VictoriaMetrics

v1.147.0

Released at 2026-07-03

• SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.24.1. See Alpine 3.24.1 release notes.

• FEATURE: vmauth: add default_vm_access_claim field into jwt section of auth config. It could be used at JWT claim placeholders, if JWT token doesn't have vm_access claim. See #11054.

• FEATURE: vmagent: reduces CPU usage by 10% at sharding among remote storages. See #11113. Thanks to @bennf for contribution.

• FEATURE: vmagent, vminsert in VictoriaMetrics cluster and vmsingle: introduce 64KiB size limit for metric metadata fields - Unit, Help and MetricFamilyName. See #11128.

• FEATURE: vmagent and vmsingle: reduce CPU usage for storing scrape target labels. See #10919.

• FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: add optimize_repeated_binary_op_subexprs=1 query arg to /api/v1/query_range for executing binary operator sides sequentially when they share the same optimized aggregate rollup result expression. This allows the second side to reuse rollup result cache populated by the first side. See #10575. Thanks to @xhebox for the contribution.

• FEATURE: vmauth: prevent possible password brute-force attacks with an artificial 2-3 second delay as recommended by OWASP. See #11180.

• FEATURE: alerts: add InvalidAuthTokenRequestErrors alerting rule to vmauth alerts. The new rule notifies when vmauth receives requests with invalid or missing auth tokens, which may indicate a client misconfiguration, expired token use, or brute-force attack. See #11180.

• FEATURE: vmsingle: Add the support of vmselect RPC to vmsingle so that single node can be queried by a vmselect from a vmcluster deployment. See 4328 and 10926.

• FEATURE: vmauth: allow log requests with missing or invalid auth tokens to access log. This is useful for identifying remote_addr IPs performing brute-force attacks. See #11180.

• FEATURE: vmauth: fall through to unauthorized_user when a JWT token has no vm_access claim and no default_vm_access_claim is configured. Previously, vmauth returned 401 Unauthorized immediately in this case, which prevented unauthorized_user from handling such requests. See #5740.

• FEATURE: MetricsQL: improve the selection algorithm of buckets_limit to remove consecutive empty buckets at the beginning and end to obtain more accurate min and max values. See #10417.

• FEATURE: vmalert: expose vmalert_group_rule_results_limit metric to indicate the number of alerts or recording results that a single rule within the group can produce. See #11179. Thanks to @vinyas-bharadwaj for the contribution.

• FEATURE: alerts: add AlertingRuleResultsApproachingLimit and RecordingRuleResultsApproachingLimit alerting rules to vmalert alerts. These alerts notify when a rule's last evaluation samples exceed 90% of the configured group results limit. See #11179. Thanks to @vinyas-bharadwaj for the contribution.

• BUGFIX: all VictoriaMetrics components: cancel in-flight HTTP requests shortly before -http.maxGracefulShutdownDuration elapses during graceful shutdown, so they can drain and the shutdown completes cleanly within that window instead of timing out and exiting via logger.Fatalf -> os.Exit. This prevents skipping the storage flush and losing in-memory data when long-lived requests are in flight (such as VictoriaLogs live tailing). See #1502.

• BUGFIX: vminsert in VictoriaMetrics cluster and vmsingle: properly check values range for the limits configured with flags -maxLabelsPerTimeseries, -maxLabelNameLen and -maxLabelValueLen. It must be in range 1..65535. See #11128.

• BUGFIX: vminsert in VictoriaMetrics cluster: fixes unexpected rare rerouting. See #11162.

• BUGFIX: vmselect in VictoriaMetrics cluster: propagate cache reset operation to selectNode when /internal/resetRollupResultCache is called. Previously, the propagation only happened when the delete_series API was called. See #11112.

• BUGFIX: stream aggregation: fix possible unexpected increases in rate_avg and rate_sum if an out-of-order sample is ingested after the previous flush. See #11140.

• BUGFIX: vmctl: properly URL-encode -vm-extra-label values when building import requests, so special characters such as & don't get split into broken query parameters. See #11144. Thanks to @immanuwell for contribution.

• BUGFIX: enterprise vmagent: ignore enable.auto.offset.store option in kafka.consumer.topic.options, since vmagent manages offset storage internally. Previously, setting this option could cause vmagent to stop committing Kafka messages. See #11208.