This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+7 more
Affected surfaces
Summary
AI summaryUpdates v1.148.0 Released at 2026-07-17, BUGFIX, and https://docs.victoriametrics.com/victoriametrics/vmagent/ across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Upgrade Go builder from Go1.26.4 to Go1.26.5. Upgrade Go builder from Go1.26.4 to Go1.26.5. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Feature | Medium |
MetricsQL adds `fill` modifiers for default missing series values. MetricsQL adds `fill` modifiers for default missing series values. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Feature | Medium |
vmagent and vmsingle support scraping metrics over Unix domain sockets. vmagent and vmsingle support scraping metrics over Unix domain sockets. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Feature | Medium |
Improve background discovery performance for http_sd in vmagent and vmsingle. Improve background discovery performance for http_sd in vmagent and vmsingle. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Feature | Medium |
Allow per‑target override of `max_scrape_size` via `__max_scrape_size__` label in vmagent and vmsingle. Allow per‑target override of `max_scrape_size` via `__max_scrape_size__` label in vmagent and vmsingle. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Feature | Medium |
Add `-maxBackfillAge` flag to vmstorage and vmsingle for limiting ingestion of historical‑timestamp samples. Add `-maxBackfillAge` flag to vmstorage and vmsingle for limiting ingestion of historical‑timestamp samples. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Feature | Medium |
vmagent automatically preloads relabeling rules in the metrics relabel debug UI. vmagent automatically preloads relabeling rules in the metrics relabel debug UI. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Bugfix | Medium |
vminsert drops metadata blocks when using legacy RPC protocol with vmstorage. vminsert drops metadata blocks when using legacy RPC protocol with vmstorage. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Bugfix | Medium |
vmbackup and vmbackupmanager retry S3 requests that return HTTP 429 or TooManyRequests. vmbackup and vmbackupmanager retry S3 requests that return HTTP 429 or TooManyRequests. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
| Bugfix | Medium |
vmselect properly applies limit to metrics metadata response. vmselect properly applies limit to metrics metadata response. Source: llm_adapter@2026-07-21 Confidence: medium |
— |
Full changelog
v1.148.0
Released at 2026-07-17
-
SECURITY: upgrade Go builder from Go1.26.4 to Go1.26.5. See the list of issues addressed in Go1.26.5.
-
FEATURE: MetricsQL: support
fillmodifiers to allow missing series on either side of a binary operation to be filled with a provided default value. See #10598. -
FEATURE: vmagent and vmsingle: support scraping metrics over Unix domain sockets. The socket path can be configured via the
__unix_socket__target label. See #11156. Thanks to @vinyas-bharadwaj for contribution. -
FEATURE: vmagent and vmsingle: Improve background discovery performance for http_sd discovery. See #8838.
-
FEATURE: vmagent and vmsingle: allow overriding
max_scrape_sizeon a per-target basis via the__max_scrape_size__label during target relabeling. See #11188. -
FEATURE: vmstorage and vmsingle: add
-maxBackfillAgecommand-line flag for limiting ingestion of samples with historical timestamps, for example, when older data has been moved between storage tiers (nvme/hdd, hot/cold). See #11199. Thanks to @AshwinRamaniPsg for contribution. -
FEATURE: vmagent: automatically preload relabeling rules configured via
-remoteWrite.relabelConfigand-remoteWrite.urlRelabelConfigin the metrics relabel debug UI. See #9918. -
BUGFIX:
vminsertin VictoriaMetrics cluster: Now drops metadata blocks when communicating with vmstorage nodes over the legacy RPC protocol. To avoid this limitation, upgradevmstorageto a version that supports the new RPC protocol (>= v1.137.0). See #11146. -
BUGFIX: vmbackup and vmbackupmanager: retry S3 requests failing with
HTTP 429status code orTooManyRequestserror code. Previously such requests were not retried, so a short burst of rate limiting would fail the whole backup. See #11218. Thanks to @gautamrizwani for contribution. -
BUGFIX:
vmselectin VictoriaMetrics cluster: properly apply limit to metrics metadata response. See #11139. -
BUGFIX: vmagent: fix a possible data race when processing OpenTelemetry metadata. See #11238. Thanks to @nevgeny for contribution.
-
BUGFIX: vmagent: flush pending persistent queue data to chunk file before updating the metadata. This prevents the metadata writer offset from getting ahead of the chunk file size and avoids losing the persistent queue after an unclean shutdown. See #11192.
-
BUGFIX: vmagent: atomically write persistent queue metainfo to prevent possible file corruption on ungraceful shutdown. See #11192.
-
BUGFIX: vmagent: fix increased CPU and memory usage when
-remoteWrite.urlRelabelConfigor-remoteWrite.streamAggr.configflags are used. The bug was introduced in #10854 and existed since v1.147.0. See #11250. -
BUGFIX: vmui: preserve newline formatting in alert and rule annotations on the Alerting page. See #11171.
-
BUGFIX: vmui: hide
Total metric namesstats on Cardinality Explorer page when user selects a specific metric or label to focus. See #11154 for details. Thanks to @lghuy05 for the contribution. -
BUGFIX: vmui: keep only one header navigation dropdown (
Explore,Tools) open at a time. Previously, hovering across two dropdowns could briefly leave both open due to the close delay. See #11224. Thanks to @antedotee for contribution. -
BUGFIX: vmauth: return
408 Request Timeoutinstead of400 Bad Requestwhen the request body isn't received within-maxQueueDuration. This preventsvmagentfrom incorrectly downgrading the remote write protocol and dropping data whenvmauthis used as a proxy for a remote write endpoint. See #11272.
Security Fixes
- Upgrade Go builder from Go1.26.4 to Go1.26.5 (includes security patches)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About VictoriaMetrics
VictoriaMetrics: fast, cost-effective monitoring solution and time series database
Related context
Related tools
Beta — feedback welcome: [email protected]