Security updates

• Updated the Go toolchain to 1.25.12, addressing CVE-2026-42505 in crypto/tls and CVE-2026-39822 in os (#5338, #5340).

Changelog

• 60673b6 Update golang version to 1.25.12 (#5338) (#5340)
• 4f9c4cc docs: add docs for supported platforms (#5316) (#5319)
• ff4c03c docs: add v2.0.4 release notes (#5268) (#5270)
• 40c22d4 docs: add v2.1 release notes (#5266) (#5271)
• 6e70009 docs: add v2.1.1 release notes (#5342) (#5344)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.1.1

Security updates

• Updated the Go toolchain to 1.25.12, addressing CVE-2026-42505 in crypto/tls and CVE-2026-39822 in os (#5338, #5341).

Changelog

• cd4f0d9 Update golang version to 1.25.12 (#5338) (#5341)
• e9c4003 docs: add v2.0.6 release notes (#5343) (#5345)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.0.6

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.0.5

Features and enhancements

• Added readiness checks for the distributor (#5142).
• Added debug information list and delete APIs, including profilecli support (#5217).
• Added dataset index generation in segment writer segments (#5112).
• Added metastore cache hit/miss metrics (#5156).
• Added distributor ingest parse duration histograms and per-tenant query bytes-fetched metrics (#5107, #5180).
• Added query frontend estimation accuracy metrics and log ratio output (#5252).
• Added per-tenant limits for the number of recording rules (#5247).
• Updated the Helm chart to default to the v2 storage architecture and added support for deploying extra Kubernetes manifests with extraObjects (#5160, #5097).
• Migrated monitoring dashboards to native histograms (#5048).

Bug fixes

• Fixed an out-of-bounds panic in clearAddresses (#5250).
• Fixed nil matcher handling for recording rule upserts (#5134).
• Fixed tenant ID validation in store-gateway (#5194).
• Fixed archive extraction issues, including zip-slip/tar-slip cleanup and file closure handling (#5195, #5206).
• Fixed label value cloning to avoid buffer reuse-after-free issues (#5116).
• Fixed query read path edge cases, including unknown QueryNode panics, sub-millisecond step parameters, and range-series bucketing (#5196, #5137, #5161).
• Fixed store-gateway ring route registration (#5130).
• Fixed speedscope handling for unknown unit values by returning an error instead of panicking (#5143).
• Fixed metastore shard cache reads and compaction worker histogram buckets (#5189, #5164).
• Fixed Helm chart rendering for volumeClaimTemplates by adding apiVersion and kind (#5203).
• Excluded trace_id from sample-to-series label promotion, preventing series-cardinality growth from the emitted trace_id label (#5220).

Security updates

• Updated UI dependencies for security fixes, including Vite, tar, js-yaml, @babel/core, uuid, and other transitive dependencies (#5260, #5263, #5123, #5181).
• Updated Go dependencies for security fixes, including golang.org/x/net, golang.org/x/crypto, golang.org/x/image, and github.com/prometheus/prometheus (#5131, #5197, #5216, #5113).
• Updated the Go toolchain directive for security coverage (#5228).
• Hardened archive extraction paths and cleanup behavior (#5195, #5206).

Documentation updates

• Added generated YAML examples and documentation for v2 configuration blocks (#5151).
• Removed the public preview note from pyroscope.receive_http documentation (#5176).
• Updated supported .NET versions to 8, 9, and 10 (#5096).
• Refreshed README content and agent guides for the v2 layout, Go version, and tracing updates (#5246, #5183).
• Fixed a broken Grafana Cloud Profiles link in SDK guides (#5132).

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.1.0

Changelog

Changelog

• e8cbf11 ci: disable latest publishing for v2.0 (#5265)
• 28c24f2 backport: prepare release/v2.0 for v2.0.4 (UI CVE cleanup + zizmor fix) (#5264)
• 3b1a732 docs: add v2.0.4 release notes (#5268) (#5269)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.0.4

Changelog

• 3715b1a Add release notes for v2.0.2 (#5127) (#5128)
• 189eace Security bumps and fixes for v2.0.3 (#5231)
• 4415924 ci(release/v2.0): align CI pipeline to main (GATB + GAR) (#5234)
• a62c208 docs: add v2.0.3 release notes (#5235) (#5236)
• 3b2704f docs: fix broken Grafana Cloud Profiles link in SDK guides (#5132) (#5133)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull grafana/pyroscope:2.0.3

Changelog

• d969f94 Bump security deps for v2.0 (#5125)
• f33eecc docs: add v2.0.1 release notes (#5087) (#5088)
• 0b25958 docs: remove outdated v2 note (#5109) (#5110)
• fd8c466 fix: clone label values to prevent buffer reuse-after-free (#5116) (#5121)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:2.0.2

Changelog

• d6cb8c3 Bump security deps for v1.21 (#5124)
• e1db60e fix: clone label values to prevent buffer reuse-after-free (#5116) (#5122)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.21.1

Fixes

• goreleaser: stamp github.com/grafana/pyroscope/v2/pkg/util/build in build ldflags so pyroscope -version and the pyroscope_build_info metric report Version, Branch, Revision, and BuildDate correctly. Restores the v2.0.0 regression where those fields were empty (#5084)

Documentation

• Add v2.0 release notes page (#5083)

Changelog

• cd861cc docs: add v2.0 release notes (#5083) (#5085)
• 025f2c7 fix(goreleaser): stamp v2 module path in build ldflags (#5084) (#5086)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:2.0.1

Breaking changes

• Go module path bumped to github.com/grafana/pyroscope/v2. Library consumers must update their imports (#5073)
• Default write path flipped from ingester to segment-writer. Set -write-path=ingester to preserve v1 behavior (#5038)
• Default storage backend flipped from empty to filesystem (#5038)
• New -architecture.storage flag (v1 | v1-v2-dual | v2), default v1-v2-dual (#5038)
• Error at startup when -architecture.storage includes v2 and no object-storage backend is configured (#5074)
• Default filesystem paths moved under ./data/v2/ (#5038)
• Removed PYROSCOPE_V2_EXPERIMENTAL environment variable (#5038)
• Removed legacy positional server argument from the pyroscope binary (#5038)
• Label sanitization disabled by default; UTF-8 label names with dots are accepted as-is. Set
  -validation.disable-label-sanitization=false to restore previous behavior (#5038)
• Helm chart 2.0.0 replaces all.enable-v1-write-path / all.enable-v1-read-path with architecture.storage, removes persistence.shared and migration.queryBackend, and forwards ingesterWeight / segmentWriterWeight correctly (#5076)

Enhancements

• profilecli: add debuginfo upload subcommand (#5080)

Fixes

• Fix missed v1 import path in pyroscope_test.go after module bump to v2 (#5077)
• make: add frontend/build dependency to reference-help target (#5071)

Documentation

• Improve v1 → v2 migration docs: switch to --reset-then-reuse-values, target chart 2.0.0 (#5079)
• Add v1.21 release notes (#5082)
• Fix contributors grid layout in README (#5078)

Changelog

• d55b18e Bump Go module path to github.com/grafana/pyroscope/v2 (#5073)
• 171db75 Fix missed v1 import path in pyroscope_test.go after module bump to v2 (#5077)
• 3a68604 Pyroscope OSS v2.0 breaking changes (#5038)
• d89fbf0 chore: Release helm chart for v1.21.0 (#5072)
• 2cc2762 docs(v2): improve v1->v2 migration docs (#5079)
• f7f6cb3 docs: add v1.21 release notes (#5082)
• 5f41b54 docs: fix contributors grid layout in README (#5078)
• 150cb32 feat(validation): error on startup when V2 storage layer has no backend (#5074)
• b2127ab helm: update chart for v2.0 breaking changes (#5076)
• df732c6 make: add frontend/build dependency to reference-help target (#5071)
• 550a119 profilecli: add a debuginfo upload subcommand (#5080)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:2.0.0