Grafana 12.0.9 → 12.4.5
41 releases · 9 breaking changes · 109 security fixes · 7 advisories fixed
109security9breaking0deprecated244feature62fix
Vulnerabilities fixed by this upgrade
- 6.5 CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
- 6.5 CVE-2026-28376 The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
- 6.5 CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as p…
- 7.5 CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
- 2.6 CVE-2026-21725 A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions…
- 5.3 CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
- 10.0 CVE-2025-41115 SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.…
Breaking changes
- breaking Plugins: Prevent passing host environment variables to plugin processes by default in 12.4.0
- breaking Faro: Update configuration with best practices in 12.3.0
- breaking LibraryPanels: Remove unique name constraints in 12.3.0
- breaking RBAC: Only write action sets in 12.3.0
- breaking Alerting: Enable alertingSaveStateCompressed by default in 12.2.0
- breaking Dashboards: Repeating with no clone keys in 12.2.0
- breaking Provisioning: Use inline secrets for gitsync in 12.2.0
- breaking Stars: Remove deprecated internal ID apis in 12.2.0
- breaking Alerting: Enable recording rules by default in 12.1.0
Security changes
- security Security: CVE-2026-9029 in 12.4.4
- security Security: CVE-2026-33382 in 12.4.4
- security Security: CVE-2026-42127 in 12.4.4
- security Security: CVE-2026-42129 in 12.4.4
- security Security: CVE-2026-10601 in 12.4.4
- security Security: CVE-2026-8609 in 12.4.4
- security Security: CVE-2026-8595 in 12.4.4
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.4.3
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.4.3
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.4.3
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.4.3
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.4.3
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.4.3
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.4.3
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.4.3
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.4.3
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.4.3
- security Security: Fixes CVE-2026-27876 in 12.4.2
- security Security: Fixes CVE-2026-27877 in 12.4.2
- security Security: Fixes CVE-2026-28375 in 12.4.2
- security Security: Fixes CVE-2026-27879 in 12.4.2
- security Security: Fixes CVE-2026-27880 in 12.4.2
- security Security: Fixes CVE-2026-33375 in 12.4.2
- security Fixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions… in 12.4.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.4.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.4.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.4.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
- security CVE-2026-17183 in 12.3.11
- security Security: CVE-2026-33382 in 12.3.7
- security Security: CVE-2026-42127 in 12.3.7
- security Security: CVE-2026-42129 in 12.3.7
- security Security: CVE-2026-10601 in 12.3.7
- security Security: CVE-2026-8609 in 12.3.7
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.3.6
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.3.6
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.3.6
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.3.6
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.3.6
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.3.6
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.3.6
- security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.3.6
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.3.6
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.3.6
- security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.3.6
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.3.6
- security Security: Fixes CVE-2026-27876 in 12.3.6
- security Security: Fixes CVE-2026-27877 in 12.3.6
- security Security: Fixes CVE-2026-28375 in 12.3.6
- security Security: Fixes CVE-2026-27879 in 12.3.6
- security Security: Fixes CVE-2026-27880 in 12.3.6
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.3.3
- security Fixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack… in 12.3.2
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.3.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.3.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.3.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.3.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.3.0
- security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.3.0
- security Security: CVE-2026-33382 in 12.2.9
- security Security: CVE-2026-42127 in 12.2.9
- security Security: CVE-2026-42129 in 12.2.9
- security Security: CVE-2026-10601 in 12.2.9
- security Security: CVE-2026-8609 in 12.2.9
- security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.2.8
- security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.2.8
- security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.2.8
- security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.2.8
- security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.2.8
- security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.2.8
- security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.2.8
- security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.2.8
- security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.2.8
- security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.2.8
- security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.2.8
- security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.2.8
- security Security: Fixes CVE-2026-27876 in 12.2.8
- security Security: Fixes CVE-2026-27877 in 12.2.8
- security Security: Fixes CVE-2026-28375 in 12.2.8
- security Security: Fixes CVE-2026-27879 in 12.2.8
- security Security: Fixes CVE-2026-27880 in 12.2.8
- security Fixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack… in 12.2.4
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.2.4
- security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 12.2.3
- security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 12.2.3
- security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.2.2
- security Fixes CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.… in 12.2.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.2.0
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.2.0
- security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.2.0
- security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.2.0
- security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.2.0
- security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.1.10
- security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.1.10
- security Security: Fix CVE-2026-27876 in 12.1.10
- security Security: Fix CVE-2026-27877 in 12.1.10
- security Security: Fix CVE-2026-28375 in 12.1.10
- security Security: Fix CVE-2026-27879 in 12.1.10
- security Security: Fix CVE-2026-27880 in 12.1.10
- security Fixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi… in 12.1.6
- security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.1.6
- security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 12.1.5
- security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 12.1.5
- security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.1.4
- security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.1.0
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 12.1.0
- security Security: Add fix for CVE-2025-3580 in 12.1.0
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 12.1.0
Every release in between
featureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureBrowse dashboards: Make elements visible and flow better when zoomed
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureGraphite: Strip tagged path from tags.name when aliasSub wrapping is detected
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
featurePlugins: Sanitise header values to printable ASCII for gRPC compatibility
fixAlerting: Fix AlertManagerPicker visibility to check Alertmanager datasources
fixAlerting: Treat not found error when fetching plugins as not installed
fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams
fixJaeger: Fix log event timestamp unit conversion in trace view
fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries
securitySecurity: CVE-2026-9029
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securitySecurity: CVE-2026-8595
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
featureAnalytics: Keep internal dashboard id
featureGo: Update to 1.25.9
featureReporting: Correctly apply appSubURL to report settings requests (Enterprise)
fixAlerting: Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4
featureAnalytics tab: Improve voice over accessibility (Enterprise)
featureDashboards a11y: Do not open time zonemenu on focus
featureDashboards: Resolve display names by identity in version history
featurePlugins: Forward AWS SDK credential chain env vars to external AWS plugins
featurePublic Dashboards: Prevent unintended CRUD operations from different orgs
fixIAM: Handle NULL team_member.external column to fix dashboard loading
fixPlugins: Fix installer IsDisabled condition
fixPlugins: Forward PLUGIN_UNIX_SOCKET_DIR to plugin processes to fix tmp dir in restricted environments
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
securitySecurity: Fixes CVE-2026-33375
securityFixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions…
featureAccessControl: Invalidate scope resolver cache on datasource deletion
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixAccessControl: Fix test utility for datasource deletion permissions cleanup (Enterprise)
fixAlerting: Change scope for testing new receivers to use supported resource type.
fixAlerting: Fix CollateAlertRuleGroup migration for MariaDB compatibility
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAPI: Add missing scope check on dashboards
featureAlerting Enrichment: Add new RBAC permissions for reading and writing enrichments (Enterprise)
featureAlerting: Add Alert Rules tabs navigation with feature toggle
featureAlerting: Add Alert activity card to alerting home page
featureAlerting: Add Cursor frontmatter to CLAUDE.md for auto-loading
featureAlerting: Add Edit/Export actions to group rows, clickable folders, and square icon for recording rules
featureAlerting: Add RBAC for enrichment
featureAlerting: Add RBAC to enrichments (Enterprise)
featureAlerting: Add UI for imported time intervals
featureAlerting: Add alert labels as tags on annotations (#28610)
featureAlerting: Add alertingSyncNotifiersApiMigration feature flag
featureAlerting: Add compressed periodic save for alert instances
featureAlerting: Add counts for firing and pending alert rules
featureAlerting: Add empty state to triage page WIP
featureAlerting: Add expression type information to webhook valueString
featureAlerting: Add feature toggle to disable DMA creation in UI
featureAlerting: Add first CLAUDE.md in the frontend alerting folder
featureAlerting: Add folder_uid label to the grafana_alerting_rule_group_rules metric
featureAlerting: Add gh in CLAUDE.md
featureAlerting: Add limits for the size of expanded notification templates
featureAlerting: Add managed folder validation frontend
featureAlerting: Add policy selector in the alert rule form
featureAlerting: Add saved searches feature for alert rules page
featureAlerting: Add viz wrapper for run queries in enrichment (Enterprise)
featureAlerting: Alerts page performance improvements
featureAlerting: Analyze an alert rule with Grafana Assistant
featureAlerting: Apply pending period to NoData and Error alerts
featureAlerting: Change group filtering to search-based using lightweight BE endpoint
featureAlerting: Collate alert_rule.namespace_uid column as binary
featureAlerting: Collate rule_group column as binary
featureAlerting: Config option to set default datasource in Prometheus rule import
featureAlerting: Correct relative paths in CLAUDE.md Required Reading links
featureAlerting: Dedicated permission for Template testing API
featureAlerting: Deprecate OpsGenie integration
featureAlerting: Filter out imported contact points from simplified routing dropdown
+320 more items in the release notessecurityCVE-2026-17183
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureGo: Update version to 1.26.5
fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
featureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureDashboards: Get annotations and dashboard endpoint performance improvements
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
featureLibraryPanels: Return 403 instead of 500 for insufficient permissions
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
featurePublic Dashboards: Prevent unintended CRUD operations from different orgs
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixDashboards: Fix start parameter in list versions API for K8s backend
fixDashboard Export: Fix datasource variable templating in dashboard export
fixProvisioning: Bump nanogit v0.3.1 with missing objects fixes
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
featureSecurity(TraceView): Sanitize html
securityFixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureElasticSearch: Update annotation time-range properties
featureExplore: Reset legend when a new query is run
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
fixAlerting: Fix data source recording rules editor
featureAlerting: Update alerting dependency
featureAzure: Improved column handling in logs query builder
featureAzure: Include aggregate columns in logs builder
featureDependencies: Bump Go to v1.25.5
featureDocs: Clarify section title for repeating rows and tabs
featurePlugins: Add PluginContext to plugins when scenes is disabled
featureQueryEditorRows: Clear hideSeriesFrom override on query edit
fixAzure: Fix dcount aggregation
fixAzure: Fix percentile syntax
fixDashboards: Fix empty space under time controls when a dashboard has a lot of variables
fixPlugins: Datasource breadcrumb link should link to settings tab
fixPostgresql: Fix variable interpolation logic when the variable has multiple values
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAPI Clients: Add lazy hooks to clients
featureAPI clients: Automatically set PATCH headers
featureAPI clients: Extract into a package
featureAPI clients: Extract into a package (Enterprise)
featureAPI clients: Update API clients to include all endpoints & add hooks
featureAccessControl: Include hidden roles in service account role display
featureAccessControl: Increase limit of LBAC for Datasources rules
featureAccessibility: Wrap data source info onto 2 lines at small viewports
featureAlert Enrichment: Add mutator to insert rule UID labels to allow for efficient use of labelSelector (Enterprise)
featureAlerting: Add enrichment components to rule view page (Enterprise)
featureAlerting: Add enrichment section to rule view page (Enterprise)
featureAlerting: Add jitter support for periodic alert state storage to reduce database load spikes
featureAlerting: Add position-based matching for identical alert rules
featureAlerting: Create alertingAlertRuleFormSchema in restrictedGrafanaApis
featureAlerting: Display error message in central state history view
featureAlerting: Enrichment per rule wip-2 (Enterprise)
featureAlerting: Hide metadata if grouping by folder
featureAlerting: Improve template ai helper prompt and add some examples (Enterprise)
featureAlerting: Move enrichment tab between details and versions
featureAlerting: Remove ai feedback button from alert form
featureAlerting: Remove unused components
featureAlerting: Remove useRulesSourcesWithRuler for SmartAlertTypeDetector
featureAlerting: Surface remote AM silence creation errors properly
featureAlerting: Triage
featureAlerting: Triage rule details drawer
featureAlerting: Update prompt examples for template AI Helper (Enterprise)
featureAlerting: Update width to instance details drawer in Triage page
featureAlerting: Use new enrichment endpoints in FE (Enterprise)
featureAlerting: Use ruleUid as a prop instead of extracting it from the rule context (Enterprise)
featureAnalytics: Aggregate daily summary in datasources analytics (Enterprise)
featureAnalytics: Apply proper batching to Loki exports and add configurable settings (Enterprise)
featureAnnotations: Exclude internal dashboard id when saved via UID
featureAzure: Use SSO settings in plugin context
featureButtons: Active style for buttons
featureCaching: Disable cache if datasource has oauthPassThru=true (Enterprise)
+116 more items in the release notesfeatureDocker: Bump Alpine-based images to 3.24.1
fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
featureDocker: Bump Alpine-based images to 3.23.4
featureGo: Update version to 1.26.3
securitySecurity: CVE-2026-33382
securitySecurity: CVE-2026-42127
securitySecurity: CVE-2026-42129
securitySecurity: CVE-2026-10601
securitySecurity: CVE-2026-8609
securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.
securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
securityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…
securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…
securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…
securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
securitySecurity: Fixes CVE-2026-27876
securitySecurity: Fixes CVE-2026-27877
securitySecurity: Fixes CVE-2026-28375
securitySecurity: Fixes CVE-2026-27879
securitySecurity: Fixes CVE-2026-27880
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixDashboards: Fix start parameter in list versions API for K8s backend
fixDashboard Export: Fix datasource variable templating in dashboard export
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
featureSecurity(TraceView): Sanitize html
securityFixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack…
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureDocs: Clarify section title for repeating rows and tabs
featureElasticSearch: Update annotation time-range properties
featureExplore: Reset legend when a new query is run
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
securityFixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
securityFixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
featureAlerting: Update alerting dependency
featureAzure: Improved column handling in logs query builder
featureAzure: Include aggregate columns in logs builder
featureDependencies: Bump Go to v1.25.5
featurePlugins: Add PluginContext to plugins when scenes is disabled
featureQueryEditorRows: Clear hideSeriesFrom override on query edit
fixAlerting: Fix contact points issue
fixAzure: Fix dcount aggregation
fixAzure: Fix percentile syntax
fixPostgresql: Fix variable interpolation logic when the variable has multiple values
featureAccess control: Reduce memory usage when fetching user's permissions
featureTable: Pill and JSON Cells should allow formatting
fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)
fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)
securitySecurity: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise)
securityFixes CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.…
featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixDashboards: Fix missing Ctrl+O keyboard shortcut for crosshair toggle
fixFix: Fix redirection after login when Grafana is served from subpath
fixFlameGraph: Ensure total is only counted once for recursive function calls
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
fixTable: Backport the Safari 26 fixes to 12.2.1
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We enco…
securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.
securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
featureAlerting: Add feedback buttons for the new AI helpers (Enterprise)
featureAccess: Remove plugin app access in plugin basic role seeder (Enterprise)
featureActions: Infinity authentication
featureAlerting: Add GMA export to the new list page
featureAlerting: Add alerting AI buttons for cloud (Enterprise)
featureAlerting: Add contact point filter to Active Notifications page
featureAlerting: Add enrichment per rule extension component (Enterprise)
featureAlerting: Add extension point link from alert rule to grafana-metricsdrilldown-app
featureAlerting: Add feature toggle and extension point
featureAlerting: Add keepFiringFor and missing_series_evals_to_resolve to file provisioning
featureAlerting: Add observability to enrichment UI (Enterprise)
featureAlerting: Add tooltips in enrichment list for enrichment type (Enterprise)
featureAlerting: Alert enrichment list page (Enterprise)
featureAlerting: Allow filter by rule source in Filter V2
featureAlerting: Auto refresh contact points in the rule form
featureAlerting: Check if TimeInterval is used in ActiveTimings when deleting
featureAlerting: Disable group consistency check for GMA rules
featureAlerting: Display Error Message in Alert History View
featureAlerting: Enrichment Config Form (Enterprise)
featureAlerting: Filter out private labels before writing recording rules
featureAlerting: List V2 - Add a group link to the rule list item
featureAlerting: List V2 - datasource icons for rules
featureAlerting: Load labels in drop-downs without blocking the interaction with the form inputs
featureAlerting: Mark Prometheus to Grafana conversion API as stable
featureAlerting: Move alerting file to an alerting folder
featureAlerting: Support JSON responses in the Prometheus conversion API
featureAlerting: Support extra labels in the Prometheus conversion API
featureAlerting: Support retry with backoff in alert rule evaluation
featureAlerting: Triage alert history with Assistant if available (Enterprise)
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuth: Add setting to disable username based brute force login protection
featureAuth: Support JWT configs tls_client_ca and jwk_set_bearer_token_file
featureAzure: Resource picker improvements (#109458)
featureAzure: Show resource group in picker
featureCanvas: Add option to disable tooltips for one-click elements
+101 more items in the release notessecurityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…
securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…
securitySecurity: Fix CVE-2026-27876
securitySecurity: Fix CVE-2026-27877
securitySecurity: Fix CVE-2026-28375
securitySecurity: Fix CVE-2026-27879
securitySecurity: Fix CVE-2026-27880
featureGo: Update to 1.25.8
featureRendering: Add support for custom CA certs in Image Renderer
fixDashboard Export: Fix datasource variable templating in dashboard export
featureAlerting: Add limits for the size of expanded notification templates
featureCorrelations: Remove support for org_id=0
featureGo: Update to 1.25.7
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled
securityFixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
featureAPI: Add missing scope check on dashboards
featureAvatar: Require sign-in, remove queue, respect timeout
featureGo: Update to 1.25.6
fixAlerting: Fix a race condition panic in ResetStateByRuleUID
securityFixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…
securityFixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
featureAlerting: Update alerting dependency
featureDependencies: Bump Go to v1.25.5
featureDocs: Clarify section title for repeating rows and tabs
featurePlugins: Add PluginContext to plugins when scenes is disabled
fixAlerting: Fix contact points issue
fixAzure: Fix dcount aggregation
fixAzure: Fix percentile syntax
fixPostgresql: Fix variable interpolation logic when the variable has multiple values
fixAlerting: Fix unmarshalling of GettableStatus to include time intervals
fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)
fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)
securitySecurity: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise)
featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
featureTable: Avoid thrown error due to internal React issue
fixAuth: Fix render user OAuth passthrough
fixFlameGraph: Ensure total is only counted once for recursive function calls
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
featureAlerting: Update alerting module
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuditing: Document new options for recording datasource query request/response body
featureChore: Don't show a "Not found" for public-dashboard fetches if the service is disabled via config
featureCloudWatch: Use default region when query region is unset
fixAlerting: Fix bug where rules with identical mute/active intervals produced conflicting routes
fixAlerting: Fix copying of recording rule fields
fixFix: Fix redirection after login when Grafana is served from subpath
fixFix: Prevent Rollup from treeshaking NPM packages
featureAlerting: Add rule group name validation to the Prometheus conversion API
featureCloudWatch: Update grafana/aws-sdk-go with STS endpo…
featureGo: Update to 1.24.6
fixAlerting: Fix active time intervals when time interval is renamed
fixAlerting: Fix subpath handling in the alerting package
fixConfig: Fix date_formats options being moved to a different section
securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
featureAccess: Disable role none option if advanced access control is not enabled
featureAlerting: Add OAuth2 Support for Webhook Receiver
featureAlerting: Add ability to import rules to GMA from Prometheus YAML
featureAlerting: Add details to the payload when tracking import to GMA
featureAlerting: Add export folder action to the new list view
featureAlerting: Add filters for health and contact point in Prometheus Rules api
featureAlerting: Add loading spinner for loading groups state
featureAlerting: Add need more info for import ui datasource field
featureAlerting: Add provenance to Prometheus API
featureAlerting: Add provenance to remote-ruler extension response (Enterprise)
featureAlerting: Add simplified routing metadata to the details tab
featureAlerting: Add state history backend to write ALERTS metric
featureAlerting: Add support for Redis Sentinel for Alerting HA
featureAlerting: Allow disabling recording rules write for a data source in the UI
featureAlerting: Correctly persist FiredAt in SyncRuleStatePersister
featureAlerting: Ensure errors cleared when Alerting after error
featureAlerting: Evaluate all imported from Prometheus rules sequentially
featureAlerting: Extensible Settings module
featureAlerting: Filter out rules managed by integrations and add an info alert
featureAlerting: Filter out synthetic datasource-managed rules when importing to GMA
featureAlerting: List V2 - Add labels popup
featureAlerting: List V2 - Grouped view filters
featureAlerting: List V2 - Use backend filters for GMA rules
featureAlerting: Make paginated rules endpoint strongly consistent (Enterprise)
featureAlerting: Optimize out unnecessary permission check for rule groups (Enterprise)
featureAlerting: Optimize prometheus api permission checks
featureAlerting: Optimize prometheus api permission checks (Enterprise)
featureAlerting: Persist alert instance FiredAt field
featureAlerting: Remove ruler from alert list view2
featureAlerting: Resend alerts for states that are missing in the eval results
featureAlerting: Send notifications immediately on Error|NoData -> Normal transitions
featureAlerting: Support PDC in Grafana-managed recording rules
featureAlerting: Use default_datasource_uid as the default target for recording rules in UI
featureAnnotations: Use dashboard uids instead of dashboard ids
featureApp Platform Provisioning: Add experimental nanogit mode for Git Sync
featureAuth: Add Azure/Entra workload identity support
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Add fix for CVE-2025-3580
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
+121 more items in the release notesfeatureAlerting: Add limits for the size of expanded notification templates
featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled