go.mod: security update golang.org/x/crypto

Fixes: NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5006 Critical < 0.1% (21st) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5023 Critical < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5017 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5020 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5013 High < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5005 Critical < 0.1% (13th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5021 Critical < 0.1% (11th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5019 Critical < 0.1% (9th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5018 High < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5033 Medium < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5014 Medium < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5015 Medium < 0.1% (8th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5016 Medium < 0.1% (6th) < 0.1
docs/changelog: cut release v1.145.0
2026-06-09 20:04:48 +03:00 · 2026-06-05 20:48:57 +03:00 · 2026-06-05 15:42:48 +03:00 · 2026-06-05 15:34:42 +03:00 · 2026-06-05 14:51:46 +03:00
11 changed files with 346 additions and 4873 deletions
--- a/.github/workflows/codeql-analysis-go.yml
+++ b/.github/workflows/codeql-analysis-go.yml
@@ -52,14 +52,14 @@ jobs:
          restore-keys: go-artifacts-${{ runner.os }}-codeql-analyze-${{ steps.go.outputs.go-version }}-

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
        with:
          languages: go

      - name: Autobuild
-        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
        with:
          category: 'language:go'
--- a/app/vmselect/vmui/assets/index-BBUnmLOr.css
+++ b/app/vmselect/vmui/assets/index-BBUnmLOr.css
--- a/app/vmselect/vmui/assets/index-BL7jEFBa.css
+++ b/app/vmselect/vmui/assets/index-BL7jEFBa.css
--- a/app/vmselect/vmui/assets/index-CoGukb-x.js
+++ b/app/vmselect/vmui/assets/index-CoGukb-x.js
--- a/app/vmselect/vmui/index.html
+++ b/app/vmselect/vmui/index.html
@@ -37,11 +37,11 @@
  <meta property="og:title" content="UI for VictoriaMetrics">
  <meta property="og:url" content="https://victoriametrics.com/">
  <meta property="og:description" content="Explore and troubleshoot your VictoriaMetrics data">
-  <script type="module" crossorigin src="./assets/index-U3iNn2Tx.js"></script>
+  <script type="module" crossorigin src="./assets/index-CoGukb-x.js"></script>
  <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-COnpUsM8.js">
  <link rel="modulepreload" crossorigin href="./assets/vendor-C8Kwp93_.js">
  <link rel="stylesheet" crossorigin href="./assets/vendor-CnsZ1jie.css">
-  <link rel="stylesheet" crossorigin href="./assets/index-BL7jEFBa.css">
+  <link rel="stylesheet" crossorigin href="./assets/index-BBUnmLOr.css">
 </head>
 <body>
 <noscript>You need to enable JavaScript to run this app.</noscript>
--- a/docs/victoriametrics/changelog/CHANGELOG.md
+++ b/docs/victoriametrics/changelog/CHANGELOG.md
@@ -26,8 +26,13 @@ See also [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-rel

 ## tip

+## [v1.145.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.145.0)
+
+Release candidate
+
 * SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See [the list of issues addressed in Go1.26.4](https://github.com/golang/go/issues?q=milestone%3AGo1.26.4%20label%3ACherryPickApproved).

+* FEATURE: [enterprise](https://docs.victoriametrics.com/enterprise/) [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): add the new metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` for measuring background historical data merge completion time. See [#10960](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10960)
 * FEATURE: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): support `match[]=<label_selector>` query parameters in `/api/v1/rules` and `/api/v1/alerts` APIs to return only the rules that have configured labels satisfying the provided label selectors. See [11020](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11020).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): add `-opentelemetry.promoteAllResourceAttributes` and `-opentelemetry.promoteScopeMetadata` command-line flags to allow managing label promotion for resource attributes and OTel scope metadata. See [OpenTelemetry](https://docs.victoriametrics.com/victoriametrics/integrations/opentelemetry/) docs and [#10931](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10931).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/vmagent/) : introduce `vmagent_remotewrite_kafka_outbuf_latency_seconds` and  `vmagent_remotewrite_kafka_rtt_seconds` metrics for [kafka integration](https://docs.victoriametrics.com/victoriametrics/integrations/kafka/). The metrics could help identify throughput bottlenecks. See [#10730](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10730).
--- a/go.mod
+++ b/go.mod
@@ -25,6 +25,7 @@ require (
 	github.com/googleapis/gax-go/v2 v2.22.0
 	github.com/influxdata/influxdb v1.12.4
 	github.com/klauspost/compress v1.18.5
+	github.com/oklog/ulid/v2 v2.1.1
 	github.com/prometheus/prometheus v0.311.3
 	github.com/urfave/cli/v2 v2.27.7
 	github.com/valyala/fastjson v1.6.10
@@ -109,7 +110,6 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect
-	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.150.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/pkg/pdatautil v0.150.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/processor/deltatocumulativeprocessor v0.150.0 // indirect
@@ -155,7 +155,7 @@ require (
 	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/term v0.43.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -509,8 +509,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
--- a/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
@@ -20,7 +20,7 @@ func chacha20Poly1305Open(dst []byte, key []uint32, src, ad []byte) bool
 func chacha20Poly1305Seal(dst []byte, key []uint32, src, ad []byte)

 var (
-	useAVX2 = cpu.X86.HasAVX2 && cpu.X86.HasBMI2
+	useAVX2 = cpu.X86.HasSSSE3 && cpu.X86.HasAVX2 && cpu.X86.HasBMI2
 )

 // setupState writes a ChaCha20 input matrix to state. See
@@ -47,7 +47,7 @@ func setupState(state *[16]uint32, key *[32]byte, nonce []byte) {
 }

 func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []byte {
-	if !cpu.X86.HasSSSE3 {
+	if !useAVX2 {
 		return c.sealGeneric(dst, nonce, plaintext, additionalData)
 	}

@@ -66,7 +66,7 @@ func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []
 }

 func (c *chacha20poly1305) open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {
-	if !cpu.X86.HasSSSE3 {
+	if !useAVX2 {
 		return c.openGeneric(dst, nonce, ciphertext, additionalData)
 	}

--- a/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -851,7 +851,7 @@ go.yaml.in/yaml/v2
 # go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.51.0
+# golang.org/x/crypto v0.52.0
 ## explicit; go 1.25.0
 golang.org/x/crypto/chacha20
 golang.org/x/crypto/chacha20poly1305
Author	SHA1	Message	Date
Max Kotliar	3147f9c24b	go.mod: security update golang.org/x/crypto Fixes: NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5006 Critical < 0.1% (21st) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5023 Critical < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5017 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5020 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5013 High < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5005 Critical < 0.1% (13th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5021 Critical < 0.1% (11th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5019 Critical < 0.1% (9th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5018 High < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5033 Medium < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5014 Medium < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5015 Medium < 0.1% (8th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5016 Medium < 0.1% (6th) < 0.1	2026-06-05 20:48:57 +03:00
Max Kotliar	db8c9badbf	docs/changelog: cut release v1.145.0 Signed-off-by: Max Kotliar <mkotlyar@victoriametrics.com>	2026-06-05 15:42:48 +03:00
Max Kotliar	2dc487d125	app/vmselect: run make vmui-update Signed-off-by: Max Kotliar <mkotlyar@victoriametrics.com>	2026-06-05 15:34:42 +03:00
Nikolay	4cb5fae347	lib/storage: add scheduled rows metrics for calculation background merge completion (#1048 ) Previously, only the size and number of partitions were exposed as metrics. It's not enough to estimate the possible completion time. New metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` allow predicting completion time by the following query: ``` sum(vm_downsampling_partitions_scheduled_rows) / sum(rate(vm_rows_merged_total{type="storage/big"})) ``` and ``` sum(vm_retention_filters_partitions_scheduled_rows) / sum(rate(vm_rows_merged_total{type="storage/big"})) ``` Note, `vm_rows_merged_total` accounts for all possible merges, and it could slightly overestimate completion time. Fixes https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10960 PR https://github.com/VictoriaMetrics/VictoriaMetrics-enterprise/pull/1048	2026-06-05 14:51:46 +03:00