Public promotion works again. This is the first installable release since 31 August, and it closes a collector-crashing route filter, three permission holes, and the two Critical OpenSSL CVEs that had blocked every public cut.
Breaking changes
This release contains breaking changes. Read the upgrade notes below before upgrading.
Read the marker, not the version number. Version numbers do not carry a semver major warning: a breaking change can ship in a minor release. Rely on the breaking-change marker, not on the version number.
GET and POST /api/v1/config/{id} and POST /api/v1/config/status are gone.
Written by us
Before you upgrade
- Search your tooling, scripts and API clients for /api/v1/config/ — those three routes no longer exist.
- To preview a collector's rendered config, call GET /api/v1/collectors/{id}/config/preview. That path requires collectors:read on that collector (or a superuser token).
- If you never called the legacy /config routes, this does not affect you.
- There is no compatibility shim. A caller of the old path gets 404.
Security updates
This release includes 3 security updates in shipped dependencies. Highest severity: high.
1 of these carry no published severity, so the highest severity above does not describe them.
Which packages, and which advisories
| Package | To | Severity | Advisory |
|---|---|---|---|
google.golang.org/grpc | v1.83.1 | high | CVE-2026-84304 |
google.golang.org/grpc | v1.83.2 | high | CVE-2026-84445 |
golang.org/x/crypto | v0.56.0 | not published | CVE-2026-78662 |
Fixes
- S-4399A route filter such as attributes["env"] == "prod" no longer crashes the collector when the source also carries metrics. An unparseable filter is refused on the request instead.
- S-3284 S-3958Clicking outside a dialog, or pressing Esc, no longer discards unsaved edits. That holds for the processor config modal and the other eight dialogs that used the same dismiss behaviour.
- S-4306The New Source Receiver Type list includes Kubernetes and synthetic-check receivers. Picking a Kubernetes template no longer displays Syslog.
- S-4307Switching source template replaces name and description with that template’s own values unless you typed them yourself.
- S-4331Kubernetes collector adoption accepts a serverUrl on the request, so an in-cluster collector can be pointed at the ClusterIP instead of the public hostname.
- S-4377Config-as-Code and Git settings require the settings permission. A viewer token can no longer publish fleet config or repoint the GitOps repo.
- S-4378Rotating a service-account token now applies the same no-escalation checks as minting one. Holding only service_accounts:create no longer hands you a raw token with someone else’s permissions.
- S-4279The processor-type list no longer offers resource or redaction (Alloy rejects the whole config if either is present) and includes groupbyattrs and span.
- S-3878--strict on support-bundle no longer claims to mask hostnames. It never did; the claim was wrong and the behaviour is unchanged.
- S-4479The shipped image no longer contains libcrypto3/libssl3 3.5.7-r0. Those two Critical CVEs were what blocked public promotion.
- S-3753Docker Hub :latest and the public package channel track this release. They had been frozen on the 31 August build because a public tag failed CI.
- S-3778Generate Data’s Enrol-an-agent action keys off a named error code, not the wording of the error message.
- S-4379An authenticated caller without collectors:read can no longer fetch another collector’s rendered config. The legacy /api/v1/config/{id} path is gone; use GET /api/v1/collectors/{id}/config/preview.
Features and improvements
- S-4138You can define a sampling policy in the server and have it delivered over the existing config push. A policy that would drop an entire signal is refused at save time.
- S-3209PII masking reports detections per rule on the coverage view, and distinguishes “no matches” from “not instrumented”.
- S-3561PII masking recognises Swiss UIDs (CHE-123.456.789 and the compact form).
- S-3285The custom-processor wizard shows the placeholder syntax for each field you define, and warns if a field is defined but unused, or referenced but undefined.
- S-1220reset-password and list-users work with the server process stopped — they open the database directly, which is the recovery path when you are locked out.
22 further changes — build and test work, internal refactoring, and changes with no effect you could observe — were reviewed and deliberately left out.
10 other dependency updates in shipped components, with no security relevance.