- Security updates: enforce memory limits on zstd ingestion, restrict OIDC discovery redirects, and upgrade Alpine base image to 3.24.2.
- New features: OIDC SSO support in vmauth, direct Prometheus Remote Write to vmstorage, configurable HTTP header logging, UI auto‑refresh controls moved, and optional random‑read advice hints for storage.
- Bug fixes: corrected Unix socket permissions, reduced CPU overhead in stream aggregation, fixed various vmagent/vmauth/vmalert reload and discovery issues, and improved handling of empty query args.