Changelog

• f1d10b1 chore: bump react router (#4845)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.17.4

Changelog

• 3657d21 Update golang version to 1.24.13 (#4808) (#4831)
• dd2622d docs: Add release notes for v1.18.1

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.18.1

Changelog

• 8e975ea Update golang version to 1.24.13 (#4830)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.17.3

Changelog

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.17.2

Enhancements

• The source code integration now supports Python (#4726, #4732, #4730)
• Implement comprehensive profile size limits across ingestion endpoints (#4734)
• Update golang version to 1.24.12 (#4760)
• Set a maximum ingestion body size by default (#4761)
• Update OpenTelemetry dependencies, proto=v1.9.0 profiles=v0.2.0 (#4731)
• Enforce maxNodes optionally on SelectMergeProfile through limits in v2 (#4723)
• Add benchmarks for timeseries query performance with exemplars (#4665)

Fixes

• Fix exemplar value calculation for split profiles (#4753)
• Relative matching for source code mapping (#4754)
• VCS Service: Failed file lookup should be 404 instead of 500 (#4759)
• Remove unintended double base64 encoding in vcs service (#4703)
• Frontend: Bump qs to address CVE-2025-15284 (#4724)
• Frontend: Bump sweetalert2 to address GHSA-457r-cqc8-9vj9, GHSA-8jh9-wqpf-q52c and GHSA-pg98-6v7f-2xfv (#4727)
• Frontend: Bump @remix-run/router and react-router to address CVE-2026-22029 and CVE-2025-68470 (#4763)

Documentation

• Rename GitHub integration to source code integration (#4755)
• Update source code integration docs to include Java and Python support (#4651)
• Fix inline link in eBPF docs (#4733)

Changelog

• e542ef3 Add release notes for v1.18
• a6dcad6 Fixing inline link (#4733)
• 4523fd1 Implement comprehensive profile size limits across ingestion endpoints (#4734)
• f7611c2 Partially revert function name modification from pyspy-based profiles (#4757)
• 1d28675 Remove function name modification from pyspy-based profiles (#4730)
• ef09e77 Rename GitHub integration to source code integration (#4755)
• 2155e94 Update golang version to 1.24.12 (#4760)
• e2dbb9c Update goreleaser and use it to push weekly builds (#4719)
• fb3b8c6 chore(deps): bump axios (#4764)
• 6fdc8e6 chore(deps): bump sinatra (#4518)
• b80dcbe chore(deps): update a few frontend packages flagged for vulnerabilities (#4724)
• 7f21353 chore(deps): update dependency eslint-plugin-jsdoc to v53 (#4744)
• 8390f63 chore(deps): update helm release alloy to v1.5.1 (#4740)
• 60bd489 chore(deps): update helm release k8s-monitoring to v3.7.1 (#4741)
• c55e2fd chore(examples): update examples (#4698)
• 413c051 chore(exampless,.NET) update Pyroscope.Opentelemetry dependency, fix dynamic labels (#4722)
• 976a49e chore(release): do not run on weekly tags, pass correct release tag explicitly (#4709)
• 681d7ae chore: Do not run update examples cron on forks (#4718)
• 50a6583 chore: Enforce max nodes in v2 query-frontend (#4723)
• 9c5cbb3 chore: Fix overlapping test names (#4728)
• 420116c chore: Frontend update sweetalert2 (#4727)
• 5b6c9f7 chore: Publish Github releases immediately during release process (#4720)
• 08ce6f8 chore: Set a maximum ingestion body size by default (#4761)
• b3ca091 chore: Update OpenTelemetry dependencies proto=v1.9.0 profiles=v0.2.0 (#4731)
• 68da980 chore: Update helm chart and release notes for v1.17 (#4702)
• ef3d709 chore: add resources to provide guidance to coding agents (#4725)
• ffd0232 chore: bump react router (#4763)
• 8d26bca chore: fix regression in main (#4738)
• 8813f79 docs: Fix code blocks code generation (#4693)
• 24cf6cf docs: Update profiling docs to include Java and Python support (#4651)
• 6879681 docs: add missing CVE reference in v1.17 release notes (#4715)
• 904fd10 docs: add warning for patching older release versions (#4714)
• 1ef6460 docs: update release notes for v1.17, v1.16.x & v1.15.x (#4710)
• d702139 docs: updates the list of contributors in README (#4721)
• e4c0f76 feat: Add support for Python source code integration (#4726)
• 4fe7a80 fix: Failed file lookup should be 404 instead of 500 (#4759)
• b378d7f fix: Properly map local file paths for Python source code integration (#4732)
• 01542cf fix: Re-enable defaults for /render from and until parameters (#4745)
• d971a5b fix: Relative matching for source code mapping (#4754)
• 6f18461 fix: Remove unintended double base64 encoding in vcs service (#4703)
• bdfc8ca fix: pass $IMAGE_TAG directly to Goreleaser (#4749)
• 989af26 fix: sum exemplar values from same profile ID and timestamp across splits (#4753)
• 0a5b09a perf: Add benchmarks for timeseries query (exemplars) performance (#4665)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.18.0

Changelog

• f27f585 Pyroscope 1.17.1 release (#4748)
• 6730264 Update goreleaser and use it to push weekly builds (#4719)
• 9f65245 [release/v1.17] backport docs updates (#4711)
• 767ee74 chore: Publish Github releases immediately during release process (#4720)
• e55ecb5 docs: add missing CVE reference in v1.17 release notes (#4715)
• 8ebbbc2 fix: Re-enable defaults for /render from and until parameters (#4745) (#4747)
• 5b051e1 fix: pass $IMAGE_TAG directly to Goreleaser (#4749) (#4750)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.17.1

Changelog

Maintenance release to update Go version and address security vulnerability.

Changes

• Update golang version to 1.24.11 (#4708)
• Patch golang.org/x/crypto/ssh vulnerability (#4708)

As always, feedbacks are more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.16.2

Changelog

Maintenance release to update Go version and address security vulnerability.

Changes

• Update golang version to 1.24.11 (#4707)
• Patch golang.org/x/crypto/ssh vulnerability (#4707)

As always, feedbacks are more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.15.3

Enhancements

• Exemplar support for individual profile retrieval (#4615) (#4621) (#4657) (#4657) (#4686) (#4605) (#4631)
• Introduce additional metastore compaction metrics (#4625)
• Add trace spans for query-frontend (#4620)
• Add tracing instrumentation to source code integration #4607)
• Minor symbolizer metrics improvements (#4597)
• Parallelize mapping symbolization to improve query performance (#4594)
• Add metric to track unsymbolized profile blocks at ingestion (#4619)
• lidia: dynsym symbols (#4691)
• perf: Merge duplicate annotations (#4646)
• vcs: Allow to provide functionName to the GetFile API. (#4613)

Fixes

• Address npm CVEs (#4682)
• Fix update-examples after ruby upgrade (#4687)
• Fix panic in pprof split when using relabel.LabelDrop (#4699)
• Assign appropriate HTTP status codes (#4684)
• Fetching go stdlib without configs (#4655)
• Implement Speedscope profile merging (#4592)
• limit max nodes in symbolization queries (#4629)
• mask COS provider secret_key config CVE-2025-41118 (#4700)
• Source code module path parsing (#4609)
• Set file name and line number in symbolization (#4610)
• SelectSeries not correct for single reports (#4617)
• Return modified labels after validation sanitization (#4662)

Changelog

• 9e07b6b feat: add exemplar support to timeseries responses for individual profile retrieval (#4615)
• 620fc2d Fix error in configuring-github-integration.md (#4614)
• 2039178 Fix update-examples after ruby upgrade (#4687)
• 114dd9f Introduce additional metastore compaction metrics (#4625)
• 1e59e76 Update README.md (#4676)
• 40d6db8 Update make docs procedure (#4612)
• eb847bd Update go version to 1.24.10 (#4634)
• f27dc74 Update golang version to 1.24.11 (#4666)
• 909602a chore(deps): bump golang.org/x/net (#4573)
• 14097c2 chore(deps): bump golang.org/x/net (#4645)
• de43403 chore(deps): bump golang.org/x/net in /examples/golang-pgo (#4630)
• d110bab chore(deps): bump node-forge from 1.3.1 to 1.3.2 (#4643)
• 8e5a68b chore(deps): bump rack from 3.1.16 to 3.1.18 in /examples/tracing/ruby (#4624)
• 2241c41 chore(deps): update actions/setup-node action to v4 (#4600)
• a720980 chore(deps): update dependency eslint-config-airbnb-typescript to v18 (#4602)
• 39bbce1 chore(deps): update dependency eslint-plugin-jsdoc to v46 (#4604)
• a3d1310 chore(deps): update dependency eslint-plugin-jsdoc to v50 (#4674)
• 667170e chore(deps): update github-actions (#4590)
• feff450 chore(deps): update github-actions (#4632)
• 42783a0 chore(deps): update github-actions (#4656)
• ecb1d34 chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (#4628)
• 6406621 chore(deps): update node.js to aa648b3 (#4589)
• d57a9fc chore(examples): fix issues with rideshare .NET example
• 34be3c5 chore(examples): update examples (#4639)
• 1349a52 chore(examples): update examples (#4649)
• c97e9a3 chore(examples): update examples (#4688)
• 8817809 chore: Add tests to validate public read path endpoint status codes (#4685)
• d9ebad7 chore: Add trace spans for query-frontend (#4620)
• dd402c9 chore: Add tracing instrumentation to source code integration (#4607)
• 6712f54 chore: Address npm CVEs (#4682)
• 9591310 chore: Ensure files copied in are writeable in ruby/simple example (#4690)
• 2a981f2 chore: Fix debug image (#4616)
• a9a8111 chore: Make profileEntryIterator more configurable (#4621)
• f0937a0 chore: Run update-contributors workflow once a month (#4679)
• dee59f4 chore: Update helm charts and release notes for v1.16 (#4593)
• d9b2285 chore: Update helm to 3.19.2 (#4680)
• ffe5822 chore: Update java images from openjdk to sapmachine (#4647)
• f04beeb chore: Upgrade nodejs sdk examples to latest sdk and node (#4622)
• 267f60f chore: minor symbolizer metrics improvements (#4597)
• 24a049d chore: parallelize mapping symbolization to improve query performance (#4594)
• 1075882 chore: remove unnecesarry auth squats (#4650)
• 6004579 chore: update helm release k8s-monitoring to v3.6.0 (#4652)
• e4135ab chore: update rideshare examples (#4683)
• 5d9ff7f chore: update symbolizer metrics (#4595)
• d9d6a1d doc: link to correct layer of directory (#4599)
• 8acc758 docs: Fix reference to .goreleaser.yaml (#4658)
• 4d0d8b2 docs: Update release documentation to address pain points (#4626)
• 2305b52 docs: Update release note docs to address website release notes (#4598)
• 2e303da docs: updates the list of contributors in README (#4653)
• 4ced8a8 docs: updates the list of contributors in README (#4661)
• aa9f56f docs: updates the list of contributors in README (#4663)
• cb5db4a docs: updates the list of contributors in README (#4669)
• 8d588a4 feat: Add .pyroscope.yaml with source code mapping support (#4606)
• 8a66402 feat: Add metric to track unsymbolized profile blocks at ingestion (#4619)
• b3e9530 feat: Add new source-code coverage option to profilecli (#4642)
• feb1032 feat: Add profile_id_selector for individual profile retrieval (#4657)
• 3118337 feat: Add trace spans for exemplars and profile ID selectors (#4686)
• ace37f9 feat: add proto definitions for individual profile retrieval API (#4605)
• 4fc3f7e feat: add validation for exemplar types in timeseries queries (#4631)
• 672add9 fix panic in pprof split when using relabel.LabelDrop (#4699)
• edb825f fix(examples): update eBPF profiler to support Linux 6.16+ kernels (#4660)
• ced5b01 fix: Assign appropriate HTTP status codes (#4684)
• eb8902e fix: Fetching go stdlib without configs (#4655)
• d758c58 fix: Fix Update Contributors in README workflow (#4654)
• e6c0bf6 fix: Implement Speedscope profile merging (#4592)
• 9a0ce8d fix: Missing labels updates to sample groups in VisitSampleSeries (#4695)
• f85cf5c fix: No data for format=dot queries, should not result in a 500 (#4675)
• 409e245 fix: Return modified labels after validation sanitization (#4662)
• d022b78 fix: SelectSeries not correct for single reports (#4617)
• 17c765a fix: Set file name and line number in symbolization (#4610)
• 10ca881 fix: Source code module path parsing (#4609)
• 3799719 fix: Update node in update_examples.Dockerfile (#4638)
• dcf54ac fix: limit max nodes in symbolization queries (#4629)
• 1c45795 fix: mask COS provider secret_key config (#4700)
• 5c90a06 fix: preserve original timestamps in exemplars during aggregation (#4637)
• cc926a7 fix: tryFindGo doesn't trim repo path when absolute path is used (#4608)
• a49b562 lidia: dynsym symbols (#4691)
• c5389c7 perf: Merge duplicate annotations (#4646)
• f213eb9 profilecli(canary): do not check for service.name label (#4677)
• 34b5c64 remove hardcoded metrics port in rideshare example (#4701)
• 1a4ae33 vcs: Allow to provide functionName to the GetFile API. (#4613)

As always, feedback is more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyrosc...

Changelog

• b8263bb fix: mask COS provider secret_key config CVE-2025-41118 (#4700)

As always, feedbacks are more than welcome, feel free to open issues/discussions.
You can reach out to the team using:

• Slack
• Github Discussions
• Github Issues
• Mailing List

Docker Images

• grafana/pyroscope

  docker pull docker.io/grafana/pyroscope:1.16.1