loki

3.7.3 (2026-06-24)

⚠ BREAKING CHANGES

• operator: switch default for OpenShift stream labels (#21001)

Features

• add bloom filter to cache known streams for ExceedsLimits requests (#20823) (f5440a3)
• add builder pool to logsobj package (#21134) (8a68101)
• add case-insensitive regex optimization (#20578) (f6a6a4f)
• Add config to delegate stream limits check to limits-service only (#21007) (ba119f6)
• add flush manager to control data object flush lifecycle (#20680) (c169ce3)
• add GroupConsumer to kafkav2 package (#20748) (5ad60ee)
• Add results cache to thor query engine (#20986) (6ef3827)
• Add SubstringInsensitive compute fn (#20584) (9c03192)
• Align start time when the query is received (#20967) (8e18f10)
• allow the initial offset to be set in the starting phase (#20770) (93f4bdf)
• Batch records before writing to sinks (#20821) (f083618)
• bench: add simulated object storage latency to LogQL benchmarks (#20733) (5102ed0)
• build: Move to Go 1.26 (#20988) (4fb960c)
• close the records chan when consumer terminates (#20761) (c3d0de9)
• dataobj-compactor: add a planner for compaction of data objects (#20527) (7f1450d)
• don't shuffle shard if shard factor is 1 (#21190) (7ac1d16)
• early goldfish correlation ID generation with X-Loki-Goldfish-ID header (#21155) (e90e4a6)
• engine: Dedupe entries when building final result (#21034) (e95137a)
• enginev2: Implement IsMember compute function (#20689) (a28d8b4)
• enginev2: Implement regexp compute function (#20642) (7b8d51b)
• enginev2: Implement substr compute function (#20641) (9740619)
• helm: Add common labels to all resources (#20269) (dc21099)
• helm: allow customization of write, read and backend PDB (#16871) (9f653b1)
• helm: finalize chart fork (#21166) (33f7a1b)
• helm: Memcached: allow to override CPU in the auto-computed resource mode (#20767) (3886548)
• Introduce a rate batcher to batch rate updates (#20784) (b9a0a15)
• limits: Add emptiness check to prepare for multiAZ (#20927) (4eeb70c)
• loki-query-engine: instrument query-engine with runtime/trace (#21000) (a7c75a6)
• loki: allow disabling cache for query_range requests (#21112) (1242aa5)
• operator: add option to customize gateway server cert (#20325) (3c8b9e8)
• operator: switch default for OpenShift stream labels (#21001) (61ec040)
• operator: Update Loki operand to v3.6.5 (#20696) (d81e977)
• operator: update metrics authentication to remove dependency on kube-rbac-proxy (#20853) (2de6e79)
• put kotel behind a flag (#20933) (f8e2d64)
• query-engine: Omit labels with empty values (#21173) (5c17103)
• refactor frontend cache, add metrics, filter out cached streams (#20860) (a63f0c3)
• release 3.7 (#21270) (21d5b59)
• Remove Promtail support (backport k299) (#21248) (939d15f)
• reset the consumption lag gauge after 1 minute of idle period (#20616) (f1d0cdf)
• separate metastore events and offsets from flushes (#20605) (cb938d0)
• Update references to v3.7.0 (backport k299) (#21274) (3361de2)
• Update to go 1.25.7 (#20694) (3a6ba0d)
• use stream sharding within segment subrings (#21181) (2def797)
• V2 query engine limits (#20549) (7151be7)

Bug Fixes

• Add build tags to Promtail build commands (#19989) (5596bdc)
• alloc: set a limit on preallocations (#20891) (9525e53)
• allow blocking multiple query hashes (#21103) (4c645c6)
• backoff if no records returned, instead of at least one error (#20747) (eab506d)
• broken get and replace for s3 client (#21163) (e6abd15)
• cancelation in kafkv2/consumer.go (#20745) (f9f20e5)
• ci: Log into dockerhub (#22528) (3584391)
• ci: prepare release 3.7.3 (82cdcdc)
• ci: Remove test checking for nfpm vars, like main (#22501) (5f48f39)
• ci: Use latest version of loki-release for capital letter support (#22520) (42c5158)
• ci: Use latest workflow definitions for 3.7.x (#22496) (0bed459)
• correct missing accumulation metric (#20734) (88cb599)
• correct relative path to configuration examples (#20546) (9001084)
• correctness failure for aggregations with a drop (#20782) (3b44b80)
• CVEs in release 3.7.x (#21771) (bb4c5d8)
• dataobj-inspect: Enhance dump and list-streams commands (#20757) (cd3fd30)
• dataobj: Also apply categorize labels to parsed labels (#20671) (660ce3f)
• dataobj: Avoid deadlock in index-builder when cancelling mid-build (#20621) (294d574)
• dataobj: Mark events completed after successful commit (#20658) (328f3d4)
• deps: update github.com/prometheus/prometheus digest to 02b1aba (main) (#20964) (4fff517)
• deps: update github.com/prometheus/prometheus digest to 1751685 (main) (#21028) (a9fa799)
• deps: update github.com/prometheus/prometheus digest to 3b1d658 (main) (#21003) (0ebaec5)
• deps: update github.com/prometheus/prometheus digest to 8b25b26 (main) (#21038) (5bee0b0)
• deps: update github.com/prometheus/prometheus digest to c317f92 (main) (#20958) (84ffd0d)
• deps: update module charm.land/bubbletea/v2 to v2.0.2 (main) (#21035) (9dfac55)
• deps: update module charm.land/lipgloss/v2 to v2.0.2 (main) (#21143) (99b89ec)
• deps: update module cloud.google.com/go/bigtable to v1.42.0 (main) (#20737) (6c304a8)
• deps: update module cloud.google.com/go/bigtable to v1.43.0 (main) (#21209) (ce89334)
• deps: update module cloud.google.com/go/storage to v1.59.2 (main) (#20632) (e3f2d18)
• deps: update module cloud.google.com/go/storage to v1.61.3 (main) (#21161) (0a47c34)
• deps: update module github.com/alecthomas/chroma/v2 to v2.23.1 (main) (#20570) (22b955e)
• deps: update module github.com/alicebob/miniredis/v2 to v2.36.1 (main) (#20564) (03fcc22)
• deps: update module github.com/alicebob/miniredis/v2 to v2.37.0 (main) (#21017) (041950d)
• deps: update module github.com/apache/arrow-go/v18 to v18.5.1 (main) (#20574) (615e2a6)
• deps: update module github.com/apache/arrow-go/v18 to v18.5.2 (main) (#21052) (2fea9be)
• deps: update module github.com/aws/aws-sdk-go-v2/config to v1.32.10 (main) (#20991) (ed30f95)
• deps: update module github.com/aws/aws-sdk-go-v2/config to v1.32.12 (main) (#21091) (9555486)
• deps: update module github.com/aws/aws-sdk-go-v2/config to v1.32.9 (main) (#20901) (7170a1f)
• deps: update module github.com/aws/aws-sdk-go-v2/credentials to v1.19.12 (main) (#21092) (fde8984)
• deps: update module github.com/aws/aws-sdk-go-v2/credentials to v1.19.9 (main) (#20902) (43bbe5e)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.54.0 (main) (#20568) (2a39e8c)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.55.0 (main) (#20729) (0aea290)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.56.0 (main) (#20995) (cd1000e)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.56.2 (main) (#21093) (3b05fe7)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.96.0 (main) (#20633) (3da63c5)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.96.1 (main) (#20993) (d36987e)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.96.2 (main) (#21025) (b24c270)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.1 (main) (#21094) (dc46c09)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [security] (release-3.7.x) (#21457) (7bc9450)
• deps: update module github.com/aws/smithy-go to v1.24.1 (main) (#20939) (9926aa9)
• deps: update module github.com/aws/smithy-go to v1.24.2 (main) (#21036) (07c0410)
• deps: update module github.com/baidubce/bce-sdk-go to v0.9.259 (main) (#20644) (09c2509)
• deps: update module github.com/baidubce/bce-sdk-go to v0.9.260 (main) (#20816) (7b229cd)
• deps: update module github.com/baidubce/bce-sdk-go to v0.9.262 (main) (#21142) (bafd8f4)
• deps: update module github.com/bmatcuk/doublestar/v4 to v4.10.0 (main) (#20601) (af2487f)
• deps: update module github.com/buger/jsonparser to v1.1.2 [security] (main) (#21200) (3a33aa7)
• deps: update module github.com/charmbracelet/bubbles to v0.21.1 (main) (#20713) (06c1280)
• deps: update module github.com/charmbracelet/bubbles to v1 (main) (#20788) (b76a53f)
• deps: update module github.com/charmbracelet/bubbles to v2 (main) (#21005) (444e6b0)
• deps: update module github.com/datadog/sketches-go to v1.4.8 (main) (#20940) (db66b9f)
• deps: update module github.com/fsouza/fake-gcs-server to v1.54.0 (main) (#20687) (aaa306f)
• deps: update module github.com/grafana/loki/v3 to v3.6.4 (main) (#20563) (65ee190)
• deps: update module github.com/grafana/loki/v3 to v3.6.5 (main) (#20746) (ed204f9)
• deps: update module github.com/grafana/loki/v3 to v3.6.6 (main) (#20907) (55faade)
• deps: update module github.com/grafana/loki/v3 to v3.6.7 (main) (#20975) (911fce4)
• deps: update module github.com/hashicorp/consul/api to v1.33.4 (main) (#20961) (d4c7fe6)
• deps: update module github.com/heroku/x to v0.5.3 (main) (#20637) (d6f34e8)
• deps: update module github.com/ibm/ibm-cos-sdk-go to v1.14.0 (main) (#21063) (f78778e)
• deps: update module github.com/ibm/sarama to v1.47.0 (main) (#21029) (5393bf9)
• deps: update module github.com/influxdata/telegraf to v1.37.2 (main) (#20707) (5a71216)
• deps: update module github.com/klauspost/compress to v1.18.4 (main) (#20743) (fe47956)
• deps: update module github.com/minio/minio-go/v7 to v7.0.99 (main) (#21096) (1f196f6)
• deps: update module github.com/parquet-go/parquet-go to v0.28.0 (main) (#20973) (0edcd60)
• deps: update module github.com/parquet-go/parquet-go to v0.29.0 (main) (#21156) (d56d6d2)
• deps: update module github.com/pierrec/lz4/v4 to v4.1.26 (main) (#21109) (69eabad)
• deps: update module github.com/pressly/goose/v3 to v3.27.0 (main) (#20965) (694d42e)
• deps: update module github.com/prometheus/alertmanager to v0.31.0 (main) (#20692) (9e3f94b)
• deps: update module github.com/prometheus/alertmanager to v0.31.1 (main) (#20815) (9fe7528)
• deps: update module github.com/prometheus/sigv4 to v0.4.1 (main) (#20688) (75cb1c4)
• deps: update module github.com/redis/go-redis/v9 to v9.17.3 (main) (#20597) (c3cff2c)
• deps: update module github.com/redis/go-redis/v9 to v9.18.0 (main) (#20878) (b7cfa4f)
• deps: update module github.com/shirou/gopsutil/v4 to v4.26.1 (main) (#20635) (734e237)
• deps: update module github.com/shirou/gopsutil/v4 to v4.26.2 (main) (#21031) (bf192d2)
• deps: update module github.com/tjhop/slog-gokit to v0.1.6 (main) (#21080) (19894ab)
• deps: update module github.com/twmb/franz-go to v1.20.7 (main) (#20908) (21cf5f0)
• deps: update module github.com/twmb/franz-go/pkg/kadm to v1.17.2 (main) (#20566) (8092a8a)
• deps: update module go.opentelemetry.io/collector/pdata to v1.50.0 (main) (#20558) (fdcb6f1)
• deps: update module go.opentelemetry.io/collector/pdata to v1.51.0 (main) (#20700) (56633ae)
• deps: update module go.opentelemetry.io/collector/pdata to v1.52.0 (main) (#20909) (755d465)
• deps: update module go.opentelemetry.io/collector/pdata to v1.53.0 (main) (#21058) (a06244a)
• deps: update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.65.0 (main) (#20701) (e815af4)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.65.0 (main) (#20702) (9643aaa)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.67.0 (main) (#21073) (df4e1f5)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.65.0 (main) (#20703) (6f22714)
• deps: update module go.opentelemetry.io/otel/sdk to v1.42.0 (main) (#21065) (9f5f159)
• deps: update module golang.org/x/net to v0.50.0 (main) (#20795) (705ba84)
• deps: update module golang.org/x/oauth2 to v0.35.0 (main) (#20740) (7c7b1fe)
• deps: update module golang.org/x/oauth2 to v0.36.0 (main) (#21099) (cb058ba)
• deps: update module golang.org/x/sys to v0.41.0 (main) (#20759) (9da5d5e)
• deps: update module golang.org/x/text to v0.34.0 (main) (#20792) (4d437a3)
• deps: update module golang.org/x/text to v0.35.0 (main) (#21158) (7b863a3)
• deps: update module golang.org/x/tools to v0.42.0 (main) (#20796) (de16cb3)
• deps: update module golang.org/x/tools to v0.43.0 (main) (#21169) (71c9cee)
• deps: update module google.golang.org/api to v0.266.0 (main) (#20483) (a5e5c06)
• deps: update module google.golang.org/api to v0.267.0 (main) (#20900) (3aa987c)
• deps: update module google.golang.org/api to v0.268.0 (main) (#20989) (42ab348)
• deps: update module google.golang.org/api to v0.269.0 (main) (#21014) (d1f08ff)
• deps: update module google.golang.org/api to v0.272.0 (main) (#21151) (dc38b6a)
• deps: update module google.golang.org/grpc to v1.78.0 (main) (#20380) (eccec66)
• deps: update module google.golang.org/grpc to v1.79.1 (main) (#20813) (60c67f2)
• deps: update module k8s.io/apimachinery to v0.35.1 (main) (#20758) (12c35dd)
• deps: update module k8s.io/apimachinery to v0.35.2 (main) (#20997) (cf5e892)
• deps: update module k8s.io/apimachinery to v0.35.3 (main) (#21197) (8f2840b)
• deps: update module k8s.io/klog/v2 to v2.140.0 (main) (#21087) (5e6548d)
• deps: use correct google.golang.org/genproto/googleapis/rpc transitive module (#20898) (8d268fb)
• duplicate lines with different structured metadata (#21039) (60a1567)
• engine: align range-query evaluation timestamps to the step grid (#20904) (28d03ec)
• engine: correct 'end' attribute in Basic.Execute trace span (#20561) (1fa1a15)
• engine: fix additional instances of writing/reading on a closed conn (#20982) (1f7cacf)
• enginev2: Copy values when storing min/max stats (#20589) (6f72400)
• Fix ruler panic related to unset validation scheme (backport release-3.7.x) (#21401) (cf65729)
• fix two skipped logql benchmark queries (#20897) (773b760)
• Fix typo in Helm deployment guide (#20608) (4a2ce63)
• force releaseplease version (#21272) (e0b94ef)
• goldfish: Normalize goldfish response (#21114) (616ec8d)
• goldfish: support nulls in mismatch_cause (#21082) (26d9031)
• handle lost partitions in index builders (#20744) (2949f75)
• helm: add support for disabling x509 strict verification in sidecar (#20818) (2a8ac94)
• helm: apply trafficDistribution setting to SingleBinary service (#20894) (bceabc3)
• helm: fix syntax in loki-egress-dns CiliumNetworkPolicy manifest (#20221) (182614c)
• helm: ignore dots after first path segment when detecting image registry (#20695) (1b97cbf)
• helm: make the loki-sc-rules sidecar container compatible with the most recent versions of k8s-sidecar (#20164) (3ee659f)
• helm: Update version in values.yaml (#20548) (5dba487)
• if we don't know the rate of a segmentation key, shard the stream (#21210) (a126c3c)
• logql: return error on way-too-long label string (#20937) (9c9660a)
• loki/single-binary: Add missing command to statefulset-recreate-job (#20556) (9851174)
• Mask all credentials (#20766) (f8d94cb)
• operator: add additional port to networkpolicy when using Swift (#20129) (1180fff)
• operator: always generate full set of condition metrics for each LokiStack (#19509) (973bb71)
• operator: CI has now moved to Vault so reusable workflow doesn't need to ask for secrets (#21174) (5c9b477)
• operator: configure to extract selectors to allow fine-grained auth in openshift-network mode (#19958) (0ba8573)
• operator: dynamically configure networkpolicy when a Kubernetes service is used for object storage (#20111) (e8a998b)
• operator: fix incorrect image reference in olm bundle (#20966) (84bc9bc)
• operator: include Loki Operator in the Observability category in Operator Hub (#21084) (913c598)
• operator: networkpolicies allow access through proxy port when a proxy is configured (#20194) (ef15181)
• operator: properly handle the deprecated replicationFactor (#20935) (1b96366)
• operator: provide AWS region in environment variable for STS mode (#21136) (cb261d9)
• operator: set ingester minimum available pods based on replication factor (#19517) (efc63e8)
• operator: Update maximum OpenShift version (#20600) (fce93a8)
• prevent goroutine leak in downstreamer on context cancellation (#21062) (2891919)
• query-engine: Fix OR operations being silently dropped (#21204) (20ea556)
• query-scheduler: Only do alignment for metric queries (#21030) (a881457)
• querytee: Compare parsed labels instead of structured metadata (#21018) (7a5ef78)
• reject streams with labels exceeding 16MB (#20719) (bbff433)
• Reset lag for index builder when partitions change (#20825) (b9af4f5)
• revert "feat: reset the consumption lag gauge after 1 minute of idle period" (#20617) (45a7f55)
• sanitize User-Agent to valid UTF-8 before using as Prometheus label value (#21162) (ed3cf08)
• security/HIGH/cmd/dataobj-inspect: Update module go.opentelemetry.io/otel to v1.41.0 [SECURITY] (release-3.7.x) (#22188) (dc8f4de)
• security/HIGH/: Update module github.com/containerd/containerd/v2 to v2.0.9 [SECURITY] (release-3.7.x) (#22187) (365c7e9)
• security/UNKNOWN/cmd/chunks-inspect: Update go toolchain directive to v1.25.11 [SECURITY] (release-3.7.x) (#22192) (d5d7a54)
• security/UNKNOWN/cmd/dataobj-inspect: Update go module directive to v1.25.11 [SECURITY] (release-3.7.x) (#22184) (6b77fa9)
• security/UNKNOWN/cmd/dataobj-inspect: Update security cmd/dataobj-inspect golang.org/x/sys to v0.44.0 [SECURITY] (release-3.7.x) (#22193) (707bcf7)
• security/UNKNOWN/pkg/push: Update go toolchain directive to v1.25.11 [SECURITY] (release-3.7.x) (#22199) (9ea02bf)
• security/UNKNOWN/: Update security golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.7.x) (#22189) (6383bfe)
• security/UNKNOWN/: Update security golang.org/x/net to v0.55.0 [SECURITY] (release-3.7.x) (#22190) (3d93fb8)
• security/UNKNOWN/: Update security golang.org/x/sys to v0.44.0 [SECURITY] (release-3.7.x) (#22191) (3379538)
• service failure on stopping kafkav2 consumer (#20672) (fcdd2ad)
• set consumption lag to zero after idle flush timeout (#20620) (14d2285)
• skip benchmark queries unsupported by v2 engine for goldfish comparison (#21186) (a668dca)
• storage: attach SHA-256 checksum on PutObject for Object Lock buckets (#21849) (7df13d9)
• test: Ensure timestamp test works in all timezones (#20916) (1bf3b78)
• Thor: Allow non-strict parsing with logfmt (#21013) (2b0a5a6)
• thor: Fix error filtering before range aggregations (#20560) (514a142)
• thor: Fix for column duplicates in consequent compat stages (#20893) (0b483ab)
• thor: incorrect empty records skipping (#20812) (b1f059d)
• thor: Return empty log lines properly for the new engine (#20971) (b2d98d6)
• typo - oki -> loki (#21051) (50d878b)
• Upgrade Go and gRPC versions on 3.7.x (#21282) (2c8fff2)
• Use newer Go in fluentbit and fix canary test (backport k299) (#21257) (e437140)
• use TrimSuffix over Trim (#20830) (1cb060b)
• WAL replay hang when flush doesn't progress (#21176) (fb58ab8)
• wire: fix panic on accept (#20720) (d5d2b3f)

Performance Improvements

• avoid bytes to runes allocs by decoding in place (#20602) (a4e75ce)
• dataobj: Optimize estimate size calculation (#20595) (9ccf55d)
• dataset: use faster Uvarint implementation (#20824) (ced1d1b)
• logql: use simpler function to drop empty labels (#20938) (b162e1e)
• operator: simplification to status validation (#20725) (834cf12)
• Prealloc slice in index builder when downloading objects (#20647) (08e5c9d)
• tsdb: don't fetch labels in TSDBIndex.GetChunkRefs (#20970) (d94ee60)
• tsdb: return full slice to pool after use (#20969) (6b58156)

3.6.12 (2026-06-24)

⚠ BREAKING CHANGES

• operator: consolidate image build workflows and improve documentation (#19395)
• move the Loki UI to a Grafana Plugin (#19390)
• operator: CI publishing image strategy (#19365)

Features

• add json parsing stage to v2 engine (#19240) (aec34ed)
• add logfmt parse support to the v2 query engine (#18931) (ccb4549)
• add loki health command (backport release-3.6.x) (#20590) (dfdbe2a)
• add p50, p95 and p99 section sizes per tenant (#19054) (cb3b74a)
• add p50, p95 and p99 sections per tenant to stats (#19044) (d256df4)
• add rules check for namespace and group (#20437) (#20463) (7733ab1)
• build multi-tenant data objects (#19034) (f60f818)
• capture logs drilldown flag in query samples (#19242) (cb3f2ad)
• Change how analytics proxy works (#19098) (82d25df)
• compactor-hs: add a metric to track the number of jobs left to conclude ongoing unit of work (#19506) (9e0f50c)
• deletion: return request ID in response header (#19444) (6e6e8a9)
• drilldown config endpoint (#19028) (52b5d95)
• engine: More aggregations for the new query engine (#19350) (1474ede)
• engine: Prefetch inputs of Merge pipeline concurrently (#19039) (f50c87f)
• fluentd: Add 'compress gzip' setting to fluentd plugin (#18995) (1cda925)
• goldfish: improve query performance with indexes and paritions (#19023) (89509de)
• helm: Add startupProbe to memcached (#19166) (f799e9b)
• helm: Add startupProbe to memcached exporter (#19165) (901e574)
• helm: add configurable livenessProbe to single binary StatefulSet (#19072) (18b8995)
• helm: add dnsconfig to all missing resources (#18903) (ed68531)
• helm: Add health probes to gateway component (#18545) (82aa322)
• helm: Add health probes to loki in backend (#18548) (10441c8)
• helm: add more specificity to affinity and topology spread constraints (#17404) (#19061) (0819e48)
• helm: add replicas to loki-canary deployment (#19095) (c9d7d76)
• helm: add support for custom alert rule annotations (#19193) (2df5197)
• helm: allow extraObjects as dict (#13252) (6a953bb)
• helm: Only delete PVC on statefulset deletion, not scaling (#19097) (0cead58)
• helm: use named ports for memcached services targetports (#18990) (6a5be7e)
• implement unwrap as a projection (#19409) (3ce6fa2)
• implement volume-based pattern filtering (#18838) (71e2e01)
• logcli: add --log.level parameter (#19136) (77c18d9)
• loki-mixin: allow disabling thanos dashboard and fix dashboard's file name (#18749) (cadc824)
• move the Loki UI to a Grafana Plugin (#19390) (3a1e5ad)
• operator: Add alert LokiIngesterFlushFailureRateCritical (#18698) (66ebc5a)
• operator: Add warning alert for when LokiStack is not getting ready (#19258) (c47fe46)
• operator: deploy network policies with LokiStack (#19099) (6e6f61f)
• operator: s3 validation reject endpoints that contain a URL path (#19356) (f6ef4d8)
• operator: Update Loki operand to v3.5.4 (#19122) (155972e)
• operator: Update Loki operand to v3.5.5 (#19187) (743929b)
• per policy overridable stream limits (#18994) (af257fd)
• prepare Loki 3.6 (ab8e800)
• querytee: Add workflow_dispatch for querytee-images workflow (#19541) (4216f68)
• remove tenant topic tee (#19082) (a03e86c)
• single-binary: delete statefulset if volumeClaimTemplates changes (#19217) (da4240d)
• Update to go 1.25.7 (#20694) (#20717) (1967a6a)
• Upgrade go.opentelemetry.io/otel/sdk from v1.38.0 to v1.40.0 (#21115) (d1ab148)
• Upgrade Go to 1.25.8 (release-3.6.x) (#21240) (10d2666)
• Upgrade Go used by querytee/promtail to 3.6 (#21244) (41a4e0c)
• Use different debian version for fluent-bit (#21247) (138c391)

Bug Fixes

• add single-binary component to ingress NetworkPolicy (#19229) (1a7b489)
• Add special case handling for comparing empty and nil values (#19348) (af6983e)
• alloc: set a limit on preallocations (backport release-3.6.x) (#20920) (7e1daf3)
• apply global otlp config to tenant config only when it is updated in the overrides (#19213) (8057c5c)
• Backport gzip fix release 3.6.x (#20514) (d805266)
• Backporting 19989 into 3.6 (#21356) (0f56890)
• build: remove busybox from dockerfile (#19502) (f2ba692)
• build: rpm signature config (#19476) (352c046)
• bump go toolchain to 1.24.6 (#19449) (becdf9b)
• bump go version for 3.6.x (#20667) (b06b508)
• ci: Log into dockerhub for patch releases (#22529) (dfeedf2)
• ci: prepare release 3.6.12 (a25e0d9)
• ci: remove nfpm, like main (#22502) (1a7d0e2)
• correctly register allowed log level fields (d8c4997)
• CVEs in release 3.6.x (#21773) (1fe3b6d)
• deps: [Release 3.6.x] Update dskit to resolve Otel conflict (#20368) (fb05a36)
• deps: Loki 3.6.1 CVE updates (#20014) (2f85998)
• deps: patch mapstructure dependency to remove CVE (#19447) (e34530e)
• deps: update alpine docker tag to v3.23.3 (main) (#20630) (#20832) (fb20246)
• deps: update dependency @hookform/resolvers to v5.2.2 (main) (#19276) (2c02eaf)
• deps: update dependency lucide-react to ^0.544.0 (main) (#19310) (f744d38)
• deps: update dependency zod to v4 (main) (#18392) (6f45a17)
• deps: update module cloud.google.com/go/bigtable to v1.40.0 (main) (#19311) (93e2a33)
• deps: update module cloud.google.com/go/bigtable to v1.40.1 (main) (#19337) (e27e476)
• deps: update module cloud.google.com/go/storage to v1.57.0 (main) (#19312) (819c9c1)
• deps: update module github.com/aws/aws-sdk-go-v2/credentials to v1.18.15 (main) (#19338) (8b8d7de)
• deps: update module github.com/aws/aws-sdk-go-v2/credentials to v1.18.16 (main) (#19352) (9d44db8)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.50.5 (main) (#19340) (afce820)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.51.0 (main) (#19388) (ba5f308)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [security] (release-3.6.x) (#21459) (11c1d07)
• deps: update module github.com/baidubce/bce-sdk-go to v0.9.245 (main) (#19278) (295d660)
• deps: update module github.com/buger/jsonparser to v1.1.2 [security] (release-3.6.x) (#21201) (3185466)
• deps: update module github.com/charmbracelet/bubbletea to v1.3.10 (main) (#19279) (789da59)
• deps: update module github.com/docker/docker to v28.4.0+incompatible (main) (#19314) (7407527)
• deps: update module github.com/docker/docker to v28.5.0+incompatible (main) (#19414) (cfd7b12)
• deps: update module github.com/go-logfmt/logfmt to v0.6.1 (main) (#19412) (7f3d419)
• deps: update module github.com/grafana/loki/v3 to v3.5.5 (main) (#18444) (d54b6d8)
• deps: update module github.com/ibm/ibm-cos-sdk-go to v1.12.3 (main) (#19281) (3308ba5)
• deps: update module github.com/ibm/sarama to v1.46.1 (main) (#19282) (7335181)
• deps: update module github.com/oschwald/geoip2-golang to v1.13.0 (main) (#18354) (7508db8)
• deps: update module github.com/pressly/goose/v3 to v3.26.0 (main) (#19417) (b2a5c08)
• deps: update module github.com/shirou/gopsutil/v4 to v4.25.8 (main) (#19284) (a31a86c)
• deps: update module github.com/shirou/gopsutil/v4 to v4.25.9 (main) (#19366) (9f1c1a5)
• deps: update module github.com/sony/gobreaker/v2 to v2.2.1 (main) (#19285) (1112aef)
• deps: update module github.com/sony/gobreaker/v2 to v2.3.0 (main) (#19418) (f84a673)
• deps: update module github.com/spf13/afero to v1.15.0 (main) (#19317) (8854ac1)
• deps: update module github.com/stretchr/testify to v1.11.1 (main) (#19042) (014ec14)
• deps: update module github.com/workiva/go-datastructures to v1.1.6 (main) (#19287) (1704434)
• deps: update module go.opentelemetry.io/collector/pdata to v1.42.0 (main) (#19323) (568cdf1)
• deps: update module go.opentelemetry.io/collector/pdata to v1.43.0 (main) (#19419) (3e415ac)
• deps: update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.63.0 (main) (#18455) (5605b2d)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.63.0 (main) (#19324) (6270613)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.63.0 (main) (#19327) (8519187)
• deps: update module go.opentelemetry.io/otel/sdk to v1.40.0 [security] (release-3.6.x) (#20887) (d267ad3)
• deps: update module go.opentelemetry.io/otel/sdk to v1.43.0 [security] (release-3.6.x) (#21480) (47fb29e)
• deps: update module golang.org/x/net to v0.45.0 (main) (#19420) (1e8c50c)
• deps: update module golang.org/x/oauth2 to v0.31.0 (main) (#19329) (eaac4ae)
• deps: update module golang.org/x/time to v0.13.0 (main) (#19330) (de928b1)
• deps: update module google.golang.org/api to v0.250.0 (main) (#19331) (a0489e3)
• deps: update module google.golang.org/api to v0.251.0 (main) (#19368) (e09cdf6)
• deps: update module google.golang.org/api to v0.252.0 (main) (#19421) (af3e999)
• deps: update module google.golang.org/grpc to v1.75.1 (main) (#19288) (4e2c090)
• deps: update module google.golang.org/grpc to v1.79.3 [security] (release-3.6.x) (#21193) (87dff41)
• deps: update module google.golang.org/protobuf to v1.36.10 (main) (#19376) (c9f2666)
• deps: update module google.golang.org/protobuf to v1.36.9 (main) (#19289) (fd073bc)
• Do not override S3 region if already specified in configuration chain (backport release-3.6.x) (#20128) (38582ac)
• docker: missing permissions to start docker (backport release-3.6.x) (#19948) (48b507f)
• docker: set WORKDIR to root in loki Dockerfiles (#19952) (6040a09)
• don't need to open section to read tenant (#19053) (598cab7)
• downgrade UI's @swc/core dep back to v1.13.5 (#19345) (134c5af)
• extended detected level for debug and critical level (#18370) (2b01a31)
• fix context canceled stops reader from cleaning up (#19210) (acb8b89)
• fix possible data loss in dataobj-consumers (#19060) (44aba62)
• Fix push stats calculation (#19319) (a6d4935)
• Fix regression in S3 client configuration (backport release-3.6.x) (#20118) (7d8176f)
• helm: Add init container configuration for backend, bloom builder, distributor, query-frontend, query-scheduler, read, write. (#18709) (95ced86)
• helm: admin-api should only be deployed in microservice mode (#13655) (51d710f)
• helm: avoid double zonal ingester scrapping by not scrapping headless svc (#19000) (350d46c)
• helm: Do not strip whitespace in target definitions for querier and read deployments (#19464) (7c309fb)
• helm: explicitly set registry for k8s-sidecar image (#19233) (e0c07c4)
• helm: Remove flaky enterprise test (#19362) (a1c9512)
• helm: un-deprecate several features in monitoring block (#19012) (3272ca7)
• helm: Update querier, read, and single binary target definitions for UI enablement (#19461) (087430e)
• helm: Use strings in stead of integers for ports in CiliumNetworkPolicies (#19252) (3f41d14)
• LineFilterLabelFilter.String() regexp correct delimiters (backport release-3.6.x) (#20649) (9d5fb5f)
• logger: correct log level verbosity in rule evaluation (#19519) (37ad381)
• Metastore timerange filter (#19171) (dfb60dc)
• networkpolicy: use UDP/53 for DNS egress instead of named port (#19073) (4cbbc4f)
• nil error returned when client closed (#19068) (5809c47)
• operator: updated AlertingRule sample to make it comply with the validation we apply (#18671) (8e6c018)
• panic while applying storage updates when a whole chunk is deleted by line filters (#19262) (cbcfbca)
• records discarded if one fetch returns error (#19069) (90ac000)
• remove UI from docker build (#19425) (48f5ade)
• security/HIGH/cmd/segment-inspect: Update security cmd/segment-inspect github.com/prometheus/prometheus to v0.311.3 [SECURITY] (release-3.6.x) (#22205) (bfd37e4)
• security/HIGH/cmd/segment-inspect: Update security cmd/segment-inspect go.opentelemetry.io/otel to v1.41.0 [SECURITY] (release-3.6.x) (#22206) (0ed7bce)
• security/HIGH/: Update module github.com/containerd/containerd/v2 to v2.0.9 [SECURITY] (release-3.6.x) (#22204) (ed38a68)
• security/MEDIUM/cmd/dataobj-inspect: Update security cmd/dataobj-inspect github.com/grafana/loki/v3 to v3.6.4 [SECURITY] (release-3.6.x) (#22209) (d6117ed)
• security/MEDIUM/cmd/segment-inspect: Update security cmd/segment-inspect github.com/grafana/loki/v3 to v3.6.4 [SECURITY] (release-3.6.x) (#22210) (186b9a9)
• security/UNKNOWN/cmd/chunks-inspect: Update go toolchain directive to v1.25.11 [SECURITY] (release-3.6.x) (#22202) (90e12c9)
• security/UNKNOWN/cmd/dataobj-inspect: Update module golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22215) (c696c66)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect go to v1.25.11 [SECURITY] (release-3.6.x) (#22203) (2c67a33)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.6.x) (#22216) (807ffd7)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22217) (7081875)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22218) (36deca1)
• security/UNKNOWN/pkg/push: Update security pkg/push golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22224) (0c53ce1)
• security/UNKNOWN/: Update security golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.6.x) (#22212) (424e5ff)
• security/UNKNOWN/: Update security golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22213) (90ae8f3)
• security/UNKNOWN/: Update security golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22214) (49b9a22)
• silly mistake, this is why we have tests (461fed7)
• Stop applying limits pushdown under a filter (#19154) (b7f14f9)
• storage: attach SHA-256 checksum on PutObject for Object Lock buckets (#21848) (2a7c34c)
• update loki-helm-test image tag to latest commit (#19227) (6298e44)
• use cooperative active sticky load balancer (#19160) (3535ae4)
• Use default config when building s3 client (backport k277) (#19559) (9d7a2f5)

Performance Improvements

• engine: reuse existing array in genericFunction.Evaluate (#19235) (24e968c)
• Reduce allocations for JSON and logfmt parser (#18637) (adb27ff)

Code Refactoring

• operator: CI publishing image strategy (#19365) (ee8c776)
• operator: consolidate image build workflows and improve documentation (#19395) (292a31e)