fix(deps): update module github.com/victoriametrics/victoriametrics to v1.151.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/VictoriaMetrics/VictoriaMetrics	v1.150.0 → v1.151.0

---

Release Notes

VictoriaMetrics/VictoriaMetrics (github.com/VictoriaMetrics/VictoriaMetrics)

v1.151.0

Compare Source

v1.151.0

Released at 2026-08-28

• SECURITY: vmsingle, vmagent, vminsert and vmselect in VictoriaMetrics cluster: check HTTP Basic Auth credentials from the -httpAuth.* command-line flags for cases that do not verify the corresponding *AuthKey command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as /config, /reload. For example, /api/v1/import/prometheus/config was routed to the data ingestion handler /api/v1/import/prometheus without checking -httpAuth.* credentials.

• FEATURE: all VictoriaMetrics components: add support for accepting HTTP requests over Unix domain socket at -httpListenAddr. For example, -httpListenAddr=unix:/run/victoria-metrics.sock. See VictoriaLogs#1618.

• FEATURE: vmagent, vmsingle, vmstorage and vmselect in VictoriaMetrics cluster: expose the vm_app_prev_shutdown_unclean gauge. It is set to 1 when the previous process run didn't shut down cleanly. Added the UncleanShutdown alerting rule, which fires for 10 minutes after an unclean shutdown is detected. See #​8443.

• FEATURE: vmui: show the selected time zone UTC offset next to the date/time controls and allow opening time zone settings from it. See #​11332.

• FEATURE: vmsingle, vmagent, vmalert, and vmselect in VictoriaMetrics cluster: show how the default value is calculated for command-line flags which derive it from the number of available CPU cores. For example, -maxConcurrentInserts now prints (default 16 = 2*cgroup.AvailableCPUs()) in -help output instead of (default 16). Updated flags: -search.maxConcurrentRequests, -search.maxWorkersPerQuery, -fs.maxConcurrency, -remoteWrite.concurrency, -remoteWrite.queues. See #​9680. Thanks to @​Vandit1604 for contribution.

• FEATURE: vmagent: introduce vmagent_kafka_consumer_broker_rtt_seconds and vmagent_kafka_consumer_fetch_queue_size metrics for Kafka consumer integration. These metrics help troubleshoot slow Kafka consumption. See #​11342.

• BUGFIX: alerts: fix AlertingRuleResultsApproachingLimit and RecordingRuleResultsApproachingLimit alerting rules in vmalert alerting rules. The alerts could produce incorrect results or fail to fire when vmalert_group_rule_results_limit returned multiple samples per (group, file) label combination, causing the on(group,file) group_left() vector matching to fail. See #​11449.

• BUGFIX: vmagent and vminsert in VictoriaMetrics cluster: fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (/opentelemetry/api/v1/push) when receiving a malformed record with an incomplete varint in the data field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See #​11424.

• BUGFIX: vmalert-tool: reuse connections to -remoteWrite.url when writing the results of recording rules and alerts. Previously every series was sent over a new connection, which left a lot of sockets in TIME_WAIT state and could exhaust the ephemeral port range. The number of idle connections can be tuned via the new -remoteWrite.maxIdleConnections command-line flag. See #​11387. Thanks @​evkuzin for contribution.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: prevent process crash in sort_by_label_numeric() and sort_by_label_numeric_desc() when a label value contains a number with 309 or more digits. See #​11423.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: fixes rare metrics metadata partial search response. See #​11384.

• BUGFIX: vmctl: reuse connections in vm-native mode when --vm-concurrency exceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when --vm-concurrency was bigger than 2. See #​11451.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly re-use memory if query aggregation returns error. See #​11426.

• BUGFIX: vmselect in VictoriaMetrics cluster: fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See #​4688.

• BUGFIX: vmselect in VictoriaMetrics cluster: consistently re-use memory during storage blocks unpacking on parsing storage block error. See #​11421.

• BUGFIX: vmalert: fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. 1786458420.123) or scientific-notation (e.g. 1.78645842E9) values were silently truncated to 0. See #​11396. Thanks to @​missusk for the contribution.

• BUGFIX: vmctl: properly release the export and import requests during migration requests fails in vm-native mode. Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.

• BUGFIX: vmagent: include vm_account_id and vm_project_id labels in the instance identity used by monitoring data exchange filtering. Previously, when multitenant handlers were enabled, series from different tenants sharing the same job and instance labels could be misidentified as coming from a discovered VictoriaMetrics instance and leak into the -remoteWrite.mdx.enable destination. See #​11381.

• BUGFIX: vmsingle, vminsert in VictoriaMetrics cluster and vmagent: fix process crash at /api/v1/import/native endpoint when receiving a specially crafted ~45-byte request. #​11471.

• BUGFIX: vmsingle, vmagent and vmstorage in VictoriaMetrics cluster: allow access to /remotewrite-relabel-config, /api/v1/status/remotewrite-relabel-config, /remotewrite-url-relabel-config, /api/v1/status/remotewrite-url-relabel-config and /internal/log_new_series with only the corresponding -configAuthKey or -logNewSeriesAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See bedc69014.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.