Vector v0.61.0 release notes

Upgrading Vector
When upgrading, we recommend stepping through minor versions as these can each contain breaking changes while Vector is pre-1.0. These breaking changes are noted in their respective upgrade guides.

Vector Changelog

1 breaking change

  • Scheme-less vector sink endpoints default to https

    address and routing.endpoints values in the vector sink that omit the scheme (for example, 127.0.0.1:6000 instead of http://127.0.0.1:6000) now default to https. Previously they defaulted to http unless TLS was enabled. The http default was deprecated in 0.59.0.

    Endpoints that already specify a scheme, and scheme-less endpoints in configurations that enable TLS, are unaffected. A scheme-less endpoint pointing at a plaintext vector source now fails the TLS handshake.

    Thanks to JinchengCao for contributing PR #26699!

3 security changes

  • The databricks_zerobus sink now verifies server certificates and hostnames for OAuth and Unity Catalog schema requests. Previously, these requests disabled TLS verification, which could expose OAuth credentials and schema responses to a network attacker.
    Thanks to thomasqueirozb for contributing PR #26925!
  • The distroless-libc Docker image now uses gcr.io/distroless/cc-debian13 as its base instead of cc-debian12. The Debian 12 CA bundle still trusts the emSign ECC Root CA - G3 and AAA Certificate Services roots that the eMudhra intermediate certificate compromise affects (CVE-2026-111943). The Debian 13 bundle removes them.
    Thanks to thomasqueirozb for contributing PR #26911!
  • Updated the bundled Mozilla root certificate store to remove the emSign ECC Root CA - G3 root following the eMudhra intermediate certificate compromise, along with other roots Mozilla has since distrusted. TLS connections to servers whose chains end at a removed root now fail validation.
    Thanks to thomasqueirozb for contributing PR #26748!

3 new features

  • Added an opensearch sink for self-managed OpenSearch, Amazon OpenSearch Service, and Amazon OpenSearch Serverless. It shares the Elasticsearch sink’s configuration options and delivery behavior. The new sink selects an OpenSearch-compatible bulk API version by default, so an explicit api_version: v7 is not needed.
    Thanks to pront for contributing PR #26722!
  • The datadog_agent source now accepts the v3 series metrics intake format used by default by Datadog Agent 7.81.0 and newer.
    Thanks to arfa79 for contributing PR #26264!
  • VRL now includes a range function that creates an array of integers from a start value to an exclusive end value, with an optional step.
    Thanks to pront for contributing PR #26876!

6 enhancements

  • The VRL playground loads faster and keeps controls disabled until ready.
    Thanks to pront for contributing PR #26813!
  • The character_delimited and newline_delimited decoding framers now report frames dropped for exceeding max_length (oversized_action: drop) as an error: the message is logged at error level and component_errors_total is incremented with error_code="decoder_frame_too_long". Previously these drops were only logged as a warning. Dropping behavior is otherwise unchanged.
    Thanks to taylorchandleryoung for contributing PR #26746!
  • Vector now reports disk buffer lifecycle events during startup and configuration reloads. Each event is logged and increments the topology_disk_buffer_lifecycle_events_total counter with an event tag:

    • removed: A removed sink still had data in its disk buffer, or Vector could not read how much data it held. The log says whether the sink’s current instance keeps draining the buffer in the background or whether the reload waits for it to finish.
    • replacement_unreferenced: A changed sink no longer uses its previous disk buffer. If the reload succeeds, the new sink will not read any data left in the old buffer.
    • unreferenced: A disk buffer in the data directory is not used by the current configuration. It may still be draining through a detached sink instance. If not, any data it holds is not being processed.
    Thanks to Jansen-w for contributing PR #26050!
  • Avoid storing a copy of the default schema definition on every event when the shared default applies, reducing allocation and reference-count overhead when creating events.
    Thanks to bruceg for contributing PR #26744!
  • Optimized the log event estimated size cache to eliminate locked operations on its value while building events, improving ingestion performance.
    Thanks to bruceg for contributing PR #26713!
  • Configuration reloads on Windows no longer wait an extra 200 milliseconds after the changed components stop.
    Thanks to thomasqueirozb for contributing PR #26832!

11 bug fixes

  • The aws_ecs_metrics source now uses the correct values for ECS_CONTAINER_METADATA_URI_V4 and ECS_CONTAINER_METADATA_URI to resolve the metadata endpoint, ensuring metadata v4 endpoints are targeted properly.
    Thanks to Captain1653 for contributing PR #26729!
  • Fixed vdev check docs reporting unrelated dirty working tree files after running cue fmt. The check now snapshots CUE files before and after formatting so only files actually modified by the formatter are reported.
    Thanks to patrickswedish for contributing PR #26725!
  • The gcp_pubsub source now reconnects immediately, without logging an error, when the server resets a streaming pull. Since Vector 0.35.0 it logged an error and waited retry_delay_secs. It also trusts every certificate in tls.ca_file, not only the last one.
    Thanks to thomasqueirozb for contributing PR #26770!
  • The gcp_pubsub source no longer delays Vector shutdown when the shutdown starts while the source connects, waits to retry, or holds an open stream with acknowledgements enabled.
    Thanks to thomasqueirozb for contributing PR #26815!
  • The gcp_pubsub source now honors tls.verify_certificate, tls.verify_hostname, tls.server_name, and tls.alpn_protocols. It also uses the configured proxy.
    Thanks to thomasqueirozb for contributing PR #26808!
  • The gcp_pubsub source and HTTPS connections from vector top and vector tap now use the same system certificate authorities as other Vector components.
    Thanks to thomasqueirozb for contributing PR #26808!
  • The vector and opentelemetry sources now answer gRPC requests for unregistered services with gRPC status UNIMPLEMENTED instead of HTTP 404. These requests no longer log an error or increment component_errors_total.
    Thanks to thomasqueirozb for contributing PR #26770!
  • The mqtt sink now closes its broker connection when the sink stops, for example when a configuration reload removes or replaces it. Before, the connection stayed open, and the broker could repeatedly disconnect a replacement sink that used the same client ID.

    Before it stops, the sink sends its queued messages and completes pending QoS exchanges. A configuration reload that waits for the sink, for example because the replacement reuses its buffer, also waits for this step. If the connection fails during this step, the sink stops without a reconnect and the reload continues.

    Thanks to thomasqueirozb for contributing PR #26793!
  • Fixed a race in the redis source with data_type: list that could lose a list entry during graceful shutdown. The source now waits up to five seconds for an in-flight pop to finish and forwards any returned entry before stopping. Blocking pops time out after one second on an empty list, keeping shutdown responsive when Redis is healthy.
    Thanks to dsavov for contributing PR #26691!
  • The vector sink now sends configured credentials to HTTP forward proxies and applies tls.server_name to TLS connections through CONNECT proxies.
    Thanks to thomasqueirozb for contributing PR #26770!
  • Fixed a startup race in vector top on Unix. Depending on thread timing, it could exit with The cursor position could not be read within a normal duration before drawing the dashboard.
    Thanks to thomasqueirozb for contributing PR #26817!

1 chore

  • address and routing.endpoints values in the vector sink that omit the scheme (for example, 127.0.0.1:6000 instead of http://127.0.0.1:6000) now default to https. Previously they defaulted to http unless TLS was enabled. The http default was deprecated in 0.59.0.

    Endpoints that already specify a scheme, and scheme-less endpoints in configurations that enable TLS, are unaffected. A scheme-less endpoint pointing at a plaintext vector source now fails the TLS handshake.

    Thanks to JinchengCao for contributing PR #26699!

VRL Changelog

0.38.0 (2026-10-28)

Security

  • Updated rustls-webpki to 0.103.16 to address RUSTSEC-2026-0382. TLS certificate verification in http_request now rejects certificate chains that contain the compromised eMudhra emSign intermediate certificates, even when the system trust store still trusts their root.

Thanks to thomasqueirozb for contributing PR #2008!

New Features

  • Added a new range function that generates an array of integers from start (inclusive) to end (exclusive), with an optional step.

Thanks to lchabert for contributing PR #1994!

Enhancements

  • http_request now uses the platform certificate verifier for HTTPS connections.

Thanks to pront for contributing PR #2026!

  • Accept critical keyword in to_syslog_severity in addition to crit.

Thanks to slopggobblercobbler81 for contributing PR #2010!

  • VRL programs that assign objects or arrays now run faster and allocate less: an assignment whose value isn’t used (for example, any statement that isn’t the last expression of a block) no longer makes a deep copy of the assigned value.

Thanks to lukesteensen for contributing PR #2002!

Fixes

  • to_unix_timestamp with unit: "nanoseconds" is now correctly marked as fallible by the compiler. The conversion can fail at runtime when the timestamp is out of range for a 64-bit nanosecond value, but the compiler previously rejected error handling for this call as unnecessary.

Programs that call to_unix_timestamp with unit: "nanoseconds" are affected: they no longer compile until the error is handled. Other units are unaffected.

Before

to_unix_timestamp(ts, unit: "nanoseconds")

After

to_unix_timestamp!(ts, unit: "nanoseconds")

or with error coalescing:

to_unix_timestamp(ts, unit: "nanoseconds") ?? 0

Thanks to suryakant-source for contributing PR #2001!

Download Version 0.61.0

macOS
tar.gz
Windows
zip
Windows (MSI)
msi

Deprecation Announcements

See the deprecations page for all active and historical deprecations.

Ignored configuration fields

Configuration fields that Vector accepts but discards during deserialization are deprecated. Vector now warns about these fields when loading configuration, including during vector validate. Existing configurations continue to work.

Correct misspelled fields or remove fields that do not belong to the selected enum variant. For example, replace this HTTP sink request setting:

request:
  retry_atempts: 3

with:

request:
  retry_attempts: 3

For options that select an enum variant, keep only the fields used by that variant. For example, HTTP authentication with strategy: bearer uses token. Remove username and password, which belong to the basic variant:

auth:
  strategy: bearer
  token: example-token

Warnings identify field paths without including their values. Maps that accept arbitrary keys, such as HTTP headers, remain supported. Recognized settings documented as inactive in a particular mode, such as value_limit with mode: excluded in tag_cardinality_limit, are not affected by this deprecation.