AverageMarcus/cluster.fun
1
0
Fork 0
Code Issues 1 Pull Requests 3 Releases Activity

Update victoriametrics/vmagent Docker tag to v1.152.0 #792

Merged
AverageMarcus merged 1 commits from renovate/victoriametrics into master 2026-09-16 06:37:15 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-09-15 03:11:31 +00:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
victoriametrics/vmagent minor v1.151.0 → v1.152.0

Release Notes

VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)

v1.152.0

Compare Source

v1.152.0

Released at 2026-09-11

  • SECURITY: upgrade Go builder from Go1.26.6 to Go1.27.1. See Go 1.27 release notes.

  • SECURITY: vmauth: fix authorization bypass in JWT-based routing when match_claims values are used. See GHSA-f99m-22fh-qw96.

  • SECURITY: vmsingle and vmselect in VictoriaMetrics cluster: properly escape server-side errors returned by /metric-relabel-debug since they could contain parts of user input. This prevents XSS attacks on the /vmui/#/relabeling page. See GHSA-vw10j-rqhg-qff9.

  • FEATURE: vmauth: add the deny_paths option to url_map to reject a subset of paths matched by src_paths or other src_* options with 403 Forbidden (401 Unauthorized for anonymous requests) instead of enumerating every allowed path. See #​11452. Thanks to @​andriibeee for contribution.

  • FEATURE: alerts-health: split TooManyLogs alert into TooManyErrorLogs and TooManyLogs. TooManyLogs now covers only warn-level logs and aggregates them per job and instance. TooManyErrorLogs fires on error, fatal, and panic logs with per-location granularity, making it easier to identify the exact source of critical log messages. See #​11417.

  • FEATURE: vmui: show the range between the minimum and maximum values for each graph line in the legend. See #​11425. Thanks to @​umer901 for contribution.

  • BUGFIX: all VictoriaMetrics components: hide values passed to -pushmetrics.header in startup logs, /metrics, and /flags, since they can contain sensitive HTTP headers such as Authorization and API keys. See #​11545.

  • BUGFIX: vmsingle, vmagent and vminsert in VictoriaMetrics cluster: fix insert requests getting stuck after another insert request times out, causing clients to time out while waiting for a response. See VictoriaLogs#1743.

  • BUGFIX: vmselect in VictoriaMetrics cluster: apply the le filter at /api/v1/status/metric_names_stats after merging request counters from all vmstorage nodes. Previously, the endpoint could report actively queried metrics as unused when the local request counter was zero on one of the nodes. See #​11473. Thanks to @​missusk for contribution.

  • BUGFIX: vmagent: now MDX discards cardinality_estimate and cardinality_churn_ratio metrics exposed by vmestimator service. #​11501.

  • BUGFIX: vmselect in VictoriaMetrics cluster: allow access to /prometheus/api/v1/admin/tsdb/delete_series and graphite/tags/delSeries using only the corresponding -deleteAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See #​11512.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [victoriametrics/vmagent](https://github.com/VictoriaMetrics/VictoriaMetrics) | minor | `v1.151.0` → `v1.152.0` | --- ### Release Notes <details> <summary>VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)</summary> ### [`v1.152.0`](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.152.0) [Compare Source](https://github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.151.0...v1.152.0) ##### [v1.152.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.152.0) Released at 2026-09-11 - SECURITY: upgrade Go builder from Go1.26.6 to Go1.27.1. See [Go 1.27 release notes](https://go.dev/doc/go1.27). - SECURITY: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): fix authorization bypass in JWT-based routing when `match_claims` values are used. See [GHSA-f99m-22fh-qw96](https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-f99m-22fh-qw96). - SECURITY: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly escape server-side errors returned by `/metric-relabel-debug` since they could contain parts of user input. This prevents XSS attacks on the `/vmui/#/relabeling` page. See [GHSA-vw10j-rqhg-qff9](https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-vw9j-rqhg-qff9). - FEATURE: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add the `deny_paths` option to `url_map` to reject a subset of paths matched by `src_paths` or other `src_*` options with `403 Forbidden` (`401 Unauthorized` for anonymous requests) instead of enumerating every allowed path. See [#&#8203;11452](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11452). Thanks to [@&#8203;andriibeee](https://github.com/andriibeee) for contribution. - FEATURE: [alerts-health](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/deployment/docker/rules/alerts-health.yml): split `TooManyLogs` alert into `TooManyErrorLogs` and `TooManyLogs`. `TooManyLogs` now covers only `warn`-level logs and aggregates them per job and instance. `TooManyErrorLogs` fires on `error`, `fatal`, and `panic` logs with per-location granularity, making it easier to identify the exact source of critical log messages. See [#&#8203;11417](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11417). - FEATURE: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): show the range between the minimum and maximum values for each graph line in the legend. See [#&#8203;11425](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11425). Thanks to [@&#8203;umer901](https://github.com/umer901) for contribution. - BUGFIX: all VictoriaMetrics components: hide values passed to `-pushmetrics.header` in startup logs, `/metrics`, and `/flags`, since they can contain sensitive HTTP headers such as `Authorization` and API keys. See [#&#8203;11545](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11545). - BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fix insert requests getting stuck after another insert request times out, causing clients to time out while waiting for a response. See [VictoriaLogs#1743](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1743). - BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): apply the `le` filter at `/api/v1/status/metric_names_stats` after merging request counters from all `vmstorage` nodes. Previously, the endpoint could report actively queried metrics as unused when the local request counter was zero on one of the nodes. See [#&#8203;11473](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11473). Thanks to [@&#8203;missusk](https://github.com/missusk) for contribution. - BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/): now [MDX](https://docs.victoriametrics.com/victoriametrics/vmagent/#monitoring-data-exchange) discards [cardinality\_estimate](https://docs.victoriametrics.com/victoriametrics/vmestimator/#cardinality-metrics) and `cardinality_churn_ratio` metrics exposed by [vmestimator](https://github.com/VictoriaMetrics/vmestimator) service. [#&#8203;11501](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11501). - BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): allow access to `/prometheus/api/v1/admin/tsdb/delete_series` and `graphite/tags/delSeries` using only the corresponding `-deleteAuthKey`, even when `-httpAuth.*` is also configured, without additionally requiring `-httpAuth.*` credentials. See [#&#8203;11512](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11512). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45MC4yIiwidXBkYXRlZEluVmVyIjoiNDQuOTAuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
renovate added 1 commit 2026-09-15 03:11:32 +00:00
Update victoriametrics/vmagent Docker tag to v1.152.0 b444bb6225
AverageMarcus merged commit d8c23afe95 into master 2026-09-16 06:37:15 +00:00
AverageMarcus deleted branch renovate/victoriametrics 2026-09-16 06:37:15 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
renovate (Renovate Bot) AverageMarcus (Marcus Noble)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: AverageMarcus/cluster.fun#792