chore(deps): update nix images: inventory/services/infra-monitoring.nix #107
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/nix-images-inventoryservicesinfra-monitoring.nix"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
13.2.3→13.2.4v1.153.0→v1.154.0v1.153.0→v1.154.0v1.153.0→v1.154.0Release Notes
grafana/grafana (docker.io/grafana/grafana)
v13.2.4Compare Source
Security
Features and enhancements
Bug fixes
VictoriaMetrics/VictoriaMetrics (docker.io/victoriametrics/victoria-metrics)
v1.154.0Compare Source
v1.154.0
Released at 2026-10-09
SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.2. See the list of issues addressed in Go1.27.2.
SECURITY: vmauth: slow down requests with invalid auth tokens even if
unauthorized_userhas URLs configured. Previously, such requests were proxied tounauthorized_userwithout delay, which allowed brute-forcing auth tokens. See GHSA-rpfx-hrcp-f73x.SECURITY: vmui: prevent cross-site scripting (XSS) on Metric Relabling Debug, Query Analyzier, and Dashboards pages. See GHSA-m2x2-9xpq-mmq5.
FEATURE: vmagent,
vminsertin VictoriaMetrics cluster and Single-node VictoriaMetrics: add/influx/pingendpoint, which returns theX-Influxdb-VersionHTTP header. Some InfluxDB clients, such as the Jenkins InfluxDB plugin, read the server version from this endpoint. See #11663. Thanks to @Vandit1604 for contribution.FEATURE: vmauth: add
oidc.auth_paramsoption to SSO config for passing additional query parameters to the IdP authentication request, e.g.,hdfor narrowing the Google account chooser to a single domain. Combine it withmatch_claimsto enforce the domain restriction. See these docs for more examples ofoidc.auth_paramsusage.FEATURE: vmsingle and
vmstoragein VictoriaMetrics cluster: abort incoming requests when a client disconnects and during graceful shutdown. See #11472.FEATURE: vmsingle and
vmselectin VictoriaMetrics cluster: cancel query requests if client disconnects. See #11355.BUGFIX: all VictoriaMetrics components: correctly configure TCP keep-alive active probes. See #11695.
BUGFIX: all VictoriaMetrics components: properly match regexps that start with an alternation or a character class and continue with
.*foo.*or.+foo.+, for example(a|b).*foo.*. Previously the leading part was ignored when matching relabelingregexandiffilters and stream aggregationmatchfilters, so such rules matched more series than intended. See #11712. Thanks to @dblackdblack for contribution.BUGFIX: alerts: fix incorrect results for
TooHighChurnRateandTooHighSlowInsertsRatein cluster alerting rules. Previously due to incorrect expressions, these rules stayed inactive since v1.108.0 and could produce false positives since v1.153.0. See #11670. Thanks to @transacid for contribution.BUGFIX: stream aggregation: properly add timeseries for increase, increase_prometheus, total and total_prometheus aggregation functions when
enable_windows: trueis set. See #11707. Thanks to @Hoipang for contribution.BUGFIX: vmalert: keep using notifiers from the previously applied notifier configuration file if the updated config fails to start, for example due to a temporary service discovery error, and retry applying it on the next reload. Previously, vmalert stopped the old notifiers before starting the new ones, so a failed reload left vmalert with no or only some notifiers, and alert notifications were silently not delivered until the file changed or vmalert restarted. See #11645.
BUGFIX: vmalert: copy alert labels before applying
alert_relabel_configsfrom the notifier configuration file, preventing different alertmanagers from affecting each other's labels. See #11676.BUGFIX: vmagent and vmalert: set the
HostHTTP request header to the resolved DNS SRV target instead of the SRV name when the url uses thesrv+prefix. Previously requests could fail at reverse proxies and load balancers, which route by theHostheader. See #8965.BUGFIX: vmauth: fixes rare data corruption on HTTP request retries. See #11508.
BUGFIX: vmauth: fix SSO login failure
Invalid state parametercaused by a race condition when multiple concurrent unauthenticated requests each set their own CSRF cookie. See #10278-comment and #11656.BUGFIX: vmauth: fix misleading
missing 'Authorization' request headerresponse for JWT-authenticated users when the requested path does not match anyurl_map. Now it correctly returns400 Bad Requestwithmissing routeerror, matching the behavior of Basic Auth and Bearer-token users. See #11523.BUGFIX: vmbackup and vmbackupmanager: add
-s3SkipTaggingDirectivecommand-line flag for S3-compatible storage that rejects thex-amz-tagging-directiveandx-amz-taggingheaders. See #11562.BUGFIX:
vmselectin VictoriaMetrics cluster: add missingaccountID,projectIDandmultiTenantfields totopByAvgMemoryUsageresults at/api/v1/status/top_queries. See #11640.BUGFIX:
vmselectin VictoriaMetrics cluster: prevent rare resource leak if-search.skipSlowReplicasflag is set. See #11551.BUGFIX: vmsingle and
vmselectin VictoriaMetrics cluster: properly executegroup_left(...)andgroup_right(..)queries when the join is then combined with another selector. See #11490.BUGFIX: vmsingle and
vmstoragein VictoriaMetrics cluster: prevent possible crash withcannot decompress zstd data...panic ondarwin,windows,freebsd,openbsd,linux/arm,linux/ppc64le,linux/386,linux/s390x, and-purebuilds. Thelinux/amd64andlinux/arm64builds are not affected. See #11683.BUGFIX: vmsingle: properly apply
-streamAggr.enableWindowscommand-line flag to stream aggregation rules. Previously, the flag was ignored by aggregation rules defined in-streamAggr.configand was applied only during config validation with-dryRunand to the standalone deduplication configured via-streamAggr.dedupInterval. See #11717.BUGFIX: vmsingle and
vmstoragein VictoriaMetrics cluster: properly release memory after historical data backfilling. Previously storage kept 8MiB*CPU memory for each month of ingested data until restart. See #11672. Thanks to @mars71003219 for contribution.BUGFIX: vmui: prevent overriding the
serverUrl,tenantId,theme, andisDarkThemesettings via query parameters. See #11485.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
ad6c570fcbto330839ff1cchore(deps): update nix images: inventory/services/infra-monitoring.nix to v1.154.0to chore(deps): update nix images: inventory/services/infra-monitoring.nix