What VictoriaMetrics/VictoriaMetrics shipped
Written by FoxPlug from public releases; not affiliated with Victoriametrics. An automatic summary of the public release, pull request and commit data of github.com/VictoriaMetrics/VictoriaMetrics. Victoriametrics did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Released v1.153.0-cluster. Release
- Added Single Sign-On support via OpenID Connect in vmauth for authentication. Pull request #11122
- vmstorage now accepts ingestion via Prometheus Remote Write v1 protocol over HTTP. Pull request #11524
- Fixed vmalert to properly reload notifier config alert relabel on configuration changes. Pull request #11639
- Reduced CPU contention in vmselect by accumulating skipped row counter locally per worker before updating the metric. Pull request #11606
- Fixed data race in vmagent remote write when sending HTTP requests. Pull request #11578
- Disabled Linux readahead for randomly read data files to reduce disk read amplification. Pull request #11521
- vmselect now ignores empty
extra_labelandextra_filtersquery arguments. Pull request #11630 - vmalert now skips redundant pending state when restoring alert states on restart. Pull request #11401
- vmauth access log now supports logging specified HTTP headers for debugging. Pull request #11598
Why it matters
This week includes improvements to alerting reliability, authentication capabilities, and query performance. The addition of OIDC SSO support and Prometheus Remote Write v1 protocol support expand integration options. Performance fixes reduce CPU hotspots and disk read overhead under high load.
Changelog entry
- Release v1.153.0-cluster Release
- Add Single Sign-On (SSO) support via OpenID Connect (OIDC) in vmauth Pull request #11122
- vmstorage: accept ingestion via Prometheus Remote Write v1 protocol Pull request #11524
- vmalert: properly reload notifier config alert relabel on configuration changes Pull request #11639
- vmselect: accumulate skipped row counter locally per worker to reduce metric update contention Pull request #11606
- vmagent/remotewrite: fix data race when sending HTTP requests Pull request #11578
- lib/fs: disable Linux readahead for randomly read data files Pull request #11521
- lib/fs: add MADV_SEQUENTIAL in MustFadviseSequentialRead for mmap coverage Pull request #11613
- vmselect: ignore empty
extra_labelandextra_filtersquery arguments Pull request #11630 - lib/httputil: log peer IP address on HTTP error for easier debugging Pull request #11631
- vmalert: skip redundant pending state when restoring alert states Pull request #11401
- vmauth: add support for HTTP headers logging in
access_logPull request #11598 - vmauth: restrict OIDC client redirects to original request host Pull request #11616
- vmauth: respect enableTCP6 flag for backend discovery Pull request #11530
- chore: prevent panic on netstorage timeseries unpack Pull request #11622
- lib/encoding/zstd: match cgo behavior for empty input in purego encoder Pull request #11610
- lib/netutil: rely on umask for Unix domain socket permissions Pull request #11627
- Makefile: limit CPU allocation for i386 tests to prevent OOM Pull request #11633
- vmui: fix URL step sync on predefined dashboards Pull request #11522
- vmselect: preserve configured storageNode order across restarts Pull request #11575
v1.153.0-cluster ships with OIDC SSO support in vmauth, Prometheus Remote Write v1 protocol support in vmstorage, improved alert config reloading, reduced query CPU contention, and numerous performance and reliability fixes.
VictoriaMetrics v1.153.0-cluster is now available. This release adds OpenID Connect single sign-on support to vmauth, enables vmstorage to accept Prometheus Remote Write v1 protocol ingestion, fixes alert configuration reloading in vmalert, reduces CPU contention in query processing, and includes performance optimizations for disk I/O and HTTP request handling.
Week of September 14, 2026
What shipped
- v1.152.0 released with security fixes for JWT-based routing authorization bypass in vmauth and Go builder upgraded to 1.27.1. Release
- Per-day index search now runs concurrently, with each day searched in a separate goroutine for improved performance. Pull request #11576
- Scrape job
sd_configsthat are removed are now properly cleaned up instead of falling back to previously discovered targets. Pull request #11532 - Stream aggregation now serially pushes input samples to aggregator to fix concurrent processing issues. Pull request #11588
limit_offsetfunction now returns an error for negative limit or offset values instead of panicking. Pull request #11561- vmagent now disables metrics metadata sending for MDX URLs when remoteWrite.enableMdx is true. Pull request #11586
- vmauth dashboard updated with new metrics, fixed queries, and minimum version bumped to 1.135.0. Pull request #11587
- vmanomaly v1.30.6 release documentation prepared covering hardened images, envelope stability fixes, and UI changes. Pull request #11603
- vmauth security documentation refined with recommendations for dropping Authorization headers and verifying OIDC token claims. Pull request #11595
- Multi-tenancy documentation chapters updated to clarify architecture and capabilities across cluster components. Pull request #11563
Why it matters
This week includes a security release fixing JWT routing authorization bypass and performance improvements to index search through concurrent per-day operations. Cleanup of scrape job configuration and error handling improvements make agent operations more reliable.
Changelog entry
- SECURITY: vmauth: fix authorization bypass in JWT-based routing when
match_claimsvalues are used Release - SECURITY: upgrade Go builder from Go1.26.6 to Go1.27.1 Release
- FEATURE: concurrent per-day index search for TSID and metric name lookups Pull request #11576
- BUGFIX: drop targets of
sd_configremoved from scrape job Pull request #11532 - BUGFIX: stream aggregation serially push input samples to aggregator Pull request #11588
- BUGFIX: reject negative limit/offset in
limit_offsetto prevent panic Pull request #11561 - BUGFIX: vmagent disable metrics metadata sending for MDX urls Pull request #11586
- IMPROVEMENT: log no
vm_accessclaim case when logInvalidAuthTokens set Pull request #11579
v1.152.0 released with security fix for JWT-based routing in vmauth and concurrent per-day index search for better performance.
v1.152.0 brings important security fixes and performance improvements. JWT-based routing authorization bypass is patched, concurrent per-day index search accelerates query performance, and scrape job configuration cleanup ensures proper target management.