chore(deps): update victoriametrics/victoria-metrics docker tag to v1.155.0 #65
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate-victoriametrics-victoria-metrics-1.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v1.153.0-scratch→v1.155.0-scratchRelease Notes
VictoriaMetrics/VictoriaMetrics (victoriametrics/victoria-metrics)
v1.155.0Compare Source
v1.155.0
Released at 2026-10-23
Update Note 1:
vmselectin VictoriaMetrics cluster:/admin/tenantsrequests withoutstartandendquery args now return tenants for the current day. This is a breaking change because previously it was expected to return all tenants. If you still need to retrieve all tenants, set thestartandendparams so that the resulting time range fully includes the-retentionPeriod. Also note that vmctl is known to send requests to/admin/tenantsunder the hood when migrating data between VictoriaMetrics deployments. Therefore, make sure that you runvmctlwith both*-filter-time-startand*-filter-time-endparams. See the updated URL format and #11791 for details.SECURITY: upgrade Go builder from Go1.27.2 to Go1.27.3. See the list of issues addressed in Go1.27.3.
SECURITY: upgrade base docker image (Alpine) from 3.24.2 to 3.24.3. See Alpine 3.24.4 release notes.
FEATURE: all VictoriaMetrics components: add
-healthcheckcommand-line flag, which checks that the running process accepts connections at-httpListenAddrand exits with non-zero code if the check fails. This allows setting up DockerHEALTHCHECKin images withoutcurlorwget. See these docs and VictoriaLogs#1565.FEATURE: all VictoriaMetrics components: expose
process_cpu_cores_host,process_cpu_cores_cgroup_quota,process_memory_host_bytesandprocess_memory_cgroup_bytesmetrics. Cgroup metrics are-1if no cgroup limit is set or the limit cannot be read. See #11460.FEATURE: vmui: deprecate Server URL editing and show a warning when using a saved custom URL. Existing custom URLs continue to work. See #11735.
FEATURE: vmui: update the appearance of error, warning, info, and success messages. See #11736.
FEATURE: vmui: add a tenant column to Top Queries and Active Queries when tenant information is available. See #6346.
FEATURE: vmui: limit tenant discovery to the selected time range. See #11784.
FEATURE: vmagent and Single-node VictoriaMetrics: limit the number of logged parse errors per each scrape of a target via
-promscrape.maxParseErrorsPerScrapecommand-line flag (20 by default). The number of suppressed parse errors is logged after the scrape. This prevents log flooding from targets exposing many malformed lines. See #8856.FEATURE: vmalert: restore Prometheus compatibility for alerts state restoration, so Prometheus can be used as
-remoteRead.urlagain. Previously, the restore query used MetricsQL functiondefault_rollup()which Prometheus rejects, so the state of alerting rules withfor > 0was reset on every vmalert restart. See #11574.FEATURE:
vmselectin VictoriaMetrics cluster: exportvm_request_duration_seconds{path="/admin/tenants"}for tracking time it takes to fetch tenants from the database.FEATURE: dashboards: apply the instance filter to the
CPU pressure,Memory pressure,IO pressure, andMemory allocations ratepanels in the Resource usage section of the VictoriaMetrics - cluster dashboard. Displays zero disk I/O and syscall rates. See #11742.FEATURE: alerts-health: add
TooManySnapshotsalerting rule. It notifies about instances where more than 2 snapshots are stored for at least 2 hours. Such snapshots are usually left behind by failedvmbackup/vmbackupmanagerruns. They keep references to the already merged data parts and prevent background merges from freeing the disk space, which results in excessive disk usage. See #9344.BUGFIX: vmagent: prevent Kafka remote write getting stuck after TLS certificates are reloaded. Previously, when vmagent detected changed certificates and restarted the Kafka producer, pending sends to the old producer could hang forever and the remote write queue stopped draining until vmagent was restarted. Now such sends are retried with the new producer. See #11737.
BUGFIX:
vminsertin VictoriaMetrics cluster: prevent metric metadata drops after transient RPC handshake timeouts when connecting tovmstorage. See #11762. Thanks to @sakateka for contribution.BUGFIX: vmsingle, vmagent and
vminsertin VictoriaMetrics cluster: properly validate time series ingested via/api/v1/import/native. See #11745. Thanks to @meshchellomishel for contribution.BUGFIX: vmsingle and vmagent: reduce memory usage during for Kubernetes service discovery, when scrape configuration has many entries that matches small subset of targets. See #11751. Thanks to @CamberLoid for contribution.
BUGFIX: vmsingle and
vmstoragein VictoriaMetrics cluster: prevent search requests panic. See #11788 for details.BUGFIX: vmsingle and vmagent: set
__meta_kubernetes_namespaceand the namespace metadata to the namespace of theEndpointsorEndpointSliceobject inrole: endpointsandrole: endpointsliceservice discovery when the referenced pod lives in another namespace. Previously the namespace of the pod was used, unlike Prometheus. See #11798. Thanks to @cestercian for contribution.BUGFIX: vmauth: skip keys with unsupported
ktyorcrv, missing required members or invalid values in the JWKS fetched via OIDC discovery instead of rejecting the whole key set, as required by RFC 7517. Previously, a single unsupported or malformed key in the JWKS caused vmauth to reject all JWTs from that issuer, including tokens signed with supported keys. See #11748.BUGFIX: vmui: stop saving the automatically calculated query step in shared URLs, so opening a link recalculates the step for the selected time range and screen width. Explicitly configured steps remain fixed. See #11638.
BUGFIX:
vmselectin VictoriaMetrics cluster: change the default time range for /admin/tenants HTTP endpoint to search tenants only for the current day instead of searching the entire[0, now]time range. This should prevent unnecessary load onvmstorageand prevent OOMs. See the updated URL format and #11791 for details.v1.154.1Compare Source
v1.154.1
Released at 2026-10-19
usersare configured. Previously, such requests were delayed by 2-3 seconds before being proxied tounauthorized_user, though there were no users to brute-force. This affected setups where onevmauthauthenticates requests and proxies them to anothervmauthwith onlyunauthorized_userconfigured. The bug has been introduced in v1.154.0. See #11774.v1.154.0Compare Source
v1.154.0
Released at 2026-10-12
Update Note 1: vmauth: setups with two chained
vmauthinstances, where the first one authenticates requests viausersand the second one proxies them viaunauthorized_user(for example,VMDistributedorVMClustermanaged by VictoriaMetrics operator), get an extra 2-3 seconds delay for every request. This is because the secondvmauthreceives theAuthorizationheader forwarded by the first one and treats it as an invalid auth token. Upgrade to the v1.154.1 release, where requests aren't delayed if nousersare configured, or remove theAuthorizationheader at the firstvmauthwithheaders: ["Authorization:"]. See #11774.Update Note 2:
vmstoragein VictoriaMetrics cluster:/admin/tenantsrequests withoutstartandendquery args (or with zero values) can cause excessive memory usage and OOM crashes ofvmstorage. Such requests are issued automatically by vmui when it is opened viavmselect. This is becausevmstorageno longer switches to the global index for queries with long time ranges, so it scans per-day indexes for every day in the whole retention concurrently. Upgrade to v1.155.0, or roll back to v1.153.0. See #11791.Update Note 3: vmsingle and
vmstoragein VictoriaMetrics cluster: queries and requests to/api/v1/series,/api/v1/labelsand/api/v1/label/.../valueswith long time ranges can cause excessive memory usage and OOM crashes. This is because VictoriaMetrics no longer switches to the global index for searches with long time ranges, so it scans per-day indexes for every day in the requested time range concurrently. Upgrade to v1.155.0, or roll back to v1.153.0. See #11791.Update Note 4:
vmselectin VictoriaMetrics cluster:-search.skipSlowReplicascauses excessive connection churn betweenvmselectandvmstorage, increasedvmstorageCPU usage andcannot process vmselect conn ... write: broken pipeerrors invmstoragelogs. This is becausevmselectnow cancels requests to slow replicas by closing connections tovmstorageinstead of reusing them. Disable-search.skipSlowReplicasor roll back to v1.153.0 until the fix is available. See #11771.SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See the list of issues addressed in Go1.27.2.
SECURITY: vmauth: slow down requests with invalid auth tokens even if
unauthorized_userhas URLs configured. Previously, such requests were proxied tounauthorized_userwithout delay, which allowed brute-forcing auth tokens. See GHSA-rpfx-hrcp-f73x.SECURITY: vmui: prevent cross-site scripting (XSS) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See GHSA-m2x2-9xpq-mmq5.
FEATURE: vmagent,
vminsertin VictoriaMetrics cluster and Single-node VictoriaMetrics: add/influx/pingendpoint, which returns theX-Influxdb-VersionHTTP header. Some InfluxDB clients, such as the Jenkins InfluxDB plugin, read the server version from this endpoint. See #11663. Thanks to @Vandit1604 for contribution.FEATURE: vmauth: add
oidc.auth_paramsoption to SSO config for passing additional query parameters to the IdP authentication request, e.g.,hdfor narrowing the Google account chooser to a single domain. Combine it withmatch_claimsto enforce the domain restriction. See these docs for more examples ofoidc.auth_paramsusage.FEATURE: vmsingle and
vmstoragein VictoriaMetrics cluster: abort incoming requests when a client disconnects and during graceful shutdown. See #11472.FEATURE: vmsingle and
vmselectin VictoriaMetrics cluster: cancel query requests if client disconnects. See #11355.BUGFIX: all VictoriaMetrics components: correctly configure TCP keep-alive active probes. See #11695.
BUGFIX: all VictoriaMetrics components: properly match regexps that start with an alternation or a character class and continue with
.*foo.*or.+foo.+, for example(a|b).*foo.*. Previously the leading part was ignored when matching relabelingregexandiffilters and stream aggregationmatchfilters, so such rules matched more series than intended. See #11712. Thanks to @dblackdblack for contribution.BUGFIX: alerts: fix incorrect results for
TooHighChurnRateandTooHighSlowInsertsRatein cluster alerting rules. Previously due to incorrect expressions, these rules stayed inactive since v1.108.0 and could produce false positives since v1.153.0. See #11670. Thanks to @transacid for contribution.BUGFIX: stream aggregation: properly add timeseries for increase, increase_prometheus, total and total_prometheus aggregation functions when
enable_windows: trueis set. See #11707. Thanks to @Hoipang for contribution.BUGFIX: vmalert: keep using notifiers from the previously applied notifier configuration file if the updated config fails to start, for example due to a temporary service discovery error, and retry applying it on the next reload. Previously, vmalert stopped the old notifiers before starting the new ones, so a failed reload left vmalert with no or only some notifiers, and alert notifications were silently not delivered until the file changed or vmalert restarted. See #11645.
BUGFIX: vmalert: copy alert labels before applying
alert_relabel_configsfrom the notifier configuration file, preventing different alertmanagers from affecting each other's labels. See #11676.BUGFIX: vmagent and vmalert: set the
HostHTTP request header to the resolved DNS SRV target instead of the SRV name when the url uses thesrv+prefix. Previously requests could fail at reverse proxies and load balancers, which route by theHostheader. See #8965.BUGFIX: vmauth: fixes rare data corruption on HTTP request retries. See #11508.
BUGFIX: vmauth: fix SSO login failure
Invalid state parametercaused by a race condition when multiple concurrent unauthenticated requests each set their own CSRF cookie. See #10278-comment and #11656.BUGFIX: vmauth: fix misleading
missing 'Authorization' request headerresponse for JWT-authenticated users when the requested path does not match anyurl_map. Now it correctly returns400 Bad Requestwithmissing routeerror, matching the behavior of Basic Auth and Bearer-token users. See #11523.BUGFIX: vmbackup and vmbackupmanager: add
-s3SkipTaggingDirectivecommand-line flag for S3-compatible storage that rejects thex-amz-tagging-directiveandx-amz-taggingheaders. See #11562.BUGFIX:
vmselectin VictoriaMetrics cluster: add missingaccountID,projectIDandmultiTenantfields totopByAvgMemoryUsageresults at/api/v1/status/top_queries. See #11640.BUGFIX:
vmselectin VictoriaMetrics cluster: prevent rare resource leak if-search.skipSlowReplicasflag is set. See #11551.BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: properly executegroup_left(...)andgroup_right(..)queries when the join is then combined with another selector. See #11490.BUGFIX: vmsingle and
vmstoragein VictoriaMetrics cluster: prevent possible crash withcannot decompress zstd data...panic ondarwin,windows,freebsd,openbsd,linux/arm,linux/ppc64le,linux/386,linux/s390x, and-purebuilds. Thelinux/amd64andlinux/arm64builds are not affected. See #11683.BUGFIX: vmsingle: properly apply
-streamAggr.enableWindowscommand-line flag to stream aggregation rules. Previously, the flag was ignored by aggregation rules defined in-streamAggr.configand was applied only during config validation with-dryRunand to the standalone deduplication configured via-streamAggr.dedupInterval. See #11717.BUGFIX: vmsingle and
vmstoragein VictoriaMetrics cluster: properly release memory after historical data backfilling. Previously storage kept 8MiB*CPU memory for each month of ingested data until restart. See #11672. Thanks to @mars71003219 for contribution.BUGFIX: vmui: prevent overriding the
serverUrl,tenantId,theme, andisDarkThemesettings via query parameters. See #11485.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
c362949319toe52117ee88chore(deps): update victoriametrics/victoria-metrics docker tag to v1.154.0to chore(deps): update victoriametrics/victoria-metrics docker tag to v1.155.0