Highlights
- MongoDB 8.3 and 9.0: no more scrape errors from the new histograms. MongoDB 8.3 added a latency histogram to
opLatencies, and MongoDB 9.0 addedqueueWaitTimeMicrosbuckets toqueuesandwiredTiger.concurrentTransactions. The exporter turned every bucket into the same series, so each scrape logged dozens to hundreds of collection errors and dropped them. They are now exported as histograms, one series per bucket, labelled by its bound (microsforopLatencies,lower_boundfor the queue buckets) (#1356, #1383).- Behaviour change: like the other diagnostic-data histograms, these series are only exported with
--collector.diagnosticdata-histograms. Nothing that worked before is lost.
- Behaviour change: like the other diagnostic-data histograms, these series are only exported with
- Docker images: no more per-architecture tags.
0.54.0and0.54are multi-arch images (amd64 and arm64) on docker.io and ghcr.io, and Docker pulls the right one automatically. The-amd64and-arm64v8tags are no longer published; existing ones stay. If you pinned one, switch to the plain tag (#1358). - Credentials no longer appear in logs. MongoDB URIs carrying a password are redacted before they are logged (#1347).
- Security fixes. Built with Go 1.27.2 (CVE-2026-78667, and CVE-2026-39821 from #1351) and
golang.org/x/net0.60.0 (CVE-2026-78669) (#1387).golang.org/x/mod0.40.0 fixes CVE-2026-56864 and CVE-2026-56865; it is only used by the build tools (#1352).
What's Changed
- chore(deps): bump github.com/alecthomas/kong from 1.16.0 to 1.16.1 by @dependabot[bot] in #1338
- chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #1343
- chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in #1341
- chore(deps): bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.8 by @dependabot[bot] in #1344
- chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.12.2 to 2.13.1 in /tools by @dependabot[bot] in #1342
- Redact MongoDB URI credentials before logging them by @ademidoff in #1347
- chore: Go toolchain, golangci-lint pin, VERSION, and two CI test flakes by @ademidoff in #1351
- Bump golang.org/x/mod to v0.40.0 (CVE-2026-56864, CVE-2026-56865) by @ademidoff in #1352
- chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.13.1 to 2.13.2 in /tools by @dependabot[bot] in #1353
- chore(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.37.9 by @dependabot[bot] in #1355
- chore(deps): bump github.com/prometheus/exporter-toolkit from 0.17.1 to 0.19.0 by @dependabot[bot] in #1354
- fix: handle the opLatencies histogram MongoDB 8.3 added by @ademidoff in #1356
- ci: reuse the Go module cache in the dry-run and migrate to dockers_v2 by @ademidoff in #1358
- chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in the go_modules group across 1 directory by @dependabot[bot] in #1357
- chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #1360
- chore(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 by @dependabot[bot] in #1359
- chore(deps): bump github.com/prometheus/common from 0.70.1 to 0.71.0 by @dependabot[bot] in #1361
- chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 by @dependabot[bot] in #1367
- chore(deps): bump go.mongodb.org/mongo-driver from 1.17.9 to 1.17.10 by @dependabot[bot] in #1366
- chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go_modules group across 1 directory by @dependabot[bot] in #1365
- chore(deps): bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 by @dependabot[bot] in #1374
- chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #1372
- chore(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #1371
- chore(deps): bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 by @dependabot[bot] in #1377
- chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #1373
- chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.13.2 to 2.14.0 in /tools by @dependabot[bot] in #1376
- chore(deps): bump github.com/prometheus/exporter-toolkit from 0.19.0 to 0.20.0 by @dependabot[bot] in #1375
- Build the GSSAPI test behind its tag, and fail loudly on a stopped test container by @ademidoff in #1369
- PMM-7 Fix MongoDB 9.0 histograms and tests. by @JiriCtvrtka in #1383
- chore(deps): bump github.com/prometheus/common from 0.71.0 to 0.72.0 by @dependabot[bot] in #1380
- chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in the go_modules group across 1 directory by @dependabot[bot] in #1370
- chore(deps): bump reviewdog/action-golangci-lint from 2.10.0 to 2.10.2 by @dependabot[bot] in #1382
- chore(deps): bump github.com/foxcpp/go-mockdns from 1.2.0 to 1.3.0 by @dependabot[bot] in #1381
- PMM-15225 Bump x/net to v0.60.0 and Go to 1.27.2 by @ademidoff in #1387
- chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #1386
- chore(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 by @dependabot[bot] in #1385
- chore(deps): bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 by @dependabot[bot] in #1384
- PMM-7 Remove built images in test-cluster-clean by @ademidoff in #1389
Full Changelog: v0.53.0...v0.54.0