prometheus

v3.5.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 17d Monitoring & Metrics

✓ No known CVEs patched

This release patches 1 known CVE

Topics

alerting graphing prometheus monitoring time-series

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 10d

The release bumps the `sanitize-html` dependency to v2.17.5, fixing CVE-2026-53606.

Why it matters: CVE-2026-53606 is addressed by upgrading sanitize‑html to version 2.17.5; update immediately if using an earlier version.

AI summary

Bump sanitize-html to v2.17.5 to fix CVE-2026-53606.

Type	Severity	Summary	CVE
Security	Critical	Bumps `sanitize-html` dependency to v2.17.5 fixing CVE-2026-53606. Bumps `sanitize-html` dependency to v2.17.5 fixing CVE-2026-53606. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

This release is built with Go 1.25.12 and fixes a security issue in a UI dependency.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track prometheus

Get notified when new releases ship.

About prometheus

The Prometheus monitoring system and time series database.