Skip to content

VictoriaMetrics

v1.145.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

database grafana graphite influxdb kubernetes monitoring
+7 more
observability opentelemetry opentsdb prometheus promql thanos tsdb

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

Upgrade the Go builder from version 1.26.3 to 1.26.4 to address security issues.

Why it matters: The upgrade resolves critical security vulnerabilities in the Go runtime dependency; operators should apply it immediately due to high severity (severity 90).

Summary

AI summary

Updates v1.145.0 Release candidate, BUGFIX, and FEATURE across a mixed release.

Changes in this release

Security Critical

Upgrade Go builder from Go1.26.3 to Go1.26.4 addressing security issues.

Upgrade Go builder from Go1.26.3 to Go1.26.4 addressing security issues.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Add metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` for measuring background merge completion time.

Add metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` for measuring background merge completion time.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Support `match[]=<label_selector>` query parameters in `/api/v1/rules` and `/api/v1/alerts` APIs to filter by label selectors.

Support `match[]=<label_selector>` query parameters in `/api/v1/rules` and `/api/v1/alerts` APIs to filter by label selectors.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Add `-opentelemetry.promoteAllResourceAttributes` and `-opentelemetry.promoteScopeMetadata` flags to control label promotion for OTel resource attributes and scope metadata.

Add `-opentelemetry.promoteAllResourceAttributes` and `-opentelemetry.promoteScopeMetadata` flags to control label promotion for OTel resource attributes and scope metadata.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Introduce `vmagent_remotewrite_kafka_outbuf_latency_seconds` and `vmagent_remotewrite_kafka_rtt_seconds` metrics for Kafka integration throughput monitoring.

Introduce `vmagent_remotewrite_kafka_outbuf_latency_seconds` and `vmagent_remotewrite_kafka_rtt_seconds` metrics for Kafka integration throughput monitoring.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Properly log user information when a missing route error occurs in vmauth.

Properly log user information when a missing route error occurs in vmauth.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Add ability to migrate data from Mimir object storage to VictoriaMetrics using vmctl.

Add ability to migrate data from Mimir object storage to VictoriaMetrics using vmctl.

Source: llm_adapter@2026-06-08

Confidence: high

Feature Medium

Show full `version` label in Version panel when `short_version` is empty, fixing previously blank display.

Show full `version` label in Version panel when `short_version` is empty, fixing previously blank display.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Fix vmalert Notifiers page appearing blank despite API returning data correctly.

Fix vmalert Notifiers page appearing blank despite API returning data correctly.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Reset group evaluation timestamp in vmalert if it exceeds current host time, preventing future timestamps after clock rollback.

Reset group evaluation timestamp in vmalert if it exceeds current host time, preventing future timestamps after clock rollback.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Properly parse Prometheus Native Histograms in vmagent and vmsingle, fixing unexpected vmrange labels.

Properly parse Prometheus Native Histograms in vmagent and vmsingle, fixing unexpected vmrange labels.

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Bugfix Medium

Prevent integrate() from extrapolating the last sample's value past the end of a time series in MetricsQL.

Prevent integrate() from extrapolating the last sample's value past the end of a time series in MetricsQL.

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Bugfix Medium

Properly escape utf-8 label names for /federate API requests in vmsingle and vmselect (cluster).

Properly escape utf-8 label names for /federate API requests in vmsingle and vmselect (cluster).

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Bugfix Medium

Fix intermittent write: connection timed out errors in vmselect (cluster) caused by silently dropped TCP connections reused from the pool.

Fix intermittent write: connection timed out errors in vmselect (cluster) caused by silently dropped TCP connections reused from the pool.

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Bugfix Low

Correctly calculate number of loaded users in vmauth startup log, including JWT configuration entries.

Correctly calculate number of loaded users in vmauth startup log, including JWT configuration entries.

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Bugfix Low

Avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled in vmselect (cluster).

Avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled in vmselect (cluster).

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Bugfix Low

Persist the Disable deduplication toggle state in vmui local storage, preventing loss on reload.

Persist the Disable deduplication toggle state in vmui local storage, preventing loss on reload.

Source: granite4.1:30b@2026-06-08-audit

Confidence: low

Full changelog

v1.145.0

Release candidate

  • SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See the list of issues addressed in Go1.26.4.

  • FEATURE: enterprise vmsingle and vmstorage in VictoriaMetrics cluster: add the new metrics vm_downsampling_partitions_scheduled_rows and vm_retention_filters_partitions_scheduled_rows for measuring background historical data merge completion time. See #10960

  • FEATURE: vmalert: support match[]=<label_selector> query parameters in /api/v1/rules and /api/v1/alerts APIs to return only the rules that have configured labels satisfying the provided label selectors. See 11020.

  • FEATURE: vmagent, vmsingle and vminsert in VictoriaMetrics cluster: add -opentelemetry.promoteAllResourceAttributes and -opentelemetry.promoteScopeMetadata command-line flags to allow managing label promotion for resource attributes and OTel scope metadata. See OpenTelemetry docs and #10931.

  • FEATURE: vmagent : introduce vmagent_remotewrite_kafka_outbuf_latency_seconds and vmagent_remotewrite_kafka_rtt_seconds metrics for kafka integration. The metrics could help identify throughput bottlenecks. See #10730.

  • FEATURE: vmauth: properly log user information when a missing route error occurs. See #11052.

  • FEATURE: vmctl: add the ability to migrate data from Mimir object storage to VictoriaMetrics. See #7717.

  • FEATURE: dashboards: show the full version label in the Version panel when short_version label is empty (e.g. custom builds from feature branch). Previously, the panel could appear empty. See #11047.

  • BUGFIX: vmalert: fix the Notifiers page in web UI appearing blank despite the API returning notifier data correctly. See #11035.

  • BUGFIX: vmalert: reset the group evaluation timestamp if it exceeds the current host time. Previously, vmalert could use future timestamps for evaluations if the system clock was shifted backward. See #10985.

  • BUGFIX: vmagent and vmsingle: properly parse Prometheus Native Histograms, previously Protobuf parser could produce unexpected vmrange labels. See #11041.

  • BUGFIX: vmauth: properly calculate number of loaded users to be printed in startup log. Previously, it was only accounting for static users and skipped JWT configuration entries. See #11050.

  • BUGFIX: MetricsQL: integrate() no longer extrapolates the last sample's value past the end of the time series. Previously, querying integrate(metric[1h]) at a timestamp where the series had already ended would keep accruing area as if the last value continued indefinitely, producing values much larger than the true integral. See #9474. Thanks to @wtfashwin for contribution.

  • BUGFIX: vmselect in VictoriaMetrics cluster: avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled. See #11009. Thanks to @fxrlv for the contribution.

  • BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly escape utf-8 label names for /federate API requests. See #10968.

  • BUGFIX: vmui: persist the Disable deduplication toggle under its own local storage key. Before this fix, the toggle state was lost after reload and could overwrite the Compact view table setting. See #11004. Thanks to @immanuwell for the contribution.

  • BUGFIX: vmselect in VictoriaMetrics cluster: fix intermittent write: connection timed out errors caused by silently dropped TCP connections being reused from the connection pool. See #10735.

Security Fixes

  • SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4 (addresses issues in Go 1.26.4).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track VictoriaMetrics

Get notified when new releases ship.

Sign up free

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →

Related context

Beta — feedback welcome: [email protected]