---
title: "Version 2.0 release notes | Grafana Pyroscope documentation"
description: "Release notes for Grafana Pyroscope 2.0"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

[Documentation](/docs/)![breadcrumb arrow](/static/assets/img/icons/grafana-icon-breadcrumb-arrow-gray.svg) [Grafana Pyroscope](/docs/pyroscope/v2.1.x/)![breadcrumb arrow](/static/assets/img/icons/grafana-icon-breadcrumb-arrow-gray.svg) [Release notes](/docs/pyroscope/v2.1.x/release-notes/)![breadcrumb arrow](/static/assets/img/icons/grafana-icon-breadcrumb-arrow-gray.svg) V2.0

Open source

## Version 2.0.4 release notes

### Security fixes

- Refresh the `/ui` dependency tree to clear known frontend vulnerabilities. The flame graph is now vendored, removing `@grafana/flamegraph` and its vulnerable transitive dependencies `protobufjs` (CVE-2026-44293, CVE-2026-44291, CVE-2026-48712) and `dompurify` (CVE-2026-49978, GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr, GHSA-x4vx-rjvf-j5p4); and `vite` (CVE-2026-53571), `@babel/core` (CVE-2026-49356), `tar` (CVE-2026-53655), and `js-yaml` (CVE-2026-53550) are updated to patched versions (security) ([#5264](https://github.com/grafana/pyroscope/pull/5264))

## Version 2.0.3 release notes

### Fixes

- **store-gateway**: Validate `tenantID` ([#5194](https://github.com/grafana/pyroscope/pull/5194))
- **query-backend**: Don’t panic on unknown `QueryNode` type ([#5196](https://github.com/grafana/pyroscope/pull/5196))
- **embedded grafana**: Clean up zip-slip/tar-slip in archive extraction ([#5195](https://github.com/grafana/pyroscope/pull/5195))
- **embedded grafana**: Close files properly in `extractZip` and `extractTarGz` ([#5206](https://github.com/grafana/pyroscope/pull/5206))

### Security fixes

- Update Go toolchain to 1.25.11, addressing CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (security) ([#5228](https://github.com/grafana/pyroscope/pull/5228))
- Update `golang.org/x/crypto` to v0.52.0 (security) ([#5197](https://github.com/grafana/pyroscope/pull/5197))
- Update `golang.org/x/net` to v0.55.0 (security) ([#5131](https://github.com/grafana/pyroscope/pull/5131))
- Update `golang.org/x/image` to v0.41.0 (security) ([#5216](https://github.com/grafana/pyroscope/pull/5216))
- Patch CVE-2026-45149 and CVE-2026-46625 in `/ui` yarn dependencies ([#5181](https://github.com/grafana/pyroscope/pull/5181))

## Version 2.0.2 release notes

### Fixes

- **querier**: Clone label values to prevent buffer reuse-after-free in concurrent `LabelValues` queries ([#5116](https://github.com/grafana/pyroscope/pull/5116))

### Security fixes

- Update `github.com/prometheus/prometheus` to v0.311.3 (security) ([#5113](https://github.com/grafana/pyroscope/pull/5113))
- Bump `postcss` from 8.5.8 to 8.5.13 in `/ui` (security) ([#5105](https://github.com/grafana/pyroscope/pull/5105))
- Bump `ip-address` from 10.1.0 to 10.2.0 in `/ui` (security) ([#5114](https://github.com/grafana/pyroscope/pull/5114))
- Bump `uuid` from 11.1.0 to 11.1.1 in `/ui` (security) ([#5123](https://github.com/grafana/pyroscope/pull/5123))

## Version 2.0.1 release notes

### Fixes

- **goreleaser**: Stamp `github.com/grafana/pyroscope/v2/pkg/util/build` in build ldflags so `pyroscope -version` and the `pyroscope_build_info` metric report `Version`, `Branch`, `Revision`, and `BuildDate` correctly. Restores the v2.0.0 regression where those fields were empty ([#5084](https://github.com/grafana/pyroscope/pull/5084))

## Version 2.0.0 release notes

The Pyroscope team is excited to present Grafana Pyroscope 2.0.0.

Pyroscope 2.0 makes the v2 storage architecture (segment-writer, query-backend, metastore, compaction-worker) the default for OSS users. v2 writes profiles directly to object storage and removes the need for in-memory ingesters, simplifying operations and reducing resource usage at scale. v1 remains available via an opt-in flag so existing deployments can upgrade without data loss.

This release contains breaking changes. Review the [v1 to v2 migration guide](../../reference-pyroscope-v2-architecture/migrate-from-v1/) before upgrading.

Notable changes are listed below. For the full diff, check out the [2.0.0 changelog](https://github.com/grafana/pyroscope/compare/v1.21.0...v2.0.0).

### Breaking changes

- Go module path bumped to `github.com/grafana/pyroscope/v2`. Library consumers must update their imports ([#5073](https://github.com/grafana/pyroscope/pull/5073))
- Default write path flipped from `ingester` to `segment-writer`. Set `-write-path=ingester` to preserve v1 behavior ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- Default storage backend flipped from empty to `filesystem` ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- New `-architecture.storage` flag (`v1` | `v1-v2-dual` | `v2`), default `v1-v2-dual` ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- Error at startup when `-architecture.storage` includes v2 and no object-storage backend is configured ([#5074](https://github.com/grafana/pyroscope/pull/5074))
- Default filesystem paths moved under `./data/v2/` ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- Removed `PYROSCOPE_V2_EXPERIMENTAL` environment variable ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- Removed legacy positional `server` argument from the `pyroscope` binary ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- Label sanitization disabled by default; UTF-8 label names with dots are accepted as-is. Set `-validation.disable-label-sanitization=false` to restore previous behavior ([#5038](https://github.com/grafana/pyroscope/pull/5038))
- Helm chart 2.0.0 replaces `all.enable-v1-write-path` / `all.enable-v1-read-path` with `architecture.storage`, removes `persistence.shared` and `migration.queryBackend`, and forwards `ingesterWeight` / `segmentWriterWeight` correctly ([#5076](https://github.com/grafana/pyroscope/pull/5076))

### Enhancements

- **profilecli**: Add `debuginfo upload` subcommand ([#5080](https://github.com/grafana/pyroscope/pull/5080))

### Fixes

- Fix missed v1 import path in `pyroscope_test.go` after module bump to v2 ([#5077](https://github.com/grafana/pyroscope/pull/5077))
- **make**: Add `frontend/build` dependency to `reference-help` target ([#5071](https://github.com/grafana/pyroscope/pull/5071))

### Documentation

- Improve v1 → v2 migration docs: switch to `--reset-then-reuse-values`, target chart 2.0.0 ([#5079](https://github.com/grafana/pyroscope/pull/5079))
- Add v1.21 release notes ([#5082](https://github.com/grafana/pyroscope/pull/5082))
- Fix contributors grid layout in README ([#5078](https://github.com/grafana/pyroscope/pull/5078))

### Upgrade

To upgrade from v1.21.x:

1. Read the [v1 to v2 migration guide](../../reference-pyroscope-v2-architecture/migrate-from-v1/).
2. If you import Pyroscope as a Go library, update imports to `github.com/grafana/pyroscope/v2`.
3. If you deploy with Helm, upgrade to chart `2.0.0` and review the removed and renamed values listed above.
4. If you run the binary directly and want to stay on v1 storage, set `-architecture.storage=v1` and `-write-path=ingester` explicitly — the previous defaults no longer apply.
5. If you want to move to v2, configure object storage and set `-architecture.storage=v2` (or leave `v1-v2-dual` during the transition).