Release 3.15.1

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>

CHANGELOG.md

@@ -1,6 +1,10 @@
 # Changelog
 
-## main / unreleased
+## 3.15.1 / 2026-10-21
+
+- [SECURITY] Container images: Update CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" following the compromise of eMudhra intermediate CA private keys.
+- [SECURITY] Build with Go 1.27.3 to fix vulnerabilities in `net/http`, `net/textproto`, `crypto/tls` and `html/template`.
+- [SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).
 
 ## 3.15.0 / 2026-09-24
 - [CHANGE] PromQL: A range query whose `end` was not aligned to `step` caused subqueries inside it to evaluate past the parent's last actual step, inflating `peakSamples` in the query stats and against the `query.max-samples` limit, and wasting storage I/O reading samples that were never used in the result. Add tests to prevent regression of the fix made in #18081. #18598

Makefile.common

@@ -61,7 +61,7 @@ PROMU_URL     := https://github.com/prometheus/promu/releases/download/v$(PROMU_
 SKIP_GOLANGCI_LINT :=
 GOLANGCI_LINT :=
 GOLANGCI_LINT_OPTS ?=
-GOLANGCI_LINT_VERSION ?= v2.13.1
+GOLANGCI_LINT_VERSION ?= v2.14.0
 GOLANGCI_FMT_OPTS ?=
 # golangci-lint only supports linux, darwin and windows platforms on i386/amd64/arm64.
 # windows isn't included here because of the path separator being different.

VERSION

@@ -1 +1 @@
-3.15.0
+3.15.1

documentation/examples/remote_storage/remote_storage_adapter/graphite/client.go

@@ -92,7 +92,7 @@ func (c *Client) Write(samples model.Samples) error {
 		t := float64(s.Timestamp.UnixNano()) / 1e9
 		v := float64(s.Value)
 		if math.IsNaN(v) || math.IsInf(v, 0) {
-			c.logger.Debug("Cannot send value to Graphite, skipping sample", "value", v, "sample", s)
+			c.logger.Debug("Cannot send value to Graphite, skipping sample", "value", v, "sample", s) //nolint:loggercheck // False positive for structured logging.
 			continue
 		}
 		fmt.Fprintf(&buf, "%s %f %f\n", k, v, t)

documentation/examples/remote_storage/remote_storage_adapter/influxdb/client.go

@@ -89,7 +89,7 @@ func (c *Client) Write(samples model.Samples) error {
 	for _, s := range samples {
 		v := float64(s.Value)
 		if math.IsNaN(v) || math.IsInf(v, 0) {
-			c.logger.Debug("Cannot send to InfluxDB, skipping sample", "value", v, "sample", s)
+			c.logger.Debug("Cannot send to InfluxDB, skipping sample", "value", v, "sample", s) //nolint:loggercheck // False positive for structured logging.
 			c.ignoredSamples.Inc()
 			continue
 		}

documentation/examples/remote_storage/remote_storage_adapter/opentsdb/client.go

@@ -77,7 +77,7 @@ func (c *Client) Write(samples model.Samples) error {
 	for _, s := range samples {
 		v := float64(s.Value)
 		if math.IsNaN(v) || math.IsInf(v, 0) {
-			c.logger.Debug("Cannot send value to OpenTSDB, skipping sample", "value", v, "sample", s)
+			c.logger.Debug("Cannot send value to OpenTSDB, skipping sample", "value", v, "sample", s) //nolint:loggercheck // False positive for structured logging.
 			continue
 		}
 		metric := TagValue(s.Metric[model.MetricNameLabel])

notifier/alertmanager.go

@@ -45,7 +45,7 @@ func (a alertmanagerLabels) url() *url.URL {
 
 // AlertmanagerFromGroup extracts a list of alertmanagers from a target group
 // and an associated AlertmanagerConfig.
-func AlertmanagerFromGroup(tg *targetgroup.Group, cfg *config.AlertmanagerConfig) ([]alertmanager, []alertmanager, error) {
+func AlertmanagerFromGroup(tg *targetgroup.Group, cfg *config.AlertmanagerConfig) ([]alertmanager, []alertmanager, error) { //nolint:revive // Preserve the existing API with an unexported return type.
 	var res []alertmanager
 	var droppedAlertManagers []alertmanager
 	lb := labels.NewBuilder(labels.EmptyLabels())

web/ui/mantine-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@prometheus-io/mantine-ui",
   "private": true,
-  "version": "0.315.0",
+  "version": "0.315.1",
   "type": "module",
   "scripts": {
     "start": "vite",

web/ui/module/codemirror-promql/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prometheus-io/codemirror-promql",
-  "version": "0.315.0",
+  "version": "0.315.1",
   "description": "a CodeMirror mode for the PromQL language",
   "types": "dist/esm/index.d.ts",
   "module": "dist/esm/index.js",

web/ui/module/lezer-promql/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prometheus-io/lezer-promql",
-  "version": "0.315.0",
+  "version": "0.315.1",
   "description": "lezer-based PromQL grammar",
   "main": "dist/index.cjs",
   "type": "module",

web/ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "prometheus-io",
   "description": "Monorepo for the Prometheus UI",
-  "version": "0.315.0",
+  "version": "0.315.1",
   "private": true,
   "scripts": {
     "build": "bash build_ui.sh --all",

web/ui/react-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prometheus-io/app",
-  "version": "0.315.0",
+  "version": "0.315.1",
   "private": true,
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.3",