VictoriaMetrics 1.153.0 → 1.155.0
3 releases · 0 breaking changes · 8 security fixes · 1 advisory fixed
8security0breaking1deprecated5feature27fix
Vulnerabilities fixed by this upgrade
- 8.7 GHSA-c7pm-322g-r9gf Missing Brute Force Protection
Breaking changes
None in the release notes.
Security changes
- security SECURITY: upgrade Go builder from Go1.27.2 to Go1.27.3. See the list of issues addressed in Go1.27.3. in 1.155.0
- security SECURITY: upgrade base docker image (Alpine) from 3.24.2 to 3.24.3. See Alpine 3.24.4 release notes. in 1.155.0
- security Fixes GHSA-c7pm-322g-r9gf: Missing Brute Force Protection in 1.154.1
- security Fixes GHSA-c7pm-322g-r9gf: Missing Brute Force Protection in 1.154.0
- security SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See the list of issues addressed in Go1.27.2. in 1.154.0
- security SECURITY: vmauth: slow down requests with invalid auth tokens even if unauthorized_user has URLs configured. Previously, such requests were proxied to unauthorized_user without delay, which allowed brute-forcing auth tokens. See GHSA-rpfx-hrcp-f73x. in 1.154.0
- security SECURITY: vmui: prevent cross-site scripting (XSS) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See GHSA-m2x2-9xpq-mmq5. in 1.154.0
- security BUGFIX: vmauth: fix SSO login failure Invalid state parameter caused by a race condition when multiple concurrent unauthenticated requests each set their own CSRF cookie. See #10278-comment and. in 1.154.0
Deprecations
- deprecated FEATURE: vmui: deprecate Server URL editing and show a warning when using a saved custom URL. Existing custom URLs continue to work. See. in 1.155.0
Every release in between
securitySECURITY: upgrade Go builder from Go1.27.2 to Go1.27.3. See the list of issues addressed in Go1.27.3.
securitySECURITY: upgrade base docker image (Alpine) from 3.24.2 to 3.24.3. See Alpine 3.24.4 release notes.
featureFEATURE: all VictoriaMetrics components: add -healthcheck command-line flag, which checks that the running process accepts connections at -httpListenAddr and exits with non-zero code if the check fails. This allows setting up Docker HEALTHCHECK in images without curl or wget. See these docs and…
otherFEATURE: all VictoriaMetrics components: expose process_cpu_cores_host, process_cpu_cores_cgroup_quota, process_memory_host_bytes and process_memory_cgroup_bytes metrics. Cgroup metrics are -1 if no cgroup limit is set or the limit cannot be read. See.
deprecatedFEATURE: vmui: deprecate Server URL editing and show a warning when using a saved custom URL. Existing custom URLs continue to work. See.
otherFEATURE: vmui: update the appearance of error, warning, info, and success messages. See.
featureFEATURE: vmui: add a tenant column to Top Queries and Active Queries when tenant information is available. See.
otherFEATURE: vmui: limit tenant discovery to the selected time range. See.
otherFEATURE: vmagent and Single-node VictoriaMetrics: limit the number of logged parse errors per each scrape of a target via -promscrape.maxParseErrorsPerScrape command-line flag (20 by default). The number of suppressed parse errors is logged after the scrape. This prevents log flooding from targets…
otherFEATURE: vmalert: restore Prometheus compatibility for alerts state restoration, so Prometheus can be used as -remoteRead.url again. Previously, the restore query used MetricsQL function default_rollup() which Prometheus rejects, so the state of alerting rules with for > 0 was reset on every…
otherFEATURE: vmselect in VictoriaMetrics cluster: export vm_request_duration_seconds{path="/admin/tenants"} for tracking time it takes to fetch tenants from the database.
otherFEATURE: dashboards: apply the instance filter to the CPU pressure, Memory pressure, IO pressure, and Memory allocations rate panels in the Resource usage section of the VictoriaMetrics - cluster dashboard. Displays zero disk I/O and syscall rates. See.
featureFEATURE: alerts-health: add TooManySnapshots alerting rule. It notifies about instances where more than 2 snapshots are stored for at least 2 hours. Such snapshots are usually left behind by failed vmbackup / vmbackupmanager runs. They keep references to the already merged data parts and prevent…
fixBUGFIX: vmagent: prevent Kafka remote write getting stuck after TLS certificates are reloaded. Previously, when vmagent detected changed certificates and restarted the Kafka producer, pending sends to the old producer could hang forever and the remote write queue stopped draining until vmagent was…
fixBUGFIX: vminsert in VictoriaMetrics cluster: prevent metric metadata drops after transient RPC handshake timeouts when connecting to vmstorage. See. Thanks to @sakateka for contribution.
fixBUGFIX: vmsingle, vmagent and vminsert in VictoriaMetrics cluster: properly validate time series ingested via /api/v1/import/native. See. Thanks to @meshchellomishel for contribution.
fixBUGFIX: vmsingle and vmagent: reduce memory usage during for Kubernetes service discovery, when scrape configuration has many entries that matches small subset of targets. See. Thanks to @CamberLoid for contribution.
fixBUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: prevent search requests panic. See for details.
fixBUGFIX: vmsingle and vmagent: set __meta_kubernetes_namespace and the namespace metadata to the namespace of the Endpoints or EndpointSlice object in role: endpoints and role: endpointslice service discovery when the referenced pod lives in another namespace. Previously the namespace of the pod…
fixBUGFIX: vmauth: skip keys with unsupported kty or crv, missing required members or invalid values in the JWKS fetched via OIDC discovery instead of rejecting the whole key set, as required by RFC 7517. Previously, a single unsupported or malformed key in the JWKS caused vmauth to reject all JWTs…
fixBUGFIX: vmui: stop saving the automatically calculated query step in shared URLs, so opening a link recalculates the step for the selected time range and screen width. Explicitly configured steps remain fixed. See.
fixBUGFIX: vmselect in VictoriaMetrics cluster: change the default time range for /admin/tenants HTTP endpoint to search tenants only for the current day instead of searching the entire [0, now] time range. This should prevent unnecessary load on vmstorage and prevent OOMs. See the updated URL format…
securityFixes GHSA-c7pm-322g-r9gf: Missing Brute Force Protection
fixBUGFIX: vmauth: do not slow down requests with auth tokens if no users are configured. Previously, such requests were delayed by 2-3 seconds before being proxied to unauthorized_user, though there were no users to brute-force. This affected setups where one vmauth authenticates requests and…
securityFixes GHSA-c7pm-322g-r9gf: Missing Brute Force Protection
securitySECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See the list of issues addressed in Go1.27.2.
securitySECURITY: vmauth: slow down requests with invalid auth tokens even if unauthorized_user has URLs configured. Previously, such requests were proxied to unauthorized_user without delay, which allowed brute-forcing auth tokens. See GHSA-rpfx-hrcp-f73x.
securitySECURITY: vmui: prevent cross-site scripting (XSS) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See GHSA-m2x2-9xpq-mmq5.
featureFEATURE: vmagent,vminsert in VictoriaMetrics cluster and Single-node VictoriaMetrics: add /influx/ping endpoint, which returns the X-Influxdb-Version HTTP header. Some InfluxDB clients, such as the Jenkins InfluxDB plugin, read the server version from this endpoint. See. Thanks to @Vandit1604 for…
featureFEATURE: vmauth: add oidc.auth_params option to SSO config for passing additional query parameters to the IdP authentication request, e.g., hd for narrowing the Google account chooser to a single domain. Combine it with match_claims to enforce the domain restriction. See these docs for more…
otherFEATURE: vmsingle and vmstorage in VictoriaMetrics cluster: abort incoming requests when a client disconnects and during graceful shutdown. See.
otherFEATURE: vmsingle and vmselect in VictoriaMetrics cluster: cancel query requests if client disconnects. See.
fixBUGFIX: all VictoriaMetrics components: correctly configure TCP keep-alive active probes. See.
fixBUGFIX: all VictoriaMetrics components: properly match regexps that start with an alternation or a character class and continue with .foo. or .+foo.+, for example (a|b).foo.. Previously the leading part was ignored when matching relabeling regex and if filters and stream aggregation match filters,…
fixBUGFIX: alerts: fix incorrect results for TooHighChurnRate and TooHighSlowInsertsRate in cluster alerting rules. Previously due to incorrect expressions, these rules stayed inactive since v1.108.0 and could produce false positives since v1.153.0. See. Thanks to @transacid for contribution.
fixBUGFIX: stream aggregation: properly add timeseries for increase, increase_prometheus, total and total_prometheus aggregation functions when enable_windows: true is set. See. Thanks to @Hoipang for contribution.
fixBUGFIX: vmalert: keep using notifiers from the previously applied notifier configuration file if the updated config fails to start, for example due to a temporary service discovery error, and retry applying it on the next reload. Previously, vmalert stopped the old notifiers before starting the…
fixBUGFIX: vmalert: copy alert labels before applying alert_relabel_configs from the notifier configuration file, preventing different alertmanagers from affecting each other's labels. See.
fixBUGFIX: vmagent and vmalert: set the Host HTTP request header to the resolved DNS SRV target instead of the SRV name when the url uses the srv+ prefix. Previously requests could fail at reverse proxies and load balancers, which route by the Host header. See.
fixBUGFIX: vmauth: fixes rare data corruption on HTTP request retries. See.
securityBUGFIX: vmauth: fix SSO login failure Invalid state parameter caused by a race condition when multiple concurrent unauthenticated requests each set their own CSRF cookie. See #10278-comment and.
fixBUGFIX: vmauth: fix misleading missing 'Authorization' request header response for JWT-authenticated users when the requested path does not match any url_map. Now it correctly returns 400 Bad Request with missing route error, matching the behavior of Basic Auth and Bearer-token users. See.
fixBUGFIX: vmbackup and vmbackupmanager: add -s3SkipTaggingDirective command-line flag for S3-compatible storage that rejects the x-amz-tagging-directive and x-amz-tagging headers. See.
fixBUGFIX: vmselect in VictoriaMetrics cluster: add missing accountID, projectID and multiTenant fields to topByAvgMemoryUsage results at /api/v1/status/top_queries. See.
fixBUGFIX: vmselect in VictoriaMetrics cluster: prevent rare resource leak if -search.skipSlowReplicas flag is set. See.
fixBUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly execute group_left(...) and group_right(..) queries when the join is then combined with another selector. See.
fixBUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: prevent possible crash with cannot decompress zstd data... panic on darwin, windows, freebsd, openbsd, linux/arm, linux/ppc64le, linux/386, linux/s390x, and -pure builds. The linux/amd64 and linux/arm64 builds are not affected. See.
fixBUGFIX: vmsingle: properly apply -streamAggr.enableWindows command-line flag to stream aggregation rules. Previously, the flag was ignored by aggregation rules defined in -streamAggr.config and was applied only during config validation with -dryRun and to the standalone deduplication configured…
fixBUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: properly release memory after historical data backfilling. Previously storage kept 8MiB*CPU memory for each month of ingested data until restart. See. Thanks to @mars71003219 for contribution.
fixBUGFIX: vmui: prevent overriding the serverUrl, tenantId, theme, and isDarkTheme settings via query parameters. See.