Security update for alloy
This update for alloy fixes the following issues:
Upgrade to version 1.12.1.
Security issues fixed:
- CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML documents
(bsc#1251509).
- CVE-2025-47913: golang.org/x/crypto: early client process termination when receiving an unexpected message type in
response to a key listing or signing request (bsc#1253609).
- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by
html.ParseFragment when processing specially
crafted input (bsc#1251716).
Other updates and bugfixes:
- Version 1.12.1:
- Bugfixes
- update to Beyla 2.7.10.
- Version 1.12.0:
- Breaking changes
prometheus.exporter.blackbox, prometheus.exporter.snmp and prometheus.exporter.statsd now use the component
ID instead of the hostname as their instance label in their exported metrics.
- Features
- (Experimental) Add an
otelcol.receiver.cloudflare component to receive logs pushed by Cloudflare's LogPush
jobs.
- (Experimental) Additions to experimental
database_observability.mysql component: explain_plans- collector now changes schema before returning the connection to the pool.
- collector now passes queries more permissively.
- enable
explain_plans collector by default - (Experimental) Additions to experimental
database_observability.postgres component: explain_plans- added the explain plan collector.
- collector now passes queries more permissively.
query_samples- add user field to wait events within
query_samples collector. - rework the query samples collector to buffer per-query execution state across scrapes and emit finalized
entries.
- process turned idle rows to calculate finalization times precisely and emit first seen idle rows.
query_details- escape queries coming from
pg_stat_statements with quotes. - enable
explain_plans collector by default. - safely generate
server_id when UDP socket used for database connection. - add table registry and include 'validated' in parsed table name logs.
- Add
otelcol.exporter.googlecloudpubsub community component to export metrics, traces, and logs to Google Cloud
Pub/Sub topic.
- Add
structured_metadata_drop stage for loki.process to filter structured metadata. - Send remote config status to the remote server for the
remotecfg service. - Send effective config to the remote server for the
remotecfg service. - Add a
stat_statements configuration block to the prometheus.exporter.postgres component to enable selecting
both the query ID and the full SQL statement. The new block includes one option to enable statement selection,
and another to configure the maximum length of the statement text.
- Add truncate stage for
loki.process to truncate log entries, label values, and structured_metadata values. - Add
u_probe_links & load_probe configuration fields to alloy pyroscope.ebpf to extend configuration of
the opentelemetry-ebpf-profiler to allow uprobe profiling and dynamic probing.
- Add
verbose_mode configuration fields to alloy pyroscope.ebpf to be enable ebpf-profiler verbose mode. - Add
file_match block to loki.source.file for built-in file discovery using glob patterns. - Add a regex argument to the
structured_metadata stage in loki.process to extract labels matching a regular
expression.
- OpenTelemetry Collector dependencies upgraded from v0.134.0 to v0.139.0.
- See the upstream
[core](https://github.com/open-telemetry/opentelemetry-collector/blob/v0.139.0/CHANGELOG.md)
and
[contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/v0.139.0/CHANGELOG.md)
changelogs for more details.
- A new
mimir.alerts.kubernetes component which discovers AlertmanagerConfig Kubernetes resources and loads them
into a Mimir instance.
- Mark
stage.windowsevent block in the loki.process component as GA. - Enhancements
- Add per-application rate limiting with the strategy attribute in the
faro.receiver component, to prevent one
application from consuming the rate limit quota of others.
- Add support of tls in components
loki.source.(awsfirehose|gcplog|heroku|api) and prometheus.receive_http and
pyroscope.receive_http.
- Remove
SendSIGKILL=no from unit files and recommendations. - Reduce memory overhead of
prometheus.remote_write's WAL by lowering the size of the allocated series storage. - Reduce lock wait/contention on the
labelstore.LabelStore by removing unecessary usage from
prometheus.relabel.
prometheus.exporter.postgres dependency has been updated to v0.18.1.- Update Beyla component to 2.7.8.
- Suppor
