Update victoriametrics/vmagent Docker tag to v1.153.0 #805
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: AverageMarcus/cluster.fun#805
Reference in New Issue
Block a user
This PR contains the following updates:
v1.152.0→v1.153.0Release Notes
VictoriaMetrics/VictoriaMetrics (victoriametrics/vmagent)
v1.153.0Compare Source
v1.153.0
Released at 2026-09-28
Update Note 1: vmsingle,
vmstorage,vmselectandvminsertin VictoriaMetrics cluster, and vmagent: builds without CGO (pure Go) may fail to read valid data blocks with thewindow size exceedederror. This can break queries, background merges and native import, and can makevmsingleandvmstoragecrash. Affected official builds:darwin,windows,freebsd,openbsd,linux/arm,linux/ppc64le,linux/386,linux/s390x, and-purebuilds. Thelinux/amd64andlinux/arm64builds use CGO and are not affected. Users of affected builds should not upgrade to this release, or should roll back to v1.152.0. See #11683.SECURITY:
vminsert, vmagent and vmsingle: properly apply memory limits to thezstdencoded blocks ingested via native import. This prevents excessive memory allocation during ingestion when handling maliciously crafted requests. See GHSA-8g4f-32hw-vqf8.SECURITY: vmauth: restrict redirects in the OIDC Discovery HTTP client to stay within the original request host. See GHSA-xxqh-2hcc-9fp6.
SECURITY: upgrade base docker image (Alpine) from 3.24.1 to 3.24.2. See Alpine 3.24.2 release notes.
FEATURE: vmalert: skip a redundant pending state when an alert can be restored directly to firing after restart. See #11401.
FEATURE: vmauth: log informative message when a JWT token has no
vm_accessclaim anddefault_vm_access_claimis not configured, if-logInvalidAuthTokensis enabled. See JWT claim-based request templating or #11579.FEATURE: dashboards/vmauth: update the dashboard to upstream Grafana version, fix typos and inconsistencies, improve resource usage panels. See #11587
FEATURE: vmauth: support printing HTTP headers in the Access Logs. Only headers listed in
access_log.headerslist will be printed in the logs. This feature should help troubleshooting pipelines that rely on HTTP headers. See #11598.FEATURE: vmui: move auto-refresh controls from the header to the
Executebutton dropdown and display the selected interval in the button text. See #11343.FEATURE:
vmstoragein VictoriaMetrics cluster: support ingesting data directly via Prometheus Remote Write v1 protocol forvmstorage. This feature can be enabled by setting-enableIngestionAPIcommand-line flag and is disabled by default. See remote write directly to vmstorage and #11252.FEATURE: vmauth: add Single sign-on (SSO) support via OpenID Connect (OIDC). vmauth redirects unauthenticated browser requests to the configured Identity Provider (IdP), verifies the IdP response, and sets a session cookie for subsequent requests. See #10278.
FEATURE: vmsingle and
vmstoragein VictoriaMetrics cluster: add support for opt-in fadvise(FADV_RANDOM) and madvise(MADV_RANDOM) hints for data part files, which can reduce disk I/O and improve page cache efficiency. To enable, set-fs.disableAdviseRandomRead=false. If you experience issues after enabling this feature, please leave a comment with details. See #11461.BUGFIX: all VictoriaMetrics components: create the Unix domain socket for
-httpListenAddr=unix:/path/to/socketwith permissions according to the umask of the process. Previously it was always created with0600permissions, so processes running under other users, such as a reverse proxy, couldn't connect to it. See these docs and #11615.BUGFIX: stream aggregation: serially push samples to stream aggregation jobs. This helps reduce CPU overhead. 11f488d8ff introduced parallel processing for this stage, which introduced extra CPU overhead while only providing negligible sample lag reduction. See #9878.
BUGFIX: vmagent: add missing
X-Influxdb-VersionHTTP header to influxdb API responses. See #11570.BUGFIX: vmagent: disable metrics metadata sending for MDX remote write destinations. See #11572.
BUGFIX: vmagent and vmsingle: properly discover
*_sd_configtargets. Previously scrape targets were preserved until the process restart if*_sd_configreturned an empty targets response. See #11550 for details. Thanks to @evkuzin for contribution.BUGFIX: vmagent: properly reload SSL certificate for kafka producer and consumer. See #11577.
BUGFIX: vmalert: properly reload
alert_relabel_configsfrom the notifier configuration file. Previously, this config was applied only at startup and was not updated on config reload. See #11635.BUGFIX:
vmselect,vminsert, vmagent and vmsingle: ignore emptyextra_label,extra_filtersandextra_filters[]query args instead of returning an error. This allows dropping client-provided values for these query args viaurl_prefixin vmauth as described in the security docs. See #11618.BUGFIX: vmauth: respect the
-enableTCP6flag when discovering backend IPs viadiscover_backend_ipsor-discoverBackendIPs. Previously, discovery included IPv6 addresses even when IPv6 support was disabled. See #11470.BUGFIX: vmui: fix synchronization of the custom query step with URL changes on the predefined dashboards page. See #11137.
BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: slightly reduce CPU usage during concurrent queries execution. See #11569.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.