3.6.20 (2026-11-06)

Bug Fixes

• deps: Update go4.org/netipx digest to 3075585 (release-3.6.x) (#26156) (5124776)
• deps: Update google.golang.org/genproto/googleapis/rpc digest to 2ffab32 (release-3.6.x) (#26157) (88e351e)
• deps: Update k8s.io/utils digest to ca04ba5 (release-3.6.x) (#26161) (8d2391d)
• security/HIGH/: Update module github.com/go-jose/go-jose/v4 to v4.1.6 [SECURITY] (release-3.6.x) (#25829) (d1915f4)
• security/HIGH/: Update module github.com/go-openapi/swag/jsonutils to v0.29.2 [SECURITY] (release-3.6.x) (#26286) (8d999cd)
• security/UNKNOWN/pkg/push: Update module golang.org/x/net to v0.62.0 [SECURITY] (release-3.6.x) (#25846) (ab6aa07)
• security/UNKNOWN/: Update module github.com/klauspost/compress to v1.20.2 [SECURITY] (release-3.6.x) (#26294) (bbbdf8a)
• security/UNKNOWN/: Update module golang.org/x/net to v0.62.0 [SECURITY] (release-3.6.x) (#25845) (77bf026)

See CHANGELOG.md for the full list of changes.

4.0.0-rc.2 (2026-11-04)

Reverts

• loki: Disable Multipath TCP on listeners by default (#26237) (7637697)

4.0.0-rc.1 (2026-11-03)

⚠ BREAKING CHANGES

• compactor: Remove deprecated allow_deletes configuration option (#21808)
• engine: Unplug the V2 query engine from the config and modules (#25353)
• frontend: Default frontend.encoding to protobuf (#23985)
• ingester: Remove deprecated per-tenant setting unordered_writes (#21835)
• ksonnet: Remove boltdb-shipper specific flags from lib (#21656)
• logql: Stop writing preserve_error as a label (#24877)
• logql: Let an error filter decide whether a metric query keeps errored samples (#24719)
• logql: Apply grouping to an errored sample's labels (#24712)
• logql: Remove support for experimental LogQL variants() queries (#23823)
• loki: Upgrade Go module to github.com/grafana/loki/v4 (#25972)
• loki: Remove deprecated per_tenant_override_config and per_tenant_override_period (#22856)
• loki: Remove targets for Simple Scalable Deployment (SSD) (#21481)
• loki: Remove deprecated /api/prom API endpoints (#21569)
• loki: Rename metric loki_log_flushes (#21765)
• loki: Remove deprecated loki_log_messages_total metric (#21764)
• operator: Stop reconciliation of deprecated BoltDB schemas (#24990)
• operator: Make schemas field required in storage spec (#24716)
• querytee: Configure a primary and a secondary backend (#25552)
• querytee: Remove the request splitting (#25496)
• querytee: Remove the routing modes (#25487)
• ruler: Remove deprecated ruler_remote_write_* per-tenant limits (#22941)
• ruler: Remove deprecated remote-write 'client' setting (#23453)
• ruler: Always wipe the remote-write WAL on startup (#22509)
• storage: Rename remaining loki_boltdb_shipper_* metrics to loki_tsdb_shipper_* (#25345)
• storage: Remove row_shards from the schema configuration (#23683)
• storage: Remove the disable_broad_index_queries setting (#23679)
• storage: Remove unused period_config settings that are no longer used by TSDB index (#23665)
• storage: Use Thanos storage clients by default (#22676)
• storage: Remove index read cache and index cache validity settings (#22066)
• storage: Remove deprecated write dedupe cache (#22056)
• storage: Remove deprecated BoltDB Shipper storage backend (#21678)
• storage: Remove deprecated BoltDB storage backend for indexes (#21637)
• storage: Remove deprecated gRPC storage backend (#21638)
• storage: Remove deprecated DynamoDB storage backend (#21601)
• storage: Remove deprecated Cassandra storage backend (#21574)
• storage: Remove support for BigTable/GCP storage backend (#21502)

Features

• alibaba oss: Alibaba oss ecs ram role (#21989) (5555ff9)
• auth: Add no_auth_tenant config option for single-tenant mode (#21819) (7923fe1)
• canary: Add support for otlp protocol to canary for continuous testing of otlp ingestion (#24985) (6abd850)
• canary: Implement support for path prefixes (#24534) (a8b5c92)
• ci: Include linux/riscv64 Loki build in releases (#21597) (76e65d7)
• compaction: Build index over compacted log objects in LogMerge (#23214) (eb93257)
• compaction: Compact a configurable lookback of older windows (#23411) (4d0120c)
• compaction: Implement merge for log objects (#23117) (b88aca5)
• compaction: Log object compaction - contract changes (#23065) (d821f2b)
• compaction: Merge unique label sets to one global ID during compaction (#24107) (48e7ae3)
• compaction: Observability for log compaction (#23122) (aa5e221)
• compaction: Track dataobj compaction artifacts via arrow record results (#23364) (47f6607)
• compactor: Add new increase_generation_numbers endpoint (#22443) (4649720)
• compactor: Improve dataobj compaction planner logging (#23752) (cf17501)
• compactor: Read new postings section type (#22143) (6102d52)
• compactor: Reuse logsobj builder metrics (#22138) (bd6316d)
• compactor: Take the LogMerge stream layout from the source objects (#25576) (859aea2)
• dataobj-compactor: Add an IndexFilter compaction task (#25024) (1aac226)
• dataobj-compactor: Add compaction dry-run flag with audit logging (#22308) (0b12196)
• dataobj-compactor: Add CompactionMerge physical-plan node (#21844) (12c419b)
• dataobj-compactor: Add compactor target skeleton, no-op coordinator stub (#21818) (4cd2cf1)
• dataobj-compactor: Add dataobj-compactor-worker target scaffold (#21873) (3a3245b)
• dataobj-compactor: Add metrics for duplicates & log-merge throughput (#24952) (fbafe9e)
• dataobj-compactor: Bucket log compaction bytes by age ([#25127](https://github.co...

See CHANGELOG.md for the full list of changes.

4.0.0-rc.1 (2026-11-03)

⚠ BREAKING CHANGES

• compactor: Remove deprecated allow_deletes configuration option (#21808)
• engine: Unplug the V2 query engine from the config and modules (#25353)
• frontend: Default frontend.encoding to protobuf (#23985)
• ingester: Remove deprecated per-tenant setting unordered_writes (#21835)
• ksonnet: Remove boltdb-shipper specific flags from lib (#21656)
• logql: Stop writing preserve_error as a label (#24877)
• logql: Let an error filter decide whether a metric query keeps errored samples (#24719)
• logql: Apply grouping to an errored sample's labels (#24712)
• logql: Remove support for experimental LogQL variants() queries (#23823)
• loki: Upgrade Go module to github.com/grafana/loki/v4 (#25972)
• loki: Remove deprecated per_tenant_override_config and per_tenant_override_period (#22856)
• loki: Remove targets for Simple Scalable Deployment (SSD) (#21481)
• loki: Remove deprecated /api/prom API endpoints (#21569)
• loki: Rename metric loki_log_flushes (#21765)
• loki: Remove deprecated loki_log_messages_total metric (#21764)
• operator: Stop reconciliation of deprecated BoltDB schemas (#24990)
• operator: Make schemas field required in storage spec (#24716)
• querytee: Configure a primary and a secondary backend (#25552)
• querytee: Remove the request splitting (#25496)
• querytee: Remove the routing modes (#25487)
• ruler: Remove deprecated ruler_remote_write_* per-tenant limits (#22941)
• ruler: Remove deprecated remote-write 'client' setting (#23453)
• ruler: Always wipe the remote-write WAL on startup (#22509)
• storage: Rename remaining loki_boltdb_shipper_* metrics to loki_tsdb_shipper_* (#25345)
• storage: Remove row_shards from the schema configuration (#23683)
• storage: Remove the disable_broad_index_queries setting (#23679)
• storage: Remove unused period_config settings that are no longer used by TSDB index (#23665)
• storage: Use Thanos storage clients by default (#22676)
• storage: Remove index read cache and index cache validity settings (#22066)
• storage: Remove deprecated write dedupe cache (#22056)
• storage: Remove deprecated BoltDB Shipper storage backend (#21678)
• storage: Remove deprecated BoltDB storage backend for indexes (#21637)
• storage: Remove deprecated gRPC storage backend (#21638)
• storage: Remove deprecated DynamoDB storage backend (#21601)
• storage: Remove deprecated Cassandra storage backend (#21574)
• storage: Remove support for BigTable/GCP storage backend (#21502)

Features

• alibaba oss: Alibaba oss ecs ram role (#21989) (5555ff9)
• auth: Add no_auth_tenant config option for single-tenant mode (#21819) (7923fe1)
• canary: Add support for otlp protocol to canary for continuous testing of otlp ingestion (#24985) (6abd850)
• canary: Implement support for path prefixes (#24534) (a8b5c92)
• ci: Include linux/riscv64 Loki build in releases (#21597) (76e65d7)
• compaction: Build index over compacted log objects in LogMerge (#23214) (eb93257)
• compaction: Compact a configurable lookback of older windows (#23411) (4d0120c)
• compaction: Implement merge for log objects (#23117) (b88aca5)
• compaction: Log object compaction - contract changes (#23065) (d821f2b)
• compaction: Merge unique label sets to one global ID during compaction (#24107) (48e7ae3)
• compaction: Observability for log compaction (#23122) (aa5e221)
• compaction: Track dataobj compaction artifacts via arrow record results (#23364) (47f6607)
• compactor: Add new increase_generation_numbers endpoint (#22443) (4649720)
• compactor: Improve dataobj compaction planner logging (#23752) (cf17501)
• compactor: Read new postings section type (#22143) (6102d52)
• compactor: Reuse logsobj builder metrics (#22138) (bd6316d)
• compactor: Take the LogMerge stream layout from the source objects (#25576) (859aea2)
• dataobj-compactor: Add an IndexFilter compaction task (#25024) (1aac226)
• dataobj-compactor: Add compaction dry-run flag with audit logging (#22308) (0b12196)
• dataobj-compactor: Add CompactionMerge physical-plan node (#21844) (12c419b)
• dataobj-compactor: Add compactor target skeleton, no-op coordinator stub (#21818) (4cd2cf1)
• dataobj-compactor: Add dataobj-compactor-worker target scaffold (#21873) (3a3245b)
• dataobj-compactor: Add metrics for duplicates & log-merge throughput (#24952) (fbafe9e)
• dataobj-compactor: Bucket log compaction bytes by age (#25127) (0c70fcc)
• dataobj-compactor: Calculate compaction runs/jobs (#21845) ([3dd8056](3dd8056...

3.7.9 (2026-10-20)

Bug Fixes

• deps: Update github.com/thanos-io/objstore digest to 72d3b9f (release-3.7.x) (#25389) (e7d6809)
• deps: Update go4.org/netipx digest to 3075585 (release-3.7.x) (#25390) (24be2f4)
• deps: Update k8s.io/utils digest to cf1189d (release-3.7.x) (#25391) (a5218df)
• ingester: Concurrent WAL Append() calls could lead to inconsitent record order and irrecoverable WAL state (#25125) (72aa93e)
• Limit request body size for ruler "CreateRuleGroup" API and LogQLAnalyzer API [release-3.7.x] (#24838) (6c6e9dc)
• logql: Keep entries while stream accumulator has free room [release-3.7.x] (#24703) (4390fb1)
• security/LOW/: Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 [SECURITY] (release-3.7.x) (#24614) (bab6de2)
• security/LOW/: Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [SECURITY] (release-3.7.x) (#24615) (7aee5f1)
• security/LOW/: Update module go.opentelemetry.io/otel/sdk to v1.45.0 [SECURITY] (release-3.7.x) (#24616) (b787d9a)
• security/MEDIUM/: Update module github.com/containerd/containerd/v2 to v2.2.9 [SECURITY] (release-3.7.x) (#24806) (bafb1b8)
• security: Bump Go to 1.26.10 [SECURITY] (release-3.7.x) (#25458) (d3b4a2f)

3.6.19 (2026-10-20)

Bug Fixes

• security: Bump Go to 1.26.10 [SECURITY] (release-3.6.x) (#25457) (de41836)

3.6.18 (2026-10-15)

Bug Fixes

• deps: Update dependencies related to otel for 3.6 (#25180) (603de5a)
• security/LOW/: Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 [SECURITY] (release-3.6.x) (#24619) (3e7c0ed)
• security/LOW/: Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [SECURITY] (release-3.6.x) (#24620) (ad5a87c)
• security: Bump Go to 1.26.9 [SECURITY] (release-3.6.x) (#25193) (c969f5c)

0.12.0 (2026-10-07)

⚠ BREAKING CHANGES

• operator: Make schemas field required in storage spec (#24716)

Features

• operator: Add CPU and memory utilization ratio telemetry recording rules (#23379) (4cc1c43)
• operator: Add support for full TLS compliance for OCP 5.0 (#24216) (8ce415a)
• operator: Allow removal of expired schemas based on retention period (#24456) (16446f8)
• operator: Enable flush_on_shutdown and increase ingester terminationGracePeriodSeconds (#24325) (90c3797)
• operator: Make schemas field required in storage spec (#24716) (071148c)
• operator: Update Loki operand to 3.7.7 (#24448) (04417f4)
• operator: Update Loki operand to 3.7.8 (#24743) (f1f1b23)

Bug Fixes

• operator: Align built-in certificate rotation defaults with OpenShift cert alert threshold (#24106) (32d3196)
• operator: Downgrade golangci-lint to Go 1.26 (#24840) (7ba6f55)
• operator: Fix Go module and golangci-lint configuration (#24346) (101e8c4)
• operator: Migrate golangci-lint to use go tool instead of bingo (#24823) (aa902b4)
• operator: Set ingester terminationGracePeriodSeconds to 300s (#24324) (c0e79ac)
• operator: Update golangci-lint and add note for formatting conflict (#24537) (97d4cc7)
• operator: Use explicit command for passthrough-gateway (#24854) (c376aea)
• operator: Validate passthrough gateway CA exists (#23800) (4e3fb38)
• security/HIGH/operator: Update module google.golang.org/grpc to v1.83.1 [SECURITY] (main) (#24326) (e9831ee)
• security/HIGH/operator: Update module google.golang.org/grpc to v1.83.2 [SECURITY] (main) (#24427) (89c21be)
• security/MEDIUM/operator/api/loki: Update module golang.org/x/net to v0.55.0 [SECURITY] (main) (#24597) (c19e9bb)
• security/UNKNOWN/operator/api/loki: Update module golang.org/x/net to v0.56.0 [SECURITY] (main) (#24862) (f63d38a)
• security/UNKNOWN/operator/api/loki: Update module golang.org/x/text to v0.39.0 [SECURITY] (main) (#24863) (db962a4)
• security/UNKNOWN/operator: Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY] (main) (#24059) (a912e03)
• security/UNKNOWN/operator: Update module go.etcd.io/etcd/client/pkg/v3 to v3.7.1 [SECURITY] (main) (#24640) (9211272)
• security/UNKNOWN/operator: Update module golang.org/x/crypto to v0.56.0 [SECURITY] (main) (#24334) (185e3ae)

3.7.8 (2026-09-17)

Bug Fixes

• security/HIGH/pkg/push: Update module google.golang.org/grpc to v1.83.2 [SECURITY] (release-3.7.x) (#24433) (4d5dc2b)
• security/HIGH/: Update module google.golang.org/grpc to v1.83.1 [SECURITY] (release-3.7.x) (#24328) (0a01797)
• security/HIGH/: Update module google.golang.org/grpc to v1.83.2 [SECURITY] (release-3.7.x) (#24429) (14b5da8)
• security/MEDIUM/: Update module github.com/containerd/containerd/v2 to v2.2.8 [SECURITY] (release-3.7.x) (#24460) (3e917f2)
• security/UNKNOWN/pkg/push: Update module golang.org/x/net to v0.56.0 [SECURITY] (release-3.7.x) (#23422) (41064da)
• security/UNKNOWN/pkg/push: Update module google.golang.org/grpc to v1.83.1 [SECURITY] (release-3.7.x) (#23416) (cd8e76d)
• security/UNKNOWN/: Update module golang.org/x/crypto to v0.56.0 [SECURITY] (release-3.7.x) (#24335) (47149cb)

3.6.17 (2026-09-09)

Bug Fixes

• security/HIGH/pkg/push: Update module google.golang.org/grpc to v1.83.1 [SECURITY] (release-3.6.x) (#24330) (d8d78f6)
• security/HIGH/pkg/push: Update module google.golang.org/grpc to v1.83.2 [SECURITY] (release-3.6.x) (#24444) (6d21d6b)
• security/HIGH/: Update module google.golang.org/grpc to v1.83.1 [SECURITY] (release-3.6.x) (#24329) (ed9df58)
• security/HIGH/: Update module google.golang.org/grpc to v1.83.2 [SECURITY] (release-3.6.x) (#24430) (ee0ef56)
• security/MEDIUM/: Update module github.com/containerd/containerd/v2 to v2.0.12 [SECURITY] (release-3.6.x) (#24461) (7fa1224)
• security/UNKNOWN/: Update module golang.org/x/crypto to v0.55.0 [SECURITY] (release-3.6.x) (#24256) (85b2d4f)
• security/UNKNOWN/: Update module golang.org/x/crypto to v0.56.0 [SECURITY] (release-3.6.x) (#24336) (57bc922)
• security/UNKNOWN/: Update module golang.org/x/mod to v0.40.0 [SECURITY] (release-3.6.x) (#23963) (c08bf30)

3.7.7 (2026-08-27)

Features

• Add flag to ignore missing chunks during deletion of logs with line filter [release-3.7.x] (#24233) (7a40404)

Bug Fixes

• security/UNKNOWN/: Update module github.com/containerd/containerd/v2 to v2.2.5 [SECURITY] (release-3.7.x) (#24097) (07cd1f0)
• security/UNKNOWN/: Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY] (release-3.7.x) (#24061) (9d1c9ee)
• security/UNKNOWN/: Update module golang.org/x/mod to v0.40.0 [SECURITY] (release-3.7.x) (#23962) (1d5e027)
• storage: Pre-compute SHA-256 to avoid aws-chunked on PutObject [release-3.7.x] (#24215) (3d6f245)