Prometheus 3.13.2
So Prometheus 3.13.2 just dropped on July 30, 2026, and I spent the morning poking at it so you don't have to. TL;DR: it's a two-line changelog that matters way more than it looks — one security sweep and one crash fix that'll save your disk-full Tuesday.
The Security Bump (Read This One)
First up: the dependency sweep. Prometheus 3.13.2 bumps golang.org/x/text to v0.39.0 (that's CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). Both landed via #19290 by @krajorama.
Now, I know what you're thinking — "another transitive dependency bump, cool cool cool." But here's the thing: x/text is the library behind string handling across the whole binary, and gRPC is how your Prometheus talks to... everything. If you're running anything on the 3.13 line, this is the "patch me before the scanners start nagging" release. Your security dashboard will thank you.
The SIGBUS Fix (This One Saves You)
The actual headline bugfix: PromQL's active query tracker now preallocates its file so you don't get SIGBUS crashes when the data disk fills up. #19289 by @akshajrawat.
Let me paint the picture: disk full → query tracker file grows into nowhere → SIGBUS → your whole Prometheus process dies mid-query. Fun, right? The preallocation means the failure mode becomes "clean error" instead of "hard crash." For anyone running Prometheus on shared or thinly-provisioned volumes, this is the fix you didn't know you needed until your pager went off at 3am.
Upgrade Notes From Someone Who Just Did It
- It's a drop-in. Same config, same flags, same TSDB. No schema changes, no breaking changes in this one.
- Do the rolling restart thing. If you run HA pairs, drain one at a time — standard practice, zero drama.
- Bump your alert rules' expectations. No, seriously — the SIGBUS fix changes crash behavior, so any alert that fires on "Prometheus down" should be quieter now.
- Grab the full diff at github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2 if you want the receipts.
That's it. Two changes, both worth having, neither will break your dashboards. Update your binaries, restart, and go back to whatever you were doing. 10/10 would patch again — and honestly, for a point release with a CVE pair and a crash fix, you really shouldn't wait for the next one.