deckhouse/prompp v0.8.16

on GitHub

Features

1. Append and WAL latency can now be broken down by stage. New low-overhead counters report the duration and execution count of caller-side append stages (prompp_head_append_stage_*), the maximum duration across shards (prompp_head_append_shard_stage_*), and WAL operations (prompp_shard_wal_stage_*). The metrics distinguish semaphore waits, relabeling and cache hits or misses, data-storage writes, WAL writes, commits, flushes and syncs without adding a shard_id label (#529).
2. Previously unattributed relabeling and label-storage memory is now visible. prompp_scrape_relabeling_caches_bytes reports scrape and report-state mapping caches per scrape job, with memoized C++ measurements to avoid a cgo call on every steady-state scrape. prompp_head_cgo_memory_bytes now reports the ingestion-only input LSS under allocator="input_lss"; allocator="main_lss" contains only the target LSS, so their sum preserves the previous total (#533).

Fixes

1. Persisting a head can no longer read a stale chunk iterator after loading the next batch. The recoder used to position the next batch before Loader::load_finalize could replace a finalized chunk, leaving cached pointers to freed memory. Depending on allocator reuse this caused a crash in ChunkRecoderIterator, wrote overlapping chunks that later failed compaction, or skipped a batch that appeared empty before loading. The iterator is now positioned only after the batch has been loaded (#531).
2. Compaction safely treats empty input and an all-corrupted input set as a no-op. Both the upstream TSDB compactor path and the Prom++ lcompactor path now return no block instead of dereferencing an empty meta list, panicking, or attempting to write a bogus block. Corrupted blocks remain marked and are excluded from the next plan, so the compaction loop terminates normally (#532, #534).
3. Two C++ undefined-behaviour paths were hardened. The WAL timestamp encoding heuristic now uses guarded unsigned arithmetic instead of underflowing, and jemalloc's slab-bitmap exhaustion path aborts on the violated allocator invariant instead of retrying an allocation through an out-of-bounds bitmap access (#535).
4. Go updated to 1.26.9, closing the twelve standard-library advisories govulncheck reports as reachable against the 1.26.8 toolchain the previous release was built with: in net/http, HTTP/2 server memory exhaustion through declared Trailer fields (GO-2026-6603), HTTP/1 client connection desynchronization after a rejected CONNECT (GO-2026-6605), an unbounded Range header parse (GO-2026-6609), the HTTP/2 transport accepting malformed framing headers (GO-2026-6610), CPU exhaustion from repeated initial window changes (GO-2026-6611), a double connection-level flow-control refund on reset streams (GO-2026-6612), HTTP/1 server desynchronization after a 2xx CONNECT response (GO-2026-6613) and an HPACK encoder race crashing the HTTP/2 server (GO-2026-6617); a memory-limit bypass parsing MIME headers in net/textproto and mime/multipart (GO-2026-6608); malformed ECH outer extension references in crypto/tls (GO-2026-6607); and two JavaScript context-tracking errors in html/template, both reachable through the template expander and the web handlers (GO-2026-6599, GO-2026-6600). The thirteenth advisory of this release, os.Root.Mkdir following junctions out of the root (GO-2026-6604), is Windows-only and does not apply to the shipped builds. Both the CI image and the werf build pin the new version.
5. golang.org/x/net updated to v0.60.0, together with the compatible x/crypto v0.57.0, x/mod v0.41.0, x/sync v0.23.0, x/sys v0.48.0, x/term v0.46.0 and x/text v0.42.0. Five of the HTTP/2 defects above also live in x/net/http2 (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617), and that package is linked into the binaries through prometheus/common/config, which configures the HTTP/2 transport of every scrape and remote-write client (#536).
6. source-map-js updated to 1.2.2 in the web UI, closing GHSA-68fv-2mgg-jv7q — indexed source-map section offsets are read without validation, so a crafted map can stall the event loop. It reaches the shipped UI through sanitize-html → postcss. The braces advisory GHSA-vfj7-8cjw-p6xm has no fixed release and is reachable only through the sass compiler and the dev-server proxy, neither of which ends up in the embedded bundle, so it is left in place.

Performance

1. WAL v2 commits only the shard whose segment reached its size limit. Cold shards are no longer forced to emit small segments and perform write/fsync work whenever a busy shard fills up. WAL v1 retains the commit-all behaviour. The v2 loader now accepts uneven shard segment counts and validates the global segment-ID sequence, including a missing ID 0 and empty shards. A head keeps the behaviour of the format stored on disk when the feature flag changes. Downgrading below this release with WAL v2 enabled is not supported: older versions can mark a head with uneven shard files read-only (#524).
2. Identical timestamp sequences are shared inside DataStorage. The timestamp encoder is replaced by a reference-counted sequence dictionary, so series with the same timestamp progression reuse one encoded stream instead of keeping duplicate timestamp state and finalized streams. Chunk lifecycle, serialization and memory accounting now operate on the shared sequence IDs (#530).

Other

1. The first part of the head catalog v3 codec is in place, without changing the production on-disk format. The new codec supports per-record field presence, protobuf payloads and CRC32C-framed records; v1 and v2 codecs were split into explicit implementations. Production and prompptool continue to write v2, so rollback remains safe. Runtime retention decisions can now use a head's actual maxt after rotation or persistence, falling back to createdAt after a v2 restart (#528).