This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+7 more
Affected surfaces
ReleasePort's take
Moderate signalUpgrade the Go builder from version 1.26.3 to 1.26.4 to address security issues.
Why it matters: The upgrade resolves critical security vulnerabilities in the Go runtime dependency; operators should apply it immediately due to high severity (severity 90).
Summary
AI summaryUpdates v1.145.0 Release candidate, BUGFIX, and FEATURE across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Upgrade Go builder from Go1.26.3 to Go1.26.4 addressing security issues. Upgrade Go builder from Go1.26.3 to Go1.26.4 addressing security issues. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Add metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` for measuring background merge completion time. Add metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` for measuring background merge completion time. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Support `match[]=<label_selector>` query parameters in `/api/v1/rules` and `/api/v1/alerts` APIs to filter by label selectors. Support `match[]=<label_selector>` query parameters in `/api/v1/rules` and `/api/v1/alerts` APIs to filter by label selectors. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Add `-opentelemetry.promoteAllResourceAttributes` and `-opentelemetry.promoteScopeMetadata` flags to control label promotion for OTel resource attributes and scope metadata. Add `-opentelemetry.promoteAllResourceAttributes` and `-opentelemetry.promoteScopeMetadata` flags to control label promotion for OTel resource attributes and scope metadata. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Introduce `vmagent_remotewrite_kafka_outbuf_latency_seconds` and `vmagent_remotewrite_kafka_rtt_seconds` metrics for Kafka integration throughput monitoring. Introduce `vmagent_remotewrite_kafka_outbuf_latency_seconds` and `vmagent_remotewrite_kafka_rtt_seconds` metrics for Kafka integration throughput monitoring. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Properly log user information when a missing route error occurs in vmauth. Properly log user information when a missing route error occurs in vmauth. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Add ability to migrate data from Mimir object storage to VictoriaMetrics using vmctl. Add ability to migrate data from Mimir object storage to VictoriaMetrics using vmctl. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
Show full `version` label in Version panel when `short_version` is empty, fixing previously blank display. Show full `version` label in Version panel when `short_version` is empty, fixing previously blank display. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Fix vmalert Notifiers page appearing blank despite API returning data correctly. Fix vmalert Notifiers page appearing blank despite API returning data correctly. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Reset group evaluation timestamp in vmalert if it exceeds current host time, preventing future timestamps after clock rollback. Reset group evaluation timestamp in vmalert if it exceeds current host time, preventing future timestamps after clock rollback. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Properly parse Prometheus Native Histograms in vmagent and vmsingle, fixing unexpected vmrange labels. Properly parse Prometheus Native Histograms in vmagent and vmsingle, fixing unexpected vmrange labels. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Medium |
Prevent integrate() from extrapolating the last sample's value past the end of a time series in MetricsQL. Prevent integrate() from extrapolating the last sample's value past the end of a time series in MetricsQL. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Medium |
Properly escape utf-8 label names for /federate API requests in vmsingle and vmselect (cluster). Properly escape utf-8 label names for /federate API requests in vmsingle and vmselect (cluster). Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Medium |
Fix intermittent write: connection timed out errors in vmselect (cluster) caused by silently dropped TCP connections reused from the pool. Fix intermittent write: connection timed out errors in vmselect (cluster) caused by silently dropped TCP connections reused from the pool. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Low |
Correctly calculate number of loaded users in vmauth startup log, including JWT configuration entries. Correctly calculate number of loaded users in vmauth startup log, including JWT configuration entries. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Low |
Avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled in vmselect (cluster). Avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled in vmselect (cluster). Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Low |
Persist the Disable deduplication toggle state in vmui local storage, preventing loss on reload. Persist the Disable deduplication toggle state in vmui local storage, preventing loss on reload. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
Full changelog
v1.145.0
Release candidate
-
SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See the list of issues addressed in Go1.26.4.
-
FEATURE: enterprise vmsingle and
vmstoragein VictoriaMetrics cluster: add the new metricsvm_downsampling_partitions_scheduled_rowsandvm_retention_filters_partitions_scheduled_rowsfor measuring background historical data merge completion time. See #10960 -
FEATURE: vmalert: support
match[]=<label_selector>query parameters in/api/v1/rulesand/api/v1/alertsAPIs to return only the rules that have configured labels satisfying the provided label selectors. See 11020. -
FEATURE: vmagent, vmsingle and
vminsertin VictoriaMetrics cluster: add-opentelemetry.promoteAllResourceAttributesand-opentelemetry.promoteScopeMetadatacommand-line flags to allow managing label promotion for resource attributes and OTel scope metadata. See OpenTelemetry docs and #10931. -
FEATURE: vmagent : introduce
vmagent_remotewrite_kafka_outbuf_latency_secondsandvmagent_remotewrite_kafka_rtt_secondsmetrics for kafka integration. The metrics could help identify throughput bottlenecks. See #10730. -
FEATURE: vmauth: properly log user information when a missing route error occurs. See #11052.
-
FEATURE: vmctl: add the ability to migrate data from Mimir object storage to VictoriaMetrics. See #7717.
-
FEATURE: dashboards: show the full
versionlabel in theVersionpanel whenshort_versionlabel is empty (e.g. custom builds from feature branch). Previously, the panel could appear empty. See #11047. -
BUGFIX: vmalert: fix the
Notifierspage in web UI appearing blank despite the API returning notifier data correctly. See #11035. -
BUGFIX: vmalert: reset the group evaluation timestamp if it exceeds the current host time. Previously, vmalert could use future timestamps for evaluations if the system clock was shifted backward. See #10985.
-
BUGFIX: vmagent and vmsingle: properly parse Prometheus Native Histograms, previously Protobuf parser could produce unexpected
vmrangelabels. See #11041. -
BUGFIX: vmauth: properly calculate number of loaded users to be printed in startup log. Previously, it was only accounting for static users and skipped JWT configuration entries. See #11050.
-
BUGFIX: MetricsQL:
integrate()no longer extrapolates the last sample's value past the end of the time series. Previously, queryingintegrate(metric[1h])at a timestamp where the series had already ended would keep accruing area as if the last value continued indefinitely, producing values much larger than the true integral. See #9474. Thanks to @wtfashwin for contribution. -
BUGFIX:
vmselectin VictoriaMetrics cluster: avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and-search.denyPartialResponseis disabled. See #11009. Thanks to @fxrlv for the contribution. -
BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: properly escapeutf-8label names for /federate API requests. See #10968. -
BUGFIX: vmui: persist the
Disable deduplicationtoggle under its own local storage key. Before this fix, the toggle state was lost after reload and could overwrite theCompact viewtable setting. See #11004. Thanks to @immanuwell for the contribution. -
BUGFIX:
vmselectin VictoriaMetrics cluster: fix intermittentwrite: connection timed outerrors caused by silently dropped TCP connections being reused from the connection pool. See #10735.
Security Fixes
- SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4 (addresses issues in Go 1.26.4).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About VictoriaMetrics
VictoriaMetrics: fast, cost-effective monitoring solution and time series database
Related context
Related tools
Beta — feedback welcome: [email protected]