`]
.github/workflows/operator-bundle.yaml (2) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`]
.github/workflows/operator-check-prepare-release-commit.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/operator-release-please.yml (4) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `googleapis/release-please-action v5.0.0@45996ed1f6d02564a971a2fa1b5860e934307cf7` - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`]
.github/workflows/operator-reusable-hub-release.yml (4) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `fjogeleit/yaml-update-action v0.17.0@dffe9a5223d84653c13374032382f6bb5de8e5ef`
.github/workflows/operator-reusable-image-build.yml (5) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a`
.github/workflows/operator-scorecard.yaml (3) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc`
.github/workflows/operator.yaml (12) - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `golangci/golangci-lint-action v9.2@1e7e51e771db61008b38414a730f564565cf7c20` → [Updates: `v9.3.0`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `actions/checkout v6` → [Updates: `v7`, `v6`] - `actions/setup-go v6` → [Updates: `v7`, `v6`] - `golangci/golangci-lint v2.12.2` → [Updates: `v2.12.2`]
.github/workflows/patch-release-pr.yml (49) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24` - `node 24`
.github/workflows/querytee-images.yml (4) - `actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803` → [Updates: `v7.0.1`] - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c`
.github/workflows/release.yml (9) - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/setup-node v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `actions/checkout v4` → [Updates: `v7`, `v4`] - `node 24`
.github/workflows/relyance.yml (2) - `actions/checkout v6.1.0@d23441a4 > ✂ **Note** > > PR body was truncated to here.", "url": "https://github.com/grafana/loki/issues/23439", "createdAt": "2026-07-23T03:41:50Z", "updatedAt": "2026-08-13T15:11:18Z", "timestamp": "2026-08-13T15:11:18Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:cb611451e2bf9e94bfd0", "signalId": "github:grafana/loki:pull_request:23627", "event": "changed", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [ "title", "text", "updatedAt" ], "signal": { "id": "github:grafana/loki:pull_request:23627", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update github.com/prometheus/prometheus digest to 3c82a95 (main)", "text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/prometheus/prometheus](https://redirect.github.com/prometheus/prometheus) | require | digest | `ab225f6` → `3c82a95` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23627", "createdAt": "2026-07-28T12:12:32Z", "updatedAt": "2026-08-13T15:08:37Z", "timestamp": "2026-08-13T15:08:37Z", "metrics": { "reactions": 0, "comments": 1 }, "labels": [ "dependencies" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:80bf0e27d13a4b00a8f9", "signalId": "github:grafana/loki:pull_request:23940", "event": "discovered", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23940", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(logql): Fix ip() line filter matching inside \"or\" chains", "text": "**What this PR does / why we need it**: `ip()` line filters combined with `or` (e.g. `|= ip(a) or ip(b)`) silently degraded to a literal substring/regex match on the raw pattern text instead of matching real addresses, because the `or` chain compiler ignored each filter node's `Op` field. Example: `{app=\"foo\"} |= ip(\"10.0.0.0/8\") or ip(\"192.168.0.0/16\")` never matched a line like `connection from 10.5.3.2 accepted`, even though `10.5.3.2` is inside `10.0.0.0/8`. It was actually compiled as \"line contains the literal text `10.0.0.0/8`\" OR \"line contains the literal text `192.168.0.0/16`\", which real log lines essentially never do. A related, independent bug in the same code path could also silently drop an operand from a chain of three or more `or` operands whenever `ip()` needed to continue the chain past the second position, since the parser attaches operands one at a time in that case and the old code overwrote any existing `Or` chain instead of appending to it. Example: `{app=\"foo\"} |= ip(\"10.0.0.0/8\") or ip(\"192.168.0.0/16\") or \"error\"` silently parsed (confirmed via `.String()`) as `ip(\"10.0.0.0/8\") or \"error\"` — the `ip(\"192.168.0.0/16\")` check vanished entirely, with no error. A line containing only a `192.168.0.0/16` address (no `10.x` address, no `\"error\"` text) would incorrectly fail to match. **Which issue(s) this PR fixes**: N/A **Special notes for your reviewer**: The new v2 query engine (`pkg/engine/internal/planner/logical/planner.go`) has an independent instance of the same class of bug — `convertLineFilter` never inspects `filter.Op`, so any `ip()` line filter routed there (with or without `or`) is silently compiled to a literal substring/regex match. Left out of this PR since it's a different engine/code path. **Checklist** - [ ] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23940", "createdAt": "2026-08-13T14:14:04Z", "updatedAt": "2026-08-13T14:29:13Z", "timestamp": "2026-08-13T14:29:13Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "pracucci", "state": "open", "assignees": [], "change": "new" } }, { "id": "event:3bb92ed960b583e86e11", "signalId": "github:grafana/loki:pull_request:23806", "event": "discovered", "observedAt": "2026-08-13T16:19:22.035158Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23806", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(deps): Update module github.com/redis/go-redis/v9 to v9.22.0 (main)", "text": "This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/redis/go-redis/v9](https://redirect.github.com/redis/go-redis) | `v9.21.0` → `v9.22.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fredis%2fgo-redis%2fv9/v9.22.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fredis%2fgo-redis%2fv9/v9.21.0/v9.22.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/23439) for more information. --- ### Release Notes
redis/go-redis (github.com/redis/go-redis/v9) ### [`v9.22.0`](https://redirect.github.com/redis/go-redis/releases/tag/v9.22.0): 9.22.0 [Compare Source](https://redirect.github.com/redis/go-redis/compare/v9.21.0...v9.22.0) This is a minor release introducing two flagship (experimental) features — **client-side caching** and **automatic pipelining** — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade. ⚠️ Two changes to be aware of when upgrading from 9.21.0: - **Default configuration values changed** ([#​3918](https://redirect.github.com/redis/go-redis/pull/3918)): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected. - **`WaitAOF` return type corrected** ([#​3888](https://redirect.github.com/redis/go-redis/pull/3888)): `WaitAOF` now returns `*IntSliceCmd`, matching the two-integer reply of `WAITAOF` (previously `*IntCmd`, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update. ##### 🚀 Highlights ##### Client-Side Caching (Experimental) The standalone `Client` gains server-assisted client-side caching built on RESP3 `CLIENT TRACKING`. Enable it by setting `ClientSideCacheConfig` in `Options` (or supply your own cache via `ClientSideCache` — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads. The invalidation architecture is selected by `ClientSideCacheStrategy`; the default (and currently only) strategy is `CSCStrategySharedTracking`: one shared cache, every pool connection runs plain `CLIENT TRACKING ON`, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (`Protocol: 3`), standalone client, DB 0 only; commands that would change the connection identity (`SELECT`, `AUTH`, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed `Username`/`Password` work and are namespaced). See the README's [client-side caching section](README.md#client-side-caching) and the runnable [example](example/client-side-caching). **Experimental:** the API may change in a minor release. ([#​3941](https://redirect.github.com/redis/go-redis/pull/3941)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) ##### Automatic Pipelining (Experimental) `AutoPipeliner` is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on `Client` and `ClusterClient` (and configurable via `Options.AutoPipelineOptions` / `UniversalOptions.AutoPipelineOptions`): - **`AutoPipeline()`** — the blocking face: a drop-in `Cmdable` where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: \\~1M+ SET/sec vs \\~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved. - **`AsyncAutoPipeline()`** — the deferred face: command calls return immediately and every typed result accessor (`Val`/`Result`/`Err`/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (\\~2–3M SET/sec locally; indicative). `AutoPipelineOptions` controls batching: `MaxBatchSize` (soft target, default 200; the blocking face's preset uses 300), `MaxBatchBytes` (approximate payload cap so huge values flush as several bounded writes), `MaxFlushDelay` with optional `AdaptiveDelay` (delay scales down as the queue fills), and `MaxConcurrentBatches` (default 1 = a single ordered batch stream; raising it requires `Unordered: true`, so ordering is never lost by accident — `Validate()` rejects the combination otherwise). A usage tour and throughput comparison live in [`example/autopipeline`](example/autopipeline). **Experimental:** the API may change in a future release — pin your go-redis version if you adopt it. ([#​3942](https://redirect.github.com/redis/go-redis/pull/3942)) by [@​ndyakov](https://redirect.github.com/ndyakov), with help from [@​cxljs](https://redirect.github.com/cxljs) ##### Redis 8.10 Support This release adds support for **Redis 8.10**. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the `redislabs/client-libs-test:8.10.0` image by default ([#​3920](https://redirect.github.com/redis/go-redis/pull/3920), [#​3940](https://redirect.github.com/redis/go-redis/pull/3940)). Coverage for the new commands and options that ship with Redis 8.10: - **`HIMPORT`** ([#​3919](https://redirect.github.com/redis/go-redis/pull/3919)) — bulk hash import via server-side fieldsets, exposed as `HImportPrepare`, `HImportSet`, `HImportDiscard`, and `HImportDiscardAll`. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the `PREPARE` on whichever pooled connection executes a `SET` that needs it, at most once per connection, with no extra round trip (the `PREPARE` is injected into the same write as the `SET`). - **`LMOVEM` / `BLMOVEM`** ([#​3913](https://redirect.github.com/redis/go-redis/pull/3913)) — move multiple elements between lists in one call. - **`SUNIONCARD` / `SDIFFCARD`** ([#​3897](https://redirect.github.com/redis/go-redis/pull/3897)) — cardinality of set union/difference without materializing the result. - **`XREAD` / `XREADGROUP` `MAXCOUNT` and `MAXSIZE`** ([#​3898](https://redirect.github.com/redis/go-redis/pull/3898)) — bound how much data a stream read returns. - **`TS.READ`** ([#​3896](https://redirect.github.com/redis/go-redis/pull/3896)), **`TS.QUERYLABELS`** ([#​3926](https://redirect.github.com/redis/go-redis/pull/3926)), **`TS.NRANGE` / `TS.NREVRANGE`** ([#​3870](https://redirect.github.com/redis/go-redis/pull/3870)) with multiple aggregators per key ([#​3937](https://redirect.github.com/redis/go-redis/pull/3937)), and **`EXCLUDEEMPTY`** on `TS.MRANGE` / `TS.MREVRANGE` ([#​3912](https://redirect.github.com/redis/go-redis/pull/3912)) — new time-series query surface. - **`FT.ALIASLIST`** ([#​3925](https://redirect.github.com/redis/go-redis/pull/3925)), **`COLLECT` reducer for `FT.AGGREGATE`** ([#​3886](https://redirect.github.com/redis/go-redis/pull/3886)), **`RERANK` on HNSW vector fields in `FT.CREATE`** ([#​3927](https://redirect.github.com/redis/go-redis/pull/3927)), and **`FT.HYBRID` timeout warnings** ([#​3911](https://redirect.github.com/redis/go-redis/pull/3911)) — search coverage. ##### Cross-SDK Aligned Defaults Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries ([#​3918](https://redirect.github.com/redis/go-redis/pull/3918)): | Setting | Old default | New default | | ------------------------------ | ----------- | --------------------------------------------------------- | | `ReadTimeout` / `WriteTimeout` | 3s | 5s | | Retry backoff (min/max) | 8ms / 512ms | 10ms / 1s | | Cluster state reload interval | 10s | 60s | | TCP keep-alive | 5min period | 30s idle / 5s interval / 3 probes (`net.KeepAliveConfig`) | Applications that set these values explicitly are unaffected; applications relying on the old defaults inherit the new ones. ##### Data-Race and Parser Hardening Sweep A systematic audit fixed data races across the client — hooks (`AddHook`, [#​3868](https://redirect.github.com/redis/go-redis/pull/3868)), `Ring.SetAddrs` ([#​3862](https://redirect.github.com/redis/go-redis/pull/3862)), cluster node slices ([#​3861](https://redirect.github.com/redis/go-redis/pull/3861)), pub/sub reconnect ([#​3906](https://redirect.github.com/redis/go-redis/pull/3906)), maintenance notifications ([#​3894](https://redirect.github.com/redis/go-redis/pull/3894), [#​3872](https://redirect.github.com/redis/go-redis/pull/3872)), pool handoff ([#​3876](https://redirect.github.com/redis/go-redis/pull/3876)), and `redisotel` ([#​3881](https://redirect.github.com/redis/go-redis/pull/3881)) — and hardened the RESP parsers against malformed or unexpected replies: over-reads on nil replies ([#​3874](https://redirect.github.com/redis/go-redis/pull/3874)), integer overflow when skipping map/attribute bodies ([#​3877](https://redirect.github.com/redis/go-redis/pull/3877)), unhashable RESP3 map keys ([#​3873](https://redirect.github.com/redis/go-redis/pull/3873)), odd-length flat replies ([#​3900](https://redirect.github.com/redis/go-redis/pull/3900)), mismatched declared array lengths ([#​3907](https://redirect.github.com/redis/go-redis/pull/3907)), unexpected extra reply frames ([#​3884](https://redirect.github.com/redis/go-redis/pull/3884)), and nil elements in numeric/bool slice replies ([#​3922](https://redirect.github.com/redis/go-redis/pull/3922)). ##### PubSub `Receive` Hang Fix `PeekPushNotificationName` blocked until 36 bytes were buffered, so a short subscribe confirmation (channel name of six or fewer characters) on an otherwise idle connection hung `PubSub.Receive` forever — a regression introduced in 9.20.1 by [#​3842](https://redirect.github.com/redis/go-redis/pull/3842). The peek now parses whatever is already buffered and only waits for one more byte when the frame prefix is valid but incomplete. Fixes [#​3935](https://redirect.github.com/redis/go-redis/issues/3935). ([#​3936](https://redirect.github.com/redis/go-redis/pull/3936)) by [@​ndyakov](https://redirect.github.com/ndyakov) ##### Correct Cluster Transaction Retries The cluster transaction pipeline treated a `MULTI`...`EXEC` block as independently retryable commands, which could scatter a transaction across nodes or send malformed transactions on retry. Redirects (`MOVED`/`ASK`/`TRYAGAIN`) and aborts are now handled at the whole-transaction level, matching Redis transaction semantics: the transaction is re-routed and retried as a unit, never partially ([#​3909](https://redirect.github.com/redis/go-redis/pull/3909)) by [@​cxljs](https://redirect.github.com/cxljs). ##### Credential Redaction in Command Tracing `rediscmd.AppendCmd` — used by `redisotel` and `rediscensus` to render commands into span attributes — now redacts credential arguments as ``: `AUTH`, `HELLO ... AUTH`, `CONFIG SET` of `requirepass` / `masterauth` / TLS key passphrases, `ACL SETUSER` password rules, and `MIGRATE ... AUTH`/`AUTH2`. The client sends `HELLO ... AUTH` on every handshake and `AUTH` on every streaming-credentials rotation through the regular hook chain, so tracing hooks previously captured credentials even when the application never issued an auth command itself ([#​3939](https://redirect.github.com/redis/go-redis/pull/3939)) by [@​saddamr3e](https://redirect.github.com/saddamr3e). ##### ✨ New Features - **Client-side caching**: server-assisted caching for the standalone client via `ClientSideCacheConfig` / `ClientSideCache`, with the `CSCStrategySharedTracking` invalidation strategy ([#​3941](https://redirect.github.com/redis/go-redis/pull/3941)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **Automatic pipelining**: `AutoPipeline()` (blocking) and `AsyncAutoPipeline()` (deferred results) on `Client` and `ClusterClient`, configured via `AutoPipelineOptions` ([#​3942](https://redirect.github.com/redis/go-redis/pull/3942)) by [@​ndyakov](https://redirect.github.com/ndyakov), with help from [@​cxljs](https://redirect.github.com/cxljs) - **`HIMPORT` command family**: `HImportPrepare` / `HImportSet` / `HImportDiscard` / `HImportDiscardAll` with lazy per-connection fieldset prepare replay ([#​3919](https://redirect.github.com/redis/go-redis/pull/3919)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`LMOVEM` / `BLMOVEM`**: move multiple list elements in one call, with `COUNT` (up to N) or `EXACTLY` (all-or-nothing) semantics via `LMoveMArgs` ([#​3913](https://redirect.github.com/redis/go-redis/pull/3913)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`SUnionCard` / `SDiffCard`**: cardinality of set union/difference ([#​3897](https://redirect.github.com/redis/go-redis/pull/3897)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`XRead` / `XReadGroup` `MAXCOUNT` / `MAXSIZE`**: bound stream read responses by entry count or payload size ([#​3898](https://redirect.github.com/redis/go-redis/pull/3898)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`TS.READ`**: read samples from a series starting at a given timestamp, with `TSReadEarliest` (`-`), `TSReadLatest` (`+`), and `TSReadNew` (`$`) sentinels ([#​3896](https://redirect.github.com/redis/go-redis/pull/3896)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`TS.QUERYLABELS`**: query label names/values across time series ([#​3926](https://redirect.github.com/redis/go-redis/pull/3926)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`TS.NRANGE` / `TS.NREVRANGE`**: range queries across multiple series ([#​3870](https://redirect.github.com/redis/go-redis/pull/3870)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa), with multiple aggregators per key ([#​3937](https://redirect.github.com/redis/go-redis/pull/3937)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`TS.MRANGE` / `TS.MREVRANGE` `EXCLUDEEMPTY`**: skip series with no samples in the result ([#​3912](https://redirect.github.com/redis/go-redis/pull/3912)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`FT.ALIASLIST`**: list all index aliases ([#​3925](https://redirect.github.com/redis/go-redis/pull/3925)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`FT.AGGREGATE` `COLLECT` reducer**: collect grouped values into an array ([#​3886](https://redirect.github.com/redis/go-redis/pull/3886)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`FT.CREATE` `RERANK`**: `RERANK` parameter on HNSW vector field definitions ([#​3927](https://redirect.github.com/redis/go-redis/pull/3927)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`FT.HYBRID` timeout warnings**: timeout warnings are now populated in hybrid search results ([#​3911](https://redirect.github.com/redis/go-redis/pull/3911)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa) - **`FT.HYBRID` KNN `SHARD_K_RATIO`** (Redis 8.8+): per-shard K ratio for KNN clauses ([#​3841](https://redirect.github.com/redis/go-redis/pull/3841)) by [@​ndyakov](https://redirect.github.com/ndyakov) ##### 🐛 Bug Fixes - **PubSub `Receive` hang**: peek push-notification names without demanding 36 buffered bytes, fixing a hang on short subscribe confirmations (fixes [#​3935](https://redirect.github.com/redis/go-redis/issues/3935), regression from 9.20.1) ([#​3936](https://redirect.github.com/redis/go-redis/pull/3936)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **Cluster transactions**: re-route the whole tx pipeline on redirect/abort instead of per-command ([#​3909](https://redirect.github.com/redis/go-redis/pull/3909)) by [@​cxljs](https://redirect.github.com/cxljs) - **Credential leak in traces**: `rediscmd.AppendCmd` redacts credential arguments (`AUTH`, `HELLO ... AUTH`, `CONFIG SET` secret params, `ACL SETUSER` password rules, `MIGRATE AUTH`/`AUTH2`), so `redisotel` / `rediscensus` span attributes no longer contain passwords ([#​3939](https://redirect.github.com/redis/go-redis/pull/3939)) by [@​saddamr3e](https://redirect.github.com/saddamr3e) - **`WaitAOF` return type**: returns `*IntSliceCmd` matching the two-integer `WAITAOF` reply ([#​3888](https://redirect.github.com/redis/go-redis/pull/3888)) by [@​CipherN9](https://redirect.github.com/CipherN9) - **`Ring.Publish` routing**: publish to the shard that owns the topic instead of a round-robined one ([#​3893](https://redirect.github.com/redis/go-redis/pull/3893)) by [@​dkindel](https://redirect.github.com/dkindel) - **Pool `OnRemove` hooks**: fire `OnRemove` on `putConn` eviction paths so removal hooks see every evicted connection ([#​3932](https://redirect.github.com/redis/go-redis/pull/3932)) by [@​cxljs](https://redirect.github.com/cxljs) - **`UniversalClient` `InfoMap`**: added `InfoMap` to the `Cmdable` interface ([#​3904](https://redirect.github.com/redis/go-redis/pull/3904)) by [@​nazarli-shabnam](https://redirect.github.com/nazarli-shabnam) - **`SlowLogGet` context**: pass the caller's context instead of a background one ([#​3915](https://redirect.github.com/redis/go-redis/pull/3915)) by [@​sonnemusk](https://redirect.github.com/sonnemusk) - **`ModuleLoadex` nil config**: return an error instead of panicking on nil config ([#​3916](https://redirect.github.com/redis/go-redis/pull/3916)) by [@​sonnemusk](https://redirect.github.com/sonnemusk) - **`ParseURL` IPv6 hosts**: keep single brackets for IPv6 hosts without a port ([#​3882](https://redirect.github.com/redis/go-redis/pull/3882)) by [@​sueun-dev](https://redirect.github.com/sueun-dev) - **`ParseURL` durations**: treat unit durations `<= 0` as disabled ([#​3866](https://redirect.github.com/redis/go-redis/pull/3866)) by [@​sueun-dev](https://redirect.github.com/sueun-dev) - **Nil `*uint8` encoding**: encode nil `*uint8` as `\"0\"` like other numeric pointers ([#​3869](https://redirect.github.com/redis/go-redis/pull/3869)) by [@​sueun-dev](https://redirect.github.com/sueun-dev) - **`JSONSliceCmd` read errors**: return the read error from `readReply` instead of swallowing it ([#​3903](https://redirect.github.com/redis/go-redis/pull/3903)) by [@​saddamr3e](https://redirect.github.com/saddamr3e) - **RESP parser hardening**: reconcile declared entry-array lengths ([#​3907](https://redirect.github.com/redis/go-redis/pull/3907)), handle nil elements in int/uint/bool slice parsers ([#​3922](https://redirect.github.com/redis/go-redis/pull/3922)), drain unexpected reply frames ([#​3884](https://redirect.github.com/redis/go-redis/pull/3884)), reject odd-length flat replies in Z/KeyValue parsers ([#​3900](https://redirect.github.com/redis/go-redis/pull/3900)), avoid int overflow when skipping map/attr bodies ([#​3877](https://redirect.github.com/redis/go-redis/pull/3877)), don't over-read nil replies in `Reader.Discard` ([#​3874](https://redirect.github.com/redis/go-redis/pull/3874)) by [@​saddamr3e](https://redirect.github.com/saddamr3e); reject unhashable keys in RESP3 map parsing ([#​3873](https://redirect.github.com/redis/go-redis/pull/3873)) by [@​iabdullah215](https://redirect.github.com/iabdullah215) - **Data races**: hook state during `AddHook` ([#​3868](https://redirect.github.com/redis/go-redis/pull/3868)), `onNewNode` during `Ring.SetAddrs` ([#​3862](https://redirect.github.com/redis/go-redis/pull/3862)), shared masters/slaves slices in cluster ([#​3861](https://redirect.github.com/redis/go-redis/pull/3861)), shared `opt.Addr` during pub/sub reconnect ([#​3906](https://redirect.github.com/redis/go-redis/pull/3906)), `clusterStateReloadCallback` in maintnotifications ([#​3894](https://redirect.github.com/redis/go-redis/pull/3894)), conn reader in `isHealthyConn` during handoff ([#​3876](https://redirect.github.com/redis/go-redis/pull/3876)) by [@​saddamr3e](https://redirect.github.com/saddamr3e); handoff race window in maintnotifications ([#​3872](https://redirect.github.com/redis/go-redis/pull/3872)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **`redisotel`**: use `ObservableCounter` for cumulative pool stats ([#​3914](https://redirect.github.com/redis/go-redis/pull/3914)) by [@​Solaris-star](https://redirect.github.com/Solaris-star); avoid a data race on shared attributes during `MinIdleConns` warmup ([#​3881](https://redirect.github.com/redis/go-redis/pull/3881)) by [@​ndyakov](https://redirect.github.com/ndyakov) ##### 🧰 Maintenance - **Cross-SDK default alignment**: new defaults for timeouts, retry backoff, cluster state reload, and TCP keep-alive ([#​3918](https://redirect.github.com/redis/go-redis/pull/3918)) by [@​ndyakov](https://redirect.github.com/ndyakov) - **CI on Redis 8.10**: 8.10 made the default test version ([#​3920](https://redirect.github.com/redis/go-redis/pull/3920)) with version gating by major.minor ([#​3908](https://redirect.github.com/redis/go-redis/pull/3908)) by [@​ofekshenawa](https://redirect.github.com/ofekshenawa); the test stack now runs the GA `redislabs/client-libs-test:8.10.0` image and 8.8 was dropped from the CI matrix ([#​3940](https://redirect.github.com/redis/go-redis/pull/3940)) - **Type-safe atomics**: use typed `sync/atomic` value types ([#​3860](https://redirect.github.com/redis/go-redis/pull/3860)) and remove the dead `assertUnstableCommand` RESP3 path ([#​3928](https://redirect.github.com/redis/go-redis/pull/3928)) by [@​cxljs](https://redirect.github.com/cxljs) - **Docs**: clarify that `ExpireTime` / `PExpireTime` return Unix timestamps ([#​3917](https://redirect.github.com/redis/go-redis/pull/3917)) by [@​sonnemusk](https://redirect.github.com/sonnemusk); remove a duplicate example step ([#​3875](https://redirect.github.com/redis/go-redis/pull/3875)) by [@​andy-stark-redis](https://redirect.github.com/andy-stark-redis) ##### 👥 Contributors We'd like to thank all the contributors who worked on this release! [@​andy-stark-redis](https://redirect.github.com/andy-stark-redis), [@​CipherN9](https://redirect.github.com/CipherN9), [@​cxljs](https://redirect.github.com/cxljs), [@​dkindel](https://redirect.github.com/dkindel), [@​iabdullah215](https://redirect.github.com/iabdullah215), [@​nazarli-shabnam](https://redirect.github.com/nazarli-shabnam), [@​ndyakov](https://redirect.github.com/ndyakov), [@​ofekshenawa](https://redirect.github.com/ofekshenawa), [@​saddamr3e](https://redirect.github.com/saddamr3e), [@​Solaris-star](https://redirect.github.com/Solaris-star), [@​sonnemusk](https://redirect.github.com/sonnemusk), [@​sueun-dev](https://redirect.github.com/sueun-dev) *** **Full Changelog**:
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section. ", "url": "https://github.com/grafana/loki/pull/23806", "createdAt": "2026-08-06T18:11:24Z", "updatedAt": "2026-08-13T15:10:33Z", "timestamp": "2026-08-13T15:10:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "dependencies", "update-minor" ], "author": "renovate-sh-app[bot]", "state": "open", "assignees": [], "change": "new" } }, { "id": "event:56295b12ff5d68d9cab5", "signalId": "github:grafana/loki:issue:6994", "event": "discovered", "observedAt": "2026-08-13T17:43:20.785491Z", "changedFields": [], "signal": { "id": "github:grafana/loki:issue:6994", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "grafana-loki lacks basic feature of extracting nested json labels", "text": " **Is your feature request related to a problem? Please describe.** I am running a java spring-boot application on AWS ECS and want to ship logs to loki/grafana. In order to have the java stack trace as a single log line in grafana I log as json to console using ```xml ``` The resulting json from AWS ECS looks like this: ```json { \"container_id\": \"ea7b47de37024af8a71629fc4c435e09-285964202\", \"container_name\": \"backend\", \"ecs_cluster\": \"dev-fargate\", \"ecs_task_arn\": \"arn:aws:ecs:eu-central-1:xxx:task/dev-fargate/ea7b47de37024af8a71629fc4c435e09\", \"ecs_task_definition\": \"dev-backend:72\", \"log\": { \"@timestamp\": \"2022-08-29T08:13:22.893Z\", \"@version\": \"1\", \"message\": \"Running with Spring Boot v2.7.3, Spring v5.3.22\", \"logger_name\": \"com.example.Application\", \"thread_name\": \"main\", \"level\": \"DEBUG\", \"level_value\": 10000 } } ``` **Describe the solution you'd like** I want to extract also lables from the log element, i.e. log level, logger name, ... and only keep the log.message as the log text. So therefore I need configuration like this (cloudformation yaml config), which is currently not working/supported: ```yaml ... LogConfiguration: LogDriver: awsfirelens Options: Name: grafana-loki Url: https://loki:3000/loki/api/v1/push Labels: \"{source=\\\"console\\\"}\" LabelKeys: container_id,ecs_task_arn,ecs_task_definition,ecs_cluster,container_name,log.level,log.logger_name,log.thread_name RemoveKeys: source,log.level_value,log.@version LineFormat: key_value insecure_skip_verify: true SecretOptions: - Name: TenantID ValueFrom: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/config/loki/tenant-id - Name: log_router Image: grafana/fluent-bit-plugin-loki:2.6.1-amd64 Essential: false Memory: 512 Cpu: 256 FirelensConfiguration: Type: fluentbit Options: enable-ecs-log-metadata: true LogConfiguration: LogDriver: awslogs Options: awslogs-stream-prefix: firelens awslogs-group: !Ref LogGroup awslogs-region: !Ref AWS::Region ... ``` **Describe alternatives you've considered** A clear and concise description of any alternative solutions or features you've considered. I have also tried using LabelMapPath, but this didn't work either. Also tried LineFormat=json but has same result. **Additional context** This is really a basic feature I bet a lot of people need! And maybe another option would be great to specify the final message target, i.e. \"log.message\" in my case... and other properties should be ignored. Would extremly ease the config avoiding the need of specifying tons of \"RemoveKeys\"...", "url": "https://github.com/grafana/loki/issues/6994", "createdAt": "2022-08-29T08:42:40Z", "updatedAt": "2026-08-13T16:32:58Z", "timestamp": "2026-08-13T16:32:58Z", "metrics": { "reactions": 9, "comments": 12 }, "labels": [ "type/feature", "good first issue", "component/fluent-bit-plugin" ], "author": "sschmiedleitner", "state": "open", "assignees": [], "change": "new" } }, { "id": "event:acdc0ad9cf31d5df9902", "signalId": "github:grafana/loki:issue:20673", "event": "changed", "observedAt": "2026-08-13T17:43:20.785491Z", "changedFields": [ "updatedAt", "metrics" ], "signal": { "id": "github:grafana/loki:issue:20673", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "issue", "title": "Replace `go.uber.go/atomic` with Go standard library `sync/atomic`", "text": "## Summary We currently have a linter rule that blocks usage of `sync/atomic` and forces us to use `go.uber.go/atomic` instead. This rule was originally added because `sync/atomic` required atomic operations on primitive types, which was considered error-prone. However, since **Go 1.19**, the standard library `sync/atomic` package now includes typed wrappers (e.g., `atomic.Uint32`, `atomic.Int64`, `atomic.Bool`, etc.) that provide the same safety guarantees as `go.uber.go/atomic`. This makes the uber package redundant. ## Context Prometheus is also making this transition: - Issue: https://github.com/prometheus/prometheus/issues/14866 - PR: https://github.com/prometheus/prometheus/pull/18009 ## Proposed Changes 1. **Remove the linter rule** that blocks `sync/atomic` 2. **Migrate all `go.uber.go/atomic` usage** to the standard library `sync/atomic` typed wrappers 3. **Configure a linter rule** to block the old-style atomic functions that operate on primitive types (e.g., `atomic.AddInt64`, `atomic.LoadUint32`) to ensure we only use the new typed wrappers and avoid accidental misuse This approach gives us: - Fewer external dependencies - Alignment with the broader Go ecosystem - Same safety guarantees we had with uber/atomic ## References - Go 1.19 release notes on atomic types: https://tip.golang.org/doc/go1.19#atomic_types - `sync/atomic` package docs: https://pkg.go.dev/sync/atomic", "url": "https://github.com/grafana/loki/issues/20673", "createdAt": "2026-02-04T12:44:57Z", "updatedAt": "2026-08-13T16:32:33Z", "timestamp": "2026-08-13T16:32:33Z", "metrics": { "reactions": 0, "comments": 6 }, "labels": [ "good first issue" ], "author": "Segflow", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:903b2ad48cb045eb1b7f", "signalId": "github:grafana/loki:pull_request:19059", "event": "discovered", "observedAt": "2026-08-13T17:43:20.785491Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:19059", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "fix(CI): release scripts add newline", "text": "**What this PR does / why we need it**: I previously tried to fix this in https://github.com/grafana/loki/pull/19011 but I now realize that it wasn't 100% correct. It solved an ephemeral issue that was remedied on the next release. Long term we need another newline in the release script. Demonstrated through a git-diff of the output. ``` ## Unreleased + ## 6.38.0 ``` **Which issue(s) this PR fixes**: Fixes # **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [x] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - **Note** that Promtail is considered to be feature complete, and future development for logs collection will be in [Grafana Alloy](https://github.com/grafana/alloy). As such, `feat` PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior. - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/19059", "createdAt": "2025-08-28T16:49:40Z", "updatedAt": "2026-08-13T16:23:27Z", "timestamp": "2026-08-13T16:23:27Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [ "size/XS" ], "author": "TheRealNoob", "state": "closed", "assignees": [], "change": "new" } }, { "id": "event:612571e6084da30b3861", "signalId": "github:grafana/loki:pull_request:23944", "event": "discovered", "observedAt": "2026-08-13T18:01:55.420671Z", "changedFields": [], "signal": { "id": "github:grafana/loki:pull_request:23944", "source": "github", "group": "observability", "project": "grafana/loki", "kind": "pull_request", "title": "perf: Lazy instantiation of drains for pattern ingesters", "text": "**What this PR does / why we need it**: Lazily create per-`detected_level` Drain trees in the pattern ingester instead of always allocating all 8 at stream creation. Most streams only see 1–3 levels; unused trees previously paid idle RSS (root node, LRU, tokenizer) for every owned stream. Unknown/custom levels still fall back to the unknown Drain; observing all 8 known levels still creates all 8. **Which issue(s) this PR fixes**: Pattern-ingester OOMs track retained Drain state per owned stream. Cutting the per-stream floor (especially for single-level streams) reduces steady-state working set. **Special notes for your reviewer**: ``` BenchmarkStreamMemory_LazyDrain/single_level 1.000 drains/stream ~1024 retained_B/stream BenchmarkStreamMemory_LazyDrain/all_levels 8.000 drains/stream ~34816 retained_B/stream ``` **Checklist** - [X] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [X] Tests updated - [X] Title matches the required conventional commits format, see [here](https://www.conventionalcommits.org/en/v1.0.0/) - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](https://github.com/grafana/loki/pull/10840/commits/0d4416a4b03739583349934b96f272fb4f685d15)", "url": "https://github.com/grafana/loki/pull/23944", "createdAt": "2026-08-13T17:53:53Z", "updatedAt": "2026-08-13T17:54:33Z", "timestamp": "2026-08-13T17:54:33Z", "metrics": { "reactions": 0, "comments": 0 }, "labels": [], "author": "paul1r", "state": "open", "assignees": [], "change": "new" } } ] } }