Loki v3.7.4 released on 24-07-2026
Loki v3.7.4 is out now. Operators and deployments handling logs should rebuild and redeploy Loki (and any related clients) to apply multiple security fixes that address several critical/high vulnerabilities.
See the project’s GitHub release for the full notes and links to commits and issues before performing upgrades.
What’s in this release
- Security upgrades: Go bumped to 1.26.5 (addresses CVE-2026-39822 and CVE-2026-42505), apache/thrift updated to v0.24.0, golang.org/x/net to v0.55.0, containerd to v2.0.10, and fluentd (used by the fluentd docker client) updated to v1.19.3.
- Dependency refresh and library updates: a range of third-party module bumps including charm.land/bubbletea/v2, charm.land/lipgloss/v2, aws-sdk-go-v2 credentials and smithy-go, baidubce SDK, coder/quartz, IBM COS SDK, klauspost/compress, pierrec lz4 v4, and shirou/gopsutil.
- CI, packaging and storage fixes: suppressed zizmor findings for operator-images in the 3.7 line, fixed a Helm CI warning, re-enabled Docker plugin publishing, plus storage/compactor fixes (Thanos filesystem delete request and an index-filename bug with the legacy S3 client and chunk_delimiter).
Upgrade notes
- Rebuild and redeploy Loki and any related clients to pick up the security fixes (Go, thrift, containerd, fluentd and other updated modules).
- If you use Thanos filesystem backends or the legacy S3 client with chunk_delimiter, upgrade to avoid failed deletes or incorrect index filenames.
Share how the upgrade went — report problems or confirmations on the GitHub release or issue tracker so others can benefit from your experience.
