Release notes from tempo v2.10.8

{
  "id": "39b4fa3ec28ac4aedc86f8534e4a4fbb959e2e18e023c61157e15982d6295e7b",
  "url": "https://github.com/grafana/tempo/releases/tag/v2.10.8",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Release notes from tempo v2.10.8",
    "summary": "Tempo v2.10.8 updates Go and several Go dependencies in security operations.",
    "evidence": "Security operations: Update Go to 1.26.5 (CVE-2026-39822, CVE-2026-27145, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507), google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf), golang.org/x/net to v0.56.0 (CVE-2026-46600), golang.org/x/text to v0.39.0 (CVE-2026-56852), and go.opentelemetry.io/otel to v1.44.0 (CVE-2026-41178)",
    "products": [
      {
        "name": {
          "value": "tempo",
          "evidence": "Release notes from tempo"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v2.10.8",
            "evidence": "v2.10.8"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Go",
          "evidence": "Update Go to 1.26.5"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.26.5",
            "evidence": "Update Go to 1.26.5"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "google.golang.org/grpc",
          "evidence": "google.golang.org/grpc to v1.82.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v1.82.1",
            "evidence": "google.golang.org/grpc to v1.82.1"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "golang.org/x/net",
          "evidence": "golang.org/x/net to v0.56.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.56.0",
            "evidence": "golang.org/x/net to v0.56.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "golang.org/x/text",
          "evidence": "golang.org/x/text to v0.39.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.39.0",
            "evidence": "golang.org/x/text to v0.39.0"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "go.opentelemetry.io/otel",
          "evidence": "go.opentelemetry.io/otel to v1.44.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v1.44.0",
            "evidence": "go.opentelemetry.io/otel to v1.44.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-39822",
        "evidence": "CVE-2026-39822"
      },
      {
        "value": "CVE-2026-27145",
        "evidence": "CVE-2026-27145"
      },
      {
        "value": "CVE-2026-42504",
        "evidence": "CVE-2026-42504"
      },
      {
        "value": "CVE-2026-42505",
        "evidence": "CVE-2026-42505"
      },
      {
        "value": "CVE-2026-42507",
        "evidence": "CVE-2026-42507"
      },
      {
        "value": "CVE-2026-46600",
        "evidence": "CVE-2026-46600"
      },
      {
        "value": "CVE-2026-56852",
        "evidence": "CVE-2026-56852"
      },
      {
        "value": "CVE-2026-41178",
        "evidence": "CVE-2026-41178"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-grafana-tempo",
  "document_id": 21328,
  "published_at": "2026-08-13T20:37:12+00:00"
}