Vector v0.61.0 release notes
Vector Changelog
1 breaking change
- Scheme-less
vectorsink endpoints default tohttpsaddressandrouting.endpointsvalues in thevectorsink that omit the scheme (for example,127.0.0.1:6000instead ofhttp://127.0.0.1:6000) now default tohttps. Previously they defaulted tohttpunless TLS was enabled. Thehttpdefault was deprecated in 0.59.0.Endpoints that already specify a scheme, and scheme-less endpoints in configurations that enable TLS, are unaffected. A scheme-less endpoint pointing at a plaintext
vectorsource now fails the TLS handshake.Thanks to JinchengCao for contributing PR #26699!
3 security changes
- The
databricks_zerobussink now verifies server certificates and hostnames for OAuth and Unity Catalog schema requests. Previously, these requests disabled TLS verification, which could expose OAuth credentials and schema responses to a network attacker.Thanks to thomasqueirozb for contributing PR #26925! - The
distroless-libcDocker image now usesgcr.io/distroless/cc-debian13as its base instead ofcc-debian12. The Debian 12 CA bundle still trusts theemSign ECC Root CA - G3andAAA Certificate Servicesroots that the eMudhra intermediate certificate compromise affects (CVE-2026-111943). The Debian 13 bundle removes them.Thanks to thomasqueirozb for contributing PR #26911! - Updated the bundled Mozilla root certificate store to remove the
emSign ECC Root CA - G3root following the eMudhra intermediate certificate compromise, along with other roots Mozilla has since distrusted. TLS connections to servers whose chains end at a removed root now fail validation.Thanks to thomasqueirozb for contributing PR #26748!
3 new features
- Added an
opensearchsink for self-managed OpenSearch, Amazon OpenSearch Service, and Amazon OpenSearch Serverless. It shares the Elasticsearch sink’s configuration options and delivery behavior. The new sink selects an OpenSearch-compatible bulk API version by default, so an explicitapi_version: v7is not needed. - The
datadog_agentsource now accepts the v3 series metrics intake format used by default by Datadog Agent 7.81.0 and newer. - VRL now includes a
rangefunction that creates an array of integers from a start value to an exclusive end value, with an optional step.
6 enhancements
- The VRL playground loads faster and keeps controls disabled until ready.
- The
character_delimitedandnewline_delimiteddecoding framers now report frames dropped for exceedingmax_length(oversized_action: drop) as an error: the message is logged aterrorlevel andcomponent_errors_totalis incremented witherror_code="decoder_frame_too_long". Previously these drops were only logged as a warning. Dropping behavior is otherwise unchanged.Thanks to taylorchandleryoung for contributing PR #26746! Vector now reports disk buffer lifecycle events during startup and configuration reloads. Each event is logged and increments the
topology_disk_buffer_lifecycle_events_totalcounter with aneventtag:removed: A removed sink still had data in its disk buffer, or Vector could not read how much data it held. The log says whether the sink’s current instance keeps draining the buffer in the background or whether the reload waits for it to finish.replacement_unreferenced: A changed sink no longer uses its previous disk buffer. If the reload succeeds, the new sink will not read any data left in the old buffer.unreferenced: A disk buffer in the data directory is not used by the current configuration. It may still be draining through a detached sink instance. If not, any data it holds is not being processed.
- Avoid storing a copy of the default schema definition on every event when the shared default applies, reducing allocation and reference-count overhead when creating events.
- Optimized the log event estimated size cache to eliminate locked operations on its value while building events, improving ingestion performance.
- Configuration reloads on Windows no longer wait an extra 200 milliseconds after the changed components stop.Thanks to thomasqueirozb for contributing PR #26832!
11 bug fixes
- The
aws_ecs_metricssource now uses the correct values forECS_CONTAINER_METADATA_URI_V4andECS_CONTAINER_METADATA_URIto resolve the metadata endpoint, ensuring metadata v4 endpoints are targeted properly.Thanks to Captain1653 for contributing PR #26729! - Fixed
vdev check docsreporting unrelated dirty working tree files after runningcue fmt. The check now snapshots CUE files before and after formatting so only files actually modified by the formatter are reported.Thanks to patrickswedish for contributing PR #26725! - The
gcp_pubsubsource now reconnects immediately, without logging an error, when the server resets a streaming pull. Since Vector 0.35.0 it logged an error and waitedretry_delay_secs. It also trusts every certificate intls.ca_file, not only the last one.Thanks to thomasqueirozb for contributing PR #26770! - The
gcp_pubsubsource no longer delays Vector shutdown when the shutdown starts while the source connects, waits to retry, or holds an open stream with acknowledgements enabled.Thanks to thomasqueirozb for contributing PR #26815! - The
gcp_pubsubsource now honorstls.verify_certificate,tls.verify_hostname,tls.server_name, andtls.alpn_protocols. It also uses the configured proxy.Thanks to thomasqueirozb for contributing PR #26808! - The
gcp_pubsubsource and HTTPS connections fromvector topandvector tapnow use the same system certificate authorities as other Vector components.Thanks to thomasqueirozb for contributing PR #26808! - The
vectorandopentelemetrysources now answer gRPC requests for unregistered services with gRPC statusUNIMPLEMENTEDinstead of HTTP 404. These requests no longer log an error or incrementcomponent_errors_total.Thanks to thomasqueirozb for contributing PR #26770! The
mqttsink now closes its broker connection when the sink stops, for example when a configuration reload removes or replaces it. Before, the connection stayed open, and the broker could repeatedly disconnect a replacement sink that used the same client ID.Before it stops, the sink sends its queued messages and completes pending QoS exchanges. A configuration reload that waits for the sink, for example because the replacement reuses its buffer, also waits for this step. If the connection fails during this step, the sink stops without a reconnect and the reload continues.
Thanks to thomasqueirozb for contributing PR #26793!- Fixed a race in the
redissource withdata_type: listthat could lose a list entry during graceful shutdown. The source now waits up to five seconds for an in-flight pop to finish and forwards any returned entry before stopping. Blocking pops time out after one second on an empty list, keeping shutdown responsive when Redis is healthy. - The
vectorsink now sends configured credentials to HTTP forward proxies and appliestls.server_nameto TLS connections through CONNECT proxies.Thanks to thomasqueirozb for contributing PR #26770! - Fixed a startup race in
vector topon Unix. Depending on thread timing, it could exit withThe cursor position could not be read within a normal durationbefore drawing the dashboard.Thanks to thomasqueirozb for contributing PR #26817!
1 chore
addressandrouting.endpointsvalues in thevectorsink that omit the scheme (for example,127.0.0.1:6000instead ofhttp://127.0.0.1:6000) now default tohttps. Previously they defaulted tohttpunless TLS was enabled. Thehttpdefault was deprecated in 0.59.0.Endpoints that already specify a scheme, and scheme-less endpoints in configurations that enable TLS, are unaffected. A scheme-less endpoint pointing at a plaintext
vectorsource now fails the TLS handshake.Thanks to JinchengCao for contributing PR #26699!
VRL Changelog
0.38.0 (2026-10-28)
Security
- Updated
rustls-webpkito 0.103.16 to address RUSTSEC-2026-0382. TLS certificate verification inhttp_requestnow rejects certificate chains that contain the compromised eMudhra emSign intermediate certificates, even when the system trust store still trusts their root.
Thanks to thomasqueirozb for contributing PR #2008!
New Features
- Added a new
rangefunction that generates an array of integers fromstart(inclusive) toend(exclusive), with an optionalstep.
Thanks to lchabert for contributing PR #1994!
Enhancements
http_requestnow uses the platform certificate verifier for HTTPS connections.
Thanks to pront for contributing PR #2026!
- Accept
criticalkeyword into_syslog_severityin addition tocrit.
Thanks to slopggobblercobbler81 for contributing PR #2010!
- VRL programs that assign objects or arrays now run faster and allocate less: an assignment whose value isn’t used (for example, any statement that isn’t the last expression of a block) no longer makes a deep copy of the assigned value.
Thanks to lukesteensen for contributing PR #2002!
Fixes
to_unix_timestampwithunit: "nanoseconds"is now correctly marked as fallible by the compiler. The conversion can fail at runtime when the timestamp is out of range for a 64-bit nanosecond value, but the compiler previously rejected error handling for this call as unnecessary.
Programs that call to_unix_timestamp with unit: "nanoseconds" are affected: they no
longer compile until the error is handled. Other units are unaffected.
Before
to_unix_timestamp(ts, unit: "nanoseconds")
After
to_unix_timestamp!(ts, unit: "nanoseconds")
or with error coalescing:
to_unix_timestamp(ts, unit: "nanoseconds") ?? 0
Thanks to suryakant-source for contributing PR #2001!
Deprecation Announcements
See the deprecations page for all active and historical deprecations.
Configuration fields that Vector accepts but discards during deserialization are deprecated.
Vector now warns about these fields when loading configuration, including during vector validate.
Existing configurations continue to work.
Correct misspelled fields or remove fields that do not belong to the selected enum variant. For example, replace this HTTP sink request setting:
request:
retry_atempts: 3
with:
request:
retry_attempts: 3
For options that select an enum variant, keep only the fields used by that variant. For example,
HTTP authentication with strategy: bearer uses token. Remove username and password, which
belong to the basic variant:
auth:
strategy: bearer
token: example-token
Warnings identify field paths without including their values. Maps that accept arbitrary keys,
such as HTTP headers, remain supported. Recognized settings documented as inactive in a particular
mode, such as value_limit with mode: excluded in tag_cardinality_limit, are not affected by this
deprecation.