This release contains 37 PRs from 9 authors. Thank you!

Changelog

2.17.12

[CHANGE] Alertmanager: Require explicit SNS receiver credentials (access key and secret key) by default to prevent tenant receivers from using the Alertmanager's AWS credentials. The previous behavior can be restored with -alertmanager.require-explicit-sns-credentials=false. #17317
[CHANGE] Alertmanager: Validate tenant configuration when loading it from storage, not only when receiving it via API. Existing configurations can be exempted with -alertmanager.tenants-exempt-from-config-validation-for-existing-config; newly uploaded configurations must still pass validation. #17317
[ENHANCEMENT] Ingester: Optimize TSDB head chunk access during compaction to avoid O(n²) linked-list walks. #16373
[BUGFIX] Ingester: Wrap TSDB in-order and out-of-order head chunk IDs so they cannot overflow into the OOO flag bit and abort head compaction. #16569
[BUGFIX] Update to Go v1.26.3 to address high-severity CVEs CVE-2026-42501, CVE-2026-39836, CVE-2026-33811, CVE-2026-33814, CVE-2026-42499, CVE-2026-39820 and other lower-severity CVEs. #15401
[BUGFIX] Update to Go v1.26.10 to address CVE-2026-111943. #17262
[BUGFIX] Ingester: Fix out-of-order queries blocking TSDB head truncation/compaction. #16366
[BUGFIX] Alertmanager: Fix an issue where configuration that referenced files could load local files. Resolves CVE-2026-81938. #16785

All changes in this release: mimir-2.17.11...mimir-2.17.12