Release notes for version 0.96.1

Release date: 25 Oct 2026

• bump version of VM components to v1.154.1, which fixes delayed requests in vmauth when a request with an Authorization header is matched to unauthorized_user. See VictoriaMetrics#11774.
• BUGFIX: vmauth.spec.unauthorizedUserAccessSpec now routes to vmsingle/vmcluster using targetRefs with crd references, and internal.vmauth.spec.unauthorizedUserAccessSpec (the vmalert datasource proxy) routes to vmsingle/vmcluster/vlsingle/vlcluster the same way, instead of a hand-built url_map. The operator now derives backend routes automatically, including /admin/tenants, which the old url_map missed. This default applies only when url_map, url_prefix and targetRefs are all left unset; setting url_prefix or targetRefs explicitly now replaces the default read/write routes entirely instead of merging alongside them. See #3153.