What VictoriaMetrics/VictoriaMetrics shipped
Generated by FoxPlug from public activity — not affiliated with Victoriametrics.
Week of September 14, 2026
What shipped
- v1.152.0 released with security fixes for JWT-based routing authorization bypass in vmauth and Go builder upgraded to 1.27.1. Release
- Per-day index search now runs concurrently, with each day searched in a separate goroutine for improved performance. Pull request #11576
- Scrape job sd_configs that are removed are now properly cleaned up instead of falling back to previously discovered targets. Pull request #11532
- Stream aggregation now serially pushes input samples to aggregator to fix concurrent processing issues. Pull request #11588
- limit_offset function now returns an error for negative limit or offset values instead of panicking. Pull request #11561
- vmagent now disables metrics metadata sending for MDX URLs when remoteWrite.enableMdx is true. Pull request #11586
- vmauth dashboard updated with new metrics, fixed queries, and minimum version bumped to 1.135.0. Pull request #11587
- vmanomaly v1.30.6 release documentation prepared covering hardened images, envelope stability fixes, and UI changes. Pull request #11603
- vmauth security documentation refined with recommendations for dropping Authorization headers and verifying OIDC token claims. Pull request #11595
- Multi-tenancy documentation chapters updated to clarify architecture and capabilities across cluster components. Pull request #11563
Why it matters
This week includes a security release fixing JWT routing authorization bypass and performance improvements to index search through concurrent per-day operations. Cleanup of scrape job configuration and error handling improvements make agent operations more reliable.
Changelog entry
- SECURITY: vmauth: fix authorization bypass in JWT-based routing when match_claims values are used Release
- SECURITY: upgrade Go builder from Go1.26.6 to Go1.27.1 Release
- FEATURE: concurrent per-day index search for TSID and metric name lookups Pull request #11576
- BUGFIX: drop targets of sd_config removed from scrape job Pull request #11532
- BUGFIX: stream aggregation serially push input samples to aggregator Pull request #11588
- BUGFIX: reject negative limit/offset in limit_offset to prevent panic Pull request #11561
- BUGFIX: vmagent disable metrics metadata sending for MDX urls Pull request #11586
- IMPROVEMENT: log no vm_access claim case when logInvalidAuthTokens set Pull request #11579
Post for X
v1.152.0 released with security fix for JWT-based routing in vmauth and concurrent per-day index search for better performance.
Post for LinkedIn
v1.152.0 brings important security fixes and performance improvements. JWT-based routing authorization bypass is patched, concurrent per-day index search accelerates query performance, and scrape job configuration cleanup ensures proper target management.