FEATURE: vmagent: add headers field to oauth2 scrape config for passing custom HTTP headers to token_url. Some services require different headers for the token endpoint and the scrape targets. See #8939.
FEATURE: vmauth: add OIDC Discovery support for JWT authentication. vmauth can now automatically fetch and rotate public keys from an OpenID Connect provider, eliminating the need to specify public keys manually. See OIDC Discovery docs. See #10585.
FEATURE: all VictoriaMetrics components: implement proper CORS preflight handling by responding 204 No Content to HTTP OPTIONS requests. See #5563.
FEATURE: vmauth: add access_log configuration option for each user that will log requests to stdout, and support filtering by HTTP status codes. See more in docs. See #5936.
FEATURE: vmauth: add JWT token match_claims for requests routing. Read more about configuration in JWT claim matching documentation. See #10584.
FEATURE: vmalert: support negative values for the group eval_offset option, which allows starting group evaluation at groupInterval-abs(eval_offset) within [0...groupInterval]. See #10424.
FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: Disable /graphite/tags/tagSeries and /graphite/tags/tagMultiSeries for Graphite tag registration since it is unlikely it is used in context of VictoriaMetrics. See 10544.
FEATURE: vmui: rename debug tools buttons for clarity. See #10453.
BUGFIX: all VictoriaMetrics components: replace histogram with untyped metric metadata type for VictoriaMetrics histograms when -metrics.exposeMetadata is set. See #82.
BUGFIX: vmauth: properly route requests to default_url. Previously, request_path query arg could be set incorrectly during concurrent requests. See #10626.
BUGFIX: vmui: use increase_pure instead of rate for histogram heatmaps in Explore Metrics to correctly display the first observation in each new bucket. See #10365. Thanks to @ab0utbla-k for the contribution.
BUGFIX: dashboards/vmauth: fix requested from system and heap inuse expressions in the memory usage panel. See #10574.
BUGFIX: vmbackup, vmbackupmanager: do not enable ACL when uploading backups to S3-compatible endpoints by default. ACL is not always supported by S3-compatible endpoints and it is not recommended to use ACLs to limit access to objects. See #10539 for more details.
BUGFIX: vmbackupmanager: overwrite s3 object metadata while syncing latest backups with other backup types. See #10639.
BUGFIX: vmstorage in VictoriaMetrics cluster: fix inaccurate vm_filestream_write_duration_seconds_total due to duplicate counting . After the fix, vm_filestream_write_duration_seconds_total will track the duration spent on calling the write(2) system call properly. See #10564.
Configuration
📅Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [victoriametrics/vmagent](https://github.com/VictoriaMetrics/VictoriaMetrics) | minor | `v1.137.0` → `v1.138.0` |
---
### Release Notes
<details>
<summary>VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)</summary>
### [`v1.138.0`](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.138.0)
[Compare Source](https://github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.137.0...v1.138.0)
##### [v1.138.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.138.0)
Released at 2026-03-13
- SECURITY: upgrade Go builder from Go1.26.0 to Go1.26.1. See [the list of issues addressed in Go1.26.1](https://github.com/golang/go/issues?q=milestone%3AGo1.26.1%20label%3ACherryPickApproved).
- FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/): add `headers` field to `oauth2` scrape config for passing custom HTTP headers to `token_url`. Some services require different headers for the token endpoint and the scrape targets. See [#​8939](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/8939).
- FEATURE: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) support for JWT authentication. `vmauth` can now automatically fetch and rotate public keys from an OpenID Connect provider, eliminating the need to specify public keys manually. See [OIDC Discovery](https://docs.victoriametrics.com/victoriametrics/vmauth/#oidc-discovery) docs. See [#​10585](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10585).
- FEATURE: all VictoriaMetrics components: implement proper CORS preflight handling by responding 204 No Content to HTTP OPTIONS requests. See [#​5563](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/5563).
- FEATURE: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add `access_log` configuration option for each user that will log requests to stdout, and support filtering by HTTP status codes. See more in [docs](https://docs.victoriametrics.com/victoriametrics/vmauth/#access-log). See [#​5936](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/5936).
- FEATURE: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add JWT token `match_claims` for requests routing. Read more about configuration in [JWT claim matching](https://docs.victoriametrics.com/victoriametrics/vmauth/#jwt-claim-matching) documentation. See [#​10584](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10584).
- FEATURE: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): support negative values for the group `eval_offset` option, which allows starting group evaluation at `groupInterval-abs(eval_offset)` within `[0...groupInterval]`. See [#​10424](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10424).
- FEATURE: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): Disable `/graphite/tags/tagSeries` and `/graphite/tags/tagMultiSeries` for Graphite tag registration since it is unlikely it is used in context of VictoriaMetrics. See [10544](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10544).
- FEATURE: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): rename debug tools buttons for clarity. See [#​10453](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10453).
- BUGFIX: all VictoriaMetrics components: replace `histogram` with `untyped` metric metadata type for [VictoriaMetrics histograms](https://docs.victoriametrics.com/victoriametrics/keyconcepts/#histogram) when `-metrics.exposeMetadata` is set. See [#​82](https://github.com/VictoriaMetrics/metrics/issues/82).
- BUGFIX: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): properly route requests to `default_url`. Previously, `request_path` query arg could be set incorrectly during concurrent requests. See [#​10626](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/10626).
- BUGFIX: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): use `increase_pure` instead of `rate` for histogram heatmaps in Explore Metrics to correctly display the first observation in each new bucket. See [#​10365](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10365). Thanks to [@​ab0utbla-k](https://github.com/ab0utbla-k) for the contribution.
- BUGFIX: [dashboards/vmauth](https://grafana.com/grafana/dashboards/21394): fix `requested from system` and `heap inuse` expressions in the memory usage panel. See [#​10574](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/10574).
- BUGFIX: [vmbackup](https://docs.victoriametrics.com/vmbackup/), [vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/): do not enable ACL when uploading backups to S3-compatible endpoints by default. ACL is not always supported by S3-compatible endpoints and it is not recommended to use ACLs to limit access to objects. See [#​10539](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10539) for more details.
- BUGFIX: [vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/): overwrite s3 object metadata while syncing latest backups with other backup types. See [#​10639](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10639).
- BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), `vminsert` and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly attach `host` label to the time series ingested via [/datadog/api/beta/sketches](https://docs.victoriametrics.com/victoriametrics/integrations/datadog/#) API. See [#​10557](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10557).
- BUGFIX: `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fix inaccurate `vm_filestream_write_duration_seconds_total` due to duplicate counting . After the fix, `vm_filestream_write_duration_seconds_total` will track the duration spent on calling the `write(2)` system call properly. See [#​10564](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10564).
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My43Ni41IiwidXBkYXRlZEluVmVyIjoiNDMuNzYuNSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v1.137.0→v1.138.0Release Notes
VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)
v1.138.0Compare Source
v1.138.0
Released at 2026-03-13
SECURITY: upgrade Go builder from Go1.26.0 to Go1.26.1. See the list of issues addressed in Go1.26.1.
FEATURE: vmagent: add
headersfield tooauth2scrape config for passing custom HTTP headers totoken_url. Some services require different headers for the token endpoint and the scrape targets. See #8939.FEATURE: vmauth: add OIDC Discovery support for JWT authentication.
vmauthcan now automatically fetch and rotate public keys from an OpenID Connect provider, eliminating the need to specify public keys manually. See OIDC Discovery docs. See #10585.FEATURE: all VictoriaMetrics components: implement proper CORS preflight handling by responding 204 No Content to HTTP OPTIONS requests. See #5563.
FEATURE: vmauth: add
access_logconfiguration option for each user that will log requests to stdout, and support filtering by HTTP status codes. See more in docs. See #5936.FEATURE: vmauth: add JWT token
match_claimsfor requests routing. Read more about configuration in JWT claim matching documentation. See #10584.FEATURE: vmalert: support negative values for the group
eval_offsetoption, which allows starting group evaluation atgroupInterval-abs(eval_offset)within[0...groupInterval]. See #10424.FEATURE: vmsingle and
vmselectin VictoriaMetrics cluster: Disable/graphite/tags/tagSeriesand/graphite/tags/tagMultiSeriesfor Graphite tag registration since it is unlikely it is used in context of VictoriaMetrics. See 10544.FEATURE: vmui: rename debug tools buttons for clarity. See #10453.
BUGFIX: all VictoriaMetrics components: replace
histogramwithuntypedmetric metadata type for VictoriaMetrics histograms when-metrics.exposeMetadatais set. See #82.BUGFIX: vmauth: properly route requests to
default_url. Previously,request_pathquery arg could be set incorrectly during concurrent requests. See #10626.BUGFIX: vmui: use
increase_pureinstead ofratefor histogram heatmaps in Explore Metrics to correctly display the first observation in each new bucket. See #10365. Thanks to @ab0utbla-k for the contribution.BUGFIX: dashboards/vmauth: fix
requested from systemandheap inuseexpressions in the memory usage panel. See #10574.BUGFIX: vmbackup, vmbackupmanager: do not enable ACL when uploading backups to S3-compatible endpoints by default. ACL is not always supported by S3-compatible endpoints and it is not recommended to use ACLs to limit access to objects. See #10539 for more details.
BUGFIX: vmbackupmanager: overwrite s3 object metadata while syncing latest backups with other backup types. See #10639.
BUGFIX: vmagent, vmsingle,
vminsertandvmstoragein VictoriaMetrics cluster: properly attachhostlabel to the time series ingested via /datadog/api/beta/sketches API. See #10557.BUGFIX:
vmstoragein VictoriaMetrics cluster: fix inaccuratevm_filestream_write_duration_seconds_totaldue to duplicate counting . After the fix,vm_filestream_write_duration_seconds_totalwill track the duration spent on calling thewrite(2)system call properly. See #10564.Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.