Backport security audit fixes (V01-V07), snappy gRPC fix, and stream push panic fix to release-1.21#7574

Merged

friedrichg merged 15 commits into

release-1.21from

backport-security-audit-v01-v07

May 31, 2026

Commits on May 29, 2026

Mask Swift, etcd, Redis, and HTTP basic-auth credentials (#7473)
friedrichg
committed
drop digest verification fail packets (#7474)

SungJin1212
authored and
friedrichg
committed
Tenant impersonation push stream (#7475)

SungJin1212
authored and
friedrichg
committed
security: fix stored XSS in alertmanager and storegateway status pages (#7512)

danielblando
and
friedrichg
committed
security: limit decompressed gzip output in ParseProtoReader and OTLP ingestion path (#7515)

danielblando
authored and
friedrichg
committed
Security: add flags for TCP connection limits and timeouts (#7518)

SungJin1212
authored and
friedrichg
committed
add WrappedHistogram with size limit before unmarshal (#7570)

PaurushGarg
authored and
friedrichg
committed

Commits on May 31, 2026