docs: backfill v2.9.5/v2.10.8/v3.0.3 changelog and release notes to main - #7771
Open
mattdurham wants to merge 1 commit into
Open
docs: backfill v2.9.5/v2.10.8/v3.0.3 changelog and release notes to main#7771mattdurham wants to merge 1 commit into
mattdurham wants to merge 1 commit into
Conversation
mattdurham
requested review from
carles-grafana,
electron0zero,
ie-pham,
javiermolinar,
knylander-grafana,
mapno,
mdisibio,
ruslan-mikhailov,
stoewer,
yvrhdn,
zalegrala and
zhxiaogg
as code owners
August 14, 2026 13:48
Contributor
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
This PR backfills missing patch-release notes (v2.9.5, v2.10.8, v3.0.3) into main’s release notes and CHANGELOG.md. However, the diff also introduces a substantial Antithesis integration (new antithesis/ harness, new Go scenario binaries, Dockerfiles/compose configs, and a production /ready bootstrap assertion) plus Go module dependency/tooling changes.
Changes:
- Backfill patch-release security/bug-fix notes into the docs release notes and
CHANGELOG.md. - Add an Antithesis test harness under
antithesis/(Docker build pipeline, compose topologies, scenario binaries, internal clients/state). - Add a bootstrap Antithesis
assert.Reachablecall in Tempo’s/readyhandler and update Go module deps to support the new code/tooling.
Reviewed changes
Copilot reviewed 50 out of 101 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| go.mod | Adds tool directive and new direct deps to support Antithesis/scenario code. |
| go.sum | Updates module sums for new/updated dependencies. |
| CHANGELOG.md | Backfills v3.0.3/v2.10.8/v2.9.5 sections into main. |
| docs/sources/tempo/release-notes/version-2/v2-9.md | Adds a 2.9.5 security-fixes entry. |
| docs/sources/tempo/release-notes/version-2/v2-10.md | Adds a 2.10.8 security-fixes entry. |
| docs/sources/tempo/release-notes/v3-0.md | Adds 3.0.3 security-fixes and bug-fixes entries. |
| cmd/tempo/app/app.go | Adds Antithesis bootstrap assert.Reachable in /ready (guarded). |
| cmd/tempo/app/app_test.go | Adds tests covering /ready behavior around the new assertion. |
| antithesis/Dockerfile | Adds multi-stage build for instrumented SUT/workload images and tooling. |
| antithesis/Dockerfile.dockerignore | Adds Antithesis-specific build-context exclusions. |
| antithesis/AGENTS.md | Documents Antithesis integration layout and rationale. |
| antithesis/config/docker-compose.yaml | Defines single-binary Antithesis compose topology. |
| antithesis/config/tempo.yaml | Provides single-binary Tempo config for Antithesis runs. |
| antithesis/config/.env | Documents env handling for the single-binary Antithesis topology. |
| antithesis/config-distributed/docker-compose.yaml | Defines distributed Antithesis compose topology. |
| antithesis/config-distributed/tempo.yaml | Provides distributed Tempo config for Antithesis runs. |
| antithesis/config-distributed/.env | Documents env handling for the distributed Antithesis topology. |
| antithesis/setup-complete.sh | Adds setup completion script used by Antithesis orchestration. |
| antithesis/instrumentation-excludes-sut.txt | Defines instrumentor exclude list for SUT build. |
| antithesis/instrumentation-excludes-workload.txt | Defines instrumentor exclude list for workload build. |
| antithesis/test/first_setup/main.go | Adds Antithesis first-setup scenario binary. |
| antithesis/test/first_setup/main_test.go | Adds unit tests for first_setup helpers. |
| antithesis/test/parallel_driver_ingest_and_query/main.go | Adds ingest+query scenario binary. |
| antithesis/test/parallel_driver_ingest_and_query/main_test.go | Adds unit tests for counter determinism. |
| antithesis/test/parallel_driver_restart_durability/main.go | Adds durability re-check scenario binary. |
| antithesis/test/finally_all_written_traces_queryable/main.go | Adds finally-sweep scenario binary. |
| antithesis/test/anytime_vulture_health/main.go | Adds anytime vulture health-check scenario binary. |
| antithesis/test/internal/config/config.go | Adds shared on-disk state/ledger helpers for scenarios. |
| antithesis/test/internal/config/config_test.go | Adds tests for state/ledger helpers. |
| antithesis/test/internal/scenarioconfig/scenarioconfig.go | Adds env-var based endpoint configuration for scenarios. |
| antithesis/test/internal/scenarioconfig/scenarioconfig_test.go | Adds tests for scenarioconfig behavior. |
| antithesis/test/internal/scenarioconfig/doc.go | Adds package docs for scenarioconfig. |
| antithesis/test/internal/tempoclient/doc.go | Adds package docs for tempoclient. |
| antithesis/test/internal/tempoclient/push.go | Adds OTLP trace pusher used by scenarios. |
| antithesis/test/internal/tempoclient/query.go | Adds HTTP query client for TraceQL and trace-by-id. |
| antithesis/test/internal/tempoclient/tempoclient_test.go | Adds tests for tempoclient query behavior. |
| antithesis/test/internal/vultureclient/metrics.go | Adds Prometheus text parsing helper for vulture metrics. |
| antithesis/test/internal/vultureclient/metrics_test.go | Adds tests for vulture metrics parsing. |
| .bob/state/test-results.md | Captures local test run results for the change set. |
| .bob/state/review.md | Captures review output used during development iteration. |
| .bob/state/review-prompt.md | Captures the review prompt used during development iteration. |
| .bob/state/plan.md | Captures an implementation plan for the Antithesis restructure. |
| .bob/state/implementation-status.md | Captures implementation status notes for the change set. |
| .bob/state/go-presubmit.md | Captures Go-focused presubmit review notes for the change set. |
| .bob/state/fix-prompt.md | Captures fix guidance used during development iteration. |
| .bob/state/commit-prompt.md | Captures commit guidance used during development iteration. |
| .bob/state/coder-1-status.md | Captures coder status notes for the change set. |
| .bob/state/coder-2-status.md | Captures coder status notes for the change set. |
| .bob/state/coder-3-status.md | Captures coder status notes for the change set. |
| .bob/state/brainstorm-prompt.md | Captures initial brainstorming prompt for the work. |
Files excluded by content exclusion policy (50)
- vendor/github.com/antithesishq/antithesis-sdk-go/LICENSE
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/assert.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/assert_noop.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/assert_types.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/boolean_guidance.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/location.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/numeric_guidance.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/rich_assert.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/rich_assert_nop.go
- vendor/github.com/antithesishq/antithesis-sdk-go/assert/tracker.go
- vendor/github.com/antithesishq/antithesis-sdk-go/internal/emit.go
- vendor/github.com/antithesishq/antithesis-sdk-go/internal/sdk_const.go
- vendor/github.com/antithesishq/antithesis-sdk-go/internal/voidstar_handler.go
- vendor/github.com/antithesishq/antithesis-sdk-go/internal/voidstar_handler_noop.go
- vendor/github.com/antithesishq/antithesis-sdk-go/lifecycle/lifecycle.go
- vendor/github.com/antithesishq/antithesis-sdk-go/lifecycle/lifecycle_noop.go
- vendor/github.com/antithesishq/antithesis-sdk-go/random/random.go
- vendor/github.com/antithesishq/antithesis-sdk-go/random/random_choice.go
- vendor/github.com/antithesishq/antithesis-sdk-go/random/random_local.go
- vendor/github.com/antithesishq/antithesis-sdk-go/random/source.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/antithesis-go-instrumentor.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/args/args.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/common/files.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/common/logger.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/common/names.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/common/text.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/config/config.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/config/exclusions.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/assertions/assertion_hints.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/assertions/assertion_scanner.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/assertions/catalog_output.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/coverage/config/config.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/coverage/file_instrumentor.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/coverage/instrumentor/instrumentor.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/coverage/instrumentor/node_stack.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/coverage/notifier_output.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/scanners/coverage/symboltable/symbol_table.go
- vendor/github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor/version.txt
- vendor/golang.org/x/mod/internal/lazyregexp/lazyre.go
- vendor/golang.org/x/mod/modfile/print.go
- vendor/golang.org/x/mod/modfile/read.go
- vendor/golang.org/x/mod/modfile/rule.go
- vendor/golang.org/x/mod/modfile/work.go
- vendor/golang.org/x/mod/module/module.go
- vendor/golang.org/x/mod/module/pseudo.go
- vendor/golang.org/x/tools/go/ast/astutil/enclosing.go
- vendor/golang.org/x/tools/go/ast/astutil/imports.go
- vendor/golang.org/x/tools/go/ast/astutil/rewrite.go
- vendor/golang.org/x/tools/go/ast/astutil/util.go
- vendor/modules.txt
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+5
to
+9
| * [SECURITY] Update Go to 1.26.5 to fix CVE-2026-39822, CVE-2026-27145, CVE-2026-42504, CVE-2026-42505, and CVE-2026-42507; update google.golang.org/grpc to v1.82.1 to fix GHSA-hrxh-6v49-42gf; update golang.org/x/net to v0.56.0 to fix CVE-2026-46600; update golang.org/x/text to v0.39.0 to fix CVE-2026-56852; update go.opentelemetry.io/otel to v1.44.0 to fix CVE-2026-41178 [#7726](https://github.com/grafana/tempo/pull/7726) (@mattdurham) | ||
| * [ENHANCEMENT] Add Tempo configuration documentation to the MCP server [#7521](https://github.com/grafana/tempo/pull/7521) (@knylander-grafana) | ||
| * [ENHANCEMENT] Update the TraceQL and metrics documentation served by the MCP server [#7375](https://github.com/grafana/tempo/pull/7375) (@knylander-grafana) | ||
| * [BUGFIX] Fix incorrect version reported by `--version`, the build-info metric, and `/api/status/buildinfo` [#7469](https://github.com/grafana/tempo/pull/7469) (@zhxiaogg) | ||
| * [CHANGE] Remove guidance on running multiple monolithic instances [#7636](https://github.com/grafana/tempo/pull/7636) (@mattdurham) |
Comment on lines
+3
to
+6
| # v3.0.3 | ||
|
|
||
| * [SECURITY] Update Go to 1.26.5 to fix CVE-2026-39822, CVE-2026-27145, CVE-2026-42504, CVE-2026-42505, and CVE-2026-42507; update google.golang.org/grpc to v1.82.1 to fix GHSA-hrxh-6v49-42gf; update golang.org/x/net to v0.56.0 to fix CVE-2026-46600; update golang.org/x/text to v0.39.0 to fix CVE-2026-56852; update go.opentelemetry.io/otel to v1.44.0 to fix CVE-2026-41178 [#7726](https://github.com/grafana/tempo/pull/7726) (@mattdurham) | ||
| * [ENHANCEMENT] Add Tempo configuration documentation to the MCP server [#7521](https://github.com/grafana/tempo/pull/7521) (@knylander-grafana) |
Comment on lines
+118
to
+124
| sm, err := services.NewManager(svc) | ||
| require.NoError(t, err) | ||
| require.NoError(t, sm.StartAsync(context.Background())) | ||
| t.Cleanup(func() { | ||
| svc.StopAsync() | ||
| require.NoError(t, svc.AwaitTerminated(context.Background())) | ||
| }) |
Comment on lines
+105
to
+108
| value, found, err := vultureclient.ParseCounter(resp.Body, metricName) | ||
| if err != nil { | ||
| return 0, true, fmt.Errorf("parse metrics: %w", err) | ||
| } |
Comment on lines
+3
to
+6
| go 1.26.5 | ||
|
|
||
| tool github.com/antithesishq/antithesis-sdk-go/tools/antithesis-go-instrumentor | ||
|
|
main was missing these sections that already shipped on the release branches, so the released notes aren't reflected on main (per RELEASES.MD Patch Releases step 8). This backfills: - CHANGELOG.md: adds the v3.0.3, v2.10.8, and v2.9.5 sections, converted to main's entry style. - release-notes/version-2/v2-9.md: adds a 2.9.5 security-fixes entry (grpc, otel). - release-notes/version-2/v2-10.md: adds a 2.10.8 security-fixes entry (Go 1.26.5, grpc, x/net, x/text, otel). - release-notes/v3-0.md: adds a 3.0.3 security-fixes entry (same as 2.10.8) and a 3.0.3 bug-fixes entry (build-version reporting fix, #7469, first appearing in the 3.0 line in this release).
mattdurham
force-pushed
the
backfill-2.9.5-2.10.8-3.0.3
branch
from
August 14, 2026 14:50
b80deef to
491ea90
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
Suppressed comments (2)
CHANGELOG.md:9
- MEDIUM: In this v3.0.3 section the entry types are out of the established order (SECURITY, CHANGE, FEATURE, ENHANCEMENT, BUGFIX). Currently the CHANGE entry comes after ENHANCEMENT/BUGFIX, which makes the changelog harder to scan consistently.
* [ENHANCEMENT] Add Tempo configuration documentation to the MCP server [#7521](https://github.com/grafana/tempo/pull/7521) (@knylander-grafana)
* [ENHANCEMENT] Update the TraceQL and metrics documentation served by the MCP server [#7375](https://github.com/grafana/tempo/pull/7375) (@knylander-grafana)
* [BUGFIX] Fix incorrect version reported by `--version`, the build-info metric, and `/api/status/buildinfo` [#7469](https://github.com/grafana/tempo/pull/7469) (@zhxiaogg)
* [CHANGE] Remove guidance on running multiple monolithic instances [#7636](https://github.com/grafana/tempo/pull/7636) (@mattdurham)
CHANGELOG.md:5
- MEDIUM:
.chloggen/README.mddocuments thatCHANGELOG.mdis generated viatools/chloggenand should not be edited directly. Since this PR backfills already-released sections, can we either (a) generate this viachloggen update -version ...from temporary.chloggen/entries, or (b) add a brief note in the PR/commit message explaining why this direct edit is the intended exception?
<!-- next version -->
# v3.0.3
* [SECURITY] Update Go to 1.26.5 to fix CVE-2026-39822, CVE-2026-27145, CVE-2026-42504, CVE-2026-42505, and CVE-2026-42507; update google.golang.org/grpc to v1.82.1 to fix GHSA-hrxh-6v49-42gf; update golang.org/x/net to v0.56.0 to fix CVE-2026-46600; update golang.org/x/text to v0.39.0 to fix CVE-2026-56852; update go.opentelemetry.io/otel to v1.44.0 to fix CVE-2026-41178 [#7726](https://github.com/grafana/tempo/pull/7726) (@mattdurham)
Contributor
Author
|
@knylander-grafana if you want to take a look |
| @@ -316,6 +316,14 @@ Tempo 3.0 upgrades to Go 1.26.2. [[PR 6443](https://github.com/grafana/tempo/pul | |||
|
|
|||
| ## Security fixes | |||
|
|
|||
Contributor
There was a problem hiding this comment.
Forgot to add this.
Suggested change
| The following security issues are addressed. | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does:
mainwas missing thev2.9.5,v2.10.8, andv3.0.3sections that already shipped on the release branches, so the released notes aren't reflected onmain(perRELEASES.MDPatch Releases step 8). This backfills:CHANGELOG.md: adds thev3.0.3,v2.10.8, andv2.9.5sections, converted to main's entry style.release-notes/version-2/v2-9.md: adds a### 2.9.5security-fixes entry (grpc, otel).release-notes/version-2/v2-10.md: adds a### 2.10.8security-fixes entry (Go 1.26.5, grpc, x/net, x/text, otel).release-notes/v3-0.md: adds a### 3.0.3security-fixes entry (same CVEs as 2.10.8) and a### 3.0.3bug-fixes entry (build-version reporting fix, fix: incorrect build version reported by tempo binaries #7469 — first appearing in the 3.0 line in this release).Formatted per
.claude/skills/shared/release-notes-workflow.md's "Patch releases" section. Note:main's CHANGELOG.md was already missingv2.9.1-v2.9.4sections before this PR (pre-existing gap, out of scope here).Which issue(s) this PR fixes:
N/A
Checklist
.chloggen/(N/A — backfills already-released sections ontomain)