Tempo v3.0.3 released on 13-08-2026
Tempo v3.0.3 is out now. It upgrades Go to 1.26.5 and updates several core dependencies to remediate multiple CVEs and advisories, reducing exposure in Tempo’s build/runtime and telemetry stacks.
See the Tempo GitHub release notes for full details and downloads.
What’s in this release
- Security: Go updated to 1.26.5 and dependencies updated (google.golang.org/grpc v1.82.1, golang.org/x/net v0.56.0, golang.org/x/text v0.39.0, go.opentelemetry.io/otel v1.44.0) addressing CVE-2026-39822, CVE-2026-27145, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507, GHSA-hrxh-6v49-42gf, CVE-2026-46600, CVE-2026-56852 and CVE-2026-41178.
- Enhancement: query-frontend now serves Tempo configuration documentation via the MCP server (docs://config/overview and docs://config/reference); the reference is generated from the default configuration so it stays in sync with code. TraceQL and metrics documentation served by MCP were also updated.
- Bug fix: corrected incorrect version reporting — –version, the build-info metric and /api/status/buildinfo now read the build version from the new top-level VERSION file for accurate build/runtime reporting.
Upgrade notes
- No breaking changes are reported in the release notes; follow your normal update procedure and ensure your builds or images pick up Go 1.26.5 and the updated dependencies.
- If you need to roll back, revert to the previous release and restore your prior build artifacts or images per your usual rollback process.
Share any feedback or report issues on the Tempo GitHub issues page — the project team will track any regressions or follow-up work there.
