go.mod: security update golang.org/x/crypto

Fixes: NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5006 Critical < 0.1% (21st) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5023 Critical < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5017 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5020 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5013 High < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5005 Critical < 0.1% (13th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5021 Critical < 0.1% (11th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5019 Critical < 0.1% (9th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5018 High < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5033 Medium < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5014 Medium < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5015 Medium < 0.1% (8th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5016 Medium < 0.1% (6th) < 0.1
docs/changelog: cut release v1.145.0
2026-06-09 03:43:58 +03:00 · 2026-06-05 20:48:57 +03:00 · 2026-06-05 15:42:48 +03:00 · 2026-06-05 15:34:42 +03:00 · 2026-06-05 14:51:46 +03:00
14 changed files with 349 additions and 4901 deletions
--- a/app/vmselect/promql/exec_test.go
+++ b/app/vmselect/promql/exec_test.go
@@ -8801,17 +8801,6 @@ func TestExecSuccess(t *testing.T) {
 		resultExpected := []netstorage.Result{r}
 		f(q, resultExpected)
 	})
-	t.Run(`range()`, func(t *testing.T) {
-		t.Parallel()
-		q := `range()`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1000, 1000, 1000, 1000, 1000, 1000},
-			Timestamps: timestampsExpected,
-		}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
 	t.Run(`step()`, func(t *testing.T) {
 		t.Parallel()
 		q := `time() / step()`
--- a/app/vmselect/promql/transform.go
+++ b/app/vmselect/promql/transform.go
@@ -90,7 +90,6 @@ var transformFuncs = map[string]transformFunc{
 	"rand":                       newTransformRand(newRandFloat64),
 	"rand_exponential":           newTransformRand(newRandExpFloat64),
 	"rand_normal":                newTransformRand(newRandNormFloat64),
-	"range":                      newTransformFuncZeroArgs(transformRange),
 	"range_avg":                  newTransformFuncRange(runningAvg),
 	"range_first":                transformRangeFirst,
 	"range_last":                 transformRangeLast,
@@ -2809,10 +2808,6 @@ func transformEnd(tfa *transformFuncArg) float64 {
 	return float64(tfa.ec.End) / 1e3
 }

-func transformRange(tfa *transformFuncArg) float64 {
-	return float64(tfa.ec.End-tfa.ec.Start) / 1e3
-}
-
 // copyTimeseries returns a copy of tss.
 func copyTimeseries(tss []*timeseries) []*timeseries {
 	rvs := make([]*timeseries, len(tss))
--- a/app/vmselect/vmui/assets/index-BBUnmLOr.css
+++ b/app/vmselect/vmui/assets/index-BBUnmLOr.css
--- a/app/vmselect/vmui/assets/index-BL7jEFBa.css
+++ b/app/vmselect/vmui/assets/index-BL7jEFBa.css
--- a/app/vmselect/vmui/assets/index-CoGukb-x.js
+++ b/app/vmselect/vmui/assets/index-CoGukb-x.js
--- a/app/vmselect/vmui/index.html
+++ b/app/vmselect/vmui/index.html
@@ -37,11 +37,11 @@
  <meta property="og:title" content="UI for VictoriaMetrics">
  <meta property="og:url" content="https://victoriametrics.com/">
  <meta property="og:description" content="Explore and troubleshoot your VictoriaMetrics data">
-  <script type="module" crossorigin src="./assets/index-U3iNn2Tx.js"></script>
+  <script type="module" crossorigin src="./assets/index-CoGukb-x.js"></script>
  <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-COnpUsM8.js">
  <link rel="modulepreload" crossorigin href="./assets/vendor-C8Kwp93_.js">
  <link rel="stylesheet" crossorigin href="./assets/vendor-CnsZ1jie.css">
-  <link rel="stylesheet" crossorigin href="./assets/index-BL7jEFBa.css">
+  <link rel="stylesheet" crossorigin href="./assets/index-BBUnmLOr.css">
 </head>
 <body>
 <noscript>You need to enable JavaScript to run this app.</noscript>
--- a/docs/victoriametrics/MetricsQL.md
+++ b/docs/victoriametrics/MetricsQL.md
@@ -1357,7 +1357,7 @@ by replacing all the values bigger or equal to 30 with 40.
 `end()` is a [transform function](#transform-functions), which returns the unix timestamp in seconds for the last point.
 It is known as `end` query arg passed to [/api/v1/query_range](https://docs.victoriametrics.com/victoriametrics/keyconcepts/#range-query).

-See also [start](#start), [time](#time), [now](#now) and [range](#range).
+See also [start](#start), [time](#time) and [now](#now).

 #### exp

@@ -1575,12 +1575,6 @@ with [normal distribution](https://en.wikipedia.org/wiki/Normal_distribution). O

 See also [rand](#rand) and [rand_exponential](#rand_exponential).

-#### range
-
-`range()` is a [transform function](#transform-functions), which returns the range duration of the current query range evaluation in seconds and is equivalent to `end() - start()`.
-
-See also [start](#start) and [end](#end).
-
 #### range_avg

 `range_avg(q)` is a [transform function](#transform-functions), which calculates the avg value across points per each time series returned by `q`.
@@ -1795,7 +1789,7 @@ This function is supported by PromQL.

 It is known as `start` query arg passed to [/api/v1/query_range](https://docs.victoriametrics.com/victoriametrics/keyconcepts/#range-query).

-See also [end](#end), [time](#time), [now](#now) and [range](#range).
+See also [end](#end), [time](#time) and [now](#now).

 #### step

--- a/docs/victoriametrics/changelog/CHANGELOG.md
+++ b/docs/victoriametrics/changelog/CHANGELOG.md
@@ -26,16 +26,19 @@ See also [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-rel

 ## tip

+## [v1.145.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.145.0)
+
+Release candidate
+
 * SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See [the list of issues addressed in Go1.26.4](https://github.com/golang/go/issues?q=milestone%3AGo1.26.4%20label%3ACherryPickApproved).

+* FEATURE: [enterprise](https://docs.victoriametrics.com/enterprise/) [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): add the new metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` for measuring background historical data merge completion time. See [#10960](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10960)
 * FEATURE: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): support `match[]=<label_selector>` query parameters in `/api/v1/rules` and `/api/v1/alerts` APIs to return only the rules that have configured labels satisfying the provided label selectors. See [11020](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11020).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): add `-opentelemetry.promoteAllResourceAttributes` and `-opentelemetry.promoteScopeMetadata` command-line flags to allow managing label promotion for resource attributes and OTel scope metadata. See [OpenTelemetry](https://docs.victoriametrics.com/victoriametrics/integrations/opentelemetry/) docs and [#10931](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10931).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/vmagent/) : introduce `vmagent_remotewrite_kafka_outbuf_latency_seconds` and  `vmagent_remotewrite_kafka_rtt_seconds` metrics for [kafka integration](https://docs.victoriametrics.com/victoriametrics/integrations/kafka/). The metrics could help identify throughput bottlenecks. See [#10730](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10730).
 * FEATURE: [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/): properly log user information when a missing route error occurs. See [#11052](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11052).
 * FEATURE: [vmctl](https://docs.victoriametrics.com/vmctl/): add the ability to migrate data from [Mimir](https://docs.victoriametrics.com/victoriametrics/vmctl/mimir/#) object storage to VictoriaMetrics. See [#7717](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/7717). 
 * FEATURE: [dashboards](https://github.com/VictoriaMetrics/VictoriaMetrics/tree/master/dashboards): show the full `version` label in the `Version` panel when `short_version` label is empty (e.g. custom builds from feature branch). Previously, the panel could appear empty. See [#11047](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11047).
-* FEATURE: [MetricsQL](https://docs.victoriametrics.com/victoriametrics/metricsql/): support `range()` function, which returns the range duration of the current query range evaluation in seconds. See [#11028](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11028).
-

 * BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): fix the `Notifiers` page in web UI appearing blank despite the API returning notifier data correctly. See [#11035](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11035).
 * BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): reset the group evaluation timestamp if it exceeds the current host time. Previously, vmalert could use future timestamps for evaluations if the system clock was shifted backward. See [#10985](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10985).
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/VictoriaMetrics/easyproto v1.2.0
 	github.com/VictoriaMetrics/fastcache v1.13.3
 	github.com/VictoriaMetrics/metrics v1.43.2
-	github.com/VictoriaMetrics/metricsql v0.87.1
+	github.com/VictoriaMetrics/metricsql v0.87.0
 	github.com/aws/aws-sdk-go-v2 v1.41.5
 	github.com/aws/aws-sdk-go-v2/config v1.32.14
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.13
@@ -25,6 +25,7 @@ require (
 	github.com/googleapis/gax-go/v2 v2.22.0
 	github.com/influxdata/influxdb v1.12.4
 	github.com/klauspost/compress v1.18.5
+	github.com/oklog/ulid/v2 v2.1.1
 	github.com/prometheus/prometheus v0.311.3
 	github.com/urfave/cli/v2 v2.27.7
 	github.com/valyala/fastjson v1.6.10
@@ -109,7 +110,6 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect
-	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.150.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/pkg/pdatautil v0.150.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/processor/deltatocumulativeprocessor v0.150.0 // indirect
@@ -155,7 +155,7 @@ require (
 	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/term v0.43.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -60,8 +60,8 @@ github.com/VictoriaMetrics/fastcache v1.13.3 h1:rBabE0iIxcqKEMCwUmwHZ9dgEqXerg8F
 github.com/VictoriaMetrics/fastcache v1.13.3/go.mod h1:hHXhl4DA2fTL2HTZDJFXWgW0LNjo6B+4aj2Wmng3TjU=
 github.com/VictoriaMetrics/metrics v1.43.2 h1:+8pIQEGwchKS5CYFyvv3LKvNXGi7baZ9hmIV4RHqibY=
 github.com/VictoriaMetrics/metrics v1.43.2/go.mod h1:xDM82ULLYCYdFRgQ2JBxi8Uf1+8En1So9YUwlGTOqTc=
-github.com/VictoriaMetrics/metricsql v0.87.1 h1:GdIblCDgXsrBJcBSDtFT8SLK7P+QHijdQmcr4L/f0Go=
-github.com/VictoriaMetrics/metricsql v0.87.1/go.mod h1:d4EisFO6ONP/HIGDYTAtwrejJBBeKGQYiRl095bS4QQ=
+github.com/VictoriaMetrics/metricsql v0.87.0 h1:Koxh3GkB/Z0f3O0bEChVFxiE4YZoxYyn5TzmGJfSfaw=
+github.com/VictoriaMetrics/metricsql v0.87.0/go.mod h1:d4EisFO6ONP/HIGDYTAtwrejJBBeKGQYiRl095bS4QQ=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
@@ -509,8 +509,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
--- a/vendor/github.com/VictoriaMetrics/metricsql/transform.go
+++ b/vendor/github.com/VictoriaMetrics/metricsql/transform.go
@@ -74,7 +74,6 @@ var transformFuncs = map[string]bool{
 	"rand":                       true,
 	"rand_exponential":           true,
 	"rand_normal":                true,
-	"range":                      true,
 	"range_avg":                  true,
 	"range_first":                true,
 	"range_last":                 true,
--- a/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
@@ -20,7 +20,7 @@ func chacha20Poly1305Open(dst []byte, key []uint32, src, ad []byte) bool
 func chacha20Poly1305Seal(dst []byte, key []uint32, src, ad []byte)

 var (
-	useAVX2 = cpu.X86.HasAVX2 && cpu.X86.HasBMI2
+	useAVX2 = cpu.X86.HasSSSE3 && cpu.X86.HasAVX2 && cpu.X86.HasBMI2
 )

 // setupState writes a ChaCha20 input matrix to state. See
@@ -47,7 +47,7 @@ func setupState(state *[16]uint32, key *[32]byte, nonce []byte) {
 }

 func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []byte {
-	if !cpu.X86.HasSSSE3 {
+	if !useAVX2 {
 		return c.sealGeneric(dst, nonce, plaintext, additionalData)
 	}

@@ -66,7 +66,7 @@ func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []
 }

 func (c *chacha20poly1305) open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {
-	if !cpu.X86.HasSSSE3 {
+	if !useAVX2 {
 		return c.openGeneric(dst, nonce, ciphertext, additionalData)
 	}

--- a/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -145,7 +145,7 @@ github.com/VictoriaMetrics/fastcache
 # github.com/VictoriaMetrics/metrics v1.43.2
 ## explicit; go 1.24.0
 github.com/VictoriaMetrics/metrics
-# github.com/VictoriaMetrics/metricsql v0.87.1
+# github.com/VictoriaMetrics/metricsql v0.87.0
 ## explicit; go 1.24.2
 github.com/VictoriaMetrics/metricsql
 github.com/VictoriaMetrics/metricsql/binaryop
@@ -851,7 +851,7 @@ go.yaml.in/yaml/v2
 # go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.51.0
+# golang.org/x/crypto v0.52.0
 ## explicit; go 1.25.0
 golang.org/x/crypto/chacha20
 golang.org/x/crypto/chacha20poly1305
Author	SHA1	Message	Date
Max Kotliar	3147f9c24b	go.mod: security update golang.org/x/crypto Fixes: NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5006 Critical < 0.1% (21st) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5023 Critical < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5017 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5020 Critical < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5013 High < 0.1% (17th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5005 Critical < 0.1% (13th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5021 Critical < 0.1% (11th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5019 Critical < 0.1% (9th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5018 High < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5033 Medium < 0.1% (16th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5014 Medium < 0.1% (10th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5015 Medium < 0.1% (8th) < 0.1 golang.org/x/crypto v0.51.0 0.52.0 go-module GO-2026-5016 Medium < 0.1% (6th) < 0.1	2026-06-05 20:48:57 +03:00
Max Kotliar	db8c9badbf	docs/changelog: cut release v1.145.0 Signed-off-by: Max Kotliar <mkotlyar@victoriametrics.com>	2026-06-05 15:42:48 +03:00
Max Kotliar	2dc487d125	app/vmselect: run make vmui-update Signed-off-by: Max Kotliar <mkotlyar@victoriametrics.com>	2026-06-05 15:34:42 +03:00
Nikolay	4cb5fae347	lib/storage: add scheduled rows metrics for calculation background merge completion (#1048 ) Previously, only the size and number of partitions were exposed as metrics. It's not enough to estimate the possible completion time. New metrics `vm_downsampling_partitions_scheduled_rows` and `vm_retention_filters_partitions_scheduled_rows` allow predicting completion time by the following query: ``` sum(vm_downsampling_partitions_scheduled_rows) / sum(rate(vm_rows_merged_total{type="storage/big"})) ``` and ``` sum(vm_retention_filters_partitions_scheduled_rows) / sum(rate(vm_rows_merged_total{type="storage/big"})) ``` Note, `vm_rows_merged_total` accounts for all possible merges, and it could slightly overestimate completion time. Fixes https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10960 PR https://github.com/VictoriaMetrics/VictoriaMetrics-enterprise/pull/1048	2026-06-05 14:51:46 +03:00