This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+7 more
Affected surfaces
Summary
AI summaryUpdates BUGFIX, https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/, and https://github.com/VictoriaMetrics/VictoriaMetrics/releases/latest across a mixed release.
Full changelog
v1.136.13
Released at 2026-07-03
v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release
-
SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.24.1. See Alpine 3.24.1 release notes.
-
BUGFIX:
vminsertin VictoriaMetrics cluster and vmsingle: properly check values range for the limits configured with flags-maxLabelsPerTimeseries,-maxLabelNameLenand-maxLabelValueLen. It must be in range1..65535. See #11128. -
BUGFIX:
vminsertin VictoriaMetrics cluster: fixes unexpected rare rerouting. See #11162. -
BUGFIX:
vmselectin VictoriaMetrics cluster: propagate cache reset operation toselectNodewhen/internal/resetRollupResultCacheis called. Previously, the propagation only happened when thedelete_seriesAPI was called. See #11112. -
BUGFIX: stream aggregation: fix possible unexpected increases in
rate_avgandrate_sumif an out-of-order sample is ingested after the previous flush. See #11140. -
BUGFIX: vmctl: properly URL-encode
-vm-extra-labelvalues when building import requests, so special characters such as&don't get split into broken query parameters. See #11144. Thanks to @immanuwell for contribution. -
BUGFIX: enterprise vmagent: ignore
enable.auto.offset.storeoption inkafka.consumer.topic.options, sincevmagentmanages offset storage internally. Previously, setting this option could causevmagentto stop committing Kafka messages. See #11208. -
BUGFIX: all VictoriaMetrics components: cancel in-flight HTTP requests shortly before
-http.maxGracefulShutdownDurationelapses during graceful shutdown, so they can drain and the shutdown completes cleanly within that window instead of timing out and exiting vialogger.Fatalf->os.Exit. This prevents skipping the storage flush and losing in-memory data when long-lived requests are in flight (such as VictoriaLogs live tailing). See #1502.
Security Fixes
- SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.24.1
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About VictoriaMetrics
VictoriaMetrics: fast, cost-effective monitoring solution and time series database
Related context
Related tools
Beta — feedback welcome: [email protected]