chore(release-3.6.x): Release 3.6.12

[loki-gh-app]

🤖 I have created a release beep boop

3.6.12

3.6.12 (2026-06-23)

Bug Fixes

• ci: Log into dockerhub for patch releases (#22529) (dfeedf2)
• ci: remove nfpm, like main (#22502) (1a7d0e2)
• security/HIGH/cmd/segment-inspect: Update security cmd/segment-inspect github.com/prometheus/prometheus to v0.311.3 [SECURITY] (release-3.6.x) (#22205) (bfd37e4)
• security/HIGH/cmd/segment-inspect: Update security cmd/segment-inspect go.opentelemetry.io/otel to v1.41.0 [SECURITY] (release-3.6.x) (#22206) (0ed7bce)
• security/HIGH/: Update module github.com/containerd/containerd/v2 to v2.0.9 [SECURITY] (release-3.6.x) (#22204) (ed38a68)
• security/MEDIUM/cmd/dataobj-inspect: Update security cmd/dataobj-inspect github.com/grafana/loki/v3 to v3.6.4 [SECURITY] (release-3.6.x) (#22209) (d6117ed)
• security/MEDIUM/cmd/segment-inspect: Update security cmd/segment-inspect github.com/grafana/loki/v3 to v3.6.4 [SECURITY] (release-3.6.x) (#22210) (186b9a9)
• security/UNKNOWN/cmd/chunks-inspect: Update go toolchain directive to v1.25.11 [SECURITY] (release-3.6.x) (#22202) (90e12c9)
• security/UNKNOWN/cmd/dataobj-inspect: Update module golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22215) (c696c66)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect go to v1.25.11 [SECURITY] (release-3.6.x) (#22203) (2c67a33)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.6.x) (#22216) (807ffd7)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22217) (7081875)
• security/UNKNOWN/cmd/segment-inspect: Update security cmd/segment-inspect golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22218) (36deca1)
• security/UNKNOWN/pkg/push: Update security pkg/push golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22224) (0c53ce1)
• security/UNKNOWN/: Update security golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.6.x) (#22212) (424e5ff)
• security/UNKNOWN/: Update security golang.org/x/net to v0.55.0 [SECURITY] (release-3.6.x) (#22213) (90ae8f3)
• security/UNKNOWN/: Update security golang.org/x/sys to v0.44.0 [SECURITY] (release-3.6.x) (#22214) (49b9a22)

---

Merging this PR will release the artifacts of dfeedf2

[github-actions]

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/helm-ci.yml:2:1
    |
  2 | / name: helm-ci
  3 | | on:
  4 | |   pull_request:
  5 | |     paths:
...   |
156 | |           TEST_DIRECTORY: "source/${{ env.INTEGRARION_TESTS_DIR }}/${{ matrix.test }}"
157 | |           DELETE_CLUSTER: true
    | |_______________________________^ default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/helm-ci.yml:93:3
    |
 93 | /   list-integration-tests:
 94 | |     name: List integration tests
 95 | |     runs-on: ubuntu-latest
 96 | |     outputs:
...   |
111 | |           echo "Tests: ${tests}"
112 | |           echo "tests=$(echo "${tests}" | jq --raw-input --slurp --compact-output 'split("\n") | map(select(. != ""))')" >> "${GITHUB_OUTPUT}"
    | |                                                                                                                                              ^
    | |                                                                                                                                              |
    | |______________________________________________________________________________________________________________________________________________this job
    |                                                                                                                                                default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/helm-ci.yml:114:3
    |
114 | /   run-integration-tests:
115 | |     name: Integration Test
116 | |     needs: list-integration-tests
117 | |     runs-on: ubuntu-latest
...   |
156 | |           TEST_DIRECTORY: "source/${{ env.INTEGRARION_TESTS_DIR }}/${{ matrix.test }}"
157 | |           DELETE_CLUSTER: true
    | |                               ^
    | |                               |
    | |_______________________________this job
    |                                 default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:1:1
   |
 1 | / name: operator images
 2 | |
 3 | | on:
 4 | |   push:
...  |
45 | |       image_name: "storage-size-calculator"
46 | |       tag: "latest"
   | |____________________^ default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:12:3
   |
12 | /   publish-grafana-operator:
13 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
14 | |     with:
15 | |       dockerfile: "operator/Dockerfile"
...  |
18 | |       image_name: "loki-operator"
19 | |       tag: "latest"
   | |                   ^
   | |                   |
   | |___________________this job
   |                     default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:21:3
   |
21 | /   publish-openshift-operator:
22 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
23 | |     with:
24 | |       dockerfile: "operator/Dockerfile"
...  |
27 | |       image_name: "loki-operator"
28 | |       tag: "latest"
   | |                   ^
   | |                   |
   | |___________________this job
   |                     default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:30:3
   |
30 | /   publish-openshift-bundle:
31 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
32 | |     with:
33 | |       dockerfile: "operator/bundle/openshift/bundle.Dockerfile"
...  |
36 | |       image_name: "loki-operator-bundle"
37 | |       tag: "latest"
   | |                   ^
   | |                   |
   | |___________________this job
   |                     default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:39:3
   |
39 | /   publish-openshift-size-calculator:
40 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
41 | |     with:
42 | |       dockerfile: "operator/calculator.Dockerfile"
...  |
45 | |       image_name: "storage-size-calculator"
46 | |       tag: "latest"
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

[loki-gh-app]

The backport to main failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new branch
git switch --create backport-22391-to-main origin/main
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x 36f51ddab4dc9971cce400d1733c9aac076c0ff5

When the conflicts are resolved, stage and commit the changes:

git add . && git cherry-pick --continue

If you have the GitHub CLI installed:

# Push the branch to GitHub:
git push --set-upstream origin backport-22391-to-main
# Create the PR body template
PR_BODY=$(gh pr view 22391 --json body --template 'Backport 36f51ddab4dc9971cce400d1733c9aac076c0ff5 from #22391{{ "\n\n---\n\n" }}{{ index . "body" }}')
# Create the PR on GitHub
echo "${PR_BODY}" | gh pr create --title 'chore(release-3.6.x): Release 3.6.12 (backport main)' --body-file - --label 'product-approved' --label 'autorelease: pending' --label 'backport' --base main --milestone main --web

Or, if you don't have the GitHub CLI installed (we recommend you install it!):

# Push the branch to GitHub:
git push --set-upstream origin backport-22391-to-main

# Create a pull request where the `base` branch is `main` and the `compare`/`head` branch is `backport-22391-to-main`.

# Remove the local backport branch
git switch main
git branch -D backport-22391-to-main

[loki-gh-app]

🤖 Release is at https://github.com/grafana/loki/releases/tag/untagged-b2c7cee312f6e6151fa6 🌻

[loki-gh-app]

🤖 Release is at https://github.com/grafana/loki/releases/tag/untagged-b1e81726dd222fe8af1e 🌻