SECURITY: vmsingle, vmagent, vminsert and vmselect in VictoriaMetrics cluster: check HTTP Basic Auth credentials from the -httpAuth.* command-line flags for cases that do not verify the corresponding *AuthKey command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as /config, /reload. For example, /api/v1/import/prometheus/config was routed to the data ingestion handler /api/v1/import/prometheus without checking -httpAuth.* credentials.
FEATURE: all VictoriaMetrics components: add support for accepting HTTP requests over Unix domain socket at -httpListenAddr. For example, -httpListenAddr=unix:/run/victoria-metrics.sock. See VictoriaLogs#1618.
FEATURE: vmagent, vmsingle, vmstorage and vmselect in VictoriaMetrics cluster: expose the vm_app_prev_shutdown_unclean gauge. It is set to 1 when the previous process run didn't shut down cleanly. Added the UncleanShutdownalerting rule, which fires for 10 minutes after an unclean shutdown is detected. See #8443.
FEATURE: vmui: show the selected time zone UTC offset next to the date/time controls and allow opening time zone settings from it. See #11332.
FEATURE: vmsingle, vmagent, vmalert, and vmselect in VictoriaMetrics cluster: show how the default value is calculated for command-line flags which derive it from the number of available CPU cores. For example, -maxConcurrentInserts now prints (default 16 = 2*cgroup.AvailableCPUs()) in -help output instead of (default 16). Updated flags: -search.maxConcurrentRequests, -search.maxWorkersPerQuery, -fs.maxConcurrency, -remoteWrite.concurrency, -remoteWrite.queues. See #9680. Thanks to @Vandit1604 for contribution.
BUGFIX: alerts: fix AlertingRuleResultsApproachingLimit and RecordingRuleResultsApproachingLimit alerting rules in vmalert alerting rules. The alerts could produce incorrect results or fail to fire when vmalert_group_rule_results_limit returned multiple samples per (group, file) label combination, causing the on(group,file) group_left() vector matching to fail. See #11449.
BUGFIX: vmagent and vminsert in VictoriaMetrics cluster: fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (/opentelemetry/api/v1/push) when receiving a malformed record with an incomplete varint in the data field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See #11424.
BUGFIX: vmalert-tool: reuse connections to -remoteWrite.url when writing the results of recording rules and alerts. Previously every series was sent over a new connection, which left a lot of sockets in TIME_WAIT state and could exhaust the ephemeral port range. The number of idle connections can be tuned via the new -remoteWrite.maxIdleConnections command-line flag. See #11387. Thanks @evkuzin for contribution.
BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: prevent process crash in sort_by_label_numeric() and sort_by_label_numeric_desc() when a label value contains a number with 309 or more digits. See #11423.
BUGFIX: vmctl: reuse connections in vm-native mode when --vm-concurrency exceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when --vm-concurrency was bigger than 2. See #11451.
BUGFIX: vmselect in VictoriaMetrics cluster: fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See #4688.
BUGFIX: vmselect in VictoriaMetrics cluster: consistently re-use memory during storage blocks unpacking on parsing storage block error. See #11421.
BUGFIX: vmalert: fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. 1786458420.123) or scientific-notation (e.g. 1.78645842E9) values were silently truncated to 0. See #11396. Thanks to @missusk for the contribution.
BUGFIX: vmctl: properly release the export and import requests during migration requests fails in vm-native mode. Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.
BUGFIX: vmagent: include vm_account_id and vm_project_id labels in the instance identity used by monitoring data exchange filtering. Previously, when multitenant handlers were enabled, series from different tenants sharing the same job and instance labels could be misidentified as coming from a discovered VictoriaMetrics instance and leak into the -remoteWrite.mdx.enable destination. See #11381.
BUGFIX: vmsingle, vmagent and vmstorage in VictoriaMetrics cluster: allow access to /remotewrite-relabel-config, /api/v1/status/remotewrite-relabel-config, /remotewrite-url-relabel-config, /api/v1/status/remotewrite-url-relabel-config and /internal/log_new_series with only the corresponding -configAuthKey or -logNewSeriesAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See bedc69014.
Configuration
📅Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [victoriametrics/vmagent](https://github.com/VictoriaMetrics/VictoriaMetrics) | minor | `v1.150.0` → `v1.151.0` |
---
### Release Notes
<details>
<summary>VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)</summary>
### [`v1.151.0`](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.151.0)
[Compare Source](https://github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.150.0...v1.151.0)
##### [v1.151.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.151.0)
Released at 2026-08-28
- SECURITY: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), `vminsert` and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): check HTTP Basic Auth credentials from the `-httpAuth.*` command-line flags for cases that do not verify the corresponding `*AuthKey` command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as `/config`, `/reload`. For example, `/api/v1/import/prometheus/config` was routed to the data ingestion handler `/api/v1/import/prometheus` without checking `-httpAuth.*` credentials.
- FEATURE: all VictoriaMetrics components: add support for accepting HTTP requests over Unix domain socket at `-httpListenAddr`. For example, `-httpListenAddr=unix:/run/victoria-metrics.sock`. See [VictoriaLogs#1618](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1618).
- FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), `vmstorage` and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): expose the `vm_app_prev_shutdown_unclean` gauge. It is set to `1` when the previous process run didn't shut down cleanly. Added the `UncleanShutdown` [alerting rule](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/deployment/docker/rules/alerts-health.yml), which fires for 10 minutes after an unclean shutdown is detected. See [#​8443](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/8443).
- FEATURE: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): show the selected time zone UTC offset next to the date/time controls and allow opening time zone settings from it. See [#​11332](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11332).
- FEATURE: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/), and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): show how the default value is calculated for command-line flags which derive it from the number of available CPU cores. For example, `-maxConcurrentInserts` now prints `(default 16 = 2*cgroup.AvailableCPUs())` in `-help` output instead of `(default 16)`. Updated flags: `-search.maxConcurrentRequests`, `-search.maxWorkersPerQuery`, `-fs.maxConcurrency`, `-remoteWrite.concurrency`, `-remoteWrite.queues`. See [#​9680](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/9680). Thanks to [@​Vandit1604](https://github.com/Vandit1604) for contribution.
- FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/): introduce `vmagent_kafka_consumer_broker_rtt_seconds` and `vmagent_kafka_consumer_fetch_queue_size` metrics for [Kafka consumer integration](https://docs.victoriametrics.com/victoriametrics/integrations/kafka/). These metrics help [troubleshoot slow Kafka consumption](https://docs.victoriametrics.com/victoriametrics/integrations/kafka/#slow-kafka-consumption). See [#​11342](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11342).
- BUGFIX: [alerts](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/deployment/docker/rules): fix `AlertingRuleResultsApproachingLimit` and `RecordingRuleResultsApproachingLimit` alerting rules in [vmalert alerting rules](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/deployment/docker/rules/alerts-vmalert.yml). The alerts could produce incorrect results or fail to fire when `vmalert_group_rule_results_limit` returned multiple samples per `(group, file)` label combination, causing the `on(group,file) group_left()` vector matching to fail. See [#​11449](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11449).
- BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (`/opentelemetry/api/v1/push`) when receiving a malformed record with an incomplete varint in the `data` field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See [#​11424](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11424).
- BUGFIX: [vmalert-tool](https://docs.victoriametrics.com/victoriametrics/vmalert-tool/): reuse connections to `-remoteWrite.url` when writing the results of recording rules and alerts. Previously every series was sent over a new connection, which left a lot of sockets in `TIME_WAIT` state and could exhaust the ephemeral port range. The number of idle connections can be tuned via the new `-remoteWrite.maxIdleConnections` command-line flag. See [#​11387](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11387). Thanks [@​evkuzin](https://github.com/evkuzin) for contribution.
- BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): prevent process crash in `sort_by_label_numeric()` and `sort_by_label_numeric_desc()` when a label value contains a number with 309 or more digits. See [#​11423](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11423).
- BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fixes rare metrics metadata partial search response. See [#​11384](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11384).
- BUGFIX: [vmctl](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): reuse connections in [vm-native mode](https://docs.victoriametrics.com/victoriametrics/vmctl/#migrating-data-from-victoriametrics) when `--vm-concurrency` exceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when `--vm-concurrency` was bigger than 2. See [#​11451](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11451).
- BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly re-use memory if query aggregation returns error. See [#​11426](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11426).
- BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See [#​4688](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/4688).
- BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): consistently re-use memory during storage blocks unpacking on parsing storage block error. See [#​11421](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11421).
- BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. `1786458420.123`) or scientific-notation (e.g. `1.78645842E9`) values were silently truncated to `0`. See [#​11396](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11396). Thanks to [@​missusk](https://github.com/missusk) for the contribution.
- BUGFIX: [vmctl](https://docs.victoriametrics.com/victoriametrics/vmctl/): properly release the export and import requests during migration requests fails in [vm-native mode](https://docs.victoriametrics.com/victoriametrics/vmctl/#migrating-data-from-victoriametrics). Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.
- BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/): include `vm_account_id` and `vm_project_id` labels in the instance identity used by [monitoring data exchange](https://docs.victoriametrics.com/victoriametrics/vmagent/#monitoring-data-exchange) filtering. Previously, when [multitenant handlers](https://docs.victoriametrics.com/victoriametrics/vmagent/#multitenancy) were enabled, series from different tenants sharing the same `job` and `instance` labels could be misidentified as coming from a discovered VictoriaMetrics instance and leak into the `-remoteWrite.mdx.enable` destination. See [#​11381](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11381).
- BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/) and [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/): fix process crash at [`/api/v1/import/native`](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#how-to-import-data-in-native-format) endpoint when receiving a specially crafted \~45-byte request. [#​11471](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11471).
- BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): allow access to `/remotewrite-relabel-config`, `/api/v1/status/remotewrite-relabel-config`, `/remotewrite-url-relabel-config`, `/api/v1/status/remotewrite-url-relabel-config` and `/internal/log_new_series` with only the corresponding `-configAuthKey` or `-logNewSeriesAuthKey`, even when `-httpAuth.*` is also configured, without additionally requiring `-httpAuth.*` credentials. See [bedc69014](https://github.com/VictoriaMetrics/VictoriaMetrics/commit/bedc690141df701a6d9f8bc4839cb79777dbd21d).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41My4wIiwidXBkYXRlZEluVmVyIjoiNDQuNTMuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v1.150.0→v1.151.0Release Notes
VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)
v1.151.0Compare Source
v1.151.0
Released at 2026-08-28
SECURITY: vmsingle, vmagent,
vminsertandvmselectin VictoriaMetrics cluster: check HTTP Basic Auth credentials from the-httpAuth.*command-line flags for cases that do not verify the corresponding*AuthKeycommand-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as/config,/reload. For example,/api/v1/import/prometheus/configwas routed to the data ingestion handler/api/v1/import/prometheuswithout checking-httpAuth.*credentials.FEATURE: all VictoriaMetrics components: add support for accepting HTTP requests over Unix domain socket at
-httpListenAddr. For example,-httpListenAddr=unix:/run/victoria-metrics.sock. See VictoriaLogs#1618.FEATURE: vmagent, vmsingle,
vmstorageandvmselectin VictoriaMetrics cluster: expose thevm_app_prev_shutdown_uncleangauge. It is set to1when the previous process run didn't shut down cleanly. Added theUncleanShutdownalerting rule, which fires for 10 minutes after an unclean shutdown is detected. See #8443.FEATURE: vmui: show the selected time zone UTC offset next to the date/time controls and allow opening time zone settings from it. See #11332.
FEATURE: vmsingle, vmagent, vmalert, and
vmselectin VictoriaMetrics cluster: show how the default value is calculated for command-line flags which derive it from the number of available CPU cores. For example,-maxConcurrentInsertsnow prints(default 16 = 2*cgroup.AvailableCPUs())in-helpoutput instead of(default 16). Updated flags:-search.maxConcurrentRequests,-search.maxWorkersPerQuery,-fs.maxConcurrency,-remoteWrite.concurrency,-remoteWrite.queues. See #9680. Thanks to @Vandit1604 for contribution.FEATURE: vmagent: introduce
vmagent_kafka_consumer_broker_rtt_secondsandvmagent_kafka_consumer_fetch_queue_sizemetrics for Kafka consumer integration. These metrics help troubleshoot slow Kafka consumption. See #11342.BUGFIX: alerts: fix
AlertingRuleResultsApproachingLimitandRecordingRuleResultsApproachingLimitalerting rules in vmalert alerting rules. The alerts could produce incorrect results or fail to fire whenvmalert_group_rule_results_limitreturned multiple samples per(group, file)label combination, causing theon(group,file) group_left()vector matching to fail. See #11449.BUGFIX: vmagent and
vminsertin VictoriaMetrics cluster: fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (/opentelemetry/api/v1/push) when receiving a malformed record with an incomplete varint in thedatafield. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See #11424.BUGFIX: vmalert-tool: reuse connections to
-remoteWrite.urlwhen writing the results of recording rules and alerts. Previously every series was sent over a new connection, which left a lot of sockets inTIME_WAITstate and could exhaust the ephemeral port range. The number of idle connections can be tuned via the new-remoteWrite.maxIdleConnectionscommand-line flag. See #11387. Thanks @evkuzin for contribution.BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: prevent process crash insort_by_label_numeric()andsort_by_label_numeric_desc()when a label value contains a number with 309 or more digits. See #11423.BUGFIX: vmsingle and
vmstoragein VictoriaMetrics cluster: fixes rare metrics metadata partial search response. See #11384.BUGFIX: vmctl: reuse connections in vm-native mode when
--vm-concurrencyexceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when--vm-concurrencywas bigger than 2. See #11451.BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: properly re-use memory if query aggregation returns error. See #11426.BUGFIX:
vmselectin VictoriaMetrics cluster: fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See #4688.BUGFIX:
vmselectin VictoriaMetrics cluster: consistently re-use memory during storage blocks unpacking on parsing storage block error. See #11421.BUGFIX: vmalert: fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g.
1786458420.123) or scientific-notation (e.g.1.78645842E9) values were silently truncated to0. See #11396. Thanks to @missusk for the contribution.BUGFIX: vmctl: properly release the export and import requests during migration requests fails in vm-native mode. Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.
BUGFIX: vmagent: include
vm_account_idandvm_project_idlabels in the instance identity used by monitoring data exchange filtering. Previously, when multitenant handlers were enabled, series from different tenants sharing the samejobandinstancelabels could be misidentified as coming from a discovered VictoriaMetrics instance and leak into the-remoteWrite.mdx.enabledestination. See #11381.BUGFIX: vmsingle,
vminsertin VictoriaMetrics cluster and vmagent: fix process crash at/api/v1/import/nativeendpoint when receiving a specially crafted ~45-byte request. #11471.BUGFIX: vmsingle, vmagent and
vmstoragein VictoriaMetrics cluster: allow access to/remotewrite-relabel-config,/api/v1/status/remotewrite-relabel-config,/remotewrite-url-relabel-config,/api/v1/status/remotewrite-url-relabel-configand/internal/log_new_serieswith only the corresponding-configAuthKeyor-logNewSeriesAuthKey, even when-httpAuth.*is also configured, without additionally requiring-httpAuth.*credentials. See bedc69014.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.