Bump github.com/thanos-io/thanos from 0.40.1 to 0.42.4 - #184

Sourced from github.com/thanos-io/thanos's releases.

v0.42.4

Had to do another version release due to broken base image SHAs. No changes.

Full Changelog: thanos-io/thanos@v0.42.3...v0.42.4

v0.42.3

Fixes a small bug - like before now Receive on shutdown creates a new block and uploads it.

Fixed

• #8948: receive: Preserve upload on shutdown behaviour

v0.42.2

Had to do another version release due to broken base image SHAs. No changes.

v0.42.1

This change fixes a small issue regarding timeouts in the Shipper component in the Receiver - we've accidentally set them too small. Sorry for that!

Changed

• #8920: receive: bump timeouts

v0.42.0

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

• #8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
• #8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
• #8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
• #8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
• #8720: Receive: Fix 503 errors during restarts in some cases.
• #8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
• #8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
• #8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
• #8810: Ruler: correctly pass query partial response for gRPC.

Added

• #8691: Cache: add redis key prefix support
• #8691: query/ui: show fanout information
• #8691: Compactor: remove the directory marker objects for some s3 compatible object stores
• #8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
• #8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
• #8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
• #8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
• #8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
• #8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
• #8594: Query: Support per endpoint TLS configuration.

... (truncated)

Sourced from github.com/thanos-io/thanos's changelog.

v0.42.4 - 2026 07 30

Had to do another version release due to broken base image SHAs. No changes.

v0.42.3 - 2026 07 29

Fixes a small bug - like before now Receive on shutdown creates a new block and uploads it.

Fixed

• #8948: receive: Preserve upload on shutdown behaviour

v0.42.2 - 2026 07 16

Had to do another version release due to broken base image SHAs. No changes.

v0.42.1 - 2026 07 16

This change fixes a small issue regarding timeouts in the Shipper component in the Receiver - we've accidentally set them too small. Sorry for that!

Changed

• #8920: receive: bump timeouts

v0.42.0 - 2026 07 08

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

• #8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
• #8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
• #8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
• #8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
• #8720: Receive: Fix 503 errors during restarts in some cases.
• #8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
• #8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
• #8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
• #8810: Ruler: correctly pass query partial response for gRPC.
• #8881: Receive: Fix routing receivers crashing with mkdir ./data: read-only file system on startup by gating data directory setup on enableIngestion, since routing receivers don't write local TSDB data.
• #8890: block: fix GatherIndexHealthStats postings walk error check to prevent swallowing an error.
• #8889: Query: Return an error if Querier doesn't have any registered endpoints and partial response is disabled.

Added

• #8691: Cache: add redis key prefix support
• #8691: query/ui: show fanout information
• #8691: Compactor: remove the directory marker objects for some s3 compatible object stores
• #8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
• #8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.

... (truncated)

• 45c4f39 Release 0.42.4 to update busybox SHA (#8952)
• b2b2b53 Merge pull request #8950 from thanos-io/42_3
• 728e5a3 *: release 0.42.3
• 7e57a8a Add e2e test
• 20839bf receive: Preserve upload on shutdown behaviour
• a698b52 *: release 0.42.2
• 0286ccf Updates busybox SHA
• 0d38f5b VERSION: bump for 0.42.1
• f0d9999 Merge pull request #8921 from thanos-io/0421
• fb628f6 CHANGELOG: add entry
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)