Hi Martina, Daniel, Lucas, and the pkg-golang team,

Now with Trixie released, we need to think about our upgrading strategy for Prometheus. I haven't heard of such plans yet; please provide me with links so that I can catch up in case I missed anything.

In the meantime, I’ve been looking into the current RC issues affecting the 2.53.x series in Unstable, and the situation is becoming increasingly difficult to manage on the 2.x branch:

**1. Unpatched Security Vulnerabilities (Grave)**
Two high-severity CVEs were published in May 2026 (Bug #1135999):
*   **CVE-2026-42151:** Plaintext exposure of the Azure AD `client_secret` via the `/-/config` endpoint.
*   **CVE-2026-42154:** DoS (memory exhaustion) via the `/api/v1/read` endpoint when handling snappy-compressed requests.

Upstream has fixed these in the 3.x line (v3.5.3 LTS and v3.12.0). However, because the 2.53 LTS branch officially reached its End-of-Life in July 2025, upstream has **not** backported these fixes to 2.x, and no future 2.5x releases are planned.

**2. Go 1.26 FTBFS Regression (Serious)**
We are seeing a FTBFS in archive rebuilds (Bugs #1137403, #1114942) with the error `parse error: unexpected character inside braces: '0'`. This is a regression tied to the Go 1.26 toolchain/libraries and stricter PromQL label validation. This is also unlikely to be addressed upstream in the EOL 2.x branch.

**Transition to 3.x**
What do we need for upgrading to 3.x? Is the old UI still available and can we somehow avoid introducing all those nodejs dependencies? Is packaging the UI separately an option?

Status update on the packaging effort for Prometheus 3.x (currently targeting 3.11.3).

The upgrade to the 3.x series introduces a significant number of new Go module dependencies that must be satisfied first. The following ITPs have been filed for the required prerequisites:

- Bug #1139940: ITP: golang-github-pb33f-jsonpath
- Bug #1139941: ITP: golang-github-pb33f-ordered-map-v2
- Bug #1140036: ITP: golang-github-pb33f-libopenapi
- Bug #1140052: ITP: golang-github-basgys-goxml2json
- Bug #1140055: ITP: golang-github-pb33f-libopenapi-validator
- Bug #1132883: ITP: golang-go.yaml-yaml-v4

Packaging for most of these dependencies is complete, with repositories pushed to Salsa. Upstream test suite issues in libopenapi-validator have recently been resolved and are pending final build verification.

Following the completion of libopenapi-validator, a subsequent dependency check against the main prometheus package will determine if any further unmet dependencies remain. Packaging of Prometheus 3.x itself will resume once the entire dependency tree is fully satisfied.

Hi everyone,

I've been working on a version 3.5.3+ds1-1 targeting experimental. This update
would address several important issues:

**Security fixes** (urgency: high):
  - CVE-2026-42151 and CVE-2026-42154 (Closes: #1135999)

**Reliability improvements**:
  - Fixes flaky tests (Closes: #1135260)
  - Refreshed all Debian patches for the new upstream release

The source package is available on my Salsa fork:

https://salsa.debian.org/siretart/prometheus/-/tree/wip/debian/3.5.4

Current status and critical needs: This package is NOT ready for upload yet. It
has successfully built and passed basic install checks, but requires critical
review and testing before it can be uploaded to experimental.

The packaging continues to ship the classic template-based UI (pre-2.34) as
the default, matching the approach from the previous stable version.

The new mantine-ui React application is present in the source tree but is
neither built nor installed by the Debian packaging. This was a deliberate
choice to keep the packaging complexity manageable and avoid introducing npm
build dependencies at this stage.

What I'd consider required before upload to experimental:

1. **Runtime testing** (CRITICAL): Verify metric scraping, alerting, and
   federation features work correctly with the new version

2. **Service startup**: Test that systemd service starts cleanly and doesn't
   break existing configurations

3. **Upgrade path**: Verify smooth upgrade from 2.53.5+ds1-5 without data loss
   or configuration breakage

What would be nice to have:

1. **Web UI modernization**: Evaluate building the mantine-ui with Debian's
   nodejs toolchain, or continue with the classic UI + optional install-ui.sh
   approach

2. **Integration testing**: Test with common exporters (node_exporter,
   blackbox_exporter) and Grafana

3. **Performance validation**: Benchmark memory usage and query performance
   compared to 2.53.5

Given the security fixes, this should eventually be uploaded to experimental
for broader testing before considering migration to unstable. If anyone has
capacity to:

  - Test the package in a staging/test environment (most critical!)
  - Help with the web UI situation
  - Review the packaging changes and patches

I'd appreciate any kind of input! Once we have confirmed basic functionality,
we can proceed with uploading to experimental. Feel free to submit MRs against
my fork or coordinate here on the bug.

Thanks to everone for maintaining this critical package!

Best regards,
-rt

Hi everyone,

Here is a status update on the effort to package the modern React-based
Mantine UI for Prometheus.

I recently spent some time attempting to build the new frontend offline using
Debian's native toolchain alongside a vendored NPM source tree. While it seems
to be possible to vendor the java script dependencies, I ran into a hard
blocker regarding `vite` (https://vite.dev/).

The Prometheus UI now relies on Vite 6.x. Starting with version 6, Vite
introduced a hard runtime dependency on `rolldown` (a Rust-based bundler,
https://rolldown.rs/).
Because `rolldown` is a massive Rust project that is not yet packaged in
Debian, and DFSG prohibits shipping the pre-compiled `rolldown.node` binary
blobs in the source package, it is currently impossible to build the modern
UI from source.

To unblock the modern UI in the long term, I have filed an RFP for
`node-vite` (Bug #1141177) and by extension, `rust-rolldown` to kickstart
the packaging of this toolchain in Debian.

However, Prometheus urgently needs an upgrade to 3.5 to address the
unpatched CVEs (CVE-2026-42151, CVE-2026-42154, Bug #1135999) and the
Go 1.26 FTBFS regression (Bugs #1137403, #1114942). Waiting for Vite
and Rolldown to be packaged is not a viable
option.

For the time being, the modern React UI build in the Debian packaging will
be completely disabled. Let's disable the UI completely for now. Maybe we can
either bring the old UI back or preferably get vite and mantine packaged.

I can work on an upload to experimental. I'd really appreciate thoughts and
opinions from the previous prometheus package uploaders and contributors.

Hi everyone,

I'd like to provide a status update on the Prometheus 3.x upgrade effort. I
have prepared a draft upgrade to 3.5.3, which is now available for review as a
merge request on Salsa:

https://salsa.debian.org/go-team/packages/prometheus/-/merge_requests/14

This is a major upgrade with several important packaging changes to address
test failures and build issues:

1. Web UI Removal:

I have intentionally dropped the old jQuery-based "classic" UI that we had been
carrying around as a patch. Maintaining that was effectively maintaining a
costly fork of Prometheus; if we really want to go that route, we should
properly fork the project on GitHub. As for the React-based UI, upstream has
migrated the build tooling to use node-vite and rust-rolldown, which are
currently unavailable in Debian. Consequently, the Web UI has been completely
disabled for this release, and a static placeholder is served at the root
endpoint instead. For further discussions and efforts regarding packaging the
new UI, please see the dedicated bug #1083100. The rationale for this
transition is also documented in `debian/README.source` and `debian/NEWS`.

2. Autopkgtest Integration:

To ensure the service remains functional despite the UI removal, I've added a
new, comprehensive systemd-based autopkgtest
(`debian/tests/service-endpoints`). This test verifies the daemon starts
successfully, the `/api/v1/status/buildinfo` endpoint returns JSON data, and
the root endpoint correctly redirects and serves the static placeholder
text. Note that this test relies on systemd integration and therefore requires
a `qemu` isolation-machine to run properly.

3. Patch Stack & Test Suite Cleanup:

I've dropped the obsolete legacy UTF-8 label validation patch (0014) since
Prometheus 3.x natively supports UTF-8 labels. This allowed us to re-enable
significant chunks of the test suite. I also added a forward-compatibility
patch to fix the `expfmt.TextParser` panic caused by Debian's newer
`prometheus/common` v0.68.0 package.

The package now builds cleanly on sbuild and passes Lintian and autopkgtest.

Please take a look at the MR when you have a chance. Feedback is very welcome!

Cheers,
-rt

Hi,

I also noticed some golang packages has similar issue that we need node-vite.

I checked and updated the missing dependencies for node-vite:
https://lists.debian.org/debian-js/2026/07/msg00005.html

Any idea?

Best regards,
-Andrew

On 2026-06-30 15:26:36, siretart@tauware.de wrote:

[...]

In my opinion, for sure, security updates are more important than
bundling the modern UI, especially since we have never managed to do so
yet, as far as I remember.

I also wonder if an argument could be made here that we *could* ship
vendored binaries for the UI, perhaps in a separate package, while those
things get packaged 'correctly'.

a.

We believe that the bug you reported is fixed in the latest version of
prometheus, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138247@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated prometheus package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 19 Jul 2026 10:17:49 -0300
Source: prometheus
Architecture: source
Version: 3.5.3+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1135260 1135999 1138247
Changes:
 prometheus (3.5.3+ds1-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release 3.5.3. (Closes: #1138247)
     - Fixes CVE-2026-42151 and CVE-2026-42154. (Closes: #1135999)
     - Fixes flaky tests. (Closes: #1135260)
   * Refresh patches.
   * Drop web UI due to missing dependencies in Debian (rust-rolldown).
   * Drop obsolete UI dependencies (fonts, libjs) from debian/control.
   * Drop legacy UTF-8 label validation patches to fix test panics and
     restore test coverage.
   * Add comprehensive autopkgtest for Prometheus systemd service.
Checksums-Sha1:
 204071420470747a055b2f4778510238a1164a0b 4873 prometheus_3.5.3+ds1-1.dsc
 3adc4411c506c14c50ca52e4579571b37d70f623 2005108 prometheus_3.5.3+ds1.orig.tar.xz
 86f6c0206454134cfe3686debd7dcee8b600bfc7 78980 prometheus_3.5.3+ds1-1.debian.tar.xz
Checksums-Sha256:
 188182e4314ed6da141e40da6b72697c0fa3099aeac40cb4b9a4c147203d3011 4873 prometheus_3.5.3+ds1-1.dsc
 271a91b47e6ff9e507bf94e8c9eb76005ff24afd07a713bd1345a4b98e3add1c 2005108 prometheus_3.5.3+ds1.orig.tar.xz
 def2b7a7f02c22ee669497ef9b9e7de91e33e4497144f1332f13e8ba14b0d721 78980 prometheus_3.5.3+ds1-1.debian.tar.xz
Files:
 863f23f0679947b3b4f2144d3cbabc36 4873 golang optional prometheus_3.5.3+ds1-1.dsc
 5375a4d3c60f768f92a6a47535d9d380 2005108 golang optional prometheus_3.5.3+ds1.orig.tar.xz
 2fe2c37ac7f75edcc2b7492e8d30c7bb 78980 golang optional prometheus_3.5.3+ds1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmpirbMUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstYPRAAjUutk9meph4Jz/emDA/Z3O0aqwk3
Ox65CUBYQ+mZPpUiM392Y1Q/CO3A6bTwexsGgQjvh9Mb7OS3BKHWqtvSyf6CIlUt
3OS1Z5dpSRWTxdd8PueKHUbomeBnTyVyQxwKRd4KTHPY8MxNf0rKI7Tt4gQSQPJ1
YZD/5xgskPXuYcVP9+RMW8p4nldAGZpn/2OAlsepAmAofmazbCCvBWN0UUc7+rRv
qZNXcj2u/nrWjKPPlgW/mbzU1ce4aC/hw8p3/Mcwygmc8PStFEu8nR7JtwP/yPly
S4WaZXLMHHLGDECSHxhhzf+YZZYGog3luJD1fbiPfSLMPgZw5zGFGrxmEG//2tzw
VqE+rCpjmIXvHx5uGbU6IAq1nCZPjxyo3Ppu6duJHuwsMBANsnA37QtDFUfRJoh1
neTEnPmr5YxNSgTLxbq2SUcjEUoNRezJWWZ4PnIcWZ9zLU0UHf6XI9uvX7544Ek5
g70ewKR5znDrPVuCIx+Obk/DrLuobRwDBoBspbEjf0KRC5+TUmGzeh9OgRnrpRtn
ELSTUuXizM+o9erdwDQzaRsbJZhd1DmUzs5NTcuJCeJbdEHemSD2u/x/rAH/j0Xb
IUv5co83IDqo4+51OurDzx+bxDXio83H52CQzpaLhZAmYR5nOBWfskMbW4n8c299
2Y8W9MNYKiptPmE=
=B1fi
-----END PGP SIGNATURE-----