Skip to content
Release Radar

Pyroscope

Monitoring & Observability

Continuous profiling platform

grafana/pyroscopeWebsiteDocumentation
v2.3.1same day as v2.2.2
View on GitHub

Part of Grafana

Release history

Security updates

  • Updated go.etcd.io/etcd/client/pkg/v3 to v3.6.14, addressing CVE-2026-73500 (#5527).
  • Updated actions/create-github-app-token to v0.3.1 to prevent generated GitHub App tokens from being exposed in workflow logs (#5531).
  • Updated google.golang.org/grpc to v1.83.1, addressing CVE-2026-84304 (#5583, #5584).
  • Updated golang.org/x/crypto to v0.56.0, addressing CVE-2026-78662 and CVE-2026-56855 (#5572).
  • Updated golang.org/x/mod to v0.40.0 and UI nanoid to v3.3.18, addressing CVE-2026-56864, CVE-2026-56865, and CVE-2026-67213 (#5598).

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.2.2

Features and enhancements

  • Added a balanced query planner (#5501).
  • Added symbol-ref tree support across the read path: a new symbolref model package, production and aggregation in symdb and the query backend, and resolution in the frontend after the final merge (#5321, #5322, #5334).
  • Made experimental asynchronous queries resumable (#5442).
  • Allowed compaction to read block metadata from object storage, adding the metadata_source and metadata_fetch_timeout options (#5427).
  • Improved debuginfod client resilience and observability in the symbolizer, adding the resolve_timeout option (#5449).
  • Added SDK scope usage tracking to the distributor (#5366).
  • Added replay dump and replay push commands to profilecli (#5374).
  • Improved read-path performance by optimizing the index symbol cache layout and aligning the symdb sample appender (#5534, #5535).
  • Improved metastore and compaction performance by scanning block bounds before decoding and avoiding deep label clones when building block indexes (#5407, #5398).
  • Reduced allocations in timeseries build and merge (#5311).

Bug fixes

  • Stopped a single bad DLQ object from blocking metastore recovery (#5371).
  • Disabled raft pipeline replication in the metastore (#5518).
  • Fixed a double prefix on metastore index cache and DLQ metrics (#5543).
  • Allowed the segment writer shard shuffle table to grow past 4096 entries (#5519).
  • Served profile-type Series queries from metadata when the selector is empty (#5483).
  • Used raft_log.CompactionJobStatusUpdate instead of metastorev1.CompactionJobStatusUpdate in compaction (#5465).
  • Keyed adaptive placement distribution stats by tenant and dataset (#5450).
  • Collapsed stripped profiles to a single sample in the distributor (#5409).
  • Treated a JFR profile size limit of 0 as unlimited (#5502).
  • Excluded the pre-window boundary point from profilecli query top totals (#5359).
  • Pointed v2 dashboard event annotations at the Alloy events stream (#5499).
  • Fixed the missing namespace in Helm discovery RBAC objects (#5447).

Security updates

  • Updated Go to 1.25.13 (#5520).
  • Updated go.etcd.io/etcd/client/pkg/v3 to v3.6.14 (#5526).
  • Updated golang.org/x/mod to v0.40.0 (#5521).
  • Bumped nanoid to 3.3.18 in the UI (#5522).
  • This release also includes every security fix from 2.2.1.

Documentation updates

  • Added Node.js to the source code integration docs (#5490).
  • Documented Python memory profiling (#5406).
  • Clarified contributing build targets and the ui/dist requirement (#5457).

Changelog

  • 8098d40 Update golang version to 1.25.13 (#5520)
  • b82524b build: remove go workspace and reduce Renovate to security-only updates (#5397)
  • 06f5e9c chore(deps): bump golang.org/x/mod to v0.40.0 (#5521)
  • 788a581 chore(deps): lock file maintenance (#5418)
  • 37f4757 chore(deps): lock file maintenance (#5452)
  • d1ac3de chore(deps): update parquet-go to v0.30.1 (#5426)
  • 16264e2 chore(examples): bump OpenTelemetry in dotnet examples (#5488)
  • d52797a chore(examples): bump grpc and x/net in go examples (#5486)
  • 098b288 chore(examples): bump puma and sinatra in ruby examples (#5487)
  • 7a6aadd chore(examples): bump starlette in the fastapi example (#5489)
  • 07f92cb chore(examples): pass GITHUB_TOKEN through to the container (#5533)
  • 324b133 chore(examples): patch vulnerable node dependencies (#5485)
  • a549d25 chore(examples): update examples (#5493)
  • 00a46d6 chore(examples): update examples (#5497)
  • 7b2be56 chore(examples): update examples (#5516)
  • cd724d8 chore(ui): bump nanoid to 3.3.18 in the lockfile (#5522)
  • ae04b4a chore: Add more logging to async queries (#5537)
  • 82d8680 chore: bump Helm chart to v2.2.0 (#5400)
  • 0ea0d16 chore: bump Helm chart to v2.2.1 (#5474)
  • ea5d2c7 ci(examples): deploy the images after publishing them (#5500)
  • 661ca37 ci(examples): push rideshare images on a schedule (#5494)
  • 6cb1bda ci(update-contributors): update contributors commits via GitHub API so they are signed (#5455)
  • b720491 docs(contributing): clarify build targets and ui/dist requirement (#5457)
  • 7bd0ca7 docs: Add Node.js to source code integration docs (#5490)
  • 8e4d977 docs: add v2.1.2 release notes (#5469)
  • dfbe475 docs: add v2.2 release notes (#5399)
  • 5ecec75 docs: add v2.2.1 release notes (#5468)
  • 25098eb docs: document Python memory profiling (#5406)
  • 755d7ce docs: updates the list of contributors in README (#5456)
  • fa92a88 examples: enable Python memory profiling (#5421)
  • 1d8fe07 feat(compaction): optionally read block metadata from object storage (#5427)
  • 5f4849c feat(distributor): track SDK scope usage (#5366)
  • f69c4e3 feat(experimental): make async queries resumable (#5442)
  • 3bcd0b1 feat(frontend): resolve symbol-ref trees after the final merge (#5334)
  • b8a5664 feat(model): add symbolref package for symbol-aware tree references (#5321)
  • 87daa75 feat(profilecli): add replay dump/push commands (#5374)
  • a5e7f2d feat(read-path): produce and aggregate symbol-ref trees (model, symdb, query backend) (#5322)
  • 98fb7e1 feat(symbolizer): improve debuginfod client resilience and observability (#5449)
  • 6db589a feat: Implement balanced query planner (#5501)
  • f217135 fix(adaptiveplacement): key distribution stats by tenant and dataset (#5450)
  • ceb071c fix(ci): bump create-github-app-token to v0.3.1 to mask app tokens (#5529)
  • 4059c18 fix(compaction): Use raft_log.CompactionJobStatusUpdate instead of metastorev1.CompactionJobStatusUpdate (#5465)
  • edc6158 fix(deps): bump brace-expansion in /ui [security] (#5466)
  • 26ef03f fix(deps): bump tar, js-yaml, brace-expansion in /ui [security] (#5413)
  • d4b3d29 fix(distributor): collapse stripped profiles to a single sample (#5409)
  • 9a31eec fix(examples): build the golang rideshare images on distroless (#5540)
  • 5056b40 fix(examples): clear the java rideshare CVEs (#5541)
  • b2eeaec fix(examples): create the update commit through the API (#5496)
  • 8216f4a fix(examples): repair the examples update cron (#5492)
  • 07074ce fix(examples): run the nodejs rideshare on a slim base (#5539)
  • b4d7407 fix(helm): missing namespace in discovery RBAC objects (#5447)
  • d50aa87 fix(jfr): treat a profile size limit of 0 as unlimited (#5502)
  • 826f308 fix(metastore): disable raft pipeline replication (#5518)
  • 5a850b1 fix(metastore): don't let a single bad DLQ object block recovery (#5371)
  • 3fe6a45 fix(metastore): double prefix on index cache and DLQ metrics (#5543)
  • c0a71b4 fix(security/critical/): update module github.co

…(truncated)

Security updates

  • Updated github.com/getkin/kin-openapi to v0.144.0, addressing GHSA-r277-6w6q-xmqw (#5416).
  • Updated google.golang.org/grpc to v1.82.1, addressing GHSA-hrxh-6v49-42gf (#5392, #5393).
  • Updated golang.org/x/text to v0.39.0, addressing CVE-2026-56852 (#5383, #5385).
  • Updated golang.org/x/net to v0.56.0, addressing CVE-2026-46600 (#5382, #5384).
  • Updated github.com/klauspost/compress to v1.18.7 (#5429).
  • UI: bumped tar, js-yaml, and brace-expansion, addressing CVE-2026-59871, CVE-2026-59873, CVE-2026-59874, and CVE-2026-59869 (#5413, #5424).
  • UI: bumped brace-expansion to 1.1.18 and 5.0.9, addressing CVE-2026-14257 and CVE-2026-69152 (#5466, #5471).
  • UI: refreshed the Yarn lockfile, removing the vulnerable ip-address package (CVE-2026-69192) and updating postcss (GHSA-r28c-9q8g-f849) (#5419).

Changelog

  • d8461d6 build: remove go workspace and reduce Renovate to security-only updates (#5397) (#5403)
  • 496c887 chore(deps): lock file maintenance (#5419)
  • a3b2460 docs: add v2.2 release notes (#5399) (#5401)
  • df3c039 docs: add v2.2.1 release notes (#5468) (#5473)
  • 400510a docs: document Python memory profiling (#5406) (#5411)
  • 852c39b fix(deps): bump brace-expansion in /ui [security] (#5466) (#5471)
  • 0252239 fix(deps): bump tar, js-yaml, brace-expansion in /ui [security] (#5413) (#5424)
  • 4504545 fix(security/critical/): update module github.com/getkin/kin-openapi to v0.144.0 [security] (#5416)
  • c7fdec8 fix(security/high/): update module google.golang.org/grpc to v1.82.1 [security] (#5392)
  • 097528e fix(security/high/api): update module google.golang.org/grpc to v1.82.1 [security] (#5393)
  • dc8c13f fix(security/unknown/): update module github.com/klauspost/compress to v1.18.7 [security] (#5429)
  • 1f4a845 fix(security/unknown/): update module golang.org/x/net to v0.56.0 [security] (#5382)
  • 0e02e48 fix(security/unknown/): update module golang.org/x/text to v0.39.0 [security] (#5383)
  • 290d232 fix(security/unknown/api): update module golang.org/x/net to v0.56.0 [security] (#5384)
  • 32e1863 fix(security/unknown/api): update module golang.org/x/text to v0.39.0 [security] (#5385)
  • aafe99d fix(ui): adapt to prettier 3.9 and eslint-plugin-react-hooks 7.1 (#5438) (#5440)

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.2.1

Security updates

  • Updated github.com/getkin/kin-openapi to v0.144.0, addressing GHSA-r277-6w6q-xmqw (#5417).
  • Updated google.golang.org/grpc to v1.82.1, addressing GHSA-hrxh-6v49-42gf (#5394, #5395).
  • Updated golang.org/x/text to v0.39.0, addressing CVE-2026-56852 (#5387, #5389).
  • Updated golang.org/x/net to v0.56.0, addressing CVE-2026-46600 (#5386, #5388).
  • Updated github.com/klauspost/compress to v1.18.7 (#5430).
  • UI: bumped tar, js-yaml, and brace-expansion, addressing CVE-2026-59871, CVE-2026-59873, CVE-2026-59874, and CVE-2026-59869 (#5413, #5423).
  • UI: bumped brace-expansion to 1.1.18 and 5.0.9, addressing CVE-2026-14257 and CVE-2026-69152 (#5466, #5470).
  • UI: refreshed the Yarn lockfile, removing the vulnerable ip-address package (CVE-2026-69192) and updating postcss (GHSA-r28c-9q8g-f849) (#5420).

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.1.2

Features and enhancements

  • Added experimental support for asynchronous query execution (#4995).
  • Added trace ID filtering to the v2 read path via trace_id_selector, with a --trace-id flag in profilecli (#5284, #5300).
  • Added SymbolRefTable and symbol_refs tree fields to the query API (#5318).
  • Exposed address-level symbol resolution as a public symbolizer API (#5317).
  • Added an optional admin HTTP server on a separate port (#5191).
  • Kept totals and labels of sampled-out profiles (#5354).
  • Added autocomplete to the query bar in the v2 embedded UI (#5172).
  • Unified merged profile query formats in the querier (#5358).
  • Added a distributor push_batch_series histogram (#5305).
  • Improved performance of pprof language detection (~40% faster and now deterministic) and label validation (#5309, #5313).
  • Added a service_name relabel rule to the Alloy scrape config in the Helm chart (#5262).

Bug fixes

  • Returned HTTP 429 for ingestion-limit rejections on the OTLP and /ingest paths (#5372).
  • Sent all converted OTLP profiles in a single PushBatch per export and bounded PushBatch series fan-out with a per-tenant limit (#5339, #5306).
  • Enforced tenant header extraction in the auth interceptor (#5251).
  • Rejected non-positive ingest sample rates and improved sample rate errors (#5253, #5276).
  • Enabled metastore retention cleanup by default and fixed retention to keep shards with recent data (#5280, #5360).
  • Fixed span selector handling in pprof and tree query paths, and returned trace IDs in span heatmaps (#5273, #5353).
  • Treated two nil value types as compatible in ProfileMerge (#5315).
  • Preserved line-less locations when rewriting symbol database partitions (#5337).
  • Added bounds checks to tree deserialization (#5145).
  • Fixed a data race in usage stats counters (#5303).
  • Declined empty build IDs during debug info uploads and improved ListDebugInfo performance for large tenants (#5302, #5286).
  • Fixed the Helm chart to respect metastore raft extraArgs overrides (#5275).

Security updates

  • Updated Go to 1.25.12 (#5338).

Documentation updates

  • Clarified which flags are v1-exclusive (#5308).
  • Added documentation for supported platforms (#5316).
  • Documented Python SDK fork safety (#5364).

Changelog

  • 0a1f541 Add signed commits requirement for pull requests (#5277)
  • c5455a9 Update golang version to 1.25.12 (#5338)
  • b9092a1 chore(deps): bump github.com/grafana/jfr-parser to v0.18.0 (#5355)
  • def8afc chore(helm): improve chart description, re-triggering the 2.1.1 release (#5352)
  • 8f5e03f chore: Bump renovate baseBranchPatterns before releasing v2.2 (#5376)
  • 12a3632 chore: Cleanup no longer used tool (#5357)
  • a70c936 chore: Ensure examples have consistent services (#5248)
  • d7ad244 chore: bump Helm chart to v2.1.0 (#5267)
  • 10446dc chore: bump Helm chart to v2.1.1 (#5346)
  • ddd724a chore: enable renovate on release branches (#5282)
  • f6e417d chore: fix spelling mistakes (#5294)
  • faaa8c5 ci(backport): migrate to grafana-github-actions-go for signed commits (#5320)
  • 343959e ci(examples): run all examples for harness changes (#5365)
  • 19f8bcc ci(examples): run example tests on same-repo PRs touching examples/ (#5272)
  • e896d94 ci(helm): bump update-helm-repo workflow to pick up signed index.yaml commits (#5351)
  • af325ae ci(release): create Homebrew formula commits via GitHub API so they are signed (#5347)
  • abcc775 docs: Make clear what flags are v1 exclusive (#5308)
  • 380aa94 docs: add docs for supported platforms (#5316)
  • d34c47c docs: add v2.0.4 release notes (#5268)
  • 6b5747d docs: add v2.0.5 release notes (#5283)
  • 277dc2f docs: add v2.0.6 release notes (#5343)
  • e463d5e docs: add v2.1 release notes (#5266)
  • d9cc2e5 docs: add v2.1.1 release notes (#5342)
  • 560ae48 docs: document Python SDK fork safety (#5364)
  • 8cb642c docs: require signed release tags (#5287)
  • 7f2def6 dx: upgrade devcontainer to Go 1.25 and add DinD support (#5288)
  • 7edf681 feat(distributor): add push_batch_series histogram (#5305)
  • f35082e feat(experimental): support async query execution (#4995)
  • ce3edc3 feat(profilecli): add --trace-id to filter query profile samples by trace (#5300)
  • 26eb6d4 feat(querier): unify merged profile query formats (#5358)
  • 6d16eb9 feat(query): add SymbolRefTable and symbol_refs tree fields to the query API (#5318)
  • c37faf2 feat(query): support trace_id_selector in the v2 read path (#5284)
  • bbe8169 feat(symbolizer): expose address-level symbol resolution as a public API (#5317)
  • a732678 feat: add optional admin HTTP server on separate port (#5191)
  • b265cd2 feat: keep totals and labels of sampled-out profiles (#5354)
  • 59a02ff feature(ui): Add autocomplete to v2 embedded UI query bar (#5172)
  • 24bf180 fix(debuginfo): decline empty build IDs during upload initiation (#5302)
  • 62e1c90 fix(debuginfo): improve ListDebugInfo performances for large tenants (#5286)
  • 254c688 fix(distributor): bound PushBatch series fan-out with a per-tenant limit (#5306)
  • c47a33a fix(examples): repair Django rideshare startup (#5363)
  • 3eb7f23 fix(helm): respect metastore raft extraArgs overrides (#5275)
  • 0771f81 fix(ingester): return 429 for ingestion-limit rejections on OTLP and /ingest paths (#5372)
  • 7820b85 fix(metastore): retain shards with recent data (#5360)
  • 5acc2f1 fix(otlp): send all converted profiles in a single PushBatch per export (#5339)
  • bff1b6c fix(pprof): treat two nil value types as compatible in ProfileMerge (#5315)
  • 6d0f831 fix(query): return trace IDs in span heatmaps (#5353)
  • 506c6f3 fix(querybackend): forward and apply span selector in pprof and tree query paths (#5273)
  • f156a4f fix(symdb): preserve line-less locations when rewriting partitions without functions (#5337)
  • f9fe9a5 fix(tree): add bounds checks to DeserializeNoDict (#5145)
  • 4dc429e fix(usagestats): guard MultiCounter/MultiStatistics total against data race (#5303)
  • 5f64687 fix: enable metastore retention cleanup by default (#5280)
  • 01a56aa fix: enforce tenant header extraction in auth interceptor (#5251)
  • 3d08dbf fix: reject non-positive ingest sample rates (#5253)
  • 5fa8702 fix: sample rate errors (#5276)
  • 80c4d21 helm: add service_name relabel rule to alloy scrape config (#5262)
  • e9cfdaf perf(pprof): make language detection deterministic and ~40% faster (#5309)
  • 96e53a1 perf(validation): hoist per-label tenant limit lookups in ValidateLabels (#5313)

As alw

…(truncated)

Security updates

  • Updated the Go toolchain to 1.25.12, addressing CVE-2026-42505 in crypto/tls and CVE-2026-39822 in os (#5338, #5341).

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.0.6

Security updates

  • Updated the Go toolchain to 1.25.12, addressing CVE-2026-42505 in crypto/tls and CVE-2026-39822 in os (#5338, #5340).

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.1.1

Features and enhancements

  • Added readiness checks for the distributor (#5142).
  • Added debug information list and delete APIs, including profilecli support (#5217).
  • Added dataset index generation in segment writer segments (#5112).
  • Added metastore cache hit/miss metrics (#5156).
  • Added distributor ingest parse duration histograms and per-tenant query bytes-fetched metrics (#5107, #5180).
  • Added query frontend estimation accuracy metrics and log ratio output (#5252).
  • Added per-tenant limits for the number of recording rules (#5247).
  • Updated the Helm chart to default to the v2 storage architecture and added support for deploying extra Kubernetes manifests with extraObjects (#5160, #5097).
  • Migrated monitoring dashboards to native histograms (#5048).

Bug fixes

  • Fixed an out-of-bounds panic in clearAddresses (#5250).
  • Fixed nil matcher handling for recording rule upserts (#5134).
  • Fixed tenant ID validation in store-gateway (#5194).
  • Fixed archive extraction issues, including zip-slip/tar-slip cleanup and file closure handling (#5195, #5206).
  • Fixed label value cloning to avoid buffer reuse-after-free issues (#5116).
  • Fixed query read path edge cases, including unknown QueryNode panics, sub-millisecond step parameters, and range-series bucketing (#5196, #5137, #5161).
  • Fixed store-gateway ring route registration (#5130).
  • Fixed speedscope handling for unknown unit values by returning an error instead of panicking (#5143).
  • Fixed metastore shard cache reads and compaction worker histogram buckets (#5189, #5164).
  • Fixed Helm chart rendering for volumeClaimTemplates by adding apiVersion and kind (#5203).
  • Excluded trace_id from sample-to-series label promotion, preventing series-cardinality growth from the emitted trace_id label (#5220).

Security updates

  • Updated UI dependencies for security fixes, including Vite, tar, js-yaml, @babel/core, uuid, and other transitive dependencies (#5260, #5263, #5123, #5181).
  • Updated Go dependencies for security fixes, including golang.org/x/net, golang.org/x/crypto, golang.org/x/image, and github.com/prometheus/prometheus (#5131, #5197, #5216, #5113).
  • Updated the Go toolchain directive for security coverage (#5228).
  • Hardened archive extraction paths and cleanup behavior (#5195, #5206).

Documentation updates

  • Added generated YAML examples and documentation for v2 configuration blocks (#5151).
  • Removed the public preview note from pyroscope.receive_http documentation (#5176).
  • Updated supported .NET versions to 8, 9, and 10 (#5096).
  • Refreshed README content and agent guides for the v2 layout, Go version, and tracing updates (#5246, #5183).
  • Fixed a broken Grafana Cloud Profiles link in SDK guides (#5132).

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.1.0

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull grafana/pyroscope:2.0.3

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull docker.io/grafana/pyroscope:2.0.2

Fixes

  • goreleaser: stamp github.com/grafana/pyroscope/v2/pkg/util/build in build ldflags so pyroscope -version and the pyroscope_build_info metric report Version, Branch, Revision, and BuildDate correctly. Restores the v2.0.0 regression where those fields were empty (#5084)

Documentation

  • Add v2.0 release notes page (#5083)

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions. You can reach out to the team using:

Docker Images

  docker pull docker.io/grafana/pyroscope:2.0.1