This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+7 more
Affected surfaces
ReleasePort's take
Moderate signalUpgrade the Go builder from version 1.26.3 to 1.26.4 as part of this release.
Why it matters: Severity 90 security fix; upgrade required for all build environments using Go 1.26.3.
Summary
AI summaryUpdates BUGFIX, https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/, and https://docs.victoriametrics.com/victoriametrics/vmalert/ across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Upgrade Go builder from Go1.26.3 to Go1.26.4. Upgrade Go builder from Go1.26.3 to Go1.26.4. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
`integrate()` no longer extrapolates the last sample's value past series end. `integrate()` no longer extrapolates the last sample's value past series end. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Persist `Disable deduplication` toggle state in vmui across reloads. Persist `Disable deduplication` toggle state in vmui across reloads. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Fix vmalert `Notifiers` page appearing blank despite API returning data. Fix vmalert `Notifiers` page appearing blank despite API returning data. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Reset vmalert group evaluation timestamp if it exceeds current host time. Reset vmalert group evaluation timestamp if it exceeds current host time. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Avoid HTTP 503 for queries with partial results when a storage group is unavailable if `-search.denyPartialResponse` is disabled. Avoid HTTP 503 for queries with partial results when a storage group is unavailable if `-search.denyPartialResponse` is disabled. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Properly escape UTF‑8 label names for `/federate` API requests in vmsingle and vmselect. Properly escape UTF‑8 label names for `/federate` API requests in vmsingle and vmselect. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Fix intermittent `write: connection timed out` errors in vmselect caused by reused dropped TCP connections. Fix intermittent `write: connection timed out` errors in vmselect caused by reused dropped TCP connections. Source: llm_adapter@2026-06-08 Confidence: high |
— |
Full changelog
v1.136.11
Released at 2026-06-05
v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release
-
SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See the list of issues addressed in Go1.26.4.
-
BUGFIX: MetricsQL:
integrate()no longer extrapolates the last sample's value past the end of the time series. Previously, queryingintegrate(metric[1h])at a timestamp where the series had already ended would keep accruing area as if the last value continued indefinitely, producing values much larger than the true integral. See #9474. Thanks to @wtfashwin for contribution. -
BUGFIX: vmui: persist the
Disable deduplicationtoggle under its own local storage key. Before this fix, the toggle state was lost after reload and could overwrite theCompact viewtable setting. See #11004. Thanks to @immanuwell for the contribution. -
BUGFIX: vmalert: fix the
Notifierspage in web UI appearing blank despite the API returning notifier data correctly. See #11035. -
BUGFIX: vmalert: reset the group evaluation timestamp if it exceeds the current host time. Previously, vmalert could use future timestamps for evaluations if the system clock was shifted backward. See #10985.
-
BUGFIX:
vmselectin VictoriaMetrics cluster: avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and-search.denyPartialResponseis disabled. See #11009. Thanks to @fxrlv for the contribution. -
BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: properly escapeutf-8label names for /federate API requests. See #10968. -
BUGFIX:
vmselectin VictoriaMetrics cluster: fix intermittentwrite: connection timed outerrors caused by silently dropped TCP connections being reused from the connection pool. See #10735.
Security Fixes
- Upgrade Go builder from Go1.26.3 to Go1.26.4 (addresses issues in Go1.26.4)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About VictoriaMetrics
VictoriaMetrics: fast, cost-effective monitoring solution and time series database
Related context
Related tools
Beta — feedback welcome: [email protected]