Alertmanager 0.28.0 → 0.34.2
14 releases · 2 breaking changes · 3 security fixes · 1 advisory fixed
3security2breaking1deprecated59feature54fix
Vulnerabilities fixed by this upgrade
- 7.6 GHSA-w5g2-x24w-p3fq Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
Breaking changes
- breaking [CHANGE] The '--enable-feature=auto-gomaxprocs' option has been removed. This flag had no effect since v0.29 and was deprecated in v0.32. It can be safely removed from any startup scripts. #5090, #5251 in 0.33.0
- breaking [ENHANCEMENT] docs: Remove duplicate header. #5034 in 0.32.0
Security changes
- security Fixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation in 0.34.2
- security [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664 in 0.34.2
- security [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943 in 0.34.2
Deprecations
- deprecated [CHANGE] The '--enable-feature=auto-gomaxprocs' option is deprecated and will be removed in v0.33. This flag currently has no effect and can be safely removed from any startup scripts. #5090 in 0.32.0
Every release in between
securityFixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
security[SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664
security[SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943
fix[BUGFIX] inhibit: Fix several issues related to inhibitions that caused alerts to be improperly un-muted in some cases. #5542, #5449, #5559
other[CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #5332
feature[FEATURE] Add optional templatable labels to alert routes. #5328
feature[FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #5315
feature[FEATURE] eventrecorder: Add stdout output type. #5311
feature[FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #5406
feature[FEATURE] sns: Add aws external_id support in sigv4 configuration. #5157
feature[FEATURE] template: Add toDate and mustToDate functions. #5327
feature[ENHANCEMENT] doc: Add AlertmanagerClusterFailedPeers alertmanager-mixin. #5301
feature[ENHANCEMENT] doc: Add description for Rocketchat parameters in global config. #5181
feature[ENHANCEMENT] doc: Add top level tracing configuration key. #5314
fix[ENHANCEMENT] doc: Fix Alertmanager port in amtool config routes example. #5312
feature[ENHANCEMENT] eventrecorder: Add optional webhook batching. #5392
other[ENHANCEMENT] notify: The discord and webex integrations now report a failure reason on alertmanager_notifications_failed_total. #5332
other[ENHANCEMENT] ui: Improve responsiveness of UI when loading thousands of alerts. #5357
fix[BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #5307
fix[BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #5379
fix[BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304
fix[BUGFIX] doc: fix missing notification_reason field in webhook documentation (#5329)
fix[BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily. (#5330)
fix[BUGFIX] silence with no matchers should populate an empty array in API response (#5331)
breaking[CHANGE] The '--enable-feature=auto-gomaxprocs' option has been removed. This flag had no effect since v0.29 and was deprecated in v0.32. It can be safely removed from any startup scripts. #5090, #5251
feature[CHANGE] Add group-key-in-metrics feature flag. #5047
other[CHANGE] Move AlertMarker, GroupMarker to marker package. #5047
other[CHANGE] Remove alertmanager_marked_alerts. #5047
other[CHANGE] Remove the following from types package: MemMarker, AlertState*, AlertStatus. #5047
feature[FEATURE] Introduce per aggregation group AlertMarkers and drop Global Alert Marker. #5047
feature[FEATURE] ui: Add support for silence annotations. #5017
feature[FEATURE] api: Add receiver labels and receiver_matchers filter to /api/v2/receivers, /api/v2/alerts, and /api/v2/alerts/groups. #5152
feature[FEATURE] eventrecorder: Add structured event recorder behind --enable-feature=event-recorder, with file, webhook, and kafka outputs. #5072, #5246
feature[ENHANCEMENT] Add the use_aws_http_client config option to the sns notifier. #5178
feature[ENHANCEMENT] template: Add now function to get current time. #5188
other[ENHANCEMENT] docs: Clarify YAML quoting vs matcher token quoting in UTF-8 matchers section. #5264
fix[BUGFIX] jira: Allow disabling the resolve transition when resolve_transition is not set. #4821
fix[BUGFIX] jira: Include unresolved issues in wont_fix_resolution JQL to prevent duplicate issue creation. #5185
fix[BUGFIX] sns: Support the AWS_CA_BUNDLE env variable for the sns notifier. #5178
fix[BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap. #5241
fix[BUGFIX] dispatcher: Fix issue with dispatching to a contended route. #5179
fix[BUGFIX] ui: Provide prebuilt ui assets in release. #5191
other[ENHANCEMENT] ui: Support building artifacts in containers with Docker or Podman. #5102
other[CHANGE] go get github.com/prometheus/alertmanager/ui will now fail as compiled UI assets are no longer checked into the repository. Downstream builds that rely on these assets being present in the source tree must now build the UI from source. #5113
deprecated[CHANGE] The '--enable-feature=auto-gomaxprocs' option is deprecated and will be removed in v0.33. This flag currently has no effect and can be safely removed from any startup scripts. #5090
other[CHANGE] Update internal function signatures across multiple packages. This affects any project that integrates Alertmanager code.
feature[ENHANCEMENT] Add static asset caching. #5113
other[ENHANCEMENT] Reduce memory allocations through pre-sizing collections and batch allocation. #5020
other[ENHANCEMENT] Replace help with documentation in navigation bar. #4943
other[ENHANCEMENT] docs(ha): Update high availability documentation. #5136
feature[ENHANCEMENT] docs: Add auth_secret_file for smtp in document. #5036
feature[ENHANCEMENT] docs: Add description for global telegram_bot_token. #5114
feature[ENHANCEMENT] docs: Add note about notifier timeouts. #5077
fix[ENHANCEMENT] docs: Fix force_implicit_tls config field name. #5030
other[ENHANCEMENT] docs: Link community supported integrations. #4978
breaking[ENHANCEMENT] docs: Remove duplicate header. #5034
other[ENHANCEMENT] docs: Update mutual tls reference in high availability documentation. #5120
other[ENHANCEMENT] tracing: Use noop spans when tracing disabled. #5118
other[ENHANCEMENT] ui: Serve pre-compressed assets. #5133
feature[FEATURE] Add silence annotations. #4965
feature[FEATURE] Add silence logging option. #4163
feature[FEATURE] Add support for multiple matcher set silences. #4957
feature[FEATURE] Add the reason for notifying in dedup stage. #4971
other[FEATURE] mattermost: Flatten attachments into top-level config. #5009
other[FEATURE] mattermost: Support global webhook url. #4998
feature[FEATURE] slack: Add default color from template. #5014
feature[FEATURE] slack: Allow receiver to edit existing messages. #5007
feature[FEATURE] template: Add dict, map and append functions. #5093
feature[FEATURE] webhook: Add full payload templating support for notifier. #5011
fix[BUGFIX] config: Check for empty cluster tls client config. #5126
fix[BUGFIX] config: Don't crash upon reading empty config for notifier. #4979
fix[BUGFIX] config: Fix ipv6 address handling in hostport.string(). #5040
fix[BUGFIX] mattermost: Omit empty text field in notifications. #4985
fix[BUGFIX] telegram: Send fallback message when notification exceeds character limit. #5074
fix[BUGFIX] tracing: Properly shutdown tracer provider. #5131
fix[BUGFIX] ui: Fix escaping for matcher values with quotes. #4862
fix[BUGFIX] ui: Handle special chars in silence regex-matchers. #4942
fix[BUGFIX] ui: Support utf-8 label names in matchers. #5089
fix[BUGFIX] docs: Fix email TLS configuration example. #4976
fix[BUGFIX] docs: Add telegram bot token options to global config docs. #4999
fix[ENHANCEMENT] docs(opsgenie): Fix description of api_url field. #4908
other[ENHANCEMENT] docs(slack): Document missing app configs. #4871
fix[ENHANCEMENT] docs: Fix max-silence-size-bytes. #4805
other[ENHANCEMENT] docs: Update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0. #4872
other[ENHANCEMENT] docs: Use matchers for inhibit rules examples. #4131
feature[ENHANCEMENT] docs: add notification integrations. #4901
other[ENHANCEMENT] docs: update slack_config attachments documentation links. #4802
other[ENHANCEMENT] docs: update description of filter query params in openapi doc. #4810
other[ENHANCEMENT] provider: Reduce lock contention. #4809
feature[FEATURE] slack: Add support for top-level text field in slack notification. #4867
feature[FEATURE] smtp: Add support for authsecret from file. #3087
other[FEATURE] smtp: Customize the ssl/tls port support (#4757). #4818
other[FEATURE] smtp: Enhance email notifier configuration validation. #4826
feature[FEATURE] telegram: Add chat_id_file configuration parameter. #4909
other[FEATURE] telegram: Support global bot token. #4823
other[FEATURE] webhook: Support templating in url fields. #4798
feature[FEATURE] wechat: Add config directive to pass api secret via file. #4734
feature[FEATURE] provider: Implement per alert limits. #4819
fix[BUGFIX] Allow empty group_by to override parent route. #4825
fix[BUGFIX] Set spellcheck=false attribute on silence filter input. #4811
fix[BUGFIX] jira: Fix for handling api v3 with ADF. #4756
fix[BUGFIX] jira: Prevent hostname corruption in cloud api url replacement. #4892
fix[BUGFIX] Fix memory leak in tracing client. #4828
feature[CHANGE] Don't allow calling qids with an empty ids list. #4707
feature[FEATURE] Add mattermost integration. #4090
feature[FEATURE] Add saturday to the first day of the week options. #4473
feature[FEATURE] Add templating functions for working with urls. #4625
feature[FEATURE] cluster: Allow persistent peer names. #4636
feature[FEATURE] dispatch: Add start delay. #4704
feature[FEATURE] provider: Add subscriber channel metrics. #4630
feature[FEATURE] template: Add tojson function. #4773
feature[FEATURE] Add api http metrics. #4162
feature[FEATURE] Add distributed tracing support. #4745
feature[FEATURE] Add names to inhibit rules. #4628
feature[FEATURE] Add timeout option for pagerduty notifier. #4354
feature[FEATURE] Add timeout option for slack notifier. #4355
feature[FEATURE] Allow nested details fields in pagerduty. #3944
feature[FEATURE] Implement phantom_threading to group email alerts into threads. #4623
other[FEATURE] gc: Report errors, but remove erroneous silences and continue. #4724
other[FEATURE] jira: Template customfields. #4029
feature[FEATURE] jira: Allow configuring issue update via parameter. #4621
other[FEATURE] Slack app support. #4211
feature[ENHANCEMENT] Add comment about smtp plain authentication. #4741
feature[ENHANCEMENT] Add documentation about high availability. #4708
feature[ENHANCEMENT] Add documentation for client_allowed_sans. #4706
other[ENHANCEMENT] Improve logging around webhook dispatch failure. #4511
feature[ENHANCEMENT] Compile silence matchers when the silence is added. #4695
other[ENHANCEMENT] Fix 's/client/alerts_api/g' broken link in 0.29. #4718
other[ENHANCEMENT] Fix rocketchat_config docs. #4767
other[ENHANCEMENT] Fix: was renamed. #4729
other[ENHANCEMENT] Improve inhibition performance. #4607
other[ENHANCEMENT] Loadsnapshot: update matcher index properly while not holding lock. #4714
other[ENHANCEMENT] Logging improvements. #4113
other[ENHANCEMENT] Move query locking back into private query function. #4694
feature[ENHANCEMENT] Optimize the new inhibitor implementation for ~2.5x performance improvement. #4668
other[ENHANCEMENT] Reduce the time dispatch.group holds the mutex. #4670
other[ENHANCEMENT] Use b.loop() to simplify the code and improve performance. #4642
other[ENHANCEMENT] Remove duplicate slice during silences query. #4696
fix[BUGFIX] Add new behavior to avoid races on config reload. #4705
fix[BUGFIX] config: Fix duplicate header detection for all case variants. #2810
fix[BUGFIX] marker: Stop state leakage from aggregation groups. #4438
fix[BUGFIX] Fix pprof debug endpoints not working with --web.route-prefix. #4698
fix[BUGFIX] Set context timeout for resolvepeers. #4343
+2 more items in the release notesfeature[FEATURE] Add incident.io notifier. #4372
feature[FEATURE] Add monospace message formatting. #4362
feature[FEATURE] Add ability to customize interval for maintenance to run. #4541
other[ENHANCEMENT] Update Jira notifier to support both Jira cloud API v3 and Jira datacenter API v2. #4542
other[ENHANCEMENT] Increase mixin rate intervals for alert FailedToSendAlerts. #4206
other[ENHANCEMENT] Make /alertmanager group writable in docker image. #4469
fix[BUGFIX] Fix logged notification count on error in notify. #4323
fix[BUGFIX] Fix docker image permissions path. #4288
fix[BUGFIX] Fix error handling in template rendering for Telegram. #4353
fix[BUGFIX] Fix duplicate other in error messages for config. #4366
fix[BUGFIX] Fix logic that considers an alert reopened in Jira. #4478
fix[BUGFIX] Fix Jira issue count #4615
other[ENHANCEMENT] Improved performance of inhibition rules when using Equal labels. #4119
other[ENHANCEMENT] Improve the documentation on escaping in UTF-8 matchers. #4157
other[ENHANCEMENT] Update alertmanager_config_hash metric help to document the hash is not cryptographically strong. #4210
fix[BUGFIX] Fix panic in amtool when using --verbose. #4218
fix[BUGFIX] Fix templating of channel field for Rocket.Chat. #4220
fix[BUGFIX] Fix rocketchat_configs written as rocket_configs in docs. #4217
fix[BUGFIX] Fix usage for --enable-feature flag. #4214
fix[BUGFIX] Trim whitespace from OpsGenie API Key. #4195
fix[BUGFIX] Fix Jira project template not rendered when searching for existing issues. #4291
fix[BUGFIX] Fix subtle bug in JSON/YAML encoding of inhibition rules that would cause Equal labels to be omitted. #4292
fix[BUGFIX] Fix header for slack_configs in docs. #4247
fix[BUGFIX] Fix weight and wrap of Microsoft Teams notifications. #4222
fix[BUGFIX] Fix format of YAML examples in configuration.md. #4207