feat(victoriametrics): update image docker.io/victoriametrics/victoria-metrics v1.137.0 → v1.138.0 (#46113)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
[docker.io/victoriametrics/victoria-metrics](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics)
| minor | `15a3261` → `b9b667f` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/18710) for more information.

Add the preset `:preserveSemverRanges` to your config if you don't want
to pin your dependencies.

---

### Release Notes

<details>
<summary>VictoriaMetrics/VictoriaMetrics
(docker.io/victoriametrics/victoria-metrics)</summary>

###
[`v1.138.0`](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.138.0)

[Compare
Source](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.137.0...v1.138.0)

####
[v1.138.0](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.138.0)

Released at 2026-03-13

- SECURITY: upgrade Go builder from Go1.26.0 to Go1.26.1. See [the list
of issues addressed in
Go1.26.1](https://redirect.github.com/golang/go/issues?q=milestone%3AGo1.26.1%20label%3ACherryPickApproved).

- FEATURE:
[vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/):
add `headers` field to `oauth2` scrape config for passing custom HTTP
headers to `token_url`. Some services require different headers for the
token endpoint and the scrape targets. See
[#&#8203;8939](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/8939).

- FEATURE:
[vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add
[OIDC
Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html)
support for JWT authentication. `vmauth` can now automatically fetch and
rotate public keys from an OpenID Connect provider, eliminating the need
to specify public keys manually. See [OIDC
Discovery](https://docs.victoriametrics.com/victoriametrics/vmauth/#oidc-discovery)
docs. See
[#&#8203;10585](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10585).

- FEATURE: all VictoriaMetrics components: implement proper CORS
preflight handling by responding 204 No Content to HTTP OPTIONS
requests. See
[#&#8203;5563](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/5563).

- FEATURE:
[vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add
`access_log` configuration option for each user that will log requests
to stdout, and support filtering by HTTP status codes. See more in
[docs](https://docs.victoriametrics.com/victoriametrics/vmauth/#access-log).
See
[#&#8203;5936](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/5936).

- FEATURE:
[vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): add
JWT token `match_claims` for requests routing. Read more about
configuration in [JWT claim
matching](https://docs.victoriametrics.com/victoriametrics/vmauth/#jwt-claim-matching)
documentation. See
[#&#8203;10584](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10584).

- FEATURE:
[vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/):
support negative values for the group `eval_offset` option, which allows
starting group evaluation at `groupInterval-abs(eval_offset)` within
`[0...groupInterval]`. See
[#&#8203;10424](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10424).

- FEATURE:
[vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/)
and `vmselect` in [VictoriaMetrics
cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/):
Disable `/graphite/tags/tagSeries` and `/graphite/tags/tagMultiSeries`
for Graphite tag registration since it is unlikely it is used in context
of VictoriaMetrics. See
[10544](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10544).

- FEATURE:
[vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui):
rename debug tools buttons for clarity. See
[#&#8203;10453](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10453).

- BUGFIX: all VictoriaMetrics components: replace `histogram` with
`untyped` metric metadata type for [VictoriaMetrics
histograms](https://docs.victoriametrics.com/victoriametrics/keyconcepts/#histogram)
when `-metrics.exposeMetadata` is set. See
[#&#8203;82](https://redirect.github.com/VictoriaMetrics/metrics/issues/82).

- BUGFIX:
[vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/):
properly route requests to `default_url`. Previously, `request_path`
query arg could be set incorrectly during concurrent requests. See
[#&#8203;10626](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/pull/10626).

- BUGFIX:
[vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui):
use `increase_pure` instead of `rate` for histogram heatmaps in Explore
Metrics to correctly display the first observation in each new bucket.
See
[#&#8203;10365](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10365).
Thanks to [@&#8203;ab0utbla-k](https://redirect.github.com/ab0utbla-k)
for the contribution.

- BUGFIX:
[dashboards/vmauth](https://grafana.com/grafana/dashboards/21394): fix
`requested from system` and `heap inuse` expressions in the memory usage
panel. See
[#&#8203;10574](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/pull/10574).

- BUGFIX: [vmbackup](https://docs.victoriametrics.com/vmbackup/),
[vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/):
do not enable ACL when uploading backups to S3-compatible endpoints by
default. ACL is not always supported by S3-compatible endpoints and it
is not recommended to use ACLs to limit access to objects. See
[#&#8203;10539](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10539)
for more details.

- BUGFIX:
[vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/):
overwrite s3 object metadata while syncing latest backups with other
backup types. See
[#&#8203;10639](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10639).

- BUGFIX:
[vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/),
[vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/),
`vminsert` and `vmstorage` in [VictoriaMetrics
cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/):
properly attach `host` label to the time series ingested via
[/datadog/api/beta/sketches](https://docs.victoriametrics.com/victoriametrics/integrations/datadog/#)
API. See
[#&#8203;10557](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10557).

- BUGFIX: `vmstorage` in [VictoriaMetrics
cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/):
fix inaccurate `vm_filestream_write_duration_seconds_total` due to
duplicate counting . After the fix,
`vm_filestream_write_duration_seconds_total` will track the duration
spent on calling the `write(2)` system call properly. See
[#&#8203;10564](https://redirect.github.com/VictoriaMetrics/VictoriaMetrics/issues/10564).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yOS4yIiwidXBkYXRlZEluVmVyIjoiNDMuMjkuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJhcHAvdmljdG9yaWFtZXRyaWNzIiwiYXV0b21lcmdlIiwicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==-->

charts/stable/victoriametrics/Chart.yaml

@@ -14,7 +14,7 @@ annotations:
   trueforge.org/min_helm_version: "3.14"
   trueforge.org/train: stable
 apiVersion: v2
-appVersion: 1.137.0
+appVersion: 1.138.0
 dependencies:
   - name: common
     version: 28.33.4
@@ -42,5 +42,5 @@ sources:
   - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/victoriametrics
   - https://hub.docker.com/r/victoriametrics/victoria-metrics
 type: application
-version: 4.34.2
+version: 4.35.0
 

charts/stable/victoriametrics/values.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=./values.schema.json
 image:
   repository: docker.io/victoriametrics/victoria-metrics
-  tag: v1.137.0@sha256:15a3261e4776a47eb275755d30101b326bf8c3cc330998f80bdd3eb359618b10
+  tag: v1.138.0@sha256:b9b667f6709f20044328ddefae8869c56ced840ebafdf89bc3bba1f28f2d7e60
   pullPolicy: IfNotPresent
 service:
   main: