v1.155.0

Released at 2026-10-23

Update Note 1: vmselect in VictoriaMetrics cluster: /admin/tenants requests without start and end query args now return tenants for the current day. This is a breaking change because previously it was expected to return all tenants. If you still need to retrieve all tenants, set the start and end params so that the resulting time range fully includes the -retentionPeriod. Also note that vmctl is known to send requests to /admin/tenants under the hood when migrating data between VictoriaMetrics deployments. Therefore, make sure that you run vmctl with both *-filter-time-start and *-filter-time-end params. See the updated URL format and #11791 for details.

• SECURITY: upgrade Go builder from Go1.27.2 to Go1.27.3. See the list of issues addressed in Go1.27.3.

• SECURITY: upgrade base docker image (Alpine) from 3.24.2 to 3.24.3. See Alpine 3.24.4 release notes.

• FEATURE: all VictoriaMetrics components: add -healthcheck command-line flag, which checks that the running process accepts connections at -httpListenAddr and exits with non-zero code if the check fails. This allows setting up Docker HEALTHCHECK in images without curl or wget. See these docs and VictoriaLogs#1565.

• FEATURE: all VictoriaMetrics components: expose process_cpu_cores_host, process_cpu_cores_cgroup_quota, process_memory_host_bytes and process_memory_cgroup_bytes metrics. Cgroup metrics are -1 if no cgroup limit is set or the limit cannot be read. See #11460.

• FEATURE: vmui: deprecate Server URL editing and show a warning when using a saved custom URL. Existing custom URLs continue to work. See #11735.

• FEATURE: vmui: update the appearance of error, warning, info, and success messages. See #11736.

• FEATURE: vmui: add a tenant column to Top Queries and Active Queries when tenant information is available. See #6346.

• FEATURE: vmui: limit tenant discovery to the selected time range. See #11784.

• FEATURE: vmagent and Single-node VictoriaMetrics: limit the number of logged parse errors per each scrape of a target via -promscrape.maxParseErrorsPerScrape command-line flag (20 by default). The number of suppressed parse errors is logged after the scrape. This prevents log flooding from targets exposing many malformed lines. See #8856.

• FEATURE: vmalert: restore Prometheus compatibility for alerts state restoration, so Prometheus can be used as -remoteRead.url again. Previously, the restore query used MetricsQL function default_rollup() which Prometheus rejects, so the state of alerting rules with for > 0 was reset on every vmalert restart. See #11574.

• FEATURE: vmselect in VictoriaMetrics cluster: export vm_request_duration_seconds{path="/admin/tenants"} for tracking time it takes to fetch tenants from the database.

• FEATURE: dashboards: apply the instance filter to the CPU pressure, Memory pressure, IO pressure, and Memory allocations rate panels in the Resource usage section of the VictoriaMetrics - cluster dashboard. Displays zero disk I/O and syscall rates. See #11742.

• FEATURE: alerts-health: add TooManySnapshots alerting rule. It notifies about instances where more than 2 snapshots are stored for at least 2 hours. Such snapshots are usually left behind by failed vmbackup / vmbackupmanager runs. They keep references to the already merged data parts and prevent background merges from freeing the disk space, which results in excessive disk usage. See #9344.

• BUGFIX: vmagent: prevent Kafka remote write getting stuck after TLS certificates are reloaded. Previously, when vmagent detected changed certificates and restarted the Kafka producer, pending sends to the old producer could hang forever and the remote write queue stopped draining until vmagent was restarted. Now such sends are retried with the new producer. See #11737.

• BUGFIX: vminsert in VictoriaMetrics cluster: prevent metric metadata drops after transient RPC handshake timeouts when connecting to vmstorage. See #11762. Thanks to @sakateka for contribution.

• BUGFIX: vmsingle, vmagent and vminsert in VictoriaMetrics cluster: properly validate time series ingested via /api/v1/import/native. See #11745. Thanks to @meshchellomishel for contribution.

• BUGFIX: vmsingle and vmagent: reduce memory usage during for Kubernetes service discovery, when scrape configuration has many entries that matches small subset of targets. See #11751. Thanks to @CamberLoid for contribution.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: prevent search requests panic. See #11788 for details.

• BUGFIX: vmsingle and vmagent: set __meta_kubernetes_namespace and the namespace metadata to the namespace of the Endpoints or EndpointSlice object in role: endpoints and role: endpointslice service discovery when the referenced pod lives in another namespace. Previously the namespace of the pod was used, unlike Prometheus. See #11798. Thanks to @cestercian for contribution.

• BUGFIX: vmauth: skip keys with unsupported kty or crv, missing required members or invalid values in the JWKS fetched via OIDC discovery instead of rejecting the whole key set, as required by RFC 7517. Previously, a single unsupported or malformed key in the JWKS caused vmauth to reject all JWTs from that issuer, including tokens signed with supported keys. See #11748.

• BUGFIX: vmui: stop saving the automatically calculated query step in shared URLs, so opening a link recalculates the step for the selected time range and screen width. Explicitly configured steps remain fixed. See #11638.

• BUGFIX: vmselect in [Victor...

v1.154.1

Released at 2026-10-19

• BUGFIX: vmauth: do not slow down requests with auth tokens if no users are configured. Previously, such requests were delayed by 2-3 seconds before being proxied to unauthorized_user, though there were no users to brute-force. This affected setups where one vmauth authenticates requests and proxies them to another vmauth with only unauthorized_user configured. The bug has been introduced in v1.154.0. See #11774.

v1.154.0

Released at 2026-10-12

Update Note 1: vmauth: setups with two chained vmauth instances, where the first one authenticates requests via users and the second one proxies them via unauthorized_user (for example, VMDistributed or VMCluster managed by VictoriaMetrics operator), get an extra 2-3 seconds delay for every request. This is because the second vmauth receives the Authorization header forwarded by the first one and treats it as an invalid auth token. Upgrade to the v1.154.1 release, where requests aren't delayed if no users are configured, or remove the Authorization header at the first vmauth with headers: ["Authorization:"]. See #11774.

Update Note 2: vmstorage in VictoriaMetrics cluster: /admin/tenants requests without start and end query args (or with zero values) can cause excessive memory usage and OOM crashes of vmstorage. Such requests are issued automatically by vmui when it is opened via vmselect. This is because vmstorage no longer switches to the global index for queries with long time ranges, so it scans per-day indexes for every day in the whole retention concurrently. Upgrade to v1.155.0, or roll back to v1.153.0. See #11791.

Update Note 3: vmsingle and vmstorage in VictoriaMetrics cluster: queries and requests to /api/v1/series, /api/v1/labels and /api/v1/label/.../values with long time ranges can cause excessive memory usage and OOM crashes. This is because VictoriaMetrics no longer switches to the global index for searches with long time ranges, so it scans per-day indexes for every day in the requested time range concurrently. Upgrade to v1.155.0, or roll back to v1.153.0. See #11791.

Update Note 4: vmselect in VictoriaMetrics cluster: -search.skipSlowReplicas causes excessive connection churn between vmselect and vmstorage, increased vmstorage CPU usage and cannot process vmselect conn ... write: broken pipe errors in vmstorage logs. This is because vmselect now cancels requests to slow replicas by closing connections to vmstorage instead of reusing them. Disable -search.skipSlowReplicas or roll back to v1.153.0 until the fix is available. See #11771.

• SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See the list of issues addressed in Go1.27.2.

• SECURITY: vmauth: slow down requests with invalid auth tokens even if unauthorized_user has URLs configured. Previously, such requests were proxied to unauthorized_user without delay, which allowed brute-forcing auth tokens. See GHSA-rpfx-hrcp-f73x.

• SECURITY: vmui: prevent cross-site scripting (XSS) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See GHSA-m2x2-9xpq-mmq5.

• FEATURE: vmagent,vminsert in VictoriaMetrics cluster and Single-node VictoriaMetrics: add /influx/ping endpoint, which returns the X-Influxdb-Version HTTP header. Some InfluxDB clients, such as the Jenkins InfluxDB plugin, read the server version from this endpoint. See #11663. Thanks to @Vandit1604 for contribution.

• FEATURE: vmauth: add oidc.auth_params option to SSO config for passing additional query parameters to the IdP authentication request, e.g., hd for narrowing the Google account chooser to a single domain. Combine it with match_claims to enforce the domain restriction. See these docs for more examples of oidc.auth_params usage.

• FEATURE: vmsingle and vmstorage in VictoriaMetrics cluster: abort incoming requests when a client disconnects and during graceful shutdown. See #11472.

• FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: cancel query requests if client disconnects. See #11355.

• BUGFIX: all VictoriaMetrics components: correctly configure TCP keep-alive active probes. See #11695.

• BUGFIX: all VictoriaMetrics components: properly match regexps that start with an alternation or a character class and continue with .*foo.* or .+foo.+, for example (a|b).*foo.*. Previously the leading part was ignored when matching relabeling regex and if filters and stream aggregation match filters, so such rules matched more series than intended. See #11712. Thanks to @dblackdblack for contribution.

• BUGFIX: alerts: fix incorrect results for TooHighChurnRate and TooHighSlowInsertsRate in cluster alerting rules. Previously due to incorrect expressions, these rules stayed inactive since v1.108.0 and could produce false positives since v1.153.0. See #11670. Thanks to @transacid for contribution.

• BUGFIX: stream aggregation: properly add timeseries for increase, increase_prometheus, total and total_prometheus aggregation functions when enable_windows: true is set. See #11707. Thanks to @Hoipang for contribution.

• BUGFIX: vmalert: keep using notifiers from the previously applied notifier configuration file if the updated config fails to start, for example due to a temporary service discovery error, and retry applying it on the next reload. Previously, vmalert stopped the old notifiers before starting the new ones, so a failed reload left vmalert with no or only some notifiers, and alert notifications were silently not delivered until the file changed or vmalert restarted. See #11645.

• BUGFIX: vmalert: copy alert labels before applying alert_relabel_configs from the [notifier configuration file](https://docs.victoriametrics.com/victoriametrics/vmalert/#notifier-configuration-...

v1.153.0

Released at 2026-09-28

Update Note 1: vmsingle, vmstorage, vmselect and vminsert in VictoriaMetrics cluster, and vmagent: builds without CGO (pure Go) may fail to read valid data blocks with the window size exceeded error. This can break queries, background merges and native import, and can make vmsingle and vmstorage crash. Affected official builds: darwin, windows, freebsd, openbsd, linux/arm, linux/ppc64le, linux/386, linux/s390x, and -pure builds. The linux/amd64 and linux/arm64 builds use CGO and are not affected. Users of affected builds should not upgrade to this release, or should roll back to v1.152.0. See #11683.

• SECURITY: vminsert, vmagent and vmsingle: properly apply memory limits to the zstd encoded blocks ingested via native import. This prevents excessive memory allocation during ingestion when handling maliciously crafted requests. See GHSA-8g4f-32hw-vqf8.

• SECURITY: vmauth: restrict redirects in the OIDC Discovery HTTP client to stay within the original request host. See GHSA-xxqh-2hcc-9fp6.

• SECURITY: upgrade base docker image (Alpine) from 3.24.1 to 3.24.2. See Alpine 3.24.2 release notes.

• FEATURE: vmalert: skip a redundant pending state when an alert can be restored directly to firing after restart. See #11401.

• FEATURE: vmauth: log informative message when a JWT token has no vm_access claim and default_vm_access_claim is not configured, if -logInvalidAuthTokens is enabled. See JWT claim-based request templating or #11579.

• FEATURE: dashboards/vmauth: update the dashboard to upstream Grafana version, fix typos and inconsistencies, improve resource usage panels. See #11587

• FEATURE: vmauth: support printing HTTP headers in the Access Logs. Only headers listed in access_log.headers list will be printed in the logs. This feature should help troubleshooting pipelines that rely on HTTP headers. See #11598.

• FEATURE: vmui: move auto-refresh controls from the header to the Execute button dropdown and display the selected interval in the button text. See #11343.

• FEATURE: vmstorage in VictoriaMetrics cluster: support ingesting data directly via Prometheus Remote Write v1 protocol for vmstorage. This feature can be enabled by setting -enableIngestionAPI command-line flag and is disabled by default. See remote write directly to vmstorage and #11252.

• FEATURE: vmauth: add Single sign-on (SSO) support via OpenID Connect (OIDC). vmauth redirects unauthenticated browser requests to the configured Identity Provider (IdP), verifies the IdP response, and sets a session cookie for subsequent requests. See #10278.

• FEATURE: vmsingle and vmstorage in VictoriaMetrics cluster: add support for opt-in fadvise(FADV_RANDOM) and madvise(MADV_RANDOM) hints for data part files, which can reduce disk I/O and improve page cache efficiency. To enable, set -fs.disableAdviseRandomRead=false. If you experience issues after enabling this feature, please leave a comment with details. See #11461.

• BUGFIX: all VictoriaMetrics components: create the Unix domain socket for -httpListenAddr=unix:/path/to/socket with permissions according to the umask of the process. Previously it was always created with 0600 permissions, so processes running under other users, such as a reverse proxy, couldn't connect to it. See these docs and #11615.

• BUGFIX: stream aggregation: serially push samples to stream aggregation jobs. This helps reduce CPU overhead. 11f488d8ff introduced parallel processing for this stage, which introduced extra CPU overhead while only providing negligible sample lag reduction. See #9878.

• BUGFIX: vmagent: add missing X-Influxdb-Version HTTP header to influxdb API responses. See #11570.

• BUGFIX: vmagent: disable metrics metadata sending for MDX remote write destinations. See #11572.

• BUGFIX: vmagent and vmsingle: properly discover *_sd_config targets. Previously scrape targets were preserved until the process restart if *_sd_config returned an empty targets response. See #11550 for details. Thanks to @evkuzin for contribution.

• BUGFIX: vmagent: properly reload SSL certificate for kafka producer and consumer. See #11577.

• BUGFIX: vmalert: properly reload alert_relabel_configs from the notifier configuration file. Previously, this config was applied only at startup and was not updated on config reload. See #11635.

• BUGFIX: vmselect, vminsert, vmagent and vmsingle: ignore empty extra_label, extra_filters and extra_filters[] query args instead of returning an error. This allows dropping client-provided values for these query args via url_prefix in vmauth as described in the security docs. See #11618.

• BUGFIX: vmauth: respect the -enableTCP6 flag when discovering backend IPs via discover_backend_ips or -discoverBackendIPs. Previously, discovery included IPv6 addresses even when IPv6 support was disabled. See [#11470](#1147...

v1.152.0

Released at 2026-09-11

• SECURITY: upgrade Go builder from Go1.26.6 to Go1.27.1. See Go 1.27 release notes.

• SECURITY: vmauth: fix authorization bypass in JWT-based routing when match_claims values are used. See GHSA-f99m-22fh-qw96.

• SECURITY: vmsingle and vmselect in VictoriaMetrics cluster: properly escape server-side errors returned by /metric-relabel-debug since they could contain parts of user input. This prevents XSS attacks on the /vmui/#/relabeling page. See GHSA-vw10j-rqhg-qff9.

• FEATURE: vmauth: add the deny_paths option to url_map to reject a subset of paths matched by src_paths or other src_* options with 403 Forbidden (401 Unauthorized for anonymous requests) instead of enumerating every allowed path. See #11452. Thanks to @andriibeee for contribution.

• FEATURE: alerts-health: split TooManyLogs alert into TooManyErrorLogs and TooManyLogs. TooManyLogs now covers only warn-level logs and aggregates them per job and instance. TooManyErrorLogs fires on error, fatal, and panic logs with per-location granularity, making it easier to identify the exact source of critical log messages. See #11417.

• FEATURE: vmui: show the range between the minimum and maximum values for each graph line in the legend. See #11425. Thanks to @umer901 for contribution.

• BUGFIX: all VictoriaMetrics components: hide values passed to -pushmetrics.header in startup logs, /metrics, and /flags, since they can contain sensitive HTTP headers such as Authorization and API keys. See #11545.

• BUGFIX: vmsingle, vmagent and vminsert in VictoriaMetrics cluster: fix insert requests getting stuck after another insert request times out, causing clients to time out while waiting for a response. See VictoriaLogs#1743.

• BUGFIX: vmselect in VictoriaMetrics cluster: apply the le filter at /api/v1/status/metric_names_stats after merging request counters from all vmstorage nodes. Previously, the endpoint could report actively queried metrics as unused when the local request counter was zero on one of the nodes. See #11473. Thanks to @missusk for contribution.

• BUGFIX: vmagent: now MDX discards cardinality_estimate and cardinality_churn_ratio metrics exposed by vmestimator service. #11501.

• BUGFIX: vmselect in VictoriaMetrics cluster: allow access to /prometheus/api/v1/admin/tsdb/delete_series and graphite/tags/delSeries using only the corresponding -deleteAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See #11512.

v1.151.0

Released at 2026-08-28

• SECURITY: vmsingle, vmagent, vminsert and vmselect in VictoriaMetrics cluster: check HTTP Basic Auth credentials from the -httpAuth.* command-line flags for cases that do not verify the corresponding *AuthKey command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as /config, /reload. For example, /api/v1/import/prometheus/config was routed to the data ingestion handler /api/v1/import/prometheus without checking -httpAuth.* credentials.

• FEATURE: all VictoriaMetrics components: add support for accepting HTTP requests over Unix domain socket at -httpListenAddr. For example, -httpListenAddr=unix:/run/victoria-metrics.sock. See VictoriaLogs#1618.

• FEATURE: vmagent, vmsingle, vmstorage and vmselect in VictoriaMetrics cluster: expose the vm_app_prev_shutdown_unclean gauge. It is set to 1 when the previous process run didn't shut down cleanly. Added the UncleanShutdown alerting rule, which fires for 10 minutes after an unclean shutdown is detected. See #8443.

• FEATURE: vmui: show the selected time zone UTC offset next to the date/time controls and allow opening time zone settings from it. See #11332.

• FEATURE: vmsingle, vmagent, vmalert, and vmselect in VictoriaMetrics cluster: show how the default value is calculated for command-line flags which derive it from the number of available CPU cores. For example, -maxConcurrentInserts now prints (default 16 = 2*cgroup.AvailableCPUs()) in -help output instead of (default 16). Updated flags: -search.maxConcurrentRequests, -search.maxWorkersPerQuery, -fs.maxConcurrency, -remoteWrite.concurrency, -remoteWrite.queues. See #9680. Thanks to @Vandit1604 for contribution.

• FEATURE: vmagent: introduce vmagent_kafka_consumer_broker_rtt_seconds and vmagent_kafka_consumer_fetch_queue_size metrics for Kafka consumer integration. These metrics help troubleshoot slow Kafka consumption. See #11342.

• BUGFIX: alerts: fix AlertingRuleResultsApproachingLimit and RecordingRuleResultsApproachingLimit alerting rules in vmalert alerting rules. The alerts could produce incorrect results or fail to fire when vmalert_group_rule_results_limit returned multiple samples per (group, file) label combination, causing the on(group,file) group_left() vector matching to fail. See #11449.

• BUGFIX: vmagent and vminsert in VictoriaMetrics cluster: fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (/opentelemetry/api/v1/push) when receiving a malformed record with an incomplete varint in the data field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See #11424.

• BUGFIX: vmalert-tool: reuse connections to -remoteWrite.url when writing the results of recording rules and alerts. Previously every series was sent over a new connection, which left a lot of sockets in TIME_WAIT state and could exhaust the ephemeral port range. The number of idle connections can be tuned via the new -remoteWrite.maxIdleConnections command-line flag. See #11387. Thanks @evkuzin for contribution.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: prevent process crash in sort_by_label_numeric() and sort_by_label_numeric_desc() when a label value contains a number with 309 or more digits. See #11423.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: fixes rare metrics metadata partial search response. See #11384.

• BUGFIX: vmctl: reuse connections in vm-native mode when --vm-concurrency exceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when --vm-concurrency was bigger than 2. See #11451.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly re-use memory if query aggregation returns error. See #11426.

• BUGFIX: vmselect in VictoriaMetrics cluster: fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See #4688.

• BUGFIX: vmselect in VictoriaMetrics cluster: consistently re-use memory during storage blocks unpacking on parsing storage block error. See #11421.

• BUGFIX: vmalert: fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. 1786458420.123) or scientific-notation (e.g. 1.78645842E9) values were silently truncated to 0. See #11396. Thanks to @missusk for the contribution.

• BUGFIX: vmctl: properly release the export and import requests during migration requests fails in vm-native mode. Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.

• BUGFIX: vmagent: include vm_account_id and vm_project_id labels in the instance identity used by monitoring data exchange filtering. Previously, when multitenant handlers were enabled, series from different tenants sharing the same job and instance labels could be misidentified as coming from a discovered VictoriaMetrics instance and leak into the -remoteWrite.mdx.enable destination. See #11381.

• BUGFIX: vmsingle, vminsert in VictoriaMetrics cluster and vmagent: fix process crash at /api/v1/import/native endpoint when receiving a specially crafted ~45-byte request. #11471.

• BUGFIX: vmsingle, vmagent and vmstorage...

v1.150.0

Released at 2026-08-14

Update Note 1: vmselect and vminsert in VictoriaMetrics cluster, and vmagent: default value of -enableMultitenancyViaHeaders command-line flag has changed from false to true. This change enables support of multitenancy via headers for cluster and for vmagent by default. With this change, mentioned components will start supporting URLs with omitted tenant ID in the path: https://<vmselect>:8481/select/prometheus/api/v1/query will become a valid URL. To disable multitenancy via headers and simplified URLs set --enableMultitenancyViaHeaders=false on vmagent, vminsert and vmselect.

• SECURITY: upgrade Go builder from Go1.26.5 to Go1.26.6. See the list of issues addressed in Go1.26.6.

• FEATURE: relabeling: reduce CPU usage up to 30% when matching relabeling rules with multiple if expressions containing exact metric names. Expressions for other metric names are now skipped before evaluating their remaining label filters. See #11341. Thanks to @nevgeny for contribution.

• FEATURE: vmagent and vmsingle: add support for linode_sd_configs for discovering scrape targets from Linode instances. See #9118. Thanks to @cxdy for contribution.

• FEATURE: vmalert: extend -replay.continueWithExecutionErr to also handle the 400 Bad Request response code, since it is used for Prometheus querying API requests when request parameters are missing or incorrect. See #11352.

• FEATURE: vmselect and vminsert in VictoriaMetrics cluster, and vmagent: set default value of -enableMultitenancyViaHeaders to true. This change enables support of multitenancy via headers for cluster and for vmagent by default, aligning VictoriaMetrics multitenancy behavior with multitenancy in VictoriaLogs. See related ticket #11365.

• FEATURE: vmui: add an option to customize the favicon color. This makes it easier to distinguish between different installations opened in multiple browser tabs. See #11329.

• BUGFIX: vmagent and vmsingle: avoid suggesting the unrelated -enableTCP6 command-line flag when scraping a target over a Unix domain socket fails. See #11320. Thanks to @lwmacct for contribution.

• BUGFIX: vmsingle and vminsert in VictoriaMetrics cluster: skip labels with empty name at /api/v1/import. Previously such a label replaced the metric name, so a series sent with "metric":{"__name__":"foo","":"bar"} was stored under the name bar. Other ingestion protocols already skip such labels. See #4962. Thanks to @Vandit1604 for contribution.

• BUGFIX: vmsingle, vmselect in VictoriaMetrics cluster and vmctl: properly parse small fractional Unix timestamps in timestamp args such as start and end in /api/v1/query_range and --vm-native-filter-time-start and --vm-native-filter-time-end in vmctl. Previously, fractional Unix timestamps with the integer part below 9223372 were interpreted with the wrong unit, for example 12.0 was parsed as 12000 seconds instead of 12 seconds. See #11324.

• BUGFIX: vmsingle, vmstorage and vmselect in VictoriaMetrics cluster: persist the previous working set cache during graceful shutdown when it is likely to contain the active working set. This prevents saving an empty or cold current cache right after split-mode cache rotation, which could otherwise slow down ingestion or queries after restart until the cache warms up again. See #11299.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: change the HTTP response code for Prometheus querying API requests from 422 Unprocessable Entity to 400 Bad Request when request parameters are missing or incorrect. See #11330.

• BUGFIX: vmui: respect the custom query step specified via g0.step_input when opening a URL. Previously, it could be reset to the automatically calculated step and potentially cause dashboards to freeze. See #11137.

• BUGFIX: vmagent and vmsingle: properly assign scrape target IP address at IPv6-only networks for docker_sd_configs. See #10965.

• BUGFIX: vmalert: rename vmalert_rule_group_results_limit back to vmalert_group_rule_results_limit. The metric was introduced in v1.147.0 but was accidentally given the wrong name. See #11179.

• BUGFIX: vmalert: properly update group-level eval_delay and eval_alignment for existing groups during runtime when config reload is triggered periodically or manually via /-/reload. Previously, these settings weren't updated after config reload during runtime. See #11374.

• BUGFIX: vmselect in VictoriaMetrics cluster: scale the default -search.maxConcurrentRequests with the number of available CPU cores instead of capping it at 16. See #11191. Thanks to @Dhru1Tanna for contribution.

v1.148.1

Released at 2026-07-31

v1.148.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.148.x line will be supported for at least 12 months since v1.148.0 release

Update Note 1: vmsingle and vmselect in VictoriaMetrics cluster: the /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints now require POST method. Previously, it also accepted GET requests. If you use GET requests for this endpoint, update your scripts or tooling to use POST instead. See #5552.

• SECURITY: vmsingle and vmselect in VictoriaMetrics cluster: restrict /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints to POST method only to prevent some SSRF-based data deletion attacks. See #5552.

• BUGFIX: MetricsQL: properly drop data points filtered out by an inner comparison operation when its result is used on the right side of another comparison. Previously, queries like foo != (bar > 100) could return unexpected results because filtered-out data points are represented internally as NaN, and value != NaN evaluates to true. Comparisons against explicitly present NaN values keep the previous behavior. See #10018. Thanks to @zasdaym for contribution.

• BUGFIX: vmagent and vmsingle: ignore HTTP proxy environment variables when scraping targets over Unix domain sockets. See #11318. Thanks to @lwmacct for contribution.

• BUGFIX: vmalert: fixed the display of rule state badges on the Groups page in the web UI. See #11160.

• BUGFIX: vmbackupmanager: previously, vmbackupmanager was crashing on startup when it failed to restore backup state from remote storage, causing a crash loop. Now it logs the error and continues running, retrying the state restore before each scheduled backup. Added vm_backup_errors_total{type="restoreState"} metric to track backup state restore failures. See #11217.

• BUGFIX: stream aggregation: fix incorrect sum_samples_total results when enable_windows: true is set. See #11261. Thanks to @beyond-infra for contribution.

• BUGFIX: vmsingle, vmselect in VictoriaMetrics cluster and vmctl: accept scientific notation with sub-second precision (e.g. 1.784144612388E9) for timestamp args such as start and end in /api/v1/query_range and --vm-native-filter-time-start and --vm-native-filter-time-end in vmctl. Previously, values with this pattern were rejected, which is incompatible with Prometheus. See #11268. Thanks to @STiFLeR7 for contribution.

v1.136.15

Released at 2026-07-31

v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release

Update Note 1: vmsingle and vmselect in VictoriaMetrics cluster: the /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints now require POST method. Previously, it also accepted GET requests. If you use GET requests for this endpoint, update your scripts or tooling to use POST instead. See #5552.

• SECURITY: vmsingle and vmselect in VictoriaMetrics cluster: restrict /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints to POST method only to prevent some SSRF-based data deletion attacks. See #5552.

• BUGFIX: vmbackupmanager: previously, vmbackupmanager was crashing on startup when it failed to restore backup state from remote storage, causing a crash loop. Now it logs the error and continues running, retrying the state restore before each scheduled backup. Added vm_backup_errors_total{type="restoreState"} metric to track backup state restore failures. See #11217.

v1.149.0

Released at 2026-07-31

Update Note 1: vminsert in VictoriaMetrics cluster: the default value of -disableRerouting flag has changed from true to false, enabling slowness-based re-routing by default. Slowness re-routing is automatically disabled when -replicationFactor is greater than 1. If you rely on the old behavior, pass -disableRerouting command-line flag to vminsert. See #11287.

Update Note 2: vmsingle and vmselect in VictoriaMetrics cluster: the /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints now require POST method. Previously, it also accepted GET requests. If you use GET requests for this endpoint, update your scripts or tooling to use POST instead. See #5552.

• SECURITY: vmsingle and vmselect in VictoriaMetrics cluster: restrict /api/v1/admin/tsdb/delete_series, /tags/delSeries endpoints to POST method only to prevent some SSRF-based data deletion attacks. See #5552.

• FEATURE: dashboards: add Fsync avg duration panel to the Troubleshooting section of the single-node, cluster, and vmagent dashboards. This panel surfaces degradation of IO operation for faster incident triage. See #10432.

• FEATURE: vmagent: add name label identifying the corresponding -remoteWrite.url target to the vm_persistentqueue_* metrics exposed by persistent queue. See #7944. Thanks to @tIGO for contribution.

• FEATURE: vmagent: add -remoteWrite.obfuscateLabels flag for hashing values of the specified labels before sending metrics to the corresponding -remoteWrite.url. This allows sharing metrics with external systems while keeping sensitive label values hidden. See #10599.

• FEATURE: vmalert: add -replay.continueWithExecutionErr flag to allow continuing to replay other rules when a rule execution fails with a 422 response code, which can happen due to an expression syntax error or a resource limit being hit. See 11313.

• FEATURE: vmalert: add template variable $interval to expose the alerting rule group's evaluation interval. This allows generating dashboard links with a lookback window relative to the rule's interval, for example &from={{ ($activeAt.Add (parseDurationTime (printf "-%s" .Interval))).UnixMilli }}&to={{ $activeAt.UnixMilli }}. See #11232. Thanks to @1solomonwakhungu for contribution.

• FEATURE: vmbackupmanager and alerts: introduce vm_backup_last_success_at metric to track the last successful backup by type. Add alerting rules NoLatestBackupWithinLastDay, NoHourlyBackupWithinLastDay, NoDailyBackupWithinLast3Days, NoWeeklyBackupWithinLast14Days and NoMonthlyBackupWithinLast62Days to remind users about the missing backups. See #11217.

• FEATURE: vmctl: support Prometheus native histograms migration in remote read mode. Native histograms are converted into _count, _sum and _bucket series with vmrange labels in the same way as VictoriaMetrics converts native histograms received via Prometheus remote write protocol, except that for native histograms with custom buckets the original bucket bounds are preserved instead of being estimated with the exponential formula. Previously native histograms were silently ignored in SAMPLES mode, while in stream mode the migration failed with EOF error. See #11292. Thanks to @liuxu623 for contribution.

• FEATURE: vminsert in VictoriaMetrics cluster: enable slowness-based re-routing by default. Previously, -disableRerouting defaulted to true, which limited ingestion throughput to the slowest vmstorage node. Now -disableRerouting defaults to false, so vminsert automatically routes data away from the slowest vmstorage node, improving overall ingestion performance. Slowness re-routing is automatically disabled when -replicationFactor is greater than 1. See #11287.

• FEATURE: vmui: persist the selected auto-refresh interval in the URL. See VictoriaLogs#1310.

• BUGFIX: MetricsQL: properly drop data points filtered out by an inner comparison operation when its result is used on the right side of another comparison. Previously, queries like foo != (bar > 100) could return unexpected results because filtered-out data points are represented internally as NaN, and value != NaN evaluates to true. Comparisons against explicitly present NaN values keep the previous behavior. See #10018. Thanks to @zasdaym for contribution.

• BUGFIX: vmagent and vmsingle: ignore HTTP proxy environment variables when scraping targets over Unix domain sockets. See #11318. Thanks to @lwmacct for contribution.

• BUGFIX: vmalert: fixed the display of rule state badges on the Groups page in the web UI. See #11160.

• BUGFIX: vmbackupmanager: previously, vmbackupmanager was crashing on startup when it failed to restore backup state from remote storage, causing a crash loop. Now it logs the error and continues running, retrying the state restore before each scheduled backup. Added vm_backup_errors_total{type="restoreState"} metric to track backup state restore failures. See #11217.

• BUGFIX: stream aggregation: fix incorrect sum_samples_total results when enable_windows: true is set. See #11261. Thanks to @beyond-infra for contribution.

• BUGFIX: vmsingle, vmselect in VictoriaMetrics cluster and vmctl: accept scientific notation with sub-second precision (e.g. 1.784144612388E9) for timestamp args such as start and end in /api/v1/query_range and --vm-native-filter-time-start and --vm-native-filter-time-end in vmctl. Previously, values with this pattern were rejected, which is incompatible with Prometheus. See #11268. Thanks to @STiFLeR7 for contribution.