Alertmanager 0.34.1 → 0.35.0

2 releases · 3 breaking changes · 3 security fixes · 1 advisory fixed

3security3breaking1deprecated13feature23fix

Is 0.34.1 affected?

Vulnerabilities fixed by this upgrade

7.6 GHSA-w5g2-x24w-p3fq Alertmanager API v2 allows cross-origin reads, alert creation and silence creation

Breaking changes

breaking [CHANGE] Promote the auto-gomemlimit feature flag to the --auto-gomemlimit command-line flag. This is a breaking change: the --enable-feature=auto-gomemlimit option has been removed. #5464 in 0.35.0
breaking [CHANGE] eventrecorder: Every output now requires a name. This is a breaking change: configurations with unnamed outputs fail to load. The name identifies the output in metrics and logs instead of its URL, broker or topic. #5393 in 0.35.0
breaking [CHANGE] eventrecorder: The output data format now uses the new events/v2 schema. This is a breaking change: alert labels, alert annotations, group labels, silence annotations, and muted-alert labels are JSON maps, and protobuf consumers must use the new schema. #5409, #5500 in 0.35.0

Security changes

security Fixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation in 0.34.2
security [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664 in 0.34.2
security [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943 in 0.34.2

Deprecations

deprecated [CHANGE] Remove the deprecated types package in favor of the alert package. #5585 in 0.35.0

Every release in between

0.35.0 Nov 9, 2026 Release notes ↗

breaking[CHANGE] Promote the auto-gomemlimit feature flag to the --auto-gomemlimit command-line flag. This is a breaking change: the --enable-feature=auto-gomemlimit option has been removed. #5464

deprecated[CHANGE] Remove the deprecated types package in favor of the alert package. #5585

breaking[CHANGE] eventrecorder: Every output now requires a name. This is a breaking change: configurations with unnamed outputs fail to load. The name identifies the output in metrics and logs instead of its URL, broker or topic. #5393

breaking[CHANGE] eventrecorder: The output data format now uses the new events/v2 schema. This is a breaking change: alert labels, alert annotations, group labels, silence annotations, and muted-alert labels are JSON maps, and protobuf consumers must use the new schema. #5409, #5500

feature[FEATURE] Add a distroless container image. #5258

feature[FEATURE] api: Add an experimental ConnectRPC API served alongside /api/v2/ under the version-neutral /api/ prefix, exposing the Connect, gRPC, and gRPC-Web protocols plus the gRPC Health Checking Protocol and server reflection. The first service is status.v3.StatusService. #5377, #5506, #5507,…

feature[FEATURE] incidentio: Add templated metadata field. #5022

feature[FEATURE] rocketchat: Add message_text option to set the message text shown in desktop and push notifications. #5595

feature[FEATURE] slack: Add post_updates_to_thread option to post subsequent notifications of an alert group as replies in the thread of the initial message. #5540

feature[FEATURE] telegram: Add timeout option to limit how long a notification request may take. #5127

feature[FEATURE] template: Add addDuration function to shift a timestamp by a duration such as -30m and return it in Unix milliseconds. #5550

feature[FEATURE] template: Allow the join function to accept slices and arrays of any type. #5233

feature[FEATURE] timeinterval: Allow weekday ranges to wrap around the end of the week, e.g. friday:monday. #5579

feature[FEATURE] ui: Serve the new Mantine UI at /ui/ alongside the existing UI. #5502, #5538, #5539, #5537

fix[ENHANCEMENT] cluster: Fix the memeberlist typo in error messages. #5472

feature[ENHANCEMENT] docs: Add a Gotify example using a custom webhook payload. #5408, #5498

feature[ENHANCEMENT] docs: Add a reusable HTML email template example. #5391

fix[ENHANCEMENT] docs: Fix rocketchat_config defaults and field types. #5591

fix[ENHANCEMENT] docs: Fix the tracing config key, which was misspelled as traciing. #5437

feature[ENHANCEMENT] notify: Add the receiver name to the log message for failed notifications. #5401

fix[BUGFIX] api: Report alerts muted by time intervals as of the time of the request instead of the last group flush, matching silences and inhibitions. #5661

fix[BUGFIX] cluster: Downgrade memberlist to v0.5.4 to fix Failed to read remote state: user state length (...) exceeds limit errors. #5640

fix[BUGFIX] config: Fix merging of global configs for the smtp, opsgenie, victorops and rocketchat notifiers. #5448, #5457

fix[BUGFIX] discord: Retry notifications on HTTP 429 (rate limited) instead of dropping them. #5496

fix[BUGFIX] httpserver: Fix the /-/reload endpoint getting stuck when the client cancels the request. #5234

fix[BUGFIX] notify: Wait the full backoff interval before retrying a notification that failed slowly. #5497, #5389, #5553

fix[BUGFIX] opsgenie: Respect the notification timeout and tracing span for the update-message request sent when update_alerts is enabled. #5465

fix[BUGFIX] pagerduty: Report the failure reason of Events API v1 requests in alertmanager_notifications_failed_total instead of reason="other". #5505

fix[BUGFIX] pushover: Trim whitespace from token_file and user_key_file contents so keys stored in files with a trailing newline are accepted. #5590

fix[BUGFIX] silences: Treat a silence as expired at exactly its end time, consistent with the API. #5665

fix[BUGFIX] silences: Use a single evaluation time for each read or write of silences. #5666

fix[BUGFIX] slack: Avoid a panic when update_message relies on global.slack_api_url. #5589

fix[BUGFIX] slack: Retry notifications on HTTP 429 (rate limited) and honor the Retry-After header instead of dropping them. #5048

fix[BUGFIX] telegram: Redact the bot token from logged notification errors. #5254

fix[BUGFIX] telegram: Report the failure reason in alertmanager_notifications_failed_total. #5375

fix[BUGFIX] template: Preserve quoted numeric strings as strings in templated JSON fields. #5098

fix[BUGFIX] timeinterval: Fix negative days_of_month resolving one day early in months with a DST transition. #5447

fix[BUGFIX] timeinterval: Reject month numbers outside 1-12. #5626

fix[BUGFIX] webex: Fix a panic when truncating long notifications containing non-ASCII characters. #5544

fix[BUGFIX] webex: Retry notifications on HTTP 429 (rate limited) and honor the Retry-After header instead of dropping them. #5548

+16 more items in the release notes

0.34.2 Oct 29, 2026 Release notes ↗

securityFixes GHSA-w5g2-x24w-p3fq: Alertmanager API v2 allows cross-origin reads, alert creation and silence creation

security[SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664

security[SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943