Prometheus v3.5.5

This maintenance release for the 3.5 LTS branch focuses heavily on hardening the observability stack. It addresses several security concerns including cross-site scripting (XSS) in the dashboard UI, potential memory exhaustion in remote storage endpoints, and improved credential masking for cloud service discoveries. Users should also see minor efficiency gains in regex-heavy queries.

Fix stored XSS vulnerabilities in UI components — Prevents malicious actors from executing scripts in your browser by injecting code through specially crafted metric names or labels, protecting SREs and operators during routine monitoring tasks.

Memory safety validation for Snappy-encoded remote storage requests — Prevents a class of Denial of Service (DoS) attacks where a malicious remote write request could cause Prometheus to over-allocate memory and crash.

Improved secret handling for AzureAD and STACKIT integrations — Reduces the risk of accidental exposure by ensuring sensitive credentials for Cloud providers and Remote Read/Write are treated as secrets in memory and logs.

Optimized Regexp engine performance — Reduces CPU overhead during alert evaluation and querying by optimizing how regular expressions are processed.

Toolchain and dependency security updates — Ensures the Prometheus binary is built with the latest security patches for the Go runtime and underlying network libraries, mitigating known CVEs.