Grafana 13.0.6 → 13.1.0
6 releases · 3 breaking changes · 17 security fixes · 0 advisories fixed
17security3breaking0deprecated39feature3fix
Breaking changes
- breaking Prometheus: Remove azure and sigv4 auth from core prometheus in 13.1.0
- breaking Prometheus: Remove grafana-prometheus package#122953 in 13.1.0
- breaking Zipkin: Remove from core plugins in 13.1.0
Security changes
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.1.0
- security Security: Fix CVE-2026-15577 in 13.0.11
- security Security: Fix CVE-2026-33374 in 13.0.11
- security Security: Fix CVE-2026-93294 in 13.0.11
- security Security: Fix CVE-2026-95502 in 13.0.11
- security CVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise) in 13.0.11
- security Security: Fix CVE-2026-13719 in 13.0.10
- security Security: Fix CVE-2026-13720 in 13.0.10
- security Security: Fix CVE-2026-81841 in 13.0.10
- security Security: Fix CVE-2026-81842 in 13.0.10
- security Security: Fix CVE-2026-15815 in 13.0.9
- security Security: Fix CVE-2026-76154 in 13.0.9
- security Security: Fix CVE-2026-79656 in 13.0.9
- security Security: Fix CVE-2026-12704 in 13.0.8
- security Security: Fix CVE-2026-14199 in 13.0.8
- security Security: Fix CVE-2026-19475 in 13.0.8
- security CVE-2026-17183 in 13.0.7
Every release in between
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
featureA11y: Remove interactivity from UserIcon if onClick is not provided
featureAccessibility: Add aria-pressed state to FilterPill
featureAccessibility: Colorblind-safe line style fill patterns
featureAlerting: Add Mimir Alertmanager auto-sync configuration to settings page
featureAlerting: Add alerting.rulesAPIV2 feature flag
featureAlerting: Add common section to filter dropdown in Alerts Activity
featureAlerting: Add feature flag for notifications api migration
featureAlerting: Add label section to enrichment view/edit drawers (Enterprise)
featureAlerting: Add reusable hook to add enrichment query param to url on drawer open
featureAlerting: Add support for label selectors in AlertRule and RecordingRule legacy storage
featureAlerting: Alert activity UI improvements part 3
featureAlerting: Alert activity groupBy not filtering by environment
featureAlerting: Alerts Activity Instance drawer drilldown, Silence flow
featureAlerting: Allow restricting contact point integration types
featureAlerting: Block Viewers from Alert Group edit route
featureAlerting: Block editing plugin-provided and provisioned rule groups
featureAlerting: Deduplicate and validate groupBy labels in alerts
featureAlerting: Export external Alertmanager sender metrics with data source UIDs
featureAlerting: Include error in Loki state history when exec_err_state is Alerting
featureAlerting: Mark notification provisioning endpoints deprecated
featureAlerting: Move filters to sidebar alerts activity
featureAlerting: Open new alert rule drawer from panel menu
featureAlerting: Preview notification routing in the alert instances table
featureAlerting: Propagate plugin rule origin as X-Rule-Origin header
featureAlerting: Remove alertRuleUseFiredAtForStartsAt feature toggle
featureAlerting: Restrict email contact point recipients to org members
featureAlerting: Set enrichment uid in url for enrichment view/edit drawer (Enterprise)
featureAlerting: Small improvements to instance drawer drilldown silence flow
featureAlerting: Support creating Grafana-managed rules without a group
featureAlerting: Surface contact point save errors in the UI
featureAlerting: Surface errors on contact point creation
featureAlerting: Surface save and bulk-delete errors to the user
featureAlerting: Use Rules API v2 in panel alert rule drawer
featureAnnotations: Clustering GA
featureAuth: Support inline public keys for JWT authentication
featureAuth: Use GrafanaComProxyAPIToken for managed plugin API requests (Enterprise)
featureAuth: Use dedicated token for requests to Grafana.com
breakingPrometheus: Remove azure and sigv4 auth from core prometheus
breakingPrometheus: Remove grafana-prometheus package#122953
+171 more items in the release notessecuritySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
securityCVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-81842
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
fixDashboards: Fix version dates and user display names in the legacy version history page
securityCVE-2026-17183
fixReporting: batch dashboard lookups when listing reports (Enterprise)