Documentation Grafana Pyroscope Release notes V2.4

Version 2.4.0 release notes

Grafana Pyroscope 2.4.0 adds experimental deterministic profile IDs, an optional distributor inflight bytes limit, and improvements to profile replay and asynchronous queries. It also improves compaction efficiency and includes security and stability fixes.

Notable changes are listed below. For the full diff, see the 2.4.0 changelog.

Enhancements

• distributor: Add an optional instance-level inflight bytes limit (#5546)
• experimental: Add opt-in deterministic profile ID generation (#4762)
• experimental: Support dedicated storage for asynchronous queries (#5756)
• experimental: Add queries to confirm externally detected profile anomalies (#5686)
• otlp: Detect profile language from telemetry.sdk.language (#5606)
• profilecli: Add timestamp-ordered dumps and streaming replay (#5762)
• profilecli: Add optional replay dump anonymization (#5763)
• symdb: Optimize insertion into wide stacktrace trees (#5732)
• symdb: Reduce compaction memory held by source symbols (#5734)
• query-backend: Optimize label-name queries (#5556)
• segment-writer: Measure ingestion bytes without re-serializing profiles (#5312)
• Helm: Support per-component extra labels on pod templates (#5752)

Fixes

• Revert the experimental symbol-reference tree query path (#5629)
• metastore: Reconcile Raft log writes that complete after a timeout (#5307)
• metastore: Fix a compaction queue statistics leak during restore (#5676)
• Clean up stale ring members on shutdown and through auto-forget (#5434)
• query-backend: Avoid retrying responses gRPC cannot deliver (#5590)
• query-frontend: Handle empty asynchronous results (#5677)
• query-frontend: Tolerate concurrent asynchronous-artifact cleanup (#5679)
• symdb: Handle line-less locations in Go PGO profiles (#5635, #5636)
• symdb: Preserve caller lines in Go PGO aggregation (#5637)
• Validate UTF-8 before truncating symbols at rune boundaries (#5692, #5696)
• Fix source lookup for installed Python packages (#5730)
• ui: Preserve arbitrary label matchers in profile queries (#5464)
• profilecli: Avoid closing replay datasets twice (#5591)
• profilecli: Anchor replay batch windows to due time (#5595)
• profilecli: Preserve replay retry errors and failure counts (#5785)
• Helm: Exclude headless services from the ServiceMonitor (#5758)

Security fixes

• Update the Go toolchain to 1.26.9 (#5788).
• Update golang.org/x/net to v0.60.0, addressing CVE-2026-78659 and CVE-2026-78660 (#5791).
• Update UI source-map-js to v1.2.2, addressing CVE-2026-93749 (#5795).

This release also includes the security updates delivered in 2.3.1 and 2.3.2.

Documentation

• Document profilecli replay (#5599)
• Document profilecli exemplar queries and drill-down commands (#5558)
• Document write-path sampling and stripped-profile limits (#5623)
• Document segment-writer object storage cost tuning (#5370)
• Expand recording rules docs and add Rust jemalloc and v2.0 upgrade guides (#5613)
• Update the Pyroscope UI documentation (#5624)
• Document the call tree view (#5625)