- Upgrade Go builder from Go1.26.0 to Go1.26.1, addressing security issues in the runtime.
- Introduce numerous features: OAuth2 custom headers in vmagent, OIDC discovery and JWT claim routing in vmauth, proper CORS preflight handling, per‑user access logging, negative eval offsets in vmalert, and UI/cluster improvements.
- Fix a wide range of bugs across components, including histogram metadata handling, request routing, UI heatmap calculations, backup ACL defaults, S3 metadata overwrites, host‑label attachment, and filestream timing accuracy.
v1.138.0
Official VictoriaMetrics changelog summary with source attribution, release tags, and community reactions.
Track this VictoriaMetrics release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this VictoriaMetrics release note into a weekly digest for the tools you actually use.
Create digestMore VictoriaMetrics changelog updates
Enable multitenancy via headers by default for vmselect, vminsert and vmagent (default flag changed to true), which may break existing URL patterns.
Upgrade Go builder to Go1.26.6, addressing security issues in the runtime.
Upgrade Go builder from 1.26.5 to 1.26.6 for security patches.