AverageMarcus/cluster.fun
1
0 Fork 0
Code Issues 1 Pull Requests 4 Releases Activity

Update victoriametrics/vmagent Docker tag to v1.154.0 #811

Merged
AverageMarcus merged 1 commits from renovate/victoriametrics into master 2026-10-14 11:30:38 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-10-13 03:11:43 +00:00
Collaborator
Copy link
Copy source

This PR contains the following updates:

Package Update Change
victoriametrics/vmagent minor v1.153.0 → v1.154.0

Release Notes

VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)

v1.154.0

Compare Source

v1.154.0

Released at 2026-10-09

  • SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See the list of issues addressed in Go1.27.2.

  • SECURITY: vmauth: slow down requests with invalid auth tokens even if unauthorized_user has URLs configured. Previously, such requests were proxied to unauthorized_user without delay, which allowed brute-forcing auth tokens. See GHSA-rpfx-hrcp-f73x.

  • SECURITY: vmui: prevent cross-site scripting (XSS) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See GHSA-m2x2-9xpq-mmq5.

  • FEATURE: vmagent,vminsert in VictoriaMetrics cluster and Single-node VictoriaMetrics: add /influx/ping endpoint, which returns the X-Influxdb-Version HTTP header. Some InfluxDB clients, such as the Jenkins InfluxDB plugin, read the server version from this endpoint. See #​11663. Thanks to @​Vandit1604 for contribution.

  • FEATURE: vmauth: add oidc.auth_params option to SSO config for passing additional query parameters to the IdP authentication request, e.g., hd for narrowing the Google account chooser to a single domain. Combine it with match_claims to enforce the domain restriction. See these docs for more examples of oidc.auth_params usage.

  • FEATURE: vmsingle and vmstorage in VictoriaMetrics cluster: abort incoming requests when a client disconnects and during graceful shutdown. See #​11472.

  • FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: cancel query requests if client disconnects. See #​11355.

  • BUGFIX: all VictoriaMetrics components: correctly configure TCP keep-alive active probes. See #​11695.

  • BUGFIX: all VictoriaMetrics components: properly match regexps that start with an alternation or a character class and continue with .*foo.* or .+foo.+, for example (a|b).*foo.*. Previously the leading part was ignored when matching relabeling regex and if filters and stream aggregation match filters, so such rules matched more series than intended. See #​11712. Thanks to @​dblackdblack for contribution.

  • BUGFIX: alerts: fix incorrect results for TooHighChurnRate and TooHighSlowInsertsRate in cluster alerting rules. Previously due to incorrect expressions, these rules stayed inactive since v1.108.0 and could produce false positives since v1.153.0. See #​11670. Thanks to @​transacid for contribution.

  • BUGFIX: stream aggregation: properly add timeseries for increase, increase_prometheus, total and total_prometheus aggregation functions when enable_windows: true is set. See #​11707. Thanks to @​Hoipang for contribution.

  • BUGFIX: vmalert: keep using notifiers from the previously applied notifier configuration file if the updated config fails to start, for example due to a temporary service discovery error, and retry applying it on the next reload. Previously, vmalert stopped the old notifiers before starting the new ones, so a failed reload left vmalert with no or only some notifiers, and alert notifications were silently not delivered until the file changed or vmalert restarted. See #​11645.

  • BUGFIX: vmalert: copy alert labels before applying alert_relabel_configs from the notifier configuration file, preventing different alertmanagers from affecting each other's labels. See #​11676.

  • BUGFIX: vmagent and vmalert: set the Host HTTP request header to the resolved DNS SRV target instead of the SRV name when the url uses the srv+ prefix. Previously requests could fail at reverse proxies and load balancers, which route by the Host header. See #​8965.

  • BUGFIX: vmauth: fixes rare data corruption on HTTP request retries. See #​11508.

  • BUGFIX: vmauth: fix SSO login failure Invalid state parameter caused by a race condition when multiple concurrent unauthenticated requests each set their own CSRF cookie. See #​10278-comment and #​11656.

  • BUGFIX: vmauth: fix misleading missing 'Authorization' request header response for JWT-authenticated users when the requested path does not match any url_map. Now it correctly returns 400 Bad Request with missing route error, matching the behavior of Basic Auth and Bearer-token users. See #​11523.

  • BUGFIX: vmbackup and vmbackupmanager: add -s3SkipTaggingDirective command-line flag for S3-compatible storage that rejects the x-amz-tagging-directive and x-amz-tagging headers. See #​11562.

  • BUGFIX: vmselect in VictoriaMetrics cluster: add missing accountID, projectID and multiTenant fields to topByAvgMemoryUsage results at /api/v1/status/top_queries. See #​11640.

  • BUGFIX: vmselect in VictoriaMetrics cluster: prevent rare resource leak if -search.skipSlowReplicas flag is set. See #​11551.

  • BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly execute group_left(...) and group_right(..) queries when the join is then combined with another selector. See #​11490.

  • BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: prevent possible crash with cannot decompress zstd data... panic on darwin, windows, freebsd, openbsd, linux/arm, linux/ppc64le, linux/386, linux/s390x, and -pure builds. The linux/amd64 and linux/arm64 builds are not affected. See #​11683.

  • BUGFIX: vmsingle: properly apply -streamAggr.enableWindows command-line flag to stream aggregation rules. Previously, the flag was ignored by aggregation rules defined in -streamAggr.config and was applied only during config validation with -dryRun and to the standalone deduplication configured via -streamAggr.dedupInterval. See #​11717.

  • BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: properly release memory after historical data backfilling. Previously storage kept 8MiB*CPU memory for each month of ingested data until restart. See #​11672. Thanks to @​mars71003219 for contribution.

  • BUGFIX: vmui: prevent overriding the serverUrl, tenantId, theme, and isDarkTheme settings via query parameters. See #​11485.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [victoriametrics/vmagent](https://github.com/VictoriaMetrics/VictoriaMetrics) | minor | `v1.153.0` → `v1.154.0` | --- ### Release Notes <details> <summary>VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)</summary> ### [`v1.154.0`](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.154.0) [Compare Source](https://github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.153.0...v1.154.0) ##### [v1.154.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.154.0) Released at 2026-10-09 - SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See [the list of issues addressed in Go1.27.2](https://github.com/golang/go/issues?q=milestone%3AGo1.27.2%20label%3ACherryPickApproved). - SECURITY: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): slow down requests with invalid auth tokens even if `unauthorized_user` has URLs configured. Previously, such requests were proxied to `unauthorized_user` without delay, which allowed brute-forcing auth tokens. See [GHSA-rpfx-hrcp-f73x](https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-rpfx-hrcp-f73x). - SECURITY: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): prevent [cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See [GHSA-m2x2-9xpq-mmq5](https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-m2x2-9xpq-mmq5). - FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/),`vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/) and [Single-node VictoriaMetrics](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/): add `/influx/ping` endpoint, which returns the `X-Influxdb-Version` HTTP header. Some [InfluxDB](https://docs.victoriametrics.com/victoriametrics/integrations/influxdb/) clients, such as the Jenkins InfluxDB plugin, read the server version from this endpoint. See [#&#8203;11663](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11663). Thanks to [@&#8203;Vandit1604](https://github.com/Vandit1604) for contribution. - FEATURE: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add `oidc.auth_params` option to [SSO](https://docs.victoriametrics.com/victoriametrics/vmauth/#single-sign-on-sso) config for passing additional query parameters to the IdP authentication request, e.g., `hd` for narrowing the Google account chooser to a single domain. Combine it with `match_claims` to enforce the domain restriction. See [these docs](https://docs.victoriametrics.com/victoriametrics/vmauth/#sso-authentication-request-parameters) for more examples of `oidc.auth_params` usage. - FEATURE: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): abort incoming requests when a client disconnects and during graceful shutdown. See [#&#8203;11472](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11472). - FEATURE: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): cancel query requests if client disconnects. See [#&#8203;11355](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11355). - BUGFIX: all VictoriaMetrics components: correctly configure TCP keep-alive active probes. See [#&#8203;11695](github.com/VictoriaMetrics/VictoriaMetrics/issues/11695). - BUGFIX: all VictoriaMetrics components: properly match regexps that start with an alternation or a character class and continue with `.*foo.*` or `.+foo.+`, for example `(a|b).*foo.*`. Previously the leading part was ignored when matching [relabeling](https://docs.victoriametrics.com/victoriametrics/relabeling/) `regex` and `if` filters and [stream aggregation](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/) `match` filters, so such rules matched more series than intended. See [#&#8203;11712](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11712). Thanks to [@&#8203;dblackdblack](https://github.com/dblackdblack) for contribution. - BUGFIX: [alerts](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/deployment/docker/rules): fix incorrect results for `TooHighChurnRate` and `TooHighSlowInsertsRate` in [cluster alerting rules](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/deployment/docker/rules/alerts-cluster.yml). Previously due to incorrect expressions, these rules stayed inactive since [v1.108.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.108.0) and could produce false positives since [v1.153.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.153.0). See [#&#8203;11670](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11670). Thanks to [@&#8203;transacid](https://github.com/transacid) for contribution. - BUGFIX: [stream aggregation](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/): properly add timeseries for [increase](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/configuration/#increase), [increase_prometheus](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/configuration/#increase_prometheus), [total](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/configuration/#total) and [total_prometheus](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/configuration/#total_prometheus) aggregation functions when `enable_windows: true` is set. See [#&#8203;11707](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11707). Thanks to [@&#8203;Hoipang](https://github.com/Hoipang) for contribution. - BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): keep using notifiers from the previously applied [notifier configuration file](https://docs.victoriametrics.com/victoriametrics/vmalert/#notifier-configuration-file) if the updated config fails to start, for example due to a temporary service discovery error, and retry applying it on the next reload. Previously, vmalert stopped the old notifiers before starting the new ones, so a failed reload left vmalert with no or only some notifiers, and alert notifications were silently not delivered until the file changed or vmalert restarted. See [#&#8203;11645](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11645). - BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): copy alert labels before applying `alert_relabel_configs` from the [notifier configuration file](https://docs.victoriametrics.com/victoriametrics/vmalert/#notifier-configuration-file), preventing different alertmanagers from affecting each other's labels. See [#&#8203;11676](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11676). - BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): set the `Host` HTTP request header to the resolved DNS SRV target instead of the SRV name when the url uses the `srv+` prefix. Previously requests could fail at reverse proxies and load balancers, which route by the `Host` header. See [#&#8203;8965](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/8965). - BUGFIX: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): fixes rare data corruption on HTTP request retries. See [#&#8203;11508](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11508). - BUGFIX: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): fix [SSO](https://docs.victoriametrics.com/victoriametrics/vmauth/#single-sign-on-sso) login failure `Invalid state parameter` caused by a race condition when multiple concurrent unauthenticated requests each set their own CSRF cookie. See [#&#8203;10278-comment](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10278#issuecomment-5862232663) and [#&#8203;11656](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11656). - BUGFIX: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): fix misleading `missing 'Authorization' request header` response for [JWT-authenticated](https://docs.victoriametrics.com/victoriametrics/vmauth/#jwt-token-auth-proxy) users when the requested path does not match any `url_map`. Now it correctly returns `400 Bad Request` with `missing route` error, matching the behavior of [Basic Auth](https://docs.victoriametrics.com/victoriametrics/vmauth/#basic-auth-proxy) and [Bearer-token](https://docs.victoriametrics.com/victoriametrics/vmauth/#bearer-token-auth-proxy) users. See [#&#8203;11523](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11523). - BUGFIX: [vmbackup](https://docs.victoriametrics.com/victoriametrics/vmbackup/) and [vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/): add `-s3SkipTaggingDirective` command-line flag for S3-compatible storage that rejects the `x-amz-tagging-directive` and `x-amz-tagging` headers. See [#&#8203;11562](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11562). - BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): add missing `accountID`, `projectID` and `multiTenant` fields to `topByAvgMemoryUsage` results at `/api/v1/status/top_queries`. See [#&#8203;11640](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11640). - BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): prevent rare resource leak if `-search.skipSlowReplicas` flag is set. See [#&#8203;11551](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11551). - BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly execute `group_left(...)` and `group_right(..)` queries when the join is then combined with another selector. See [#&#8203;11490](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11490). - BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): prevent possible crash with `cannot decompress zstd data...` panic on `darwin`, `windows`, `freebsd`, `openbsd`, `linux/arm`, `linux/ppc64le`, `linux/386`, `linux/s390x`, and `-pure` builds. The `linux/amd64` and `linux/arm64` builds are not affected. See [#&#8203;11683](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11683). - BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/): properly apply `-streamAggr.enableWindows` command-line flag to [stream aggregation](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/) rules. Previously, the flag was ignored by aggregation rules defined in `-streamAggr.config` and was applied only during config validation with `-dryRun` and to the standalone deduplication configured via `-streamAggr.dedupInterval`. See [#&#8203;11717](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11717). - BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly release memory after historical [data backfilling](https://docs.victoriametrics.com/victoriametrics/#backfilling). Previously storage kept 8MiB\*CPU memory for each month of ingested data until restart. See [#&#8203;11672](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11672). Thanks to [@&#8203;mars71003219](https://github.com/mars71003219) for contribution. - BUGFIX: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): prevent overriding the `serverUrl`, `tenantId`, `theme`, and `isDarkTheme` settings via query parameters. See [#&#8203;11485](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11485#issuecomment-5779024739). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
renovate added 1 commit 2026-10-13 03:11:43 +00:00
Update victoriametrics/vmagent Docker tag to v1.154.0 d4c54439db
AverageMarcus merged commit fde417913a into master 2026-10-14 11:30:38 +00:00
AverageMarcus deleted branch renovate/victoriametrics 2026-10-14 11:30:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
renovate (Renovate Bot) AverageMarcus (Marcus Noble)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: AverageMarcus/cluster.fun#811