build(deps): bump github.com/VictoriaMetrics/VictoriaMetrics from 1.128.0 to 1.129.1 in /api

[dependabot]

Bumps github.com/VictoriaMetrics/VictoriaMetrics from 1.128.0 to 1.129.1.

Release notes

Sourced from github.com/VictoriaMetrics/VictoriaMetrics's releases.

v1.129.1

v1.129.1

Released at 2025-11-04

• BUGFIX: vminsert, vmagent and vmsingle: properly apply maxDataSize memory limits to the snappy encoded requests. It protects ingest endpoints from malicious requests.

v1.129.0

v1.129.0

Released at 2025-10-31

• FEATURE: vminsert and vmstorage in VictoriaMetrics cluster: introduce new RPC protocol for insert-storage communication. See this PR #9820 for details.

• FEATURE: vmalert: explicitly check response type for range queries during replay and return error on type mismatch. This change should reduce confusions like in #9779.

• FEATURE: vmctl: allow providing multiple filters for remote-read migration mode via multiple --remote-read-filter-label and --remote-read-filter-label-value flags. This is useful in order to narrow down the data being migrated by using more precise filters. See this PR #9917 for details.

• FEATURE: vmalert: support alert_relabel_configs per each notifier in -notifier.config file. See #5980.

• FEATURE: vmalert: add template function now to return the Unix timestamp in seconds at the time of the template evaluation. For example, {{ (now | toTime).Sub $activeAt }} can calculate duration the alert has been active. See this issue #9864 for more details. Thank you @​nguu0123 for the pull request.

• FEATURE: vmalert: start groups with group.interval > 5m faster. Before, vmalert was delaying group start for random duration up to group.interval. This could significantly delay group's evaluation if their interval was set to big values. With this change, vmalert limits the max start delay via new command-line flag --group.maxStartDelay (by default, 5m).

• FEATURE: vmagent: add /remotewrite-relabel-config and /api/v1/status/remotewrite-relabel-config API handlers for returning content of --remoteWrite.relabelConfig cmd-line flag. Useful for inspecting and verifying the final global relabeling rules used by vmagent. Access to new handlers can be protected via --configAuthKey command-line flag. See #9504.

• FEATURE: vmagent: add /remotewrite-url-relabel-config and /api/v1/status/remotewrite-url-relabel-config API handlers for returning content of --remoteWrite.urlRelabelConfig cmd-line flag. Useful for inspecting and verifying the final per-remote-write relabeling rules used by vmagent. Access to new handlers can be protected via --configAuthKey command-line flag. See #9504.

• FEATURE: vmagent: improve performance for the stream aggregation with multiple configured rules. See this issue #9878 for details.

• FEATURE: stream aggregation: change the behavior when both streamAggr.dropInput and streamAggr.keepInput are set to true. Previously, all input samples were kept when both flags were true. Now, only input samples matching any aggregation are retained; all others are dropped. See #9724.

• FEATURE: VictoriaMetrics enterprise: slow query statistics logging is now enabled by default with -search.logSlowQueryStats=5s. This makes it easier to analyze query performance via the Query Stats dashboard. See Query execution stats for more details.

• FEATURE: vmauth: make the load distribution more even among the backends which execute queries with various durations. See #9712.

• FEATURE: dashboards/all: enable column filters in Non-default flags panel. See #9910. Thanks to @​SamarthBagga for enhancement!

• FEATURE: add linux/s390x artifact to releases. See #9697 for the details.

• BUGFIX: vmbackup, vmrestore, vmbackupmanager: complete a fix of environment variables configuration parsing for connection to AWS S3. Previously, such settings were ignored starting from v1.115.0 and releases v1.128.0, v1.122.6 and v1.110.21 did not fix an issue completely. See this issue #9858 for details.

• BUGFIX: vmalert: fix search over group names and other attributes in vmalert's WEB UI. This functionality was broken since v1.117.0. See #9886 for details.

• BUGFIX: vmalert: preserve HTML formatting in rule's annotations in vmalert's WEB UI and vmui's alerting page. See #9892 for details.

• BUGFIX vmbackupmanager: consistently set vm_backup_last_created_at{type="latest"} to the latest backup start time.

• BUGFIX: vmbackupmanager: prevent breaking shell formatting when using vmbackupmanager CLI mode by adding a newline after the command output. Previously, using CLI mode would not always include newline at the end of output, which could break shell formatting.

Commits

• 5e98e0c CHANGELOG.md: cut v1.129.1 release
• 51b44af lib: properly apply snappy Decode limits
• 5a8d798 docs/vmanomaly: release v1.27.0 (#9954)
• 57752ca docs: update VM version to v1.129.0
• 171cdf0 deployment/docker: update VM version to v1.129.0
• 7d19ec2 lib/storage: extract storage file names into constants (#9944)
• a9b5033 docs/changelog: backport LTS changelog
• a783b20 docs/changelog: cut v1.129.0
• fd48c72 docs: update version tooltips
• 05e52fa app/vmselect: run make vmui-update
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.