VictoriaMetrics/VictoriaMetrics v1.153.0

on GitHub

v1.153.0

Released at 2026-09-25

• SECURITY: vminsert, vmagent and vmsingle: properly apply memory limits to the zstd encoded blocks ingested via native import. This prevents excessive memory allocation during ingestion when handling maliciously crafted requests. See GHSA-8g4f-32hw-vqf8.

• SECURITY: vmauth: restrict redirects in the OIDC Discovery HTTP client to stay within the original request host. See GHSA-xxqh-2hcc-9fp6.

• SECURITY: upgrade base docker image (Alpine) from 3.24.1 to 3.24.2. See Alpine 3.24.2 release notes.

• FEATURE: vmalert: skip a redundant pending state when an alert can be restored directly to firing after restart. See #11401.

• FEATURE: vmauth: log informative message when a JWT token has no vm_access claim and default_vm_access_claim is not configured, if -logInvalidAuthTokens is enabled. See JWT claim-based request templating or #11579.

• FEATURE: dashboards/vmauth: update the dashboard to upstream Grafana version, fix typos and inconsistencies, improve resource usage panels.

• FEATURE: vmauth: support printing HTTP headers in the Access Logs. Only headers listed in access_log.headers list will be printed in the logs. This feature should help troubleshooting pipelines that rely on HTTP headers.

• FEATURE: vmui: move auto-refresh controls from the header to the Execute button dropdown and display the selected interval in the button text. See #11343.

• FEATURE: vmstorage in VictoriaMetrics cluster: support ingesting data directly via Prometheus Remote Write v1 protocol for vmstorage. This feature can be enabled by setting -enableIngestionAPI command-line flag and is disabled by default. See remote write directly to vmstorage and #11252.

• FEATURE: vmauth: add Single sign-on (SSO) support via OpenID Connect (OIDC). vmauth redirects unauthenticated browser requests to the configured Identity Provider (IdP), verifies the IdP response, and sets a session cookie for subsequent requests. See #10278.

• FEATURE: vmsingle and vmstorage in VictoriaMetrics cluster: add support for opt-in fadvise(FADV_RANDOM) and madvise(MADV_RANDOM) hints for data part files, which can reduce disk I/O and improve page cache efficiency. To enable, set -fs.disableAdviseRandomRead=false. If you experience issues after enabling this feature, please leave a comment with details. See #11461.

• BUGFIX: all VictoriaMetrics components: create the Unix domain socket for -httpListenAddr=unix:/path/to/socket with permissions according to the umask of the process. Previously it was always created with 0600 permissions, so processes running under other users, such as a reverse proxy, couldn't connect to it. See these docs and #11615.

• BUGFIX: stream aggregation: serially push samples to stream aggregation jobs. This helps reduce CPU overhead. 11f488d8ff introduced parallel processing for this stage, which introduced extra CPU overhead while only providing negligible sample lag reduction. See #9878.

• BUGFIX: vmagent: add missing X-Influxdb-Version HTTP header to influxdb API responses. See #11570.

• BUGFIX: vmagent: disable metrics metadata sending for MDX remote write destinations. See #11572.

• BUGFIX: vmagent and vmsingle: properly discover *_sd_config targets. Previously scrape targets were preserved until the process restart if *_sd_config returned an empty targets response. See #11550 for details. Thanks to @evkuzin for contribution.

• BUGFIX: vmagent: properly reload SSL certificate for kafka producer and consumer. See #11577.

• BUGFIX: vmalert: properly reload alert_relabel_configs from the notifier configuration file. Previously, this config was applied only at startup and was not updated on config reload. See #11635.

• BUGFIX: vmselect, vminsert, vmagent and vmsingle: ignore empty extra_label, extra_filters and extra_filters[] query args instead of returning an error. This allows dropping client-provided values for these query args via url_prefix in vmauth as described in the security docs. See #11618.

• BUGFIX: vmauth: respect the -enableTCP6 flag when discovering backend IPs via discover_backend_ips or -discoverBackendIPs. Previously, discovery included IPv6 addresses even when IPv6 support was disabled. See #11470.

• BUGFIX: vmui: fix synchronization of the custom query step with URL changes on the predefined dashboards page. See #11137.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: slightly reduce CPU usage during concurrent queries execution. See #11569.