Skip to content

VictoriaMetrics

v1.136.10 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 9d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

database grafana graphite influxdb kubernetes monitoring
+7 more
observability opentelemetry opentsdb prometheus promql thanos tsdb

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates BUGFIX, https://docs.victoriametrics.com/victoriametrics/vmagent/, and https://docs.victoriametrics.com/victoriametrics/stream-aggregation/ across a mixed release.

Changes in this release

Bugfix Medium

Hide sensitive HTTP headers in vmagent startup logs, /metrics, and /flags.

Hide sensitive HTTP headers in vmagent startup logs, /metrics, and /flags.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Hide sensitive proxy URLs in vmagent startup logs, /metrics, and /flags.

Hide sensitive proxy URLs in vmagent startup logs, /metrics, and /flags.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Properly establish MTLS connections between vmstorage and vminsert in VictoriaMetrics cluster, fixing a regression from v1.130.0 enterprise.

Properly establish MTLS connections between vmstorage and vminsert in VictoriaMetrics cluster, fixing a regression from v1.130.0 enterprise.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Prevent vmagent from unintentionally rerouting samples when a blocked remoteWrite target lacks `-remoteWrite.disableOnDiskQueue`.

Prevent vmagent from unintentionally rerouting samples when a blocked remoteWrite target lacks `-remoteWrite.disableOnDiskQueue`.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Return startup error if `-remoteWrite.disableOnDiskQueue` is not uniformly configured across all remoteWrite URLs when sharding is enabled.

Return startup error if `-remoteWrite.disableOnDiskQueue` is not uniformly configured across all remoteWrite URLs when sharding is enabled.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Hide sensitive proxy URLs in vmsingle and vmselect startup logs, /metrics, and /flags.

Hide sensitive proxy URLs in vmsingle and vmselect startup logs, /metrics, and /flags.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Preserve exact series values in vmui graph tooltips without rounding.

Preserve exact series values in vmui graph tooltips without rounding.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Add missing `__timestamp__` and `__value__` columns to CSV exports from vmui table view.

Add missing `__timestamp__` and `__value__` columns to CSV exports from vmui table view.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Stop emitting stale quantile values for stream aggregation when a time series has no samples in the current interval.

Stop emitting stale quantile values for stream aggregation when a time series has no samples in the current interval.

Source: llm_adapter@2026-05-25

Confidence: high

 —
Bugfix Medium

Hide sensitive HTTP headers in vmalert configuration handling across multiple flag types.

Hide sensitive HTTP headers in vmalert configuration handling across multiple flag types.

Source: llm_adapter@2026-05-25

Confidence: low

 —
Bugfix Low

Extend delay on aggregation windows flush by the biggest sample lag, improving handling of outliers.

Extend delay on aggregation windows flush by the biggest sample lag, improving handling of outliers.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

 —
Bugfix Low

Fix cardinality limiter in vmagent to correctly differentiate series with different label sets.

Fix cardinality limiter in vmagent to correctly differentiate series with different label sets.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

 —
Bugfix Low

Hide sensitive HTTP headers for multiple flag types (`-remoteWrite.headers`, `remoteRead.headers`, `datasource.headers`, `notifier.headers`) in vmalert logs, metrics, and flags.

Hide sensitive HTTP headers for multiple flag types (`-remoteWrite.headers`, `remoteRead.headers`, `datasource.headers`, `notifier.headers`) in vmalert logs, metrics, and flags.

Source: granite4.1:30b@2026-05-25-audit

Confidence: low

 —
Full changelog

v1.136.10

Released at 2026-05-22

v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release

  • BUGFIX: stream aggregation: stop emitting stale values for quantiles(...) outputs when a time series has no samples during the current aggregation interval. See #10918. Thanks to @alexei38 for the contribution.
  • BUGFIX: stream aggregation: extend delay on aggregation windows flush by the biggest lag among pushed samples. Before, the delay was calculated as 95th percentile across samples, which could underrepresent outliers and reject them from aggregation as "too old". See #10402.
  • BUGFIX: vmagent: fix a bug in cardinality limiters where series with different labels, like {a="bc"} and {ab="c"}, could be incorrectly treated as identical and dropped. See #10937.
  • BUGFIX: vmagent: hide values passed to -remoteWrite.headers in startup logs, /metrics, and /flags, since they can contain sensitive HTTP headers such as Authorization and API keys.
  • BUGFIX: vmagent: hide values passed to -remoteWrite.proxyURL in startup logs, /metrics, and /flags, since they can contain sensitive credentials.
  • BUGFIX: vmalert: hide values passed to -remoteWrite.headers,remoteRead.headers, datasource.headers and notifier.headers in startup logs, /metrics, and /flags, since they can contain sensitive HTTP headers such as Authorization and API keys.
  • BUGFIX: vminsert in VictoriaMetrics cluster: properly establish mtls connection between vmstorage and vminsert. Regression was introduced in v1.130.0 release for the enterprise version of vmstorage. See #10972.
  • BUGFIX: vmrestore: fix a bug where specifying -storageDataPath with a trailing slash could cause vmrestore to panic. See #10823. Thanks to @utafrali for the contribution.
  • BUGFIX: vmagent: prevent unintentional rerouting of samples to other sharding targets when one of the -remoteWrite.url targets with -remoteWrite.disableOnDiskQueue becomes blocked. Previously this could break the sharding guarantee by sending samples to wrong targets instead of dropping or retrying them. See #10507.
  • BUGFIX: vmagent: return error on startup if -remoteWrite.disableOnDiskQueue is not configured uniformly across all -remoteWrite.url targets when -remoteWrite.shardByURL is enabled. Either all targets must have it enabled or all must have it disabled. See #10507.
  • BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: hide values passed to vmalert.proxyURL in startup logs, /metrics, and /flags, since they can contain sensitive HTTP headers such as Authorization and API keys.
  • BUGFIX: vmui: preserve exact series values in graph tooltips instead of rounding them by significant digits. See #10952.
  • BUGFIX: vmui: add missing __timestamp__ and __value__ columns to CSV exported from the table view on the Query tab. See #10975.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track VictoriaMetrics

Get notified when new releases ship.

Sign up free

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →

Related context

Beta — feedback welcome: [email protected]