Skip to content

v4.3.0

Choose a tag to compare

View all tags
@pambrose pambrose released this 12 Oct 22:15
4.3.0
ae9800f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A smaller release that adds three opt-in JVM metric groups, fixes two bugs, and updates dependencies. The dashboard now shows each agent's real address, and a proxy that fails to start now exits instead of hanging. The proxy and agent images move to the Ubuntu 24.04 variant of their base image, which is clear of an OpenSSL vulnerability and of a bundled binary that vulnerability scanners flag. Nothing needs to change to upgrade: the new metric groups are off by default.

Highlights

More JVM metrics. Three more JVM metric groups can be turned on under proxy.metrics and agent.metrics, all off by default:

  • bufferPoolExportsEnabled: memory in the JVM's direct and mapped buffer pools (jvm_buffer_pool_*).
  • compilationExportsEnabled: time spent in JIT compilation (jvm_compilation_time_seconds_total).
  • nativeMemoryExportsEnabled: the JVM's native memory by area (jvm_native_memory_*). It needs the JVM started with -XX:NativeMemoryTracking=summary; without it, nothing is exported.

The dashboard shows each agent's real address. It showed Unknown for every agent; it now shows the address and port the agent connected from, and so do the proxy's logs. With the transport filter disabled, as behind an nginx reverse proxy, it still shows Unknown, since the connection there comes from the reverse proxy.

A proxy that fails to start now exits. With a port already taken, it logged the error but kept running, holding its admin and metrics ports, so a service manager's restart policy never fired. A failed start now stops everything it started and exits with status 1.

Images on Ubuntu 24.04. The proxy and agent images move from eclipse-temurin:25-jre to eclipse-temurin:25-jre-noble, the same Temurin JDK 25 on Ubuntu 24.04 LTS instead of 26.04. The new base is clear of the OpenSSL CVE-2026-84782 (HIGH) that the 4.2.0 images carried, and it doesn't include the pebble binary that Ubuntu 26.04 bundles, whose Go standard library Trivy flags for three HIGH CVEs. The images still run as the prometheus user (UID 1001) and are published for amd64, arm64, s390x and ppc64le.

Before you upgrade

  • Nothing needs to change. The new metric groups are off by default, and the configuration is otherwise unchanged.
  • If you build your own image on top of pambrose/prometheus-proxy or pambrose/prometheus-agent, it is now based on Ubuntu 24.04 (noble) rather than 26.04, so apt packages come from the noble archive.

Also in this release

  • Docs: the README and llms.txt describe the JVM metric groups and point to SECURITY.md for reporting a vulnerability. The website explains both fixes, with a Troubleshooting entry for the port conflict behind a failed start.
  • Release tooling: make release checks that a release is ready before publishing anything (a clean, up-to-date master with passing CI, the version bumped everywhere, and not already published), runs the full test suite, asks once, then publishes to Maven Central and Docker Hub and verifies the images.
  • CI:
    • zizmor audits the GitHub Actions workflows on every pull request, and following its findings, checkouts no longer leave the job's token in the git config, and Dependabot waits seven days after a release.
    • The image scan uploads only HIGH and CRITICAL findings to code scanning.
    • A weekly workflow deletes Actions caches no run can use again.
    • Both coverage floors run in one step.
  • The nginx reverse-proxy example enables HTTP/2 with http2 on; and no longer logs a deprecation warning at startup. The container tests no longer leave a ~591 MB image behind on every run.
  • Dependency updates:
    • Runtime: common-utils 5.0.0 → 5.1.1, grpc 1.84.0 → 1.84.2, netty-tcnative 2.0.81.Final → 2.0.84.Final (for BoringSSL fixes), Kotlin 2.4.20 → 2.4.21, and Logback 1.6.4 → 1.6.5.
    • Build only: Gradle 9.8.0 → 9.8.1 and Kover 0.9.9 → 0.9.11.

Artifacts

  • prometheus-proxy.jar / prometheus-agent.jar — standalone fat JARs, and prometheus-proxy-4.3.0-sources.jar, attached below
  • Maven Central: com.pambrose:prometheus-proxy:4.3.0
  • Docker: pambrose/prometheus-proxy:4.3.0, pambrose/prometheus-agent:4.3.0
  • Homebrew: pambrose/tap/prometheus-proxy, pambrose/tap/prometheus-agent
  • Helm: charts/prometheus-proxy, charts/prometheus-agent

Full release notes are in RELEASE_NOTES.md; the itemized list is in CHANGELOG.md.

Full Changelog: 4.2.0...4.3.0

Assets 5
Loading