chore(deps): Bump github.com/thanos-io/thanos from 0.41.0 to 0.42.0

[dependabot]

Bumps github.com/thanos-io/thanos from 0.41.0 to 0.42.0.

Release notes

Sourced from github.com/thanos-io/thanos's releases.

v0.42.0

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

• #8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
• #8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
• #8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
• #8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
• #8720: Receive: Fix 503 errors during restarts in some cases.
• #8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
• #8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
• #8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
• #8810: Ruler: correctly pass query partial response for gRPC.

Added

• #8691: Cache: add redis key prefix support
• #8691: query/ui: show fanout information
• #8691: Compactor: remove the directory marker objects for some s3 compatible object stores
• #8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
• #8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
• #8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
• #8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
• #8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
• #8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
• #8594: Query: Support per endpoint TLS configuration.

Changed

• #8670: Receive: breaking ⚠️ removed --shipper.ignore-unequal-block-size. TSDB now delays compaction until blocks have been uploaded by the shipper, allowing compaction while uploading without risking data loss.
• #8802: Cache: add SendToReplicas option while initializing Rueidis client to allow sending read-only requests to Redis replica instances.
• #8839: Store: breaking ⚠️ removed --debug.advertise-compatibility-label. Stores now don't advertise @thanos_compatibility_store_type=store external label by default, breaking compatibility with Thanos Query before v0.8.0.
• #8831: Query-Frontend: change time_taken field to time_taken_ms for consistent JSON output for easier parsing by the log collector.
• #8853: Compactor: remove labels specified as dedup replica labels in hashmod calculation; this fixes a footgun that users could inadvertently hit.
• #8796: queryfrontend: add other params to key

Removed

v0.42.0-rc.2

v0.42.0-rc.2 - 2026 06 30

RC.2 fixes a few small regressions after introducing the *os.Root API.

NOTE: we skipped over rc.0 because the release pipeline was broken due to update base image SHAs. There are no other changes except for that in comparison to rc.0.

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

... (truncated)

Changelog

Sourced from github.com/thanos-io/thanos's changelog.

v0.42.0 - 2026 07 08

The biggest new things in this release are, I think, Receive component's improvements regarding tenant's lifecycle handling, ability to have per endpoint configuration, and showing fanout information in Thanos Query. Thank you to everyone for your contributions!

Fixed

• #8752: Query: Fix exemplar proxy stripping external label matchers in multi-tier query topologies. In Query A → Query B → Sidecar setups, external label matchers are now preserved when forwarding to downstream Query nodes so they can route to the correct stores.
• #8726: *: Bump thanos-community/grpc-go fork to fix CVE-2026-33186 (CVSS 9.1), an authorization bypass via malformed :path headers that could bypass path-based "deny" rules in grpc/authz interceptors.
• #8714: Tracing: Fix tls_config fields (ca_file, cert_file, key_file) being silently ignored when using the OTLP gRPC exporter. Previously, deployments using a private CA or mTLS client certificates had to work around this via OTEL_EXPORTER_OTLP_CERTIFICATE and related environment variables.
• #8128: Query-Frontend: Fix panic in AnalyzesMerge caused by indexing the wrong slice variable, leading to an out-of-range access when merging more than two query analyses.
• #8720: Receive: Fix 503 errors during restarts in some cases.
• #8762: Query-Frontend: Fix trace ID missing from slow query logs, regression from #8618.
• #8799: *: Set a KeepaliveEnforcementPolicy with MinTime: 10s on all gRPC servers, matching the client keepalive interval.
• #8806: Receive: Validate tenant IDs extracted from split-tenant labels to prevent path traversal.
• #8810: Ruler: correctly pass query partial response for gRPC.
• #8881: Receive: Fix routing receivers crashing with mkdir ./data: read-only file system on startup by gating data directory setup on enableIngestion, since routing receivers don't write local TSDB data.
• #8890: block: fix GatherIndexHealthStats postings walk error check to prevent swallowing an error.
• #8889: Query: Return an error if Querier doesn't have any registered endpoints and partial response is disabled.

Added

• #8691: Cache: add redis key prefix support
• #8691: query/ui: show fanout information
• #8691: Compactor: remove the directory marker objects for some s3 compatible object stores
• #8730: *: add --grpc-server-tls-ciphers to configure cipher suites for gRPC servers.
• #8730: Receive: add --remote-write.server-tls-ciphers to configure cipher suites for the HTTP server.
• #8770: *: add --grpc-server-tls-curves to configure curves for gRPC servers.
• #8770: Receive: add --remote-write.server-tls-curves to configure curves for the HTTP server.
• #8808: ruler, sidecar: Add TSDB stats endpoint to gRPC server.
• #8797: Receive, Compact, Sidecar: Use os.Root API to confine filesystem access to the service data directory.
• #8594: Query: Support per endpoint TLS configuration.

Changed

• #8670: Receive: breaking ⚠️ removed --shipper.ignore-unequal-block-size. TSDB now delays compaction until blocks have been uploaded by the shipper, allowing compaction while uploading without risking data loss.
• #8802: Cache: add SendToReplicas option while initializing Rueidis client to allow sending read-only requests to Redis replica instances.
• #8839: Store: breaking ⚠️ removed --debug.advertise-compatibility-label. Stores now don't advertise @thanos_compatibility_store_type=store external label by default, breaking compatibility with Thanos Query before v0.8.0.
• #8831: Query-Frontend: change time_taken field to time_taken_ms for consistent JSON output for easier parsing by the log collector.
• #8853: Compactor: remove labels specified as dedup replica labels in hashmod calculation; this fixes a footgun that users could inadvertently hit.
• #8796: queryfrontend: add other params to key

Removed

Commits

• 0d7a353 Merge pull request #8905 from thanos-io/release_0420_final
• 4d637c8 VERSION: bump
• ffb2fca receive: fold test into another one
• e88d0bc receive: fix linter
• 4fc367b receive: fix a few bugs
• 5095711 fix(store): release label values read lock
• d8a04ba Add missing partial response stategy check
• 3684e2e block: fix GatherIndexHealthStats postings walk error check
• 566ab6f fix upload-blocks resource lifetime
• fa48b9a Return an errof if we have no stores at all
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)