Alertmanager 0.31.0 → 0.35.0
10 releases · 5 breaking changes · 3 security fixes · 1 advisory fixed
3security5breaking2deprecated42feature49fix
Vulnerabilities fixed by this upgrade
- 7.6 GHSA-w5g2-x24w-p3fq Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
Breaking changes
- breaking [CHANGE] Promote the auto-gomemlimit feature flag to the --auto-gomemlimit command-line flag. This is a breaking change: the --enable-feature=auto-gomemlimit option has been removed. #5464 in 0.35.0
- breaking [CHANGE] eventrecorder: Every output now requires a name. This is a breaking change: configurations with unnamed outputs fail to load. The name identifies the output in metrics and logs instead of its URL, broker or topic. #5393 in 0.35.0
- breaking [CHANGE] eventrecorder: The output data format now uses the new events/v2 schema. This is a breaking change: alert labels, alert annotations, group labels, silence annotations, and muted-alert labels are JSON maps, and protobuf consumers must use the new schema. #5409, #5500 in 0.35.0
- breaking [CHANGE] The '--enable-feature=auto-gomaxprocs' option has been removed. This flag had no effect since v0.29 and was deprecated in v0.32. It can be safely removed from any startup scripts. #5090, #5251 in 0.33.0
- breaking [ENHANCEMENT] docs: Remove duplicate header. #5034 in 0.32.0
Security changes
- security Fixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation in 0.34.2
- security [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664 in 0.34.2
- security [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943 in 0.34.2
Deprecations
- deprecated [CHANGE] Remove the deprecated types package in favor of the alert package. #5585 in 0.35.0
- deprecated [CHANGE] The '--enable-feature=auto-gomaxprocs' option is deprecated and will be removed in v0.33. This flag currently has no effect and can be safely removed from any startup scripts. #5090 in 0.32.0
Every release in between
breaking[CHANGE] Promote the auto-gomemlimit feature flag to the --auto-gomemlimit command-line flag. This is a breaking change: the --enable-feature=auto-gomemlimit option has been removed. #5464
deprecated[CHANGE] Remove the deprecated types package in favor of the alert package. #5585
breaking[CHANGE] eventrecorder: Every output now requires a name. This is a breaking change: configurations with unnamed outputs fail to load. The name identifies the output in metrics and logs instead of its URL, broker or topic. #5393
breaking[CHANGE] eventrecorder: The output data format now uses the new events/v2 schema. This is a breaking change: alert labels, alert annotations, group labels, silence annotations, and muted-alert labels are JSON maps, and protobuf consumers must use the new schema. #5409, #5500
feature[FEATURE] Add a distroless container image. #5258
feature[FEATURE] api: Add an experimental ConnectRPC API served alongside /api/v2/ under the version-neutral /api/ prefix, exposing the Connect, gRPC, and gRPC-Web protocols plus the gRPC Health Checking Protocol and server reflection. The first service is status.v3.StatusService. #5377, #5506, #5507,…
feature[FEATURE] incidentio: Add templated metadata field. #5022
feature[FEATURE] rocketchat: Add message_text option to set the message text shown in desktop and push notifications. #5595
feature[FEATURE] slack: Add post_updates_to_thread option to post subsequent notifications of an alert group as replies in the thread of the initial message. #5540
feature[FEATURE] telegram: Add timeout option to limit how long a notification request may take. #5127
feature[FEATURE] template: Add addDuration function to shift a timestamp by a duration such as -30m and return it in Unix milliseconds. #5550
feature[FEATURE] template: Allow the join function to accept slices and arrays of any type. #5233
feature[FEATURE] timeinterval: Allow weekday ranges to wrap around the end of the week, e.g. friday:monday. #5579
feature[FEATURE] ui: Serve the new Mantine UI at /ui/ alongside the existing UI. #5502, #5538, #5539, #5537
fix[ENHANCEMENT] cluster: Fix the memeberlist typo in error messages. #5472
feature[ENHANCEMENT] docs: Add a Gotify example using a custom webhook payload. #5408, #5498
feature[ENHANCEMENT] docs: Add a reusable HTML email template example. #5391
fix[ENHANCEMENT] docs: Fix rocketchat_config defaults and field types. #5591
fix[ENHANCEMENT] docs: Fix the tracing config key, which was misspelled as traciing. #5437
feature[ENHANCEMENT] notify: Add the receiver name to the log message for failed notifications. #5401
fix[BUGFIX] api: Report alerts muted by time intervals as of the time of the request instead of the last group flush, matching silences and inhibitions. #5661
fix[BUGFIX] cluster: Downgrade memberlist to v0.5.4 to fix Failed to read remote state: user state length (...) exceeds limit errors. #5640
fix[BUGFIX] config: Fix merging of global configs for the smtp, opsgenie, victorops and rocketchat notifiers. #5448, #5457
fix[BUGFIX] discord: Retry notifications on HTTP 429 (rate limited) instead of dropping them. #5496
fix[BUGFIX] httpserver: Fix the /-/reload endpoint getting stuck when the client cancels the request. #5234
fix[BUGFIX] notify: Wait the full backoff interval before retrying a notification that failed slowly. #5497, #5389, #5553
fix[BUGFIX] opsgenie: Respect the notification timeout and tracing span for the update-message request sent when update_alerts is enabled. #5465
fix[BUGFIX] pagerduty: Report the failure reason of Events API v1 requests in alertmanager_notifications_failed_total instead of reason="other". #5505
fix[BUGFIX] pushover: Trim whitespace from token_file and user_key_file contents so keys stored in files with a trailing newline are accepted. #5590
fix[BUGFIX] silences: Treat a silence as expired at exactly its end time, consistent with the API. #5665
fix[BUGFIX] silences: Use a single evaluation time for each read or write of silences. #5666
fix[BUGFIX] slack: Avoid a panic when update_message relies on global.slack_api_url. #5589
fix[BUGFIX] slack: Retry notifications on HTTP 429 (rate limited) and honor the Retry-After header instead of dropping them. #5048
fix[BUGFIX] telegram: Redact the bot token from logged notification errors. #5254
fix[BUGFIX] telegram: Report the failure reason in alertmanager_notifications_failed_total. #5375
fix[BUGFIX] template: Preserve quoted numeric strings as strings in templated JSON fields. #5098
fix[BUGFIX] timeinterval: Fix negative days_of_month resolving one day early in months with a DST transition. #5447
fix[BUGFIX] timeinterval: Reject month numbers outside 1-12. #5626
fix[BUGFIX] webex: Fix a panic when truncating long notifications containing non-ASCII characters. #5544
fix[BUGFIX] webex: Retry notifications on HTTP 429 (rate limited) and honor the Retry-After header instead of dropping them. #5548
+16 more items in the release notessecurityFixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation
security[SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664
security[SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943
fix[BUGFIX] inhibit: Fix several issues related to inhibitions that caused alerts to be improperly un-muted in some cases. #5542, #5449, #5559
other[CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #5332
feature[FEATURE] Add optional templatable labels to alert routes. #5328
feature[FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #5315
feature[FEATURE] eventrecorder: Add stdout output type. #5311
feature[FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #5406
feature[FEATURE] sns: Add aws external_id support in sigv4 configuration. #5157
feature[FEATURE] template: Add toDate and mustToDate functions. #5327
feature[ENHANCEMENT] doc: Add AlertmanagerClusterFailedPeers alertmanager-mixin. #5301
feature[ENHANCEMENT] doc: Add description for Rocketchat parameters in global config. #5181
feature[ENHANCEMENT] doc: Add top level tracing configuration key. #5314
fix[ENHANCEMENT] doc: Fix Alertmanager port in amtool config routes example. #5312
feature[ENHANCEMENT] eventrecorder: Add optional webhook batching. #5392
other[ENHANCEMENT] notify: The discord and webex integrations now report a failure reason on alertmanager_notifications_failed_total. #5332
other[ENHANCEMENT] ui: Improve responsiveness of UI when loading thousands of alerts. #5357
fix[BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #5307
fix[BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #5379
fix[BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304
fix[BUGFIX] doc: fix missing notification_reason field in webhook documentation (#5329)
fix[BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily. (#5330)
fix[BUGFIX] silence with no matchers should populate an empty array in API response (#5331)
breaking[CHANGE] The '--enable-feature=auto-gomaxprocs' option has been removed. This flag had no effect since v0.29 and was deprecated in v0.32. It can be safely removed from any startup scripts. #5090, #5251
feature[CHANGE] Add group-key-in-metrics feature flag. #5047
other[CHANGE] Move AlertMarker, GroupMarker to marker package. #5047
other[CHANGE] Remove alertmanager_marked_alerts. #5047
other[CHANGE] Remove the following from types package: MemMarker, AlertState*, AlertStatus. #5047
feature[FEATURE] Introduce per aggregation group AlertMarkers and drop Global Alert Marker. #5047
feature[FEATURE] ui: Add support for silence annotations. #5017
feature[FEATURE] api: Add receiver labels and receiver_matchers filter to /api/v2/receivers, /api/v2/alerts, and /api/v2/alerts/groups. #5152
feature[FEATURE] eventrecorder: Add structured event recorder behind --enable-feature=event-recorder, with file, webhook, and kafka outputs. #5072, #5246
feature[ENHANCEMENT] Add the use_aws_http_client config option to the sns notifier. #5178
feature[ENHANCEMENT] template: Add now function to get current time. #5188
other[ENHANCEMENT] docs: Clarify YAML quoting vs matcher token quoting in UTF-8 matchers section. #5264
fix[BUGFIX] jira: Allow disabling the resolve transition when resolve_transition is not set. #4821
fix[BUGFIX] jira: Include unresolved issues in wont_fix_resolution JQL to prevent duplicate issue creation. #5185
fix[BUGFIX] sns: Support the AWS_CA_BUNDLE env variable for the sns notifier. #5178
fix[BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap. #5241
fix[BUGFIX] dispatcher: Fix issue with dispatching to a contended route. #5179
fix[BUGFIX] ui: Provide prebuilt ui assets in release. #5191
other[ENHANCEMENT] ui: Support building artifacts in containers with Docker or Podman. #5102
other[CHANGE] go get github.com/prometheus/alertmanager/ui will now fail as compiled UI assets are no longer checked into the repository. Downstream builds that rely on these assets being present in the source tree must now build the UI from source. #5113
deprecated[CHANGE] The '--enable-feature=auto-gomaxprocs' option is deprecated and will be removed in v0.33. This flag currently has no effect and can be safely removed from any startup scripts. #5090
other[CHANGE] Update internal function signatures across multiple packages. This affects any project that integrates Alertmanager code.
feature[ENHANCEMENT] Add static asset caching. #5113
other[ENHANCEMENT] Reduce memory allocations through pre-sizing collections and batch allocation. #5020
other[ENHANCEMENT] Replace help with documentation in navigation bar. #4943
other[ENHANCEMENT] docs(ha): Update high availability documentation. #5136
feature[ENHANCEMENT] docs: Add auth_secret_file for smtp in document. #5036
feature[ENHANCEMENT] docs: Add description for global telegram_bot_token. #5114
feature[ENHANCEMENT] docs: Add note about notifier timeouts. #5077
fix[ENHANCEMENT] docs: Fix force_implicit_tls config field name. #5030
other[ENHANCEMENT] docs: Link community supported integrations. #4978
breaking[ENHANCEMENT] docs: Remove duplicate header. #5034
other[ENHANCEMENT] docs: Update mutual tls reference in high availability documentation. #5120
other[ENHANCEMENT] tracing: Use noop spans when tracing disabled. #5118
other[ENHANCEMENT] ui: Serve pre-compressed assets. #5133
feature[FEATURE] Add silence annotations. #4965
feature[FEATURE] Add silence logging option. #4163
feature[FEATURE] Add support for multiple matcher set silences. #4957
feature[FEATURE] Add the reason for notifying in dedup stage. #4971
other[FEATURE] mattermost: Flatten attachments into top-level config. #5009
other[FEATURE] mattermost: Support global webhook url. #4998
feature[FEATURE] slack: Add default color from template. #5014
feature[FEATURE] slack: Allow receiver to edit existing messages. #5007
feature[FEATURE] template: Add dict, map and append functions. #5093
feature[FEATURE] webhook: Add full payload templating support for notifier. #5011
fix[BUGFIX] config: Check for empty cluster tls client config. #5126
fix[BUGFIX] config: Don't crash upon reading empty config for notifier. #4979
fix[BUGFIX] config: Fix ipv6 address handling in hostport.string(). #5040
fix[BUGFIX] mattermost: Omit empty text field in notifications. #4985
fix[BUGFIX] telegram: Send fallback message when notification exceeds character limit. #5074
fix[BUGFIX] tracing: Properly shutdown tracer provider. #5131
fix[BUGFIX] ui: Fix escaping for matcher values with quotes. #4862
fix[BUGFIX] ui: Handle special chars in silence regex-matchers. #4942
fix[BUGFIX] ui: Support utf-8 label names in matchers. #5089
fix[BUGFIX] docs: Fix email TLS configuration example. #4976
fix[BUGFIX] docs: Add telegram bot token options to global config docs. #4999