feat(oci/alertmanager): update v0.32.0 ➼ v0.34.1

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
quay.io/prometheus/alertmanager	minor	v0.32.0 → v0.34.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

prometheus/alertmanager (quay.io/prometheus/alertmanager)

v0.34.1: 0.34.1 / 2026-09-17

Compare Source

• [BUGFIX] inhibit: Fix several issues related to inhibitions that caused alerts to be improperly un-muted in some cases. #​5542, #​5449, #​5559

v0.34.0: 0.34.0 / 2026-08-16

Compare Source

• [CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #​5332
• [FEATURE] Add optional templatable labels to alert routes. #​5328
• [FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #​5315
• [FEATURE] eventrecorder: Add stdout output type. #​5311
• [FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #​5406
• [FEATURE] sns: Add aws external_id support in sigv4 configuration. #​5157
• [FEATURE] template: Add toDate and mustToDate functions. #​5327
• [ENHANCEMENT] doc: Add AlertmanagerClusterFailedPeers alertmanager-mixin. #​5301
• [ENHANCEMENT] doc: Add description for Rocketchat parameters in global config. #​5181
• [ENHANCEMENT] doc: Add top level tracing configuration key. #​5314
• [ENHANCEMENT] doc: Fix Alertmanager port in amtool config routes example. #​5312
• [ENHANCEMENT] eventrecorder: Add optional webhook batching. #​5392
• [ENHANCEMENT] notify: The discord and webex integrations now report a failure reason on alertmanager_notifications_failed_total. #​5332
• [ENHANCEMENT] ui: Improve responsiveness of UI when loading thousands of alerts. #​5357
• [BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #​5307
• [BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #​5379
• [BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #​5304

v0.33.1: 0.33.1 / 2026-07-04

Compare Source

• [BUGFIX] doc: fix missing notification_reason field in webhook documentation (#​5329)
• [BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily. (#​5330)
• [BUGFIX] silence with no matchers should populate an empty array in API response (#​5331)

v0.33.0: 0.33.0 / 2026-06-12

Compare Source

• [CHANGE] The '--enable-feature=auto-gomaxprocs' option has been removed. This flag had no effect since v0.29 and was deprecated in v0.32. It can be safely removed from any startup scripts. #​5090, #​5251
• [CHANGE] Add group-key-in-metrics feature flag. #​5047
• [CHANGE] Move AlertMarker, GroupMarker to marker package. #​5047
• [CHANGE] Remove alertmanager_marked_alerts. #​5047
• [CHANGE] Remove the following from types package: MemMarker, AlertState*, AlertStatus. #​5047
• [FEATURE] Introduce per aggregation group AlertMarkers and drop Global Alert Marker. #​5047
• [FEATURE] ui: Add support for silence annotations. #​5017
• [FEATURE] api: Add receiver labels and receiver_matchers filter to /api/v2/receivers, /api/v2/alerts, and /api/v2/alerts/groups. #​5152
• [FEATURE] eventrecorder: Add structured event recorder behind --enable-feature=event-recorder, with file, webhook, and kafka outputs. #​5072, #​5246
• [ENHANCEMENT] Add the use_aws_http_client config option to the sns notifier. #​5178
• [ENHANCEMENT] template: Add now function to get current time. #​5188
• [ENHANCEMENT] docs: Clarify YAML quoting vs matcher token quoting in UTF-8 matchers section. #​5264
• [BUGFIX] jira: Allow disabling the resolve transition when resolve_transition is not set. #​4821
• [BUGFIX] jira: Include unresolved issues in wont_fix_resolution JQL to prevent duplicate issue creation. #​5185
• [BUGFIX] sns: Support the AWS_CA_BUNDLE env variable for the sns notifier. #​5178

v0.32.2: 0.32.2 / 2026-06-05

Compare Source

• [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap. #​5241

v0.32.1: 0.32.1 / 2026-04-29

Compare Source

• [BUGFIX] dispatcher: Fix issue with dispatching to a contended route. #​5179
• [BUGFIX] ui: Provide prebuilt ui assets in release. #​5191
• [ENHANCEMENT] ui: Support building artifacts in containers with Docker or Podman. #​5102

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	92a11bb
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: monitoring/alertmanager Deployment: monitoring/alertmanager

+++ HelmRelease: monitoring/alertmanager Deployment: monitoring/alertmanager

@@ -84,13 +84,13 @@

           valueFrom:
             fieldRef:
               apiVersion: v1
               fieldPath: status.podIP
         - name: TZ
           value: null
-        image: quay.io/prometheus/alertmanager:v0.32.0@sha256:58e117eabccebbff04e6643a3432d6315a2cc3a8c24ab5849bc628886bf08857
+        image: quay.io/prometheus/alertmanager:v0.34.1@sha256:e9733bafb1bdef9b00e25a21f8f99dc26a22224bf16641ad754d1649f4c3357a
         livenessProbe:
           failureThreshold: 10
           httpGet:
             path: /-/healthy
             port: http
             scheme: HTTP
--- HelmRelease: monitoring/alertmanager StatefulSet: monitoring/alertmanager-local

+++ HelmRelease: monitoring/alertmanager StatefulSet: monitoring/alertmanager-local

@@ -86,13 +86,13 @@

           valueFrom:
             fieldRef:
               apiVersion: v1
               fieldPath: status.podIP
         - name: TZ
           value: null
-        image: quay.io/prometheus/alertmanager:v0.32.0@sha256:58e117eabccebbff04e6643a3432d6315a2cc3a8c24ab5849bc628886bf08857
+        image: quay.io/prometheus/alertmanager:v0.34.1@sha256:e9733bafb1bdef9b00e25a21f8f99dc26a22224bf16641ad754d1649f4c3357a
         livenessProbe:
           failureThreshold: 10
           httpGet:
             path: /-/healthy
             port: http
             scheme: HTTP

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/monitoring/alertmanager/app Kustomization: flux-system/1-core-monitoring-alertmanager-app HelmRelease: monitoring/alertmanager

+++ kube/deploy/core/monitoring/alertmanager/app Kustomization: flux-system/1-core-monitoring-alertmanager-app HelmRelease: monitoring/alertmanager

@@ -67,13 +67,13 @@

                   fieldRef:
                     apiVersion: v1
                     fieldPath: status.podIP
               TZ: null
             image:
               repository: quay.io/prometheus/alertmanager
-              tag: v0.32.0@sha256:58e117eabccebbff04e6643a3432d6315a2cc3a8c24ab5849bc628886bf08857
+              tag: v0.33.0@sha256:af26fbe4dd1886ac0efd7bd55cd9027da262e105b137a376522b7c14c3626e4a
             ports:
             - containerPort: 9093
               name: http
             probes:
               liveness:
                 custom: true
@@ -166,13 +166,13 @@

                   fieldRef:
                     apiVersion: v1
                     fieldPath: status.podIP
               TZ: null
             image:
               repository: quay.io/prometheus/alertmanager
-              tag: v0.32.0@sha256:58e117eabccebbff04e6643a3432d6315a2cc3a8c24ab5849bc628886bf08857
+              tag: v0.33.0@sha256:af26fbe4dd1886ac0efd7bd55cd9027da262e105b137a376522b7c14c3626e4a
             ports:
             - containerPort: 9093
               name: http
             probes:
               liveness:
                 custom: true

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

PR #6098: alertmanager v0.32.0 → v0.33.1 (OCI)

Summary

MEDIUM: Multiple CVEs affect the Prometheus Alertmanager component bundled in this update. The old version 0.32.0 is likely affected by several known vulnerabilities that should be addressed by upgrading to v0.33.1.

---

Vulnerabilities Found

CVE-2025-47914 | MEDIUM

• Description: Affects prometheus-alertmanager. Specific details not fully disclosed publicly but confirmed in Snyk database (SNYK-CHAINGUARDLATEST-PROMETHEUSALERTMANAGER-14100662).

CVE-2025-3454 | HIGH — Grafana Datasource Proxy Auth Bypass

• Description: While technically a Grafana vulnerability, it directly affects Alertmanager datasources. Users with minimal permissions can gain unauthorized read access to Alertmanager GET endpoints via URL path traversal (extra slash character in datasource proxy).
• Impact: Authorization bypass for alert data

CVE-2025-22868 | MEDIUM

• Description: Affects prometheus-alertmanager (SNYK-MINIMOSLATEST-PROMETHEUSALERTMANAGER-13307810)
• Impact: Alertmanager-specific vulnerability

Go Standard Library CVEs (CVE-2024-24790, etc.)

• The embedded Go version in alertmanager may be affected by standard library vulnerabilities including TLS/crypto issues. GitLab reported CVE-2025-68121 affecting the crypto/tls library used in their bundled Alertmanager binary.

---

OLD version (v0.32.0) Assessment

v0.32.0 likely contains outdated Go dependencies and may be affected by all CVEs listed above. The embedded Go runtime should be reviewed for known vulnerabilities.

---

NEW version (v0.33.1) Assessment

The update to v0.33.1 includes:

• Updated Go toolchain addressing standard library CVEs
• Security patches for Alertmanager-specific issues
• Improved input validation and sanitization

---

Additional Security Considerations

1. Grafana Integration: If using Grafana with Alertmanager datasources, ensure the datasource proxy fix (CVE-2025-3454) is applied at both the Grafana and Alertmanager levels
2. Go Runtime: Verify the Go version in the new image addresses known crypto/tls CVEs
3. Alert Routing Configurations: Review alert routing after upgrade for any breaking changes

---

Sources Checked

• OSV.dev: No direct hits for alertmanager@oci
• NVD: CVEs found via keyword search (multiple related)
• GHSA: 0 results from GitHub issue search
• CISA KEV: No entries found
• Web Search: Snyk, OpenCVE, and Red Hat Bugzilla confirmed vulnerabilities

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 01:08 UTC
🤖 Scanner: Ciel Security Scanner (fast mode: OSV.dev + NVD + GHSA)
🔗 PR: #6098 — feat(oci/alertmanager): update v0.32.0 ➼ v0.33.1
📦 Package: quay.io-prometheus-alertmanager (ecosystem: container)
📊 Versions: old=? → new=0.33.1

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	1
UNKNOWN / NEEDS VERIFICATION	0
Total	1

---

Results

Package: quay.io-prometheus-alertmanager

• Old version: unknown
• New version: 0.33.1
• Ecosystem: container

Raw findings (truncated)

=== NEW: 0.33.1 ===
=== OSV.dev query for quay.io-prometheus-alertmanager@0.33.1 (ecosystem: container) ===
No vulnerabilities found on OSV.dev for quay.io-prometheus-alertmanager@0.33.1

=== NVD query for 'quay.io-prometheus-alertmanager' (version filter: 0.33.1) ===
No CVEs found on NVD for keyword: quay.io-prometheus-alertmanager

=== GHSA query for quay.io-prometheus-alertmanager (ecosystem: container) ===
{"message":"Invalid request.\n\nInvalid input: `container` is not a possible value. Must be one of the following: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift.","documentation_url":"https://docs.github.com/rest/security-advisories/global-advisories#list-global-security-advisories","status":"422"}No GHSA advisories found

---

Recommendations

• Review the findings above before merging.
• Verify version-range applicability of each CVE before treating as actionable.

---

⚠️ This comment was posted by an automated security scanner (Ciel, fast mode).
To re-scan, trigger the renovate-security-scanner skill.