chore(deps): update docker.io/grafana/alloy docker tag to v1.18.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
docker.io/grafana/alloy	minor	v1.14.0 → v1.18.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

grafana/alloy (docker.io/grafana/alloy)

v1.18.1

Compare Source

Bug Fixes 🐛

• Add nop receiver to OTel Engine [backport] (#​6755) (d7588f8) (@​blewis12)
• Backport dependency upgrades to address CVE's GO-2026-6061 & GO-2026-5970 (#​6836) (4c3e8a6) (@​blewis12, @​thampiotr)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.18.0

Compare Source

⚠ BREAKING CHANGES

• otelcol.receiver.otlp, otelcol.receiver.faro, otelcol.receiver.jaeger, otelcol.receiver.zipkin, otelcol.receiver.influxdb, otelcol.receiver.splunkhec, otelcol.receiver.datadog, and otelcol.extension.jaeger_remote_sampling now default to idle_timeout = "1m", read_header_timeout = "1m", and write_timeout = "30s" on their HTTP servers, matching upstream default. These were previously being defaulted to "0s". You can explicitly set them to "0s" to restore the previous behavior.
• otelcol.receiver.kafka and otelcol.exporter.kafka: resolve_canonical_bootstrap_servers_only is now a no-op and deprecated. The upstream migration from migration from sarama to `franz-go dropped the behavior. The argument still parses but no longer resolves bootstrap server addresses.
• otelcol.exporter.splunkhec — batcher block removed (upstream deletion in otel-contrib v0.151). Configs using it will fail to load. Migration: move the equivalent fields under sending_queue.batch (enabled → presence of the block; flush_timeout/sizer/min_size/max_size keep their names).

Features 🌟

• Add alloy.command to override the Alloy Helm container entrypoint (#​6509) (fea3056) (@​petewall)
• Add k8sleaderelector Extension and k8scluster Receiver to OTel Engine (#​6450) (24fc846) (@​blewis12, @​kgeckhart)
• Add OpAmp Extension to OTel Engine (#​6632) (a32e83b) (@​blewis12)
• Add otelcol.connector.signaltometrics component (#​6410) (887ca3f) (@​bradleypettit, @​clayton-cornell)
• database_observability.mysql: Collect mysql query error info (#​6675) (d63d9ff) (@​matthewnolf)
• database_observability.postgres: Emit op=error_message Loki entries with query fingerprint (#​6180) (377f1d0) (@​gaantunes)
• database_observability.sql_server: Add table_spec to schema_details collector (#​6641) (db801a6) (@​cristiangreco)
• database_observability.sql_server: Add scaffolding for sql_server schema_details collector (#​6624) (0cedb33) (@​cristiangreco)
• database_observability.sql_server: Scan all databases in schema_details collector (#​6672) (dd1eabe) (@​cristiangreco)
• discovery.aws: Add AWS unified service discovery component (#​6658) (25cb5f0) (@​kgeckhart)
• Expose HTTP server idle/read/read_header/write timeouts in OTel Components (#​6636) (7cc28ee) (@​kgeckhart)
• Helm Chart: Make service.externalTrafficPolicy avaliable (#​4511) (a987e33) (@​at-blacknight, @​kalleep)
• Inline config support for Alloy Otel Extension (#​6442) (53589bd) (@​x1unix)
• Make alloyengine extension OCB-able (#​6395) (b6c5b20) (@​jharvey10)
• metrics: Add native histogram support for self-monitoring metrics (#​6385) (6045de1) (@​Rishabh-1098git)
• otelcol.connector.spanmetrics: Expose include_collector_instance_id (#​6635) (ca46cb4) (@​kgeckhart)
• otelcol: Expose small v0.152/v0.153 upstream config field additions (#​6664) (f824237) (@​kgeckhart)
• prometheus.exporter.windows: Add time collector to the Windows exporter (#​6517) (6289603) (@​ptodev)
• prometheus.remote_write: Expose google_iam, round_robin_dns, and additional sigv4/azuread auth options (#​6637) (96dd5e0) (@​kgeckhart)
• pyroscope.ebpf: Add no_kernel_version_check argument (#​6475) (020d74c) (@​marcsanmi, @​clayton-cornell, @​dehaansa)
• pyroscope: Add scope labels to Alloy profiles (#​6569) (cb771b6) (@​korniltsev-grafanista)
• ui: Render pipeline graph via @​grafana/alloy-pipeline-graph (#​6566) (7772bf8) (@​fabienne-m, @​cursoragent)
• Upgrade Prometheus to v3.12.0 (GA) and OpenTelemetry Collector to v0.153.0 (#​6597) (118a5d1) (@​kgeckhart)
• Upgrade Prometheus to v3.12.0-rc.0, otel-contrib to v0.151.0, Loki to v3.7.1 (#​6240) (b4b6747) (@​kgeckhart)
• Upgrade to Beyla 3.22 (#​6452) (1cb72f6) (@​grcevski)

Bug Fixes 🐛

• Back off usage reporting on persistent failure instead of retrying every minute (#​6478) (0a1d139) (@​kgeckhart)
• Beyla glob parsing (#​6525) (beddf1b) (@​grcevski)
• Bump github.com/prometheus/procfs To Pull XFS Collector Fix (#​6630) (976726c) (@​blewis12)
• Bump moduledeps fixtures to go 1.26.4 (#​6521) (9d27acd) (@​thampiotr)
• ci: Only stamp BuildDate for release builds (#​6541) (59ed586), closes #​4266 (@​Churi12)
• database_observability.mysql: Simplify denylist in-memory map for explain_plans collector (#​6473) (18fe267) (@​cristiangreco)
• database_observability.postgres: Handle Postgres DSN with unix sockets (#​6463) (d065b84) (@​fridgepoet)
• database_observability.postgres: Update postgres collect intervals to match mysql (#​6639) (d55dee0) (@​rgeyer)
• database_observability/postgres: Route Windows builds to the nocgo fingerprint stub (#​6690) (5ec00a4) (@​gaantunes)
• database_observability: Explain-plan conditions now redact (7e8e72d) (@​jharvey10)
• deps: Update high-confidence go dependencies (#​6558) (bd61eeb), closes #​6547 (@​thampiotr)
• Don't emit error log when remotecfg is unused (#​6483) (d0f30ea) (@​kalleep)
• Ensure Alloy Logs Dashboard Accounts for New Native Histograms Options (#​6704) (5ab0b06) (@​blewis12)
• Ensure generate-otel-collector-distro runs "go mod tidy" after all generation steps (#​6640) (7b15c04) (@​blewis12)
• Fix typo in the pull request template (#​6676) (a473efe) (@​petewall)
• loki.process: Log logfmt decode failures at debug instead of error (#​6599) (66990eb) (@​mstumpfx)
• loki.process: Prevent data race for metircs (#​6519) (2ae1848) (@​kalleep)
• Make go mod tidy resilient to transient module-proxy failures (#​6491) (23e04c9) (@​kgeckhart)
• prometheus.exporter.cloudwatch: Stop forcing legacy metric-name validation process-wide (#​6616) (fabebf8) (@​kgeckhart)
• promethues.exporter.mongodb: Add currentop_slow_time argument (#​6539) (dd48729) (@​kalleep)
• pyroscope.ebpf: Skip empty build ID debug info uploads (#​6634) (580d0a1) (@​korniltsev-grafanista)
• Remove duplicate Time field in windows exporter (#​6633) (a97ec91) (@​kgeckhart)
• Remove extra bracketing of squid exporter host (#​6573) (4259b8f) (@​dehaansa)
• security/web/ui: Update web/ui vite to v7.3.5 [SECURITY] (#​6497) (d2bb8c0)
• Skip noop error log at collector registration (#​6543) (80968d4) (@​skl)
• Stabilize ServiceMonitor e2e target injection sequencing (#​6523) (cddef2d) (@​thampiotr)
• Stabilize Windows CI in Loki tests and static converter (#​6524) (7284c0d) (@​thampiotr)
• syntax: Release syntax 0.1.1 (#​6549) (c43e289)
• Upgrade homebrew-bump-formula action (#​6708) (69cd783) (@​x1unix)
• web/ui: Bump esbuild to 0.28.1 (#​6522) (a2b3981) (@​thampiotr)
• windows_service: Gracefully terminate alloy when service is stopped (#​6593) (d3969ba) (@​kalleep)
• windows: Allow non-admin service account to start Alloy (#​6627) (bef2f3d) (@​fabiiw05)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.17.1

Compare Source

Bug Fixes 🐛

• Back off usage reporting on persistent failure instead of retrying every minute [backport] (#​6505) (36e1a8f) (@​kgeckhart)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.17.0

Compare Source

Features 🌟

• Add gql subcommand (#​6242) (ec09c43) (@​jharvey10)
• database_observability.mysql: Add database_observability_wait_event_seconds_total counter (#​6106) (602b0b5) (@​gaantunes)
• database_observability.mysql: Refactor bulk table metadata collection (#​6222) (e8d441b) (@​cristiangreco)
• database_observability.mysql: Refactor schema_details logging strategy (#​6239) (fd51530) (@​cristiangreco)
• database_observability.postgres: Add exclude_current_user top-level setting (#​6187) (f019b5e) (@​cristiangreco, @​matthewnolf)
• database_observability.postgres: Improve monitoring user privileges check (#​6177) (96b50d1) (@​cristiangreco)
• database_observability.postgres: Make health_check respect user/database exclusions settings (#​6144) (b4ee0a7) (@​cristiangreco)
• database_observability.postgres: Throttle schema details create_statement logs (#​6260) (fcb3d3e) (@​cristiangreco)
• database_observability: Add wait_event_v2 op with pre-classified wait_event_type (#​6105) (f7a1ebd) (@​gaantunes)
• database_observability: Always extract traceparent in MySQL query_samples collector (#​6081) (bf2b436) (@​fridgepoet)
• database_observability: Always extract traceparent in Postgres query_samples collector (#​6411) (74d595a) (@​fridgepoet)
• database_observability: Set query_sample, wait_event timestamps at query start for MySQL (#​6291) (a47de00) (@​fridgepoet)
• database_observability: Set timestamp query_sample at query start for Postgres (#​6393) (62d8ecc) (@​fridgepoet)
• database_observability: Update wait_event_v2 to a 6-bucket taxonomy and surface Mysql nested events (#​6143) (3df9542) (@​gaantunes, @​cristiangreco)
• faro.receiver: Support gzip-compressed request bodies (#​6195) (4fa44d2) (@​d0ugal)
• GraphQL server (#​5580) (5a2562f) (@​jharvey10)
• helm: Support externally-managed HPAs via controller.autoscaling.horizontal.externalHPA (#​6311) (a1e61c7) (@​jmichalek132)
• Integration tests for aws firehose and cloudflare logpull (#​6089) (f55f780) (@​x1unix)
• Integration tests for loki.source.azure_event_hubs (#​6113) (8e40165) (@​x1unix)
• Integration tests for loki.source.gcplog (#​6161) (feceb8d) (@​x1unix)
• loki.process: Add regex field to logfmt and json stages (#​4941) (cfbabda) (@​timonegk)
• loki.rules.kubernetes: Add external_labels support (#​6320) (9166a61) (@​gianvetter)
• loki.source.heroku: Drop github.com/heroku/x package (#​6064) (3382721) (@​x1unix)
• Migrate from Docker to Moby (#​6167) (1e2bbf9) (@​x1unix)
• mimir.rules.kubernetes, loki.rules.kubernetes: Add configurable mimir_namespace_separator and loki_namespace_separator arguments to allow using a URL-safe separator (#​5961) (7dba4f1) (@​QuentinBisson, @​clayton-cornell)
• otelcol.exporter.prometheus: Config option to prevent stripping service.* attributes (#​6434) (c229b3c) (@​jcreixell)
• otelcol.exporter.prometheus: Convert classic histograms to NHCB (#​6281) (46f4fb6) (@​madaraszg-tulip)
• otelcol: Add Nginx receiver (#​6141) (fa8d520) (@​henworth, @​clayton-cornell, @​blewis12)
• prometheus.enrich: Support multi-label matching (#​5822) (04a1aba) (@​dtrejod)
• prometheus.relabel: Add opt-in TTL cache mode (#​6169) (40632c3) (@​kgeckhart)
• telemetry: Add graph connection metrics (#​6243) (4f3bbbe) (@​theSuess)
• telemetry: Add pyroscope_forwarded_entries_total metric (#​6244) (65ad64c) (@​theSuess)
• Update to Beyla 3.9.7 (#​6175) (4015bd9) (@​rafaelroquetto)
• Update to Beyla 3.9.8 (#​6189) (6fffa30) (@​skl)

Bug Fixes 🐛

• Address Critical CVE's From Scanner (#​6232) (e713e7a) (@​blewis12)
• alloycli: Use filepath.Base for CLI Use name to fix shell completions (#​6217) (17cfd01) (@​IngmarStein)
• cluster: Fix nodes failing to join the cluster when TLS is enabled (#​6437) (efbad6d) (@​kgeckhart)
• database_observability.mysql: Exclude system schemas from MySQL health check (#​6116) (fcae6f4) (@​matthewnolf)
• database_observability.postgres: Count error logs when log_timezone is non-UTC (#​6274) (2eaa769) (@​gaantunes, @​cristiangreco)
• database_observability.postgres: Do not retain query text in explain_plans collector (#​6461) (4c06a64) (@​cristiangreco)
• database_observability: Exclude more explain plan output keywords (#​6145) (3ff6c14) (@​cristiangreco)
• deb: Restart Alloy only on upgrade in postinst script (#​6094) (8c15cb3) (@​guoard, @​jharvey10)
• deps: Pin dependencies (#​6376) (79323b5)
• deps: Update dependencies for catchpoint, databricks, and snowflake exporters (#​6188) (c1b740c) (@​Dasomeone)
• deps: Update module go.opentelemetry.io/obi to v0.8.0 [SECURITY] (#​6091) (05c14af)
• documentation: Fix documentation for loki.rules.kubernetes (#​6088) (61f2b8a) (@​timonegk, @​clayton-cornell)
• Enforce Singleton For Running Alloy Extension Instances (#​5763) (83da6f0) (@​blewis12, @​clayton-cornell)
• faro: Abort on context cancelation (#​6104) (bf733a6) (@​kalleep)
• Fix bug that caused 'logging' block's 'write_to' to be used after config update even if not set (#​6264) (cba7243) (@​ptodev)
• graphql: Update cli flags for consistency (#​6441) (7749d4f) (@​jharvey10)
• helm: Honor alloy.configMap.key in templates/configmap.yaml (#​6312) (415af2c) (@​jmichalek132, @​kalleep)
• integration-tests: Forward GO_TAGS to k8s integration tests (#​6220) (b00f79c) (@​thampiotr)
• logging: Fix startup deadlock when components log before logging config is evaluated (#​6112) (6cdce9e) (@​kgeckhart)
• loki.process: Make limit stage shutdown cancelable (#​6215) (20717b5) (@​boinger)
• loki.process: New action_on_duplicate_timestamp config attribute to fudge identical log timestamps (#​5615) (7d56f50) (@​boussaffawalid)
• loki.process: No longer mutate rules in stage.truncate causing every config update to reload pipeline when this stage is used (#​6271) (b52a4d8) (@​kalleep)
• loki.process: Potential deadlock on update with stage and receiver changes (#​6270) (cb22e82) (@​kalleep)
• loki.process: Wrap NewPipeline error correctly in match stage (#​6216) (f3af2dd) (@​boinger)
• loki.rules.kubernetes: Add timeout to ruler sync calls (26170d4) (@​QuentinBisson)
• loki.source.syslog: Fix goroutine leak in UDP listener (#​6231) (268b260) (@​x1unix)
• loki: Clone structured metadata so we can perform fan-out correctly (#​6138) (473244d) (@​kalleep)
• oracledb_exporter: Support CGO_ENABLED=0 cross-compilation (#​6168) (63ab53d) (@​korniltsev-grafanista)
• otelcol.exporter.awss3: Add missing unique_key_func_name attribute (#​6184) (9ad2b44) (@​kalleep)
• prometheus.exporter.oracledb: Fix issue with custom metrics not appearing when more than one instance of prometheus.exporter.oracledb is used (#​6228) (57de4f4) (@​ptodev)
• prometheus.operator.*: Pass ScrapeNativeHistograms to ScrapeOptions (#​6356) (a44fced) (@​sberz)
• remotewrite: Use blocking send with timeout in test server (#​6208) (a279088) (@​kgeckhart)
• security: Update module github.com/jackc/pgx/v5 to v5.9.2 [SECURITY] (#​6326) (bf3ff2e)
• security: Update x/crypto and x/net for CVEs (#​6336) (4c7b93b) (@​thampiotr)
• ui: Reduce UI dependencies (#​6349) (85e12ba) (@​jharvey10)
• ui: Update dependency minor versions (#​6288) (52a28d2) (@​jharvey10)
• Update go to v1.26.4 (#​6418) (51fb7d2) (@​kalleep)
• validation: Improve type checking of ast.LiteralExpr (#​5916) (d0a1177) (@​kalleep)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.16.3

Compare Source

Bug Fixes 🐛

• cluster: Fix nodes failing to join the cluster when TLS is enabled [backport] (#​6438) (4920e69) (@​kgeckhart)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.16.2

Compare Source

Bug Fixes 🐛

• ci: Bump build image to use go v1.26.3 (#​6334) [backport] (d379ce1) (@​thampiotr)
• ci: Update to go v1.26.3 (#​6337) [backport] (d379ce1) (@​kalleep)
• loki.process: No longer mutate rules in stage.truncate causing every config update to reload pipeline when this stage is used [backport] (#​6394) (32c64cb) (@​kalleep)
• loki.process: Potential deadlock on update with stage and receiver changes [backport] (#​6290) (144e0e2) (@​kalleep)
• otelcol.exporter.awss3: Add missing unique_key_func_name attribute [backport] (#​6193) (928bb50) (@​kalleep)
• security: Address Critical CVE's From Scanner (#​6232) [backport] (d379ce1) (@​blewis12)
• security: Update module github.com/jackc/pgx/v5 to v5.9.2 [SECURITY] (#​6326) [backport] (d379ce1) (@​kgeckhart)
• security: Update x/crypto and x/net for CVEs (#​6336) [backport] (d379ce1) (@​thampiotr)
• ui: Reduce UI dependencies (#​6349) [backport] (d379ce1) (@​jharvey10)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.16.1

Compare Source

Bug Fixes 🐛

• deb: Restart Alloy only on upgrade in postinst script [backport] (#​6129) (14481bc)
  (@​guoard, @​jharvey10)
• logging: Fix startup deadlock when components log before logging config is evaluated [backport] (#​6135) (f1eb20e)
  (@​kgeckhart)
• Migrate from Docker to Moby [backport] (#​6172) (51b52b0)
  (@​x1unix)
• Update to Beyla 3.9.7 [backport] (#​6182) (5ef4ab1)
  (@​rafaelroquetto, @​jharvey10)
• Update to Beyla 3.9.8 [backport] (#​6191) (2095e76) (@​x1unix, @​skl)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

v1.16.0

Compare Source

Features 🌟

• Add clustering for loki.source.kubernetes_events (#​6027) (3dbf587) (@​petewall)
• Add otelcol.auth.google client auth provider (#​5526) (da99a66) (@​dashpole, @​clayton-cornell)
• beyla.ebpf: Bump to v3.7.0 (#​5966) (5126c2e) (@​marctc)
• database_observability: Add support for GCP Cloud SQL metadata (#​5875) (5d23245) (@​cristiangreco, @​clayton-cornell)
• database_observability: Make targets optional (#​5924) (54664b2) (@​matthewnolf)
• database_observability: Update default excluded schemas and users (#​6080) (b386fff) (@​cristiangreco)
• faro.receiver: Add sourcemap fetching from remote locations (#​4614) (b6cb5da) (@​Oxel40)
• helm: Add support for global.image.pullPolicy (#​6069) (2e2ce72) (@​petewall)
• helm: Allow configuring image pull policy for config reloader (#​5923) (991539b) (@​kalleep)
• loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#​5898) (2ad8834) (@​kleimkuhler)
• loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#​5855) (053a2f7) (@​kleimkuhler)
• loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#​5909) (c16a660) (@​mikefat)
• loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#​5970) (b16decb) (@​kleimkuhler)
• Oracle exporter can scrape more than one DB (#​6008) (6fbad38) (@​ptodev)
• prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#​5936) (f1c036d) (@​x1unix)
• prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#​5836) (4f49b57) (@​cristiangreco)
• prometheus.remote_write: Sync WAL with upstream Prometheus (#​5907) (e74a91b) (@​x1unix)
• pyroscope: Add support for extra async-profiler CLI arguments (#​5472) (9251e33) (@​ivanape)
• pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API ([#​5891](https://redirect.github.com/gr

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.