Loki v3.6.12 Release

3.6.12 (2026-06-24)

⚠ BREAKING CHANGES

• operator: consolidate image build workflows and improve documentation (#19395)
• move the Loki UI to a Grafana Plugin (#19390)
• operator: CI publishing image strategy (#19365)

Features

• add json parsing stage to v2 engine (#19240) (aec34ed)
• add logfmt parse support to the v2 query engine (#18931) (ccb4549)
• add loki health command (backport release-3.6.x) (#20590) (dfdbe2a)
• add p50, p95 and p99 section sizes per tenant (#19054) (cb3b74a)
• add p50, p95 and p99 sections per tenant to stats (#19044) (d256df4)
• add rules check for namespace and group (#20437) (#20463) (7733ab1)
• build multi-tenant data objects (#19034) (f60f818)
• capture logs drilldown flag in query samples (#19242) (cb3f2ad)
• Change how analytics proxy works (#19098) (82d25df)
• compactor-hs: add a metric to track the number of jobs left to conclude ongoing unit of work (#19506) (9e0f50c)
• deletion: return request ID in response header (#19444) (6e6e8a9)
• drilldown config endpoint (#19028) (52b5d95)
• engine: More aggregations for the new query engine (#19350) (1474ede)
• engine: Prefetch inputs of Merge pipeline concurrently (#19039) (f50c87f)
• fluentd: Add 'compress gzip' setting to fluentd plugin (#18995) (1cda925)
• goldfish: improve query performance with indexes and paritions (#19023) (89509de)
• helm: Add startupProbe to memcached (#19166) (f799e9b)
• helm: Add startupProbe to memcached exporter (#19165) (901e574)
• helm: add configurable livenessProbe to single binary StatefulSet (#19072) (18b8995)
• helm: add dnsconfig to all missing resources (#18903) (ed68531)
• helm: Add health probes to gateway component (#18545) (82aa322)
• helm: Add health probes to loki in backend (#18548) (10441c8)
• helm: add more specificity to affinity and topology spread constraints (#17404) (#19061) (0819e48)
• helm: add replicas to loki-canary deployment (#19095) (c9d7d76)
• helm: add support for custom alert rule annotations (#19193) (2df5197)
• helm: allow extraObjects as dict (#13252) (6a953bb)
• helm: Only delete PVC on statefulset deletion, not scaling (#19097) (0cead58)
• helm: use named ports for memcached services targetports (#18990) (6a5be7e)
• implement unwrap as a projection (#19409) (3ce6fa2)
• implement volume-based pattern filtering (#18838) (71e2e01)
• logcli: add --log.level parameter (#19136) (77c18d9)
• loki-mixin: allow disabling thanos dashboard and fix dashboard's file name (#18749) (cadc824)
• move the Loki UI to a Grafana Plugin (#19390) (3a1e5ad)
• operator: Add alert LokiIngesterFlushFailureRateCritical (#18698) (66ebc5a)
• operator: Add warning alert for when LokiStack is not getting ready (#19258) (c47fe46)
• operator: deploy network policies with LokiStack (#19099) (6e6f61f)
• operator: s3 validation reject endpoints that contain a URL path (#19356) (f6ef4d8)
• operator: Update Loki operand to v3.5.4 (#19122) (155972e)
• operator: Update Loki operand to v3.5.5 (#19187) (743929b)
• per policy overridable stream limits (#18994) (af257fd)
• prepare Loki 3.6 (ab8e800)
• querytee: Add workflow_dispatch for querytee-images workflow (#19541) (4216f68)
• remove tenant topic tee (#19082) (a03e86c)
• single-binary: delete statefulset if volumeClaimTemplates changes (#19217) (da4240d)
• Update to go 1.25.7 (#20694) (#20717) (1967a6a)
• Upgrade go.opentelemetry.io/otel/sdk from v1.38.0 to v1.40.0 (#21115) (d1ab148)
• Upgrade Go to 1.25.8 (release-3.6.x) (#21240) (10d2666)
• Upgrade Go used by querytee/promtail to 3.6 (#21244) (41a4e0c)
• Use different debian version for fluent-bit (#21247) (138c391)

Bug Fixes

• add single-binary component to ingress NetworkPolicy (#19229) (1a7b489)
• Add special case handling for comparing empty and nil values (#19348) (af6983e)
• alloc: set a limit on preallocations (backport release-3.6.x) (#20920) (7e1daf3)
• apply global otlp config to tenant config only when it is updated in the overrides (#19213) (8057c5c)
• Backport gzip fix release 3.6.x (#20514) (d805266)
• Backporting 19989 into 3.6 (#21356) (0f56890)
• build: remove busybox from dockerfile (#19502) (f2ba692)
• build: rpm signature config (#19476) (352c046)
• bump go toolchain to 1.24.6 (#19449) (becdf9b)
• bump go version for 3.6.x (#20667) (b06b508)
• ci: Log into dockerhub for patch releases (#22529) (dfeedf2)
• ci: prepare release 3.6.12 (a25e0d9)
• ci: remove nfpm, like main (#22502) (1a7d0e2)
• correctly register allowed log level fields (d8c4997)
• CVEs in release 3.6.x (#21773) (1fe3b6d)
• deps: [Release 3.6.x] Update dskit to resolve Otel conflict (#20368) (fb05a36)
• deps: Loki 3.6.1 CVE updates (#20014) (2f85998)
• deps: patch mapstructure dependency to remove CVE (#19447) (e34530e)
• deps: update alpine docker tag to v3.23.3 (main) (#20630) (#20832) (fb20246)
• deps: update dependency @hookform/resolvers to v5.2.2 (main) (#19276) (2c02eaf)
• deps: update dependency lucide-react to ^0.544.0 (main) (#19310) (f744d38)
• deps: update dependency zod to v4 (main) (#18392) (6f45a17)
• deps: update module cloud.google.com/go/bigtable to v1.40.0 (main) (#19311) (93e2a33)
• deps: update module cloud.google.com/go/bigtable to v1.40.1 (main) (#19337) (e27e476)
• deps: update module cloud.google.com/go/storage to v1.57.0 (main) (#19312) (819c9c1)
• deps: update module github.com/aws/aws-sdk-go-v2/credentials to v1.18.15 (main) (#19338) (8b8d7de)
• deps: update module github.com/aws/aws-sdk-go-v2/credentials to v1.18.16 (main) (#19352) (9d44db8)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.50.5 (main) (#19340) (afce820)
• deps: update module github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.51.0 (main) (#19388) (ba5f308)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [security] (release-3.6.x) (#21459) (11c1d07)
• deps: update module github.com/baidubce/bce-sdk-go to v0.9.245 (main) (#19278) (295d660)
• deps: update module github.com/buger/jsonparser to v1.1.2 [security] (release-3.6.x) (#21201) (3185466)
• deps: update module github.com/charmbracelet/bubbletea to v1.3.10 (main) (#19279) (789da59)
• deps: update module github.com/docker/docker to v28.4.0+incompatible (main) (#19314) (7407527)
• deps: update module github.com/docker/docker to v28.5.0+incompatible (main) (#19414) (cfd7b12)
• deps: update module github.com/go-logfmt/logfmt to v0.6.1 (main) (#19412) (7f3d419)
• deps: update module github.com/grafana/loki/v3 to v3.5.5 (main) (#18444) (d54b6d8)
• deps: update module github.com/ibm/ibm-cos-sdk-go to v1.12.3 (main) (#19281) (3308ba5)
• deps: update module github.com/ibm/sarama to v1.46.1 (main) (#19282) (7335181)
• deps: update module github.com/oschwald/geoip2-golang to v1.13.0 (main) (#18354) (7508db8)
• deps: update module github.com/pressly/goose/v3 to v3.26.0 (main) (#19417) (b2a5c08)
• deps: update module github.com/shirou/gopsutil/v4 to v4.25.8 (main) (#19284) (a31a86c)
• deps: update module github.com/shirou/gopsutil/v4 to v4.25.9 (main) (#19366) (9f1c1a5)
• deps: update module github.com/sony/gobreaker/v2 to v2.2.1 (main) (#19285) (1112aef)
• deps: update module github.com/sony/gobreaker/v2 to v2.3.0 (main) (#19418) (f84a673)
• deps: update module github.com/spf13/afero to v1.15.0 (main) (#19317) (8854ac1)
• deps: update module github.com/stretchr/testify to v1.11.1 (main) (#19042) (014ec14)
• deps: update module github.com/workiva/go-datastructures to v1.1.6 (main) (#19287) (1704434)
• deps: update module go.opentelemetry.io/collector/pdata to v1.42.0 (main) (#19323) (568cdf1)
• deps: update module go.opentelemetry.io/collector/pdata to v1.43.0 (main) (#19419) (3e415ac)
• deps: update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.63.0 (main) (#18455) (5605b2d)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace to v0.63.0 (main) (#19324) (6270613)
• deps: update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.63.0 (main) (#19327) (8519187)
• deps: update module go.opentelemetry.io/otel/sdk to v1.40.0 [security] (release-3.6.x) (#20887) (d267ad3)
• deps: update module go.opentelemetry.io/otel/sdk to v1.43.0 [security] (release-3.6.x) (#21480) (47fb29e)
• deps: update module golang.org/x/net to v0.45.0 (main) (#19420) (1e8c50c)
• deps: update module golang.org/x/oauth2 to v0.31.0 (main) (#19329) (eaac4ae)
• deps: update module golang.org/x/time to v0.13.0 (main) (#19330) (de928b1)
• deps: update module google.golang.org/api to v0.250.0 (main) (#19331) (a0489e3)
• deps: update module google.golang.org/api to v0.251.0 (main) (#19368) (e09cdf6)
• deps: update module google.golang.org/api to v0.252.0 (main) (#19421) (af3e999)
• deps: update module google.golang.org/grpc to v1.75.1 (main) (#19288) (4e2c090)
• deps: update module google.golang.org/grpc to v1.79.3 [security] (release-3.6.x) (#21193) (87dff41)
• deps: update module google.golang.org/protobuf to v1.36.10 (main) (#19376) (c9f2666)
• deps: update module google.golang.org/protobuf to v1.36.9 (main) (#19289) (fd073bc)
• Do not override S3 region if already specified in configuration chain (backport release-3.6.x) (#20128) (38582ac)
• docker: missing permissions to start docker (backport release-3.6.x) (#19948) (48b507f)
• docker: set WORKDIR to root in loki Dockerfiles (#19952) (6040a09)
• don't need to open section to read tenant (#19053) (598cab7)
• downgrade UI's @swc/core dep back to v1.13.5 (#19345) (134c5af)
• extended detected level for debug and critical level (#18370) (2b01a31)
• fix context canceled stops reader from cleaning up (#19210) (acb8b89)
• fix possible data loss in dataobj-consumers (#19060) (44aba62)
• Fix push stats calculation (#19319) (a6d4935)
• Fix regression in S3 client configuration (backport release-3.6.x) (#20118) (7d8176f)
• helm: Add init container configuration for backend, bloom builder, distributor, query-frontend, query-scheduler, read, write. (#18709) (95ced86)
• helm: admin-api should only be deployed in microservice mode (#13655) (51d710f)
• helm: avoid double zonal ingester scrapping by not scrapping headless svc (#19000) (350d46c)
• helm: Do not strip whitespace in target definitions for querier and read deployments (#19464) (7c309fb)
• helm: explicitly set registry for k8s-sidecar image (#19233) (e0c07c4)
• helm: Remove flaky enterprise test (#19362) (a1c9512)
• helm: un-deprecate several features in monitoring block (#19012) (3272ca7)
• helm: Update querier, read, and single binary target definitions for UI enablement (#19461) (087430e)
• helm: Use strings in stead of integers for ports in CiliumNetworkPolicies (#19252) (3f41d14)
• LineFilterLabelFilter.String() regexp correct delimiters (backport release-3.6.x) (#20649) (9d5fb5f)
• logger: correct log level verbosity in rule evaluation (#19519) (37ad381)
• Metastore timerange filter (#19171) (dfb60dc)
• networkpolicy: use UDP/53 for DNS egress instead of named port (#19073) (4cbbc4f)
• nil error returned when client closed (#19068) (5809c47)
• operator: updated AlertingRule sample to make it comply with the validation we apply (#18671) (8e6c018)
• panic while applying storage updates when a whole chunk is deleted by line filters (#19262) (cbcfbca)
• records discarded if one fetch returns error (#19069) (90ac000)
• remove UI from docker build (#19425) (48f5ade)
• security/HIGH/cmd/segment-inspect: Update security cmd/segment-inspect github.com/prometheus/prometheus to v0.311.3 [SECURITY] (release-3.6.x) (#22205) (bfd37e4)
• security/HIGH/cmd/segment-inspect: Update security cmd/segment-inspect go.opentelemetry.io/otel to v1.41.0 [SECURITY] (release-3.6.x) (#22206) (0ed7bce)
• security/HIGH/: Update module github.com/containerd/containerd/v2 to v2.0.9 [SECURITY] (release-3.6.x) (#22204) (ed38a68)
• security/MEDIUM/cmd/dataobj-inspect: Update security cmd/dataobj-inspect github.com/grafana/loki/v3 to v3.6.4 [SECURITY] (release-3.6.x) (#22209) (d6117ed)
• security/MEDIUM/cmd/segment-inspect: Update security cmd/segment-inspect github.com/grafana/loki/v3 to v3.6.4 [SECURITY] (release-3.6.x) (#22210) (186b9a9)
• security/UNKNOWN/cmd/chunks-inspect: Update go toolchain directive to v1.25.11 [SECURITY] (release-3.6.x) (#22202) (90e12c9)
• security/UNKNOWN/cmd/dataobj-inspect: Update module golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22215) (c696c66)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect go to v1.25.11 [SECURITY] (release-3.6.x) (#22203) (2c67a33)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.6.x) (#22216) (807ffd7)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22217) (7081875)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22218) (36deca1)
• security/UNKNOWN/pkg/push: Update security pkg/push golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22224) (0c53ce1)
• security/UNKNOWN/: Update security golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.6.x) (#22212) (424e5ff)
• security/UNKNOWN/: Update security golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22213) (90ae8f3)
• security/UNKNOWN/: Update security golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22214) (49b9a22)
• silly mistake, this is why we have tests (461fed7)
• Stop applying limits pushdown under a filter (#19154) (b7f14f9)
• storage: attach SHA-256 checksum on PutObject for Object Lock buckets (#21848) (2a7c34c)
• update loki-helm-test image tag to latest commit (#19227) (6298e44)
• use cooperative active sticky load balancer (#19160) (3535ae4)
• Use default config when building s3 client (backport k277) (#19559) (9d7a2f5)

Performance Improvements

• engine: reuse existing array in genericFunction.Evaluate (#19235) (24e968c)
• Reduce allocations for JSON and logfmt parser (#18637) (adb27ff)

Code Refactoring

• operator: CI publishing image strategy (#19365) (ee8c776)
• operator: consolidate image build workflows and improve documentation (#19395) (292a31e)