What VictoriaMetrics/VictoriaMetrics shipped
Written by FoxPlug from the repository's own releases; not affiliated with Victoriametrics. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/VictoriaMetrics/VictoriaMetrics; Victoriametrics did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Released v1.156.0-cluster. Release
- Vmselect promql now checks the sub-query series limit after aligning start and end with the sub-query step, removing a possible runtime panic. Pull request #11862
- Vmselect no longer increases
vm_http_request_errors_totalwhen a query is canceled by the client. Pull request #11833 - Lib/cgroup now correctly checks systemd-slice limits on cgroupv1, aligning the logic with cgroupv2 to avoid OOM errors and CPU throttling. Pull request #11867
- Vmalert keeps original labels in recording rule staleness markers, so label values containing commas or equals signs are no longer misparsed. Pull request #11851
- Vmagent allows configuring the persistent queue path per remote write URL, so reordering or removing command-line flags no longer drops queue contents. Pull request #11709
- Azure service discovery in vmagent gained WorkloadIdentity authentication for federated Kubernetes workloads without a static client secret. Pull request #11591
- Vmstorage added the
vm_fastcache_modemetric to expose whether the working set cache runs in split, whole or switching mode. Pull request #11871 - Vmselect re-uses connections after a client cancels a request instead of closing them, which helps setups using search.skipSlowReplicas. Pull request #11789
- Deployment alerting rules no longer fire backup alerts for backup types that are intentionally disabled. Pull request #11644
Why it matters
This week brings a cluster release plus fixes across vmselect, vmagent, vmstorage and vmalert that reduce false errors, panics and unnecessary connection churn. Users also get clearer control over persistent queue paths, cgroupv1 resource limits and Azure workload identity discovery.
Changelog entry
- Release: v1.156.0-cluster Release
- App/vmselect/promql: check sub-query series limit after start/end alignment to avoid runtime panic Pull request #11862
- Vmselect: do not increase
vm_http_request_errors_totalwhen the query is canceled Pull request #11833 - Lib/cgroup: correctly check cgroupv1 systemd-slice limits Pull request #11867
- App/vmalert: keep original labels in recording rule staleness markers Pull request #11851
- App/vmagent: allow configuring queue path per remote write URL Pull request #11709
- Lib/promscrape/discovery/azure: add WorkloadIdentity authentication Pull request #11591
- Vmstorage: add
vm_fastcache_modemetric for the working set cache mode Pull request #11871 - App/vmselect: re-use connection after request cancel Pull request #11789
- Deployment/docker/rules: prevent NoBackup alerts for intentionally disabled backups Pull request #11644
- Stream aggregation: use lag of dropped samples for window flush delay when no samples were accepted Pull request #11866
- .github: build Solaris and NetBSD on CI Pull request #11874
V1.156.0-cluster is out. This week: vmselect no longer counts canceled queries as http errors and checks sub-query series limits after step alignment; vmalert keeps original labels in staleness markers; vmagent adds per-URL queue paths and Azure workload identity auth.
VictoriaMetrics v1.156.0-cluster is released. This week's changes: vmselect stops increasing vm_http_request_errors_total for client-canceled queries and checks the sub-query series limit after start/end alignment, avoiding a runtime panic. vmalert now keeps original labels in recording rule staleness markers. vmagent can configure the persistent queue path per remote write URL and adds WorkloadIdentity authentication for Azure service discovery. lib/cgroup now checks systemd-slice limits on cgroupv1 like cgroupv2. vmstorage exposes the working set cache mode via vm_fastcache_mode, and deployment rules no longer alert for intentionally disabled backups.
Week of October 26, 2026
What shipped
- Released v1.154.0 on 2026-10-12, with an update note for chained vmauth setups where the first instance authenticates via users and the second proxies via
unauthorized_user. Release - Released v1.155.0 on 2026-10-23, where vmselect in cluster mode returns tenants for the current day when /admin/tenants is called without start and end args, a breaking change from returning all tenants. Release
- Released v1.154.1 on 2026-10-19, fixing vmauth slowing down requests with auth tokens by 2-3 seconds when no users are configured. Release
- Fixed false counter resets in stream aggregation rate outputs with
enable_windowsby tracking the last accepted sample timestamp per series across the green and blue windows and dropping older samples. Pull request #11812 - Fixed
running_avgandrange_avgto count only non-NaN points when averaging, so series with gaps no longer produce wrong values after the gap. Pull request #11823 - Capped stream aggregation window flush delay at 90 percent of the aggregation interval. Pull request #11816
- Added Kafka producer latency panels to the vmagent dashboard, showing request queue latency and broker RTT per instance, destination and topic. Pull request #11559
- Fixed Unix socket tests that broke with a long TMPDIR because the socket path exceeded the
sun_pathlimit. Pull request #11719 - Added a practical model selection guide to the anomaly detection docs for engineers without an ML background. Pull request #11825
- Documented the Online MAD decay argument, including its (0, 1] range, default of 1.0, the adaptation tradeoff and an example. Pull request #11831
Why it matters
This week brought two feature releases and a patch release, including a breaking change to how /admin/tenants behaves in cluster mode when no time range is given, so users of that endpoint should check their queries. Stream aggregation received two correctness fixes for counter resets and flush timing, and average functions now handle gaps properly. The vmauth latency fix addresses slow proxying in token-authenticated setups without configured users.
Changelog entry
- V1.154.0 released at 2026-10-12; update note covers chained vmauth instances where the second proxies via
unauthorized_user. Release - V1.155.0 released at 2026-10-23; vmselect /admin/tenants without start and end returns tenants for the current day, a breaking change. Release
- V1.154.1 released at 2026-10-19; vmauth no longer slows requests with auth tokens when no users are configured. Release
- Stream aggregation: fix false counter resets in rate outputs with
enable_windowsby dropping samples older than the last accepted sample per series. Pull request #11812 - Vmselect:
running_avgandrange_avgcount only non-NaN points, fixing wrong values after gaps in a series. Pull request #11823 - Stream aggregation: cap aggregation windows flush delay at 90 percent of the interval. Pull request #11816
- Dashboards: add Kafka producer latency and broker RTT panels to the vmagent dashboard. Pull request #11559
- Lib/netutil: fix Unix socket tests failing when TMPDIR points to a deep path. Pull request #11719
- Docs/anomaly-detection: add a practical model selection guide. Pull request #11825
- Docs(anomaly-detection): document the Online MAD decay argument, its range and default. Pull request #11831
- App/vmui: update package dependencies. Pull request #11848
- Dashboards: clarify downsampling in the Deduplication rate panel description. Pull request #11817
V1.155.0 and v1.154.0 are out. /admin/tenants without start and end now returns current-day tenants in cluster mode, a breaking change. v1.154.1 fixes vmauth delays of 2-3s for token requests with no users configured. Also: stream aggregation rate and average fixes, and Kafka pro
This week VictoriaMetrics shipped v1.155.0, v1.154.0 and the v1.154.1 patch. In v1.155.0, vmselect in cluster mode now returns tenants for the current day when /admin/tenants is called without start and end query args; this is a breaking change, since the endpoint previously returned all tenants. v1.154.1 fixes vmauth slow requests with auth tokens when no users are configured, which were delayed 2-3 seconds before proxying to unauthorized_user. Stream aggregation got two fixes: false counter resets in rate outputs with enable_windows, and a flush delay capped at 90 percent of the interval. running_avg and range_avg now count only non-NaN points, the vmagent dashboard shows Kafka producer latency, and the anomaly detection docs gained a model selection guide and Online MAD decay details.
Week of October 19, 2026
What shipped
- Released v1.155.0-cluster of VictoriaMetrics. Release
- Limited per-day search concurrency in indexDB to twice the CPU count to avoid spawning too many goroutines. Pull request #11787
- Changed the default time range for /admin/tenants to the current day to avoid unnecessary load and possible OOMs. Pull request #11802
- Prevented handshake timeouts from forcing vminsert into legacy mode, which drops metric metadata. Pull request #11762
- Restored Prometheus compatibility for restoring alert state from remote read in vmalert. Pull request #11799
- Fixed Kubernetes endpoints discovery to use the Endpoints namespace for pods in other namespaces. Pull request #11800
- Prevented concurrent mutation of cached metricIDs. Pull request #11792
- Added a -healthcheck flag so binaries can check the local health endpoint, useful in Docker images without curl or wget. Pull request #11805
- Limited tenant discovery in vmui to the selected time range and added a time range selector to Top Queries. Pull request #11796
- Fixed cluster resource filters in dashboards for consistent instance filtering and zero values. Pull request #11742
Why it matters
This week brought a cluster release and fixes that reduce load and avoid failures in storage searches, tenant queries, and handshakes. Users get more stable vmselect, vminsert, and vmalert behavior, improved Kubernetes discovery, and more predictable vmui and dashboard experiences.
Changelog entry
- Release v1.155.0-cluster. Release
- Lib/storage: limit per-day search concurrency in indexDB to 2xCPU to avoid too many goroutines. Pull request #11787
- App/vmselect: change the default time range for /admin/tenants to the current day to avoid unnecessary load. Pull request #11802
- Lib/handshake: avoid legacy fallback on handshake timeout so metric metadata is not dropped. Pull request #11762
- Vmalert: restore Prometheus compatibility for alerts state restoration via -remoteRead.url. Pull request #11799
- Lib/promscrape/discovery/kubernetes: use the Endpoints namespace for pods from other namespaces. Pull request #11800
- Lib/storage: prevent cached metricIDs from concurrent mutation. Pull request #11792
- Lib/httpserver: add -healthcheck flag for checking the local health endpoint. Pull request #11805
- App/vmui: limit tenant discovery to the selected time range and add a time range selector to Top Queries. Pull request #11796
- App/vmui: preserve automatic query step in shared URLs. Pull request #11716
- Dashboards: fix cluster resource filters for consistent instance filtering and zero values. Pull request #11742
- App/vmselect/prometheus: add
vm_request_duration_seconds{path="/admin/tenants"}. Pull request #11785
V1.155.0-cluster is out. This week: per-day search concurrency is capped, /admin/tenants defaults to the current day, handshake timeouts no longer drop metadata, and vmalert restores alert state compatibly with Prometheus. vmui and dashboard fixes also landed.
VictoriaMetrics v1.155.0-cluster is released. This week's changes include a cap on per-day index search concurrency to avoid goroutine spikes, a current-day default for /admin/tenants to reduce storage load, and a fix so handshake timeouts do not force vminsert into legacy mode. vmalert now restores alert state from remote read in a Prometheus-compatible way, Kubernetes endpoints discovery uses the correct namespace for pods in other namespaces, and cached metricIDs are protected from concurrent mutation. vmui limits tenant discovery to the selected time range, dashboards have consistent resource filters, and a new -healthcheck flag helps with Docker health checks.
Week of October 12, 2026
What shipped
- Released v1.154.0, which upgrades the Go builder from Go1.27.1 to Go1.27.2 and slows down vmauth requests with invalid auth tokens even when
unauthorized_userhas URLs configured. Release - Moved search time range adjustment into indexDB in lib/storage, so each indexDB now checks whether it may hold data for a given search time range instead of Storage adjusting the range for every indexDB. Pull request #11757
- Reduced memory retained during full Kubernetes service-discovery target rebuilds in vmagent when most discovered objects produce no scrape targets after relabeling or native shard assignment. Pull request #11751
- Lib/storage now rejects reversed timestamp ranges in native blocks by validating timestamp bounds before decoding, with regression coverage for reversed and equal bounds. Pull request #11745
- Exposed four new cgroup gauges for effective CPU and memory limits and host capacity, so you can tell whether values come from the host or from cgroup limits. Pull request #11487
- Added a tenant column to Top Queries and Active Queries in vmui, showing accountID:projectID or multitenant when tenant data is available. Pull request #11734
- Disabled Server URL editing in vmui by default; changing the URL now requires clicking Enable editing, and saved custom URLs still work with a warning and a link to Settings. Pull request #11741
- Updated the appearance of info, success, warning and error messages in vmui to match the VictoriaLogs UI styling, with optional titles. Pull request #11736
- Fixed the quick start scrape steps by setting
scrape_intervalto 10s so the CPU graph fills faster, and corrected the cluster login section. Pull request #11706 - Added a standalone data recovery guide for data missing from one installation but still available in another, covering vmagent in Multi-Cluster and Multi-AZ deployments and queue history. Pull request #11626
Why it matters
This week brought a new release, v1.154.0, with security-related changes in the Go builder and vmauth. Storage and vmagent also got changes aimed at safer search range handling, lower memory use during Kubernetes target rebuilds, and rejecting malformed native blocks. On the UI and docs side, vmui gained a tenant column and stricter Server URL editing, and new guides cover data recovery and unix socket scraping.
Changelog entry
- V1.154.0: upgrade Go builder from Go1.27.1 to Go1.27.2 and slow down vmauth requests with invalid auth tokens even when
unauthorized_userhas URLs configured. Release - Lib/storage: indexDB now checks whether it may contain data for a search time range instead of Storage adjusting the range for every indexDB. Pull request #11757
- Lib/promscrape/discovery/kubernetes: reduce memory retained during full target rebuilds when most discovered objects produce no scrape targets. Pull request #11751
- Lib/storage: reject native blocks with MaxTimestamp below MinTimestamp by validating bounds before decoding. Pull request #11745
- Lib/storage: organize indexDB public search methods to validate input and report results and errors consistently. Pull request #11759
- Lib/cgroup: expose four gauges for effective CPU and memory host capacity and cgroup limits. Pull request #11487
- App/vmui: add tenant column to Top Queries and Active Queries showing accountID:projectID or multitenant. Pull request #11734
- App/vmui: disable Server URL editing by default; require Enable editing and warn on saved custom URLs, which continue to work. Pull request #11741
- App/vmui: update alert appearance for info, success, warning and error messages and add optional titles. Pull request #11736
- Docs/victoriametrics: set
scrape_intervalto 10s in quick start so the CPU graph fills faster and fix the cluster login section. Pull request #11706 - Docs/victoriametrics: add a standalone guide for recovering data missing from one installation but available in another. Pull request #11626
- Docs/vmagent: add scraping targets via unix sockets. Pull request #11756
V1.154.0 is out: Go builder updated and vmauth slows invalid auth requests. Also this week: lower vmagent memory during Kubernetes target rebuilds, tenant column in vmui, and a new data recovery guide.
V1.154.0 is released, with the Go builder upgraded from Go1.27.1 to Go1.27.2 and vmauth slowing down requests with invalid auth tokens even when unauthorized_user has URLs configured. In storage, search time range adjustment moved into indexDB, and native blocks with reversed timestamp ranges are now rejected rather than risking a panic. vmagent retains less memory during full Kubernetes service-discovery target rebuilds. vmui adds a tenant column to Top Queries and Active Queries, disables Server URL editing by default, and updates alert styling. Docs gained a data recovery guide and a vmagent guide for scraping targets via unix sockets.
Week of October 5, 2026
What shipped
- Lib/storage releases idle rawRowsShard buffers after periodic flush instead of holding them until the partition is closed. Pull request #11684
- Lib/streamaggr fixes incorrect increase and total results when
enable_windowsis set and a single push carries samples from the current and next window. Pull request #11708 - Lib/storage no longer searches the global index when the per-day index is enabled. Pull request #11697
- Docs/vmanomaly documents v1.31.0 and UI v1.10.0, including peer-group detection, model tuning, deployment sizing and performance improvements. Pull request #11739
- Release v1.154.0-cluster is out. Release
- Lib/httputil sets the Host header to the SRV target for srv+ remote write URLs. Pull request #11700
- App/vmalert prevents a race condition on alerts relabeling by copying labels before relabeling. Pull request #11699
- Lib/netutil uses net.KeepAliveConfig to set keepalive parameters, keeping the interval at 1 second. Pull request #11696
- Vmalert retries notifier config reload after a failed start, keeping the previously applied config. Pull request #11645
- Lib/backup adds the -s3SkipTaggingDirective flag for S3-compatible storage without tagging directive support. Pull request #11691
Why it matters
This week brings a cluster release plus storage changes that free idle buffers and skip the global index when the per-day index is enabled, which affects memory use and query behavior. Streaming aggregation results are corrected for enable_windows, and several networking and alerting fixes reduce leaks, races and reload failures.
Changelog entry
- Lib/storage: release idle rawRowsShard buffers Pull request #11684
- Lib/streamaggr: fix incorrect increase and total results when
enable_windowsis set Pull request #11708 - Lib/storage: do not search global index when per-day index is enabled Pull request #11697
- Lib/storage: create global and per-day index entries separately when registering metric names Pull request #11694
- Lib/httputil: set Host header to SRV target for srv+ urls Pull request #11700
- Lib/regexutil: do not modify the parsed regexp inside getOrValues() Pull request #11711
- Lib/encoding: use proper limit for minimal zstd window size Pull request #11690
- App/vmalert: prevent race condition on alerts relabeling Pull request #11699
- Lib/netutil: use net.KeepAliveConfig API to set keepalive params Pull request #11696
- Vmalert: retry notifier config reload after a failed start Pull request #11645
- Lib/backup: add -s3SkipTaggingDirective flag for S3-compatible storage without tagging directive support Pull request #11691
- App/vmauth: apply slowdown for
unauthorized_userwith URLs too Pull request #11680
This week: v1.154.0-cluster out. Storage frees idle rawRowsShard buffers, skips global index with per-day index, streamaggr fixes enable_windows totals, vmalert fixes relabel race and retries notifier reload. vmanomaly docs updated for v1.31.0 and UI v1.10.0.
This week VictoriaMetrics shipped v1.154.0-cluster and a set of fixes across storage, streaming aggregation and alerting. lib/storage now releases idle rawRowsShard buffers after periodic flush and does not search the global index when the per-day index is enabled. lib/streamaggr corrects increase and total results when enable_windows is set and a push carries samples from two windows. lib/httputil sets the Host header to the SRV target for srv+ URLs, lib/netutil uses net.KeepAliveConfig for keepalive parameters, and vmalert copies labels before relabeling and retries notifier config reload after a failed start. vmanomaly documentation was updated for v1.31.0 and UI v1.10.0, and lib/backup adds a flag for S3-compatible storage without tagging directive support.
Week of September 28, 2026
What shipped
- Released v1.153.0 with fixes for data block reading errors and improved request cancellation in storage operations. Release
- Storage now uses cancelable request context instead of deadline timestamps, allowing proper cancellation of indexDB requests during client disconnect or graceful shutdown. Pull request #11472
- Fixed data race in vmauth request retries that could cause corruption when retrying HTTP requests with shared request bodies. Pull request #11647
- Added HTML and Markdown sanitization to vmui to prevent cross-site scripting attacks when rendering untrusted content. Pull request #11485
- Removed URL parameter overrides in vmui that could allow crafted links to change the configured server URL. Pull request #11667
- Fixed misleading 401 errors in vmauth for JWT-authenticated users hitting unmapped paths, now returns proper 400 missing route error. Pull request #11679
- Added /influx/ping endpoint to vmagent for compatibility with Jenkins InfluxDB plugin. Pull request #11671
- Fixed SSO login race condition in vmauth when multiple requests overwrote CSRF cookies. Pull request #11656
- Fixed 31 broken documentation links returning 404 or pointing to non-existent anchors and removed one duplicate guide page. Pull request #11651
- Updated cluster dashboard to highlight cache misses near limit by color-coding miss-ratio lines based on cache usage. Pull request #11648
Why it matters
V1.153.0 addresses critical issues including data corruption risks, security vulnerabilities, and storage shutdown problems that affect production deployments. The fixes to request handling, authentication errors, and XSS prevention improve reliability and safety across multiple components.
Changelog entry
- V1.153.0 released with improvements to request cancellation and data reliability Release
- Lib/storage: replace deadline timestamps with cancelable request context for better shutdown handling Pull request #11472
- App/vmauth: fix data race in request retries by allocating new bytes reader per request Pull request #11647
- App/vmui: add HTML and Markdown sanitization to prevent XSS attacks Pull request #11485
- App/vmui: prevent server URL overrides via query parameters Pull request #11667
- App/vmauth: return correct error code for JWT users with unmatched paths Pull request #11679
- App/vmagent: add /influx/ping endpoint for InfluxDB plugin compatibility Pull request #11671
- App/vmauth: fix SSO login race condition with CSRF cookie overwrites Pull request #11656
- Docs: fix 31 broken links and remove duplicate guide page Pull request #11651
- Docs: fix anchor case for Groups section link in vmalert.md Pull request #11664
- Dashboards: add cache miss highlighting in cluster dashboard Pull request #11648
- App/vmagent: remove unnecessary type conversions in promremotewrite Pull request #11650
V1.153.0 is out with fixes for data race in request retries, proper request cancellation during shutdown, and security improvements in vmui and vmauth. See release notes for details on required actions.
VictoriaMetrics v1.153.0 is now available. This release fixes critical issues including data corruption risks in request retries, improves graceful shutdown with proper request cancellation, and hardens security with XSS prevention and URL parameter validation. Storage improvements and authentication fixes make deployments more reliable.
Week of September 21, 2026
What shipped
- Released v1.153.0-cluster. Release
- Added Single Sign-On support via OpenID Connect in vmauth for authentication. Pull request #11122
- Vmstorage now accepts ingestion via Prometheus Remote Write v1 protocol over HTTP. Pull request #11524
- Fixed vmalert to properly reload notifier config alert relabel on configuration changes. Pull request #11639
- Reduced CPU contention in vmselect by accumulating skipped row counter locally per worker before updating the metric. Pull request #11606
- Fixed data race in vmagent remote write when sending HTTP requests. Pull request #11578
- Disabled Linux readahead for randomly read data files to reduce disk read amplification. Pull request #11521
- Vmselect now ignores empty
extra_labelandextra_filtersquery arguments. Pull request #11630 - Vmalert now skips redundant pending state when restoring alert states on restart. Pull request #11401
- Vmauth access log now supports logging specified HTTP headers for debugging. Pull request #11598
Why it matters
This week includes improvements to alerting reliability, authentication capabilities, and query performance. The addition of OIDC SSO support and Prometheus Remote Write v1 protocol support expand integration options. Performance fixes reduce CPU hotspots and disk read overhead under high load.
Changelog entry
- Release v1.153.0-cluster Release
- Add Single Sign-On (SSO) support via OpenID Connect (OIDC) in vmauth Pull request #11122
- Vmstorage: accept ingestion via Prometheus Remote Write v1 protocol Pull request #11524
- Vmalert: properly reload notifier config alert relabel on configuration changes Pull request #11639
- Vmselect: accumulate skipped row counter locally per worker to reduce metric update contention Pull request #11606
- Vmagent/remotewrite: fix data race when sending HTTP requests Pull request #11578
- Lib/fs: disable Linux readahead for randomly read data files Pull request #11521
- Lib/fs: add MADV_SEQUENTIAL in MustFadviseSequentialRead for mmap coverage Pull request #11613
- Vmselect: ignore empty
extra_labelandextra_filtersquery arguments Pull request #11630 - Lib/httputil: log peer IP address on HTTP error for easier debugging Pull request #11631
- Vmalert: skip redundant pending state when restoring alert states Pull request #11401
- Vmauth: add support for HTTP headers logging in
access_logPull request #11598 - Vmauth: restrict OIDC client redirects to original request host Pull request #11616
- Vmauth: respect enableTCP6 flag for backend discovery Pull request #11530
- Chore: prevent panic on netstorage timeseries unpack Pull request #11622
- Lib/encoding/zstd: match cgo behavior for empty input in purego encoder Pull request #11610
- Lib/netutil: rely on umask for Unix domain socket permissions Pull request #11627
- Makefile: limit CPU allocation for i386 tests to prevent OOM Pull request #11633
- Vmui: fix URL step sync on predefined dashboards Pull request #11522
- Vmselect: preserve configured storageNode order across restarts Pull request #11575
V1.153.0-cluster ships with OIDC SSO support in vmauth, Prometheus Remote Write v1 protocol support in vmstorage, improved alert config reloading, reduced query CPU contention, and numerous performance and reliability fixes.
VictoriaMetrics v1.153.0-cluster is now available. This release adds OpenID Connect single sign-on support to vmauth, enables vmstorage to accept Prometheus Remote Write v1 protocol ingestion, fixes alert configuration reloading in vmalert, reduces CPU contention in query processing, and includes performance optimizations for disk I/O and HTTP request handling.
Week of September 14, 2026
What shipped
- V1.152.0 released with security fixes for JWT-based routing authorization bypass in vmauth and Go builder upgraded to 1.27.1. Release
- Per-day index search now runs concurrently, with each day searched in a separate goroutine for improved performance. Pull request #11576
- Scrape job
sd_configsthat are removed are now properly cleaned up instead of falling back to previously discovered targets. Pull request #11532 - Stream aggregation now serially pushes input samples to aggregator to fix concurrent processing issues. Pull request #11588
- Limit_offset function now returns an error for negative limit or offset values instead of panicking. Pull request #11561
- Vmagent now disables metrics metadata sending for MDX URLs when remoteWrite.enableMdx is true. Pull request #11586
- Vmauth dashboard updated with new metrics, fixed queries, and minimum version bumped to 1.135.0. Pull request #11587
- Vmanomaly v1.30.6 release documentation prepared covering hardened images, envelope stability fixes, and UI changes. Pull request #11603
- Vmauth security documentation refined with recommendations for dropping Authorization headers and verifying OIDC token claims. Pull request #11595
- Multi-tenancy documentation chapters updated to clarify architecture and capabilities across cluster components. Pull request #11563
Why it matters
This week includes a security release fixing JWT routing authorization bypass and performance improvements to index search through concurrent per-day operations. Cleanup of scrape job configuration and error handling improvements make agent operations more reliable.
Changelog entry
- SECURITY: vmauth: fix authorization bypass in JWT-based routing when
match_claimsvalues are used Release - SECURITY: upgrade Go builder from Go1.26.6 to Go1.27.1 Release
- FEATURE: concurrent per-day index search for TSID and metric name lookups Pull request #11576
- BUGFIX: drop targets of
sd_configremoved from scrape job Pull request #11532 - BUGFIX: stream aggregation serially push input samples to aggregator Pull request #11588
- BUGFIX: reject negative limit/offset in
limit_offsetto prevent panic Pull request #11561 - BUGFIX: vmagent disable metrics metadata sending for MDX urls Pull request #11586
- IMPROVEMENT: log no
vm_accessclaim case when logInvalidAuthTokens set Pull request #11579
V1.152.0 released with security fix for JWT-based routing in vmauth and concurrent per-day index search for better performance.
V1.152.0 brings important security fixes and performance improvements. JWT-based routing authorization bypass is patched, concurrent per-day index search accelerates query performance, and scrape job configuration cleanup ensures proper target management.