chore(deps): update module github.com/thanos-io/thanos to v0.42.4

[scality-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/thanos-io/thanos	v0.41.0 → v0.42.4

---

Release Notes

thanos-io/thanos (github.com/thanos-io/thanos)

v0.42.4

Compare Source

Had to do another version release due to broken base image SHAs. No changes.

v0.42.3

Compare Source

Fixes a small bug - like before now Receive on shutdown creates a new block and uploads it.

Fixed

• #​8948: receive: Preserve upload on shutdown behaviour

v0.42.2

Compare Source

Had to do another version release due to broken base image SHAs. No changes.

v0.42.1

Compare Source

This change fixes a small issue regarding timeouts in the Shipper component in the Receiver - we've accidentally set them too small. Sorry for that!

Changed

• #​8920: receive: bump timeouts

v0.42.0

Compare Source

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

• #​8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
• #​8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
• #​8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
• #​8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
• #​8720: Receive: Fix 503 errors during restarts in some cases.
• #​8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #​8618.
• #​8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
• #​8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
• #​8810: Ruler: correctly pass query partial response for gRPC.
• #​8881: Receive: Fix routing receivers crashing with mkdir ./data: read-only file system on startup by gating data directory setup on enableIngestion, since routing receivers don't write local TSDB data.
• #​8890: block: fix GatherIndexHealthStats postings walk error check to prevent swallowing an error.
• #​8889: Query: Return an error if Querier doesn't have any registered endpoints and partial response is disabled.

Added

• #​8691: Cache: add redis key prefix support
• #​8691: query/ui: show fanout information
• #​8691: Compactor: remove the directory marker objects for some s3 compatible object stores
• #​8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
• #​8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
• #​8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
• #​8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
• #​8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
• #​8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
• #​8594: Query: Support per endpoint TLS configuration.

Changed

• #​8670: Receive: breaking ⚠️ removed --shipper.ignore-unequal-block-size. TSDB now delays compaction until blocks have been uploaded by the shipper, allowing compaction while uploading without risking data loss.
• #​8802: Cache: add SendToReplicas option while initializing Rueidis client to allow sending read-only requests to Redis replica instances.
• #​8839: Store: breaking ⚠️ removed --debug.advertise-compatibility-label. Stores now don't advertise @thanos_compatibility_store_type=store external label by default, breaking compatibility with Thanos Query before v0.8.0.
• #​8831: Query-Frontend: change time_taken field to time_taken_ms for consistent JSON output for easier parsing by the log collector.
• #​8853: Compactor: remove labels specified as dedup replica labels in hashmod calculation; this fixes a footgun that users could inadvertently hit.
• #​8796: queryfrontend: add other params to key

Removed

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
github.com/VictoriaMetrics/easyproto	v0.1.4 -> v1.1.3
golang.org/x/net	v0.55.0 -> v0.56.0
golang.org/x/sync	v0.20.0 -> v0.21.0
golang.org/x/sys	v0.45.0 -> v0.46.0
golang.org/x/term	v0.43.0 -> v0.44.0
golang.org/x/text	v0.37.0 -> v0.38.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260615183401-62b3387ff324

[github-actions]

Dependency Bump Evaluation

Version change: github.com/thanos-io/thanos v0.41.0 -> v0.42.0
Semver bump type: minor

Changes:

• Fixed: exemplar proxy stripping in multi-tier query topologies, panic in AnalyzesMerge, Receive 503 errors during restarts, trace ID missing from slow query logs, gRPC keepalive enforcement policy, Ruler partial response passthrough, Receive routing receiver crash on read-only FS, block health stats error check
• Added: Redis key prefix support, Query UI fanout info, per-endpoint TLS configuration, gRPC cipher suite and curve configuration, TSDB stats gRPC endpoint, filesystem confinement via os.Root
• Security: CVE-2026-33186 (CVSS 9.1) -- gRPC authz bypass via malformed :path headers; Receive tenant ID path traversal validation

Breaking changes:

1. Removed --shipper.ignore-unequal-block-size (Receive) -- no impact, this project does not use Thanos Receive
2. Removed --debug.advertise-compatibility-label (Store) -- no impact, this project implements its own StoreAPI server and does not use this CLI flag; only breaks Thanos Query < v0.8.0

Security concerns: CVE-2026-33186 is a critical gRPC authz bypass, but this project does not use grpc/authz interceptors (confirmed by codebase search). The fix is carried by the transitive grpc-go fork bump. No direct exposure.

Impact on codebase: This project imports storepb, labelpb, and infopb from Thanos. No documented API changes to these packages in v0.42.0. No usage of removed flags or deprecated features found. Transitive bumps include VictoriaMetrics/easyproto v0.1.4 -> v1.1.3 (major, indirect) and routine golang.org/x/* patch bumps. CI passes: build, lint, test all green.

Recommendation: SAFE TO MERGE

Notes: The two breaking changes are operational CLI flags for Thanos components (Receive, Store) that this project does not use. The Go API surface consumed by this project (storepb, labelpb, infopb) is unchanged. All CI checks green.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: github.com/thanos-io/thanos v0.41.0 → v0.42.4
Semver bump type: minor (spans v0.42.0 through v0.42.4)

Changes (v0.42.0–v0.42.4):

• Receive: preserve upload on shutdown, bump timeouts, fix 503 errors during restarts, fix routing receiver crash, validate tenant IDs for path traversal
• Query: fix exemplar proxy stripping external label matchers in multi-tier topologies, return error if no endpoints and partial response disabled
• Query-Frontend: fix AnalyzesMerge panic, fix missing trace ID in slow query logs, rename time_taken to time_taken_ms
• gRPC: bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), set KeepaliveEnforcementPolicy on all servers
• New features: per-endpoint TLS config, redis key prefix, gRPC cipher/curve config, TSDB stats endpoint, os.Root filesystem confinement
• Transitive: VictoriaMetrics/easyproto v0.1.4 to v1.1.3 (major, indirect), standard golang.org/x/* minor bumps

Breaking changes:

• --shipper.ignore-unequal-block-size removed (Receive CLI flag) — no impact: this adapter does not use Thanos CLI flags
• --debug.advertise-compatibility-label removed (Store CLI flag, drops @thanos_compatibility_store_type=store external label, breaks Thanos Query < v0.8.0) — no impact: this adapter implements StoreAPI from the library and never advertised this label

Security concerns:

• CVE-2026-33186 (CVSS 9.1): authorization bypass via malformed :path headers in grpc/authz interceptors — no direct impact on this adapter (no grpc/authz interceptors used), but the fix propagates through the updated grpc-go fork, which is positive
• Receive tenant ID path traversal fix (#8806) — not applicable to this adapter

Impact on codebase:

• Searched for usage of removed CLI flags (shipper, advertise-compatibility-label, thanos_compatibility_store_type): none found
• Searched for grpc/authz interceptor usage: none found
• Verified StoreAPI surface used by the adapter (storepb.StoreServer, infopb.InfoServer, labelpb.ZLabel/ZLabelSet/ZLabelSetsFromPromLabels, storepb.Series, storepb.AggrChunk, storepb.Chunk, storepb.NewSeriesResponse, storepb.MatchersToString): no API changes mentioned in release notes
• The adapter's custom zLabels() function (avoiding ZLabelsFromPromLabels due to the unsafe cast under stringlabels) remains correct and unaffected

Recommendation: SAFE TO MERGE

Notes:

• CI checks were still in progress at time of evaluation — verify all checks pass before merging
• The two marked breaking changes are CLI-flag removals for the Thanos binary; this adapter uses Thanos purely as a library for protobuf types (storepb, infopb, labelpb) and is unaffected
• The CVE fix is a welcome transitive improvement even though this adapter does not use the affected authz interceptors

— Claude Code