v1.152.0

Official VictoriaMetrics changelog summary with source attribution, release tags, and community reactions.

Track this VictoriaMetrics release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

VictoriaMetrics·Sep 14, 2026, 10:36 AMFixSecurity-relevantAI-assisted summary

Summary

Security updates: upgraded Go builder to 1.27.1, fixed vmauth JWT authorization bypass, and escaped server‑side errors to prevent XSS on the relabeling UI.
Features added: vmauth now supports a deny‑paths option, alerts health splits TooManyLogs into TooManyErrorLogs and TooManyLogs, and vmui displays min‑max ranges for graph lines in the legend.
Bug fixes: sensitive header values are hidden in logs/metrics, insert requests no longer hang after timeouts, le‑filter stats are applied correctly, estimator metrics are dropped, and deleteAuthKey works without requiring httpAuth for ad...

featuresecuritybugfixsource healthy

Official source Last checked Sep 20, 2026, 1:01 PM

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked Sep 20, 2026, 1:01 PM

related channels

Turn this VictoriaMetrics release note into a weekly digest for the tools you actually use.