docs: forward port LTS v1.136.15 changelog to upstream

Signed-off-by: Max Kotliar <mkotlyar@victoriametrics.com>

docs/victoriametrics/changelog/CHANGELOG.md

@@ -53,6 +53,25 @@ Release candidate
 * BUGFIX: [stream aggregation](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/): fix incorrect [sum_samples_total](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/configuration/#sum_samples_total) results when `enable_windows: true` is set. See [#11261](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11261). Thanks to @beyond-infra for contribution.
 * BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/) and [vmctl](https://docs.victoriametrics.com/victoriametrics/vmctl/): accept scientific notation with sub-second precision (e.g. `1.784144612388E9`) for timestamp args such as `start` and `end` in `/api/v1/query_range` and `--vm-native-filter-time-start` and `--vm-native-filter-time-end` in `vmctl`. Previously, values with this pattern were rejected, which is incompatible with Prometheus. See [#11268](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11268). Thanks to @STiFLeR7 for contribution.
 
+## [v1.148.1](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.148.1)
+
+Released at 2026-07-31
+
+**v1.148.x is a line of [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-releases/). It contains important up-to-date bugfixes for [VictoriaMetrics enterprise](https://docs.victoriametrics.com/victoriametrics/enterprise/).
+All these fixes are also included in [the latest community release](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/latest).
+The v1.148.x line will be supported for at least 12 months since [v1.148.0](https://docs.victoriametrics.com/victoriametrics/changelog/#v11480) release**
+
+**Update Note 1:** [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): the `/api/v1/admin/tsdb/delete_series`, `/tags/delSeries` endpoints now require `POST` method. Previously, it also accepted `GET` requests. If you use `GET` requests for this endpoint, update your scripts or tooling to use `POST` instead. See [#5552](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/5552).
+
+* SECURITY: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): restrict `/api/v1/admin/tsdb/delete_series`, `/tags/delSeries` endpoints to `POST` method only to prevent some [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery)-based data deletion attacks. See [#5552](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/5552).
+
+* BUGFIX: [MetricsQL](https://docs.victoriametrics.com/victoriametrics/metricsql/): properly drop data points filtered out by an inner [comparison operation](https://prometheus.io/docs/prometheus/latest/querying/operators/#comparison-binary-operators) when its result is used on the right side of another comparison. Previously, queries like `foo != (bar > 100)` could return unexpected results because filtered-out data points are represented internally as `NaN`, and `value != NaN` evaluates to `true`. Comparisons against explicitly present `NaN` values keep the previous behavior. See [#10018](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10018). Thanks to @zasdaym for contribution.
+* BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/): ignore HTTP proxy environment variables when scraping targets over Unix domain sockets. See [#11318](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11318). Thanks to @lwmacct for contribution.
+* BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): fixed the display of rule state badges on the `Groups` page in the web UI. See [#11160](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11160).
+* BUGFIX: [vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/): previously, `vmbackupmanager` was crashing on startup when it failed to restore backup state from remote storage, causing a crash loop. Now it logs the error and continues running, retrying the state restore before each scheduled backup. Added `vm_backup_errors_total{type="restoreState"}` metric to track backup state restore failures. See [#11217](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11217).
+* BUGFIX: [stream aggregation](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/): fix incorrect [sum_samples_total](https://docs.victoriametrics.com/victoriametrics/stream-aggregation/configuration/#sum_samples_total) results when `enable_windows: true` is set. See [#11261](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11261). Thanks to @beyond-infra for contribution.
+* BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/) and [vmctl](https://docs.victoriametrics.com/victoriametrics/vmctl/): accept scientific notation with sub-second precision (e.g. `1.784144612388E9`) for timestamp args such as `start` and `end` in `/api/v1/query_range` and `--vm-native-filter-time-start` and `--vm-native-filter-time-end` in `vmctl`. Previously, values with this pattern were rejected, which is incompatible with Prometheus. See [#11268](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11268). Thanks to @STiFLeR7 for contribution.
+
 ## [v1.148.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.148.0)
 
 Released at 2026-07-20
@@ -375,6 +394,20 @@ It enables back `Discovered targets` debug UI by default.
 * BUGFIX: `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly apply `extra_filters[]` filter when querying `vm_account_id` or `vm_project_id` labels via [multitenant](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/#multitenancy) request for `/api/v1/label/…/values` API. Before, `extra_filters` was ignored. See [#10503](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/10503).
 * BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): revert the use of rollup result cache for [instant queries](https://docs.victoriametrics.com/keyConcepts.html#instant-query) that contain [`rate`](https://docs.victoriametrics.com/MetricsQL.html#rate) function with a lookbehind window larger than `-search.minWindowForInstantRollupOptimization`. The cache usage was removed since [v1.132.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.132.0). See [#10098](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10098#issuecomment-3895011084) for more details.
 
+## [v1.136.15](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.15)
+
+Released at 2026-07-31
+
+**v1.136.x is a line of [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-releases/). It contains important up-to-date bugfixes for [VictoriaMetrics enterprise](https://docs.victoriametrics.com/victoriametrics/enterprise/).
+All these fixes are also included in [the latest community release](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/latest).
+The v1.136.x line will be supported for at least 12 months since [v1.136.0](https://docs.victoriametrics.com/victoriametrics/changelog/#v11360) release**
+
+**Update Note 1:** [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): the `/api/v1/admin/tsdb/delete_series`, `/tags/delSeries` endpoints now require `POST` method. Previously, it also accepted `GET` requests. If you use `GET` requests for this endpoint, update your scripts or tooling to use `POST` instead. See [#5552](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/5552).
+
+* SECURITY: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): restrict `/api/v1/admin/tsdb/delete_series`, `/tags/delSeries` endpoints to `POST` method only to prevent some [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery)-based data deletion attacks. See [#5552](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/5552).
+
+* BUGFIX: [vmbackupmanager](https://docs.victoriametrics.com/victoriametrics/vmbackupmanager/): previously, `vmbackupmanager` was crashing on startup when it failed to restore backup state from remote storage, causing a crash loop. Now it logs the error and continues running, retrying the state restore before each scheduled backup. Added `vm_backup_errors_total{type="restoreState"}` metric to track backup state restore failures. See [#11217](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11217).
+
 ## [v1.136.14](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.14)
 
 Released at 2026-07-17

lib/timeutil/time_test.go

@@ -24,62 +24,62 @@ func TestTryParseUnixTimestamp_Success(t *testing.T) {
 	f("0", 0)
 
 	// nanoseconds
-	f("-1234567890123456789", -1234567890123456789)
-	f("1234567890123456789", 1234567890123456789)
-	f("1234567890123456.789", 1234567890123456789)
+	f("-1234567890123456789", -1234567890_123_456_789)
+	f("1234567890123456789", 1234567890_123_456_789)
+	f("1234567890123456.789", 1234567890_123_456_789)
 
 	// microseconds
-	f("-1234567890123456", -1234567890123456000)
-	f("1234567890123456", 1234567890123456000)
-	f("1234567890123456.789", 1234567890123456789)
+	f("-1234567890123456", -1234567890_123_456_000)
+	f("1234567890123456", 1234567890_123_456_000)
+	f("1234567890123456.789", 1234567890_123_456_789)
 
 	// milliseconds
-	f("-1234567890123", -1234567890123000000)
-	f("1234567890123", 1234567890123000000)
-	f("1234567890123.456", 1234567890123456000)
+	f("-1234567890123", -1234567890_123_000_000)
+	f("1234567890123", 1234567890_123_000_000)
+	f("1234567890123.456", 1234567890_123_456_000)
 
 	// seconds
-	f("-1234567890", -1234567890000000000)
-	f("1234567890", 1234567890000000000)
-	f("1234567890.123456789", 1234567890123456789)
-	f("1234567890.12345678", 1234567890123456780)
-	f("1234567890.1234567", 1234567890123456700)
-	f("-1234567890.123456", -1234567890123456000)
-	f("-1234567890.12345", -1234567890123450000)
-	f("-1234567890.1234", -1234567890123400000)
-	f("-1234567890.123", -1234567890123000000)
-	f("-1234567890.12", -1234567890120000000)
-	f("-1234567890.1", -1234567890100000000)
+	f("-1234567890", -1234567890_000_000_000)
+	f("1234567890", 1234567890_000_000_000)
+	f("1234567890.123456789", 1234567890_123_456_789)
+	f("1234567890.12345678", 1234567890_123_456_780)
+	f("1234567890.1234567", 1234567890_123_456_700)
+	f("-1234567890.123456", -1234567890_123_456_000)
+	f("-1234567890.12345", -1234567890_123_450_000)
+	f("-1234567890.1234", -1234567890_123_400_000)
+	f("-1234567890.123", -1234567890_123_000_000)
+	f("-1234567890.12", -1234567890_120_000_000)
+	f("-1234567890.1", -1234567890_100_000_000)
 
 	// scientific notation
-	f("1e9", 1000000000000000000)
-	f("1.234e9", 1234000000000000000)
-	f("-1.23456789e9", -1234567890000000000)
-	f("1.234567890123456789e18", 1234567890123456789)
-	f("-1.234567890123456789e18", -1234567890123456789)
-	f("0.23456789e9", 234567890000000000)
-	f("123.456789123e9", 123456789123000000)
-	f("-1234.5678912e9", -1234567891200000000)
-	f("123.678912e7", 1236789120000000000)
-	f("1.23e7", 12300000000000000)
-	f("1.23e6", 1230000000000000)
-	f("1.23e5", 123000000000000)
-	f("1.23e4", 12300000000000)
-	f("1.23e3", 1230000000000)
-	f("1.23e2", 123000000000)
-	f("1.2e1", 12000000000)
-	f("1123.456789123456789E15", 1123456789123456789)
+	f("1e9", 1000000000_000_000_000)
+	f("1.234e9", 1234000000_000_000_000)
+	f("-1.23456789e9", -1234567890_000_000_000)
+	f("1.234567890123456789e18", 1234567890_123_456_789)
+	f("-1.234567890123456789e18", -1234567890_123_456_789)
+	f("0.23456789e9", 234567890_000_000_000)
+	f("123.456789123e9", 123456789_123_000_000)
+	f("-1234.5678912e9", -1234567891_200_000_000)
+	f("123.678912e7", 1236789120_000_000_000)
+	f("1.23e7", 12300000_000_000_000)
+	f("1.23e6", 1230000_000_000_000)
+	f("1.23e5", 123000_000_000_000)
+	f("1.23e4", 12300_000_000_000)
+	f("1.23e3", 1230_000_000_000)
+	f("1.23e2", 123_000_000_000)
+	f("1.2e1", 12_000_000_000)
+	f("1123.456789123456789E15", 1123456789_123_456_789)
 
 	// scientific notation with sub-second precision, i.e. more fractional digits
 	// than the exponent shifts (https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11268).
 	// These must match the equivalent plain fractional form.
-	f("1.784144612388E9", 1784144612388000000) // == 1784144612.388
-	f("1.784144612388e9", 1784144612388000000)
-	f("-1.784144612388e9", -1784144612388000000)
-	f("1.5000000005e9", 1500000000500000000) // == 1500000000.5
-	f("1.23456789e9", 1234567890000000000)   // exponent consumes all frac digits (integer result)
-	f("1.23e1", 12300000000000)              // == 12.3
-	f("1.234e0", 1234000000000)              // == 1.234
+	f("1.784144612388E9", 1784144612_388_000_000) // == 1784144612.388
+	f("1.784144612388e9", 1784144612_388_000_000)
+	f("-1.784144612388e9", -1784144612_388_000_000)
+	f("1.5000000005e9", 1500000000_500_000_000) // == 1500000000.5
+	f("1.23456789e9", 1234567890_000_000_000)   // exponent consumes all frac digits (integer result)
+	f("1.23e1", 12300_000_000_000)              // == 12.3
+	f("1.234e0", 1234_000_000_000)              // == 1.234
 }
 
 func TestTryParseUnixTimestamp_Failure(t *testing.T) {
@@ -146,27 +146,27 @@ func TestParseTimeAtSuccess(t *testing.T) {
 	now := time.Now().UnixNano()
 
 	// unix timestamp in seconds
-	f("1562529662", now, 1562529662*1e9)
-	f("1562529662.6", now, 1562529662600*1e6)
-	f("1562529662.67", now, 1562529662670*1e6)
-	f("1562529662.678", now, 1562529662678*1e6)
-	f("1562529662.678123", now, 1562529662678123*1e3)
-	f("1562529662.678123456", now, 1562529662678123456)
+	f("1562529662", now, 1562529662_000_000_000)
+	f("1562529662.6", now, 1562529662_600_000_000)
+	f("1562529662.67", now, 1562529662_670_000_000)
+	f("1562529662.678", now, 1562529662_678_000_000)
+	f("1562529662.678123", now, 1562529662_678_123_000)
+	f("1562529662.678123456", now, 1562529662_678_123_456)
 
 	// unix timestamp in milliseconds
-	f("1562529662678", now, 1562529662678*1e6)
-	f("1562529662678.9", now, 1562529662678900*1e3)
-	f("1562529662678.901", now, 1562529662678901*1e3)
-	f("1562529662678.901324", now, 1562529662678901324)
+	f("1562529662678", now, 1562529662_678_000_000)
+	f("1562529662678.9", now, 1562529662_678_900_000)
+	f("1562529662678.901", now, 1562529662_678_901_000)
+	f("1562529662678.901324", now, 1562529662_678_901_324)
 
 	// unix timestamp in microseconds
-	f("1562529662678901", now, 1562529662678901*1e3)
-	f("1562529662678901.3", now, 1562529662678901300)
-	f("1562529662678901.32", now, 1562529662678901320)
-	f("1562529662678901.321", now, 1562529662678901321)
+	f("1562529662678901", now, 1562529662_678_901_000)
+	f("1562529662678901.3", now, 1562529662_678_901_300)
+	f("1562529662678901.32", now, 1562529662_678_901_320)
+	f("1562529662678901.321", now, 1562529662_678_901_321)
 
 	// unix timestamp in nanoseconds
-	f("1562529662678901234", now, 1562529662678901234)
+	f("1562529662678901234", now, 1562529662_678_901_234)
 
 	// duration relative to the current time
 	f("now", now, now)
@@ -175,7 +175,7 @@ func TestParseTimeAtSuccess(t *testing.T) {
 	// negative duration relative to the current time
 	f("-5m", now, now-5*60*1e9)
 	f("-123", now, now-123*1e9)
-	f("-123.456", now, now-123456*1e6)
+	f("-123.456", now, now-123_456*1e6)
 	f("now-1h5m", now, now-(3600+5*60)*1e9)
 
 	// Year
@@ -209,9 +209,9 @@ func TestParseTimeAtSuccess(t *testing.T) {
 	f("2023-05-20T04:57:43-02:30", now, 1.684567663e+09*1e9)
 
 	// milliseconds
-	f("2023-05-20T04:57:43.123Z", now, 1684558663123000000)
-	f("2023-05-20T04:57:43.123456789+02:30", now, 1684549663123456789)
-	f("2023-05-20T04:57:43.123456789-02:30", now, 1684567663123456789)
+	f("2023-05-20T04:57:43.123Z", now, 1684558663_123_000_000)
+	f("2023-05-20T04:57:43.123456789+02:30", now, 1684549663_123_456_789)
+	f("2023-05-20T04:57:43.123456789-02:30", now, 1684567663_123_456_789)
 }
 
 func TestParseTimeAtLimits(t *testing.T) {