chore(deps): update victoriametrics/victoria-metrics docker tag to v1.137.0

[renovate]

This PR contains the following updates:

Package	Update	Change
victoriametrics/victoria-metrics	minor	v1.135.0 → v1.137.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

VictoriaMetrics/VictoriaMetrics (victoriametrics/victoria-metrics)

v1.137.0

Compare Source

v1.137.0

Released at 2026-02-27

Update Note 1: vmsingle and vmagent: default value of the flag -promscrape.dropOriginalLabels changed from true to false.
It enables back Discovered targets debug UI by default.

• FEATURE: vmbackup: can now copy backups between different storage backends, such as from s3 to local disk or gcs to s3. See #​10401. Thanks to @​BenNF for the contribution.

• FEATURE: vmauth: add JWT token authentication support with signature verification based on provided public_keys. Read more about configuration in JWT Token auth proxy documentation. See #​10445.

• FEATURE: vmauth: support dynamic rewriting of upstream URLs and request headers using placeholders populated from JWT vm_access claim fields. This allows routing requests to the correct tenant backend without maintaining a separate user config entry per tenant. Read more in JWT claim-based request templating documentation. See #​10492.

• FEATURE: all VictoriaMetrics components: expose process_cpu_seconds_total, process_resident_memory_bytes, and other process-level metrics when running on macOS. See metrics#75.

• FEATURE: dashboards/vmauth: add Request body buffering duration panel to the Troubleshooting section. This panel shows the time spent buffering incoming client request bodies, helping identify slow client uploads and potential concurrency issues. The panel is only available when -requestBufferSize is non-zero. See #​10309.

• FEATURE: vmagent and vmsingle: reduce CPU and memory usage when -promscrape.dropOriginalLabels command-line flag is set. See #​9952.

• FEATURE: vmagent, vmsingle, vminsert and vmstorage in VictoriaMetrics cluster: enable ingestion and in-memory storage of metrics metadata by default. Metadata ingestion can be disabled with -enableMetadata=false. See #​2974.

• FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: decode UTF-8 label names in the label/<name>/values API according to the Prometheus API specifications. See #​10446. Thanks to @​utrack for the contribution.

• FEATURE: vmsingle and vmstorage in VictoriaMetrics cluster: increase default value for -storage.minFreeDiskSpaceBytes flag from 10M to 100M to reduce risk of panics under high ingestion on small disks. See #​9561.

• FEATURE: vmagent and vmsingle: improve InfluxDB ingestion parsing error message when a closing quote is missing for a quoted field value, by adding a hint that this may be caused by a raw newline (\n) inside the quoted field value. See #​10067. Thanks to @​hklhai for the contribution.

• FEATURE: MetricsQL: add histogram_fraction function to calculate the fraction of buckets falling between lowerLe and upperLe. See #​5346.

• FEATURE: dashboards/alert-statistics: add job and instance filters to the VictoriaMetrics - Alert statistics dashboard. This allows users running multiple independent vmalert instances to filter and analyze alerts statistics per specific instance, making it easier to identify issues in a particular vmalert deployment. See #​10549.

• FEATURE: dashboards/alert-statistics: add a link to a specific alerting rule on the table of firing alerts. See #​10508. Thanks to @​sias32 for the contribution.

• FEATURE: alerts: use $externalURL instead of localhost in the alerting rules. This should improve usability of the rules if $externalURL is correctly configured, without need to update rules annotations. See #​10508. Thanks to @​sias32 for the contribution.

• FEATURE: all VictoriaMetrics components: publish SPDX SBOM attestations for container images on docker.io and quay.io. See SECURITY.md and #​10474. Thanks to @​smuda for the contribution.

• BUGFIX: all VictoriaMetrics components: return gzip-compressed response instead of zstd-compressed response to the client if Accept-Encoding request header contains both gzip and zstd. This is needed because some clients and proxies improperly handle zstd-compressed responses. See #​10535.

• BUGFIX: vmagent and vmsingle: properly check expired client certificate during mTLS requests. See #​10393.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: prevent panic error parsing regexp: expression nests too deeply triggered by large repetition ranges in regex, for example {"__name__"=~"a{0,1000}"}. See VictoriaLogs#1112.

• BUGFIX: vmui: fix escaping for label names with special characters. See #​10485.

• BUGFIX: vmstorage in VictoriaMetrics cluster: properly search tenants for multitenant query request. See #​10422.

• BUGFIX: vmstorage in VictoriaMetrics cluster: properly apply extra_filters[] filter when querying vm_account_id or vm_project_id labels via multitenant request for /api/v1/label/…/values API. Before, extra_filters was ignored. See #​10503.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: revert the use of rollup result cache for instant queries that contain rate function with a lookbehind window larger than -search.minWindowForInstantRollupOptimization. The cache usage was removed since v1.132.0. See #​10098 for more details.

v1.136.0

Compare Source

v1.136.0

Released at 2026-02-13

• SECURITY: upgrade Go builder from Go1.25.6 to Go1.26.0. See Go 1.26 release notes.

• SECURITY: upgrade base docker image (Alpine) from 3.23.2 to 3.23.3. See Alpine 3.23.3 release notes.

• FEATURE: dashboards/single, dashboards/cluster, dashboards/vmagent: add clickable source code links to the Logging rate panel in Drilldown. Users can use it to navigate directly to the source code location that generated those logs, making debugging and code exploration easier. See #​10406.

• FEATURE: vmui: add Queries with most memory to execute section in Top Queries page of vmui. It can help users to find queries that consume most memory and potentially cause OOM. See #​9330.

• FEATURE: vmui: make label value autocomplete context-aware by suggesting values only from series matching already selected label filters. See #​9269.

• BUGFIX: all VictoriaMetrics components: respect default http client proxy env variables (HTTP_PROXY, HTTPS_PROXY, NO_PROXY). See #​10385. Thanks to @​zane-deg for the contribution.

• BUGFIX: vmagent and vmsingle: properly expose kubernetes_sd discovery network dialer metrics vm_promscrape_discovery_kubernetes_conn_*. See #​10382.

• BUGFIX: vmsingle: slightly reduce memory usage for metrics-metadata ingestion. See #​10392.

• BUGFIX: VictoriaMetrics enterprise vmagent and vmsingle: introduce time‑based manual offset commit for kafka consumer to fix performance degradation with enabled manual commit. After this change, the consumer will commit partition offsets in batch per second to avoid high commit QPS on the Kafka broker. It's no longer recommended to set enable.auto.commit=true in -kafka.consumer.topic.options, as vmagent will automatically manage it. See #​10395.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: fix vm_deduplicated_samples_total{type="select"} to correctly count deduplicated identical samples with the same timestamp and value. See #​10400.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly prettify metricsql queries with regex. See metricsql#60. Thanks to @​freeseacher for the contribution.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: previously the Graphite render API used a fixed process timeout that could expire before long queries completed; now the timeout follows the query deadline, so users can extend it via -search.maxQueryDuration or the timeout argument in the query. See #​8484.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: properly report last partition metrics at the end of current month. See #​10387.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: avoid slow-path deduplication for time series with staleness markers. See #​10384. Thanks to @​fxrlv for the contribution.

• BUGFIX: vmsingle, vminsert in VictoriaMetrics cluster and vmagent: ensure proper reset of buf size for OpenTelemetry ingestion, and allow flushing when buf size exceeds 4MiB. Previously, when a small number of requests carried a large volume of time series or labels, buf was over-expanded and recycled to the pool, resulting in excessive memory usage. See #​10378.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: correctly display hierarchy of actions in query trace during index searches. Before, search within the specific index was placed out of scope in the trace. See #​10459.

---

Configuration

📅 Schedule: Branch creation - "before 8am" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (7db68b5) to head (bfb4d87).
⚠️ Report is 10 commits behind head on develop.

Additional details and impacted files

@@               Coverage Diff               @@
##             develop     #2851       +/-   ##
===============================================
+ Coverage      82.36%   100.00%   +17.63%     
+ Complexity       694         7      -687     
===============================================
  Files            205         2      -203     
  Lines           3135        32     -3103     
  Branches         146         0      -146     
===============================================
- Hits            2582        32     -2550     
+ Misses           484         0      -484     
+ Partials          69         0       -69     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.