When is the next release planned?

[AnderssonPeter]

Hi I found the pull request(#3200) for token_file and user_key_file for the pushover receiver that was merged about 3 weeks ago.

Are there any plans for when a new docker image will be released that contains that code? I tried both latest and v0.25.0 but none of them seem to contain the needed code?

[TheMeier]

It has been a while. Last release was in Dec. 2022. There is 124 commits on the main branch since the last release. A trivy scan of the official image shows a vulnerability rated HIGH.

Can we get more frequent builds please?

[tIGO]

There has been no release since 2024-02-28. Recently some important fixes were merged (e.g. #3648 and #3826). Do you have plans to release a new version with them?

[hatamiarash7]

We need a new release :))))

[czomo]

@simonpasquier @w0rm Any changes to create new releases? It is impossible set specyfic alertmenager version(main for example) using kube-prometheus-stack because of crd validation

[acdha]

Is there anything we can do to help with a new release? We've been waiting for #3728 to remove a bunch of extra configuration from our workaround and I'd be willing to help get that out the door if there's something we can help with.

[aboukhal]

It seems that the release schedule is a frequently asked question over the years. What's the trigger for a release? Every half a year, certain milestones...? That would help people understand what to expect.
A new release would be awesome for some of the features that have been merged so far.

[simonpasquier]

I'll work on the next release in the coming days/weeks. Stay tuned.

[grobinson-grafana]

Let's see if we can get #3797 into that release, as the feature is currently incomplete as it is in main.

[dabelousov]

How long we need to stay tuned? :) Waiting for release.

[cahyahikmawan]

waiting this feature for release #3638

[nicknamenotknown]

waiting this feature for release #3638

This feature merget at Apr 30, how long need wait next release?

[bdun1013]

Are there any updates on the next release? There are a few vulnerabilities in v0.27.0 that are fixed in main:

v0.27.0:

$ govulncheck ./...   
=== Symbol Results ===

Vulnerability #1: GO-2024-2883
    Denial of service via malicious preflight requests in github.com/rs/cors
  More info: https://pkg.go.dev/vuln/GO-2024-2883
  Module: github.com/rs/cors
    Found in: github.com/rs/[email protected]
    Fixed in: github.com/rs/[email protected]
    Example traces found:
      #1: api/v2/restapi/server.go:328:31: restapi.Serve calls http.Server.Serve, which eventually calls cors.Cors.handlePreflight
      #2: api/v2/api.go:134:28: api.NewAPI calls cors.Default

Vulnerability #2: GO-2024-2687
    HTTP/2 CONTINUATION flood in net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2687
  Module: golang.org/x/net
    Found in: golang.org/x/[email protected]
    Fixed in: golang.org/x/[email protected]
    Example traces found:
      #1: cli/root.go:122:52: cli.NewAlertmanagerClient calls config.NewClientFromConfig, which eventually calls http2.ConfigureTransports
      #2: types/types.go:290:28: types.MultiError.Error calls http2.ConnectionError.Error
      #3: notify/notify.go:995:21: notify.TimeActiveStage.Exec calls log.jsonLogger.Log, which eventually calls http2.ErrCode.String
      #4: notify/notify.go:995:21: notify.TimeActiveStage.Exec calls log.jsonLogger.Log, which eventually calls http2.FrameHeader.String
      #5: notify/notify.go:995:21: notify.TimeActiveStage.Exec calls log.jsonLogger.Log, which eventually calls http2.FrameType.String
      #6: types/types.go:290:28: types.MultiError.Error calls http2.GoAwayError.Error
      #7: notify/notify.go:995:21: notify.TimeActiveStage.Exec calls log.jsonLogger.Log, which eventually calls http2.Setting.String
      #8: notify/notify.go:995:21: notify.TimeActiveStage.Exec calls log.jsonLogger.Log, which eventually calls http2.SettingID.String
      #9: types/types.go:290:28: types.MultiError.Error calls http2.StreamError.Error
      #10: api/v2/client/silence/silence_client.go:196:35: silence.Client.PostSilences calls client.Runtime.Submit, which eventually calls http2.Transport.NewClientConn
      #11: api/v2/client/silence/silence_client.go:196:35: silence.Client.PostSilences calls client.Runtime.Submit, which eventually calls http2.Transport.RoundTrip
      #12: notify/email/email.go:253:14: email.Email.Notify calls fmt.Fprintf, which eventually calls http2.chunkWriter.Write
      #13: types/types.go:290:28: types.MultiError.Error calls http2.connError.Error
      #14: types/types.go:290:28: types.MultiError.Error calls http2.duplicatePseudoHeaderError.Error
      #15: test/cli/acceptance.go:361:3: cli.Alertmanager.Start calls http2.gzipReader.Close
      #16: test/cli/acceptance.go:365:22: cli.Alertmanager.Start calls io.ReadAll, which calls http2.gzipReader.Read
      #17: types/types.go:290:28: types.MultiError.Error calls http2.headerFieldNameError.Error
      #18: types/types.go:290:28: types.MultiError.Error calls http2.headerFieldValueError.Error
      #19: api/v2/client/silence/silence_client.go:196:35: silence.Client.PostSilences calls client.Runtime.Submit, which eventually calls http2.noDialH2RoundTripper.RoundTrip
      #20: types/types.go:290:28: types.MultiError.Error calls http2.pseudoHeaderError.Error
      #21: notify/email/email.go:253:14: email.Email.Notify calls fmt.Fprintf, which eventually calls http2.stickyErrWriter.Write
      #22: test/cli/acceptance.go:361:3: cli.Alertmanager.Start calls http2.transportResponseBody.Close
      #23: test/cli/acceptance.go:365:22: cli.Alertmanager.Start calls io.ReadAll, which calls http2.transportResponseBody.Read
      #24: notify/notify.go:995:21: notify.TimeActiveStage.Exec calls log.jsonLogger.Log, which eventually calls http2.writeData.String

Your code is affected by 2 vulnerabilities from 2 modules.
This scan also found 0 vulnerabilities in packages you import and 4
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

main:

$ govulncheck ./...
=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 3
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

[satyamkapoor]

Waiting for new release

[freak12techno]

I would actually propose not just adding a new release, but have a release schedule.
For example, I recently checked out Grafana Alloy (https://github.com/grafana/alloy) and they state they have a release cycle that has a minor release bump every 6 weeks. Sounds reasonable to have something similar here, do you guys think it's possible?