Skip to content

VictoriaMetrics

v1.148.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 6d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

database grafana graphite influxdb kubernetes monitoring
+7 more
observability opentelemetry opentsdb prometheus promql thanos tsdb

Affected surfaces

deps

Summary

AI summary

Updates v1.148.0 Released at 2026-07-17, BUGFIX, and https://docs.victoriametrics.com/victoriametrics/vmagent/ across a mixed release.

Changes in this release

Security Critical

Upgrade Go builder from Go1.26.4 to Go1.26.5.

Upgrade Go builder from Go1.26.4 to Go1.26.5.

Source: llm_adapter@2026-07-21

Confidence: medium

Feature Medium

MetricsQL adds `fill` modifiers for default missing series values.

MetricsQL adds `fill` modifiers for default missing series values.

Source: llm_adapter@2026-07-21

Confidence: medium

Feature Medium

vmagent and vmsingle support scraping metrics over Unix domain sockets.

vmagent and vmsingle support scraping metrics over Unix domain sockets.

Source: llm_adapter@2026-07-21

Confidence: medium

Feature Medium

Improve background discovery performance for http_sd in vmagent and vmsingle.

Improve background discovery performance for http_sd in vmagent and vmsingle.

Source: llm_adapter@2026-07-21

Confidence: medium

Feature Medium

Allow per‑target override of `max_scrape_size` via `__max_scrape_size__` label in vmagent and vmsingle.

Allow per‑target override of `max_scrape_size` via `__max_scrape_size__` label in vmagent and vmsingle.

Source: llm_adapter@2026-07-21

Confidence: medium

Feature Medium

Add `-maxBackfillAge` flag to vmstorage and vmsingle for limiting ingestion of historical‑timestamp samples.

Add `-maxBackfillAge` flag to vmstorage and vmsingle for limiting ingestion of historical‑timestamp samples.

Source: llm_adapter@2026-07-21

Confidence: medium

Feature Medium

vmagent automatically preloads relabeling rules in the metrics relabel debug UI.

vmagent automatically preloads relabeling rules in the metrics relabel debug UI.

Source: llm_adapter@2026-07-21

Confidence: medium

Bugfix Medium

vminsert drops metadata blocks when using legacy RPC protocol with vmstorage.

vminsert drops metadata blocks when using legacy RPC protocol with vmstorage.

Source: llm_adapter@2026-07-21

Confidence: medium

Bugfix Medium

vmbackup and vmbackupmanager retry S3 requests that return HTTP 429 or TooManyRequests.

vmbackup and vmbackupmanager retry S3 requests that return HTTP 429 or TooManyRequests.

Source: llm_adapter@2026-07-21

Confidence: medium

Bugfix Medium

vmselect properly applies limit to metrics metadata response.

vmselect properly applies limit to metrics metadata response.

Source: llm_adapter@2026-07-21

Confidence: medium

Full changelog

v1.148.0

Released at 2026-07-17

  • SECURITY: upgrade Go builder from Go1.26.4 to Go1.26.5. See the list of issues addressed in Go1.26.5.

  • FEATURE: MetricsQL: support fill modifiers to allow missing series on either side of a binary operation to be filled with a provided default value. See #10598.

  • FEATURE: vmagent and vmsingle: support scraping metrics over Unix domain sockets. The socket path can be configured via the __unix_socket__ target label. See #11156. Thanks to @vinyas-bharadwaj for contribution.

  • FEATURE: vmagent and vmsingle: Improve background discovery performance for http_sd discovery. See #8838.

  • FEATURE: vmagent and vmsingle: allow overriding max_scrape_size on a per-target basis via the __max_scrape_size__ label during target relabeling. See #11188.

  • FEATURE: vmstorage and vmsingle: add -maxBackfillAge command-line flag for limiting ingestion of samples with historical timestamps, for example, when older data has been moved between storage tiers (nvme/hdd, hot/cold). See #11199. Thanks to @AshwinRamaniPsg for contribution.

  • FEATURE: vmagent: automatically preload relabeling rules configured via -remoteWrite.relabelConfig and -remoteWrite.urlRelabelConfig in the metrics relabel debug UI. See #9918.

  • BUGFIX: vminsert in VictoriaMetrics cluster: Now drops metadata blocks when communicating with vmstorage nodes over the legacy RPC protocol. To avoid this limitation, upgrade vmstorage to a version that supports the new RPC protocol (>= v1.137.0). See #11146.

  • BUGFIX: vmbackup and vmbackupmanager: retry S3 requests failing with HTTP 429 status code or TooManyRequests error code. Previously such requests were not retried, so a short burst of rate limiting would fail the whole backup. See #11218. Thanks to @gautamrizwani for contribution.

  • BUGFIX: vmselect in VictoriaMetrics cluster: properly apply limit to metrics metadata response. See #11139.

  • BUGFIX: vmagent: fix a possible data race when processing OpenTelemetry metadata. See #11238. Thanks to @nevgeny for contribution.

  • BUGFIX: vmagent: flush pending persistent queue data to chunk file before updating the metadata. This prevents the metadata writer offset from getting ahead of the chunk file size and avoids losing the persistent queue after an unclean shutdown. See #11192.

  • BUGFIX: vmagent: atomically write persistent queue metainfo to prevent possible file corruption on ungraceful shutdown. See #11192.

  • BUGFIX: vmagent: fix increased CPU and memory usage when -remoteWrite.urlRelabelConfig or -remoteWrite.streamAggr.config flags are used. The bug was introduced in #10854 and existed since v1.147.0. See #11250.

  • BUGFIX: vmui: preserve newline formatting in alert and rule annotations on the Alerting page. See #11171.

  • BUGFIX: vmui: hide Total metric names stats on Cardinality Explorer page when user selects a specific metric or label to focus. See #11154 for details. Thanks to @lghuy05 for the contribution.

  • BUGFIX: vmui: keep only one header navigation dropdown (Explore, Tools) open at a time. Previously, hovering across two dropdowns could briefly leave both open due to the close delay. See #11224. Thanks to @antedotee for contribution.

  • BUGFIX: vmauth: return 408 Request Timeout instead of 400 Bad Request when the request body isn't received within -maxQueueDuration. This prevents vmagent from incorrectly downgrading the remote write protocol and dropping data when vmauth is used as a proxy for a remote write endpoint. See #11272.

Security Fixes

  • Upgrade Go builder from Go1.26.4 to Go1.26.5 (includes security patches)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track VictoriaMetrics

Get notified when new releases ship.

Sign up free

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →

Related context

Beta — feedback welcome: [email protected]