grafana/pyroscope v2.3.3

on GitHub

Security fixes

• Updated the Go build toolchain to 1.26.10 and distroless runtime images to include the compromised certificate authority mitigations (#5890).
• Updated golang.org/x/net to v0.60.0 to address HTTP/2 vulnerabilities (#5792).
• Updated github.com/getkin/kin-openapi to v0.149.0 to address validation bypass and denial-of-service vulnerabilities (#5833).
• Updated UI Vite to v8.3.4 and source-map-js to v1.2.2 to address dependency vulnerabilities (#5892).

Bug fixes

• Fixed decoding of resource and scope attributes stored in the OpenTelemetry profiles dictionary (#5895).

Changelog

• 252dabb Update golang version to 1.26.9 (#5788) (#5789)
• 98f09c5 [release/v2.3] chore(deps): update Go to 1.26.10 and distroless runtime images (#5890)
• 2d1517e [release/v2.3] fix(ui): backport source-map-js and Vite security fixes (#5892)
• 14a6a23 chore(deps): lock file maintenance (#5633)
• aaa211b chore: prepare v2.3 publishing for the v2.4 release (#5798)
• ae3d4ea docs: prepare v2.3.3 security release notes (#5897)
• adf45a9 fix(deps): update golang.org/x/net to v0.60.0 [security] (#5792)
• d0556da fix(security/high/): update module github.com/getkin/kin-openapi to v0.149.0 [security] (#5833)
• 063a43b fix: resource and scope attributes encoded through the profiles dictionary (#5857) (#5895)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.3.3