feat(helm/kube-prometheus-stack)!: Update 83.4.0 ➼ 84.5.0

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
kube-prometheus-stack (source)	major	83.4.0 → 84.5.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

prometheus-community/helm-charts (kube-prometheus-stack)

v84.5.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6885

Full Changelog: prometheus-community/helm-charts@prometheus-29.5.0...kube-prometheus-stack-84.5.0

v84.4.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update Helm release grafana to v12.3.0 by @​renovate[bot] in #​6877

Full Changelog: prometheus-community/helm-charts@alertmanager-1.35.1...kube-prometheus-stack-84.4.0

v84.3.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6871

Full Changelog: prometheus-community/helm-charts@prom-label-proxy-0.21.0...kube-prometheus-stack-84.3.0

v84.2.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] prom spec add thanos.image by @​trouaux in #​6849

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-84.2.0...kube-prometheus-stack-84.2.1

v84.2.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update Helm release grafana to v12.2.1 by @​renovate[bot] in #​6868

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-84.1.2...kube-prometheus-stack-84.2.0

v84.1.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update Helm release grafana to v12.1.3 by @​renovate[bot] in #​6867

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-84.1.1...kube-prometheus-stack-84.1.2

v84.1.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update Helm release grafana to v12.1.2 by @​renovate[bot] in #​6866

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-84.1.0...kube-prometheus-stack-84.1.1

v84.1.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Add kubeApiServer jobNameOverride by @​abelfodil in #​6865

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-84.0.1...kube-prometheus-stack-84.1.0

v84.0.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6863

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.38.2...kube-prometheus-stack-84.0.1

v84.0.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update Helm release grafana to v12 by @​renovate[bot] in #​6848

Full Changelog: prometheus-community/helm-charts@prometheus-nginx-exporter-1.21.0...kube-prometheus-stack-84.0.0

v83.7.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update https://github.com/kubernetes-monitoring/kubernetes-mixin digest to afc9733 by @​renovate[bot] in #​6858

Full Changelog: prometheus-community/helm-charts@prom-label-proxy-0.19.0...kube-prometheus-stack-83.7.0

v83.6.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update https://github.com/prometheus-operator/kube-prometheus digest to ac9a509 by @​renovate[bot] in #​6854

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-83.5.1...kube-prometheus-stack-83.6.0

v83.5.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6851

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.38.1...kube-prometheus-stack-83.5.1

v83.5.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] add sessionPersistence support to alertm… by @​sebastiangaiser in #​6847

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-83.4.3...kube-prometheus-stack-83.5.0

v83.4.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Ensure version value is rendered as string by @​0-tae in #​6806

New Contributors

• @​0-tae made their first contribution in #​6806

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-83.4.2...kube-prometheus-stack-83.4.3

v83.4.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6843

Full Changelog: prometheus-community/helm-charts@prometheus-29.2.1...kube-prometheus-stack-83.4.2

v83.4.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update quay.io/prometheus/prometheus Docker tag to v3.11.2 by @​renovate[bot] in #​6840

Full Changelog: prometheus-community/helm-charts@prometheus-nginx-exporter-1.20.10...kube-prometheus-stack-83.4.1

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: monitoring/kps Job: monitoring/kps-admission-create

+++ HelmRelease: monitoring/kps Job: monitoring/kps-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.0
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.2
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kps-operator,kps-operator.monitoring.svc
         - --namespace=monitoring
         - --secret-name=kps-admission
--- HelmRelease: monitoring/kps Job: monitoring/kps-admission-patch

+++ HelmRelease: monitoring/kps Job: monitoring/kps-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.0
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.2
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kps-admission
         - --namespace=monitoring
         - --secret-name=kps-admission

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: monitoring/kps Job: monitoring/kps-admission-create

+++ HelmRelease: monitoring/kps Job: monitoring/kps-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.0
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.1
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kps-operator,kps-operator.monitoring.svc
         - --namespace=monitoring
         - --secret-name=kps-admission
--- HelmRelease: monitoring/kps Job: monitoring/kps-admission-patch

+++ HelmRelease: monitoring/kps Job: monitoring/kps-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.0
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.1
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kps-admission
         - --namespace=monitoring
         - --secret-name=kps-admission

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	4677fc7
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/monitoring/kps/app Kustomization: flux-system/1-core-monitoring-kps-app HelmRelease: monitoring/kps

+++ kube/deploy/core/monitoring/kps/app Kustomization: flux-system/1-core-monitoring-kps-app HelmRelease: monitoring/kps

@@ -12,13 +12,13 @@

     spec:
       chart: kube-prometheus-stack
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
         namespace: flux-system
-      version: 83.4.0
+      version: 84.5.0
   driftDetection:
     ignore:
     - paths:
       - /spec/replicas
     mode: warn
   install:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 05:18 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5581 — feat(helm/kube-prometheus-stack)!: Update 83.4.0 ➼ 84.5.0
📦 Packages checked: 1 (kube-prometheus-stack)
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 1 (MEDIUM)

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	1
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	1

---

Results

Package: kube-prometheus-stack

• Ecosystem: Helm
• Old version: 83.4.0 — VULNERABLE (bundles Prometheus v3.11.1 with 1 CVE)
• New version: 84.5.0 — CLEAN (bundles Prometheus v3.11.3, Grafana v13.0.1)

Vulnerabilities in version 83.4.0 (via bundled Prometheus)

1. CVE-2026-40179 — Severity: MEDIUM (CVSS 6.1)
   • Description: Stored XSS in Prometheus web UI tooltips and metrics explorer via unescaped metric names and label values in innerHTML.
   • Affected versions: Prometheus >= 3.0, < 3.11.2
   • Fixed in: Prometheus 3.11.2 (kps 83.4.1+)
   • Sources: NVD, GHSA (GHSA-vffh-x6r8-xx99), Changelog
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-40179 | GHSA-vffh-x6r8-xx99
   • Status: ✅ Fixed in newer versions

Vulnerabilities in version 84.5.0

No known vulnerabilities found in the chart itself or its bundled components (Prometheus v3.11.3 ≥ 3.11.2; Grafana v13.0.1).

Changelog Security Highlights (83.4.0 → 84.5.0)

• v83.4.1 — Prometheus updated from v3.11.1→v3.11.2: fixes CVE-2026-40179 (Stored XSS)
• v83.4.3 — Input validation fix: "Ensure version value is rendered as string"
• v84.0.0 — Grafana subchart v11.6.0→v12.0.0 (major bump, numerous CVE fixes in intermediate releases)
• v84.1.1→v84.4.0 — Grafana updated through v12.1.2, v12.1.3, v12.2.1, v12.3.0 (cumulative security patches)
• v83.4.2, v83.5.1, v84.0.1, v84.3.0, v84.5.0 — Dependency non-major updates (kube-state-metrics 7.2.2→7.3.0, node-exporter 4.53.1→4.55.0)

---

Recommendations

• MERGE PRIORITY: MEDIUM — The old version (83.4.0) bundles Prometheus v3.11.1, which has 1 MEDIUM-severity vulnerability (CVE-2026-40179, Stored XSS) remediated in the new version (84.5.0 bundles Prometheus v3.11.3). No new vulnerabilities introduced.
• This is a major version bump (83.x → 84.x) that includes a Grafana v12 major upgrade — review breaking changes in the Grafana v12 release notes before merging.
• The Prometheus Stored XSS can be exploited by an attacker who can inject metrics via compromised scrape targets or remote write; merging promptly reduces exposure.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.