Grafana 13.1.0 → 13.3.0
16 releases · 2 breaking changes · 49 security fixes · 0 advisories fixed
49security2breaking0deprecated85feature16fix
Breaking changes
- breaking Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace in 13.3.0
- breaking Alerting: Remove alertingSaveStateCompressed feature flag in 13.2.0
Security changes
- security Security: Fix CVE-2026-100105 in 13.3.0
- security Security: Fix CVE-2026-13719 in 13.3.0
- security Security: Fix CVE-2026-13720 in 13.3.0
- security Security: Fix CVE-2026-15577 in 13.3.0
- security Security: Fix CVE-2026-33374 in 13.3.0
- security Security: Fix CVE-2026-81841 in 13.3.0
- security Security: Fix CVE-2026-88858 in 13.3.0
- security Security: Fix CVE-2026-88967 in 13.3.0
- security Security: Fix CVE-2026-93294 in 13.3.0
- security Security: Fix CVE-2026-95502 in 13.3.0
- security Security: Fix CVE-2026-17183 in 13.3.0
- security Security: Fix CVE-2026-100105 in 13.2.5
- security Security: Fix CVE-2026-103506 in 13.2.5
- security Security: Fix CVE-2026-88858 in 13.2.5
- security Security: Fix CVE-2026-88967 in 13.2.5
- security Security: Fix CVE-2026-15577 in 13.2.4
- security Security: Fix CVE-2026-33374 in 13.2.4
- security Security: Fix CVE-2026-93294 in 13.2.4
- security Security: Fix CVE-2026-95502 in 13.2.4
- security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.2.4
- security Security: Fix CVE-2026-13719 in 13.2.3
- security Security: Fix CVE-2026-13720 in 13.2.3
- security Security: Fix CVE-2026-81841 in 13.2.3
- security Security: Fix CVE-2026-15815 in 13.2.2
- security Security: Fix CVE-2026-76154 in 13.2.2
- security Security: Fix CVE-2026-79656 in 13.2.2
- security Security: Fix CVE-2026-12704 in 13.2.1
- security Security: Fix CVE-2026-14199 in 13.2.1
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.2.0
- security CVE-2026-17183 in 13.2.0
- security Security: Fix CVE-2026-100105 in 13.1.9
- security Security: Fix CVE-2026-88858 in 13.1.9
- security Security: Fix CVE-2026-88967 in 13.1.9
- security Security: Fix CVE-2026-15577 in 13.1.8
- security Security: Fix CVE-2026-33374 in 13.1.8
- security Security: Fix CVE-2026-93294 in 13.1.8
- security Security: Fix CVE-2026-95502 in 13.1.8
- security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.1.8
- security Security: Fix CVE-2026-13719 in 13.1.7
- security Security: Fix CVE-2026-13720 in 13.1.7
- security Security: Fix CVE-2026-81841 in 13.1.7
- security Security: Fix CVE-2026-15815 in 13.1.6
- security Security: Fix CVE-2026-76154 in 13.1.6
- security Security: Fix CVE-2026-79656 in 13.1.6
- security Security: Fix CVE-2026-12704 in 13.1.5
- security Security: Fix CVE-2026-14199 in 13.1.5
- security Security: Fix CVE-2026-19475 in 13.1.5
- security CVE-2026-17183 in 13.1.4
- security Security: Fix CVE-2026-13438 in 13.1.2
Every release in between
securitySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAccess control: reject global role creation in single-org mode (Enterprise)
featureAlerting: Add AccessControlAction entries for inhibition rules
featureAlerting: Add notifications API boundary module
featureAlerting: Add the Config API data layer for external Alertmanager auto-sync
featureAlerting: Allow drag and drop for yaml file as import source for import wizard
featureAlerting: Cleanup promote staged config code
featureAlerting: Disable datasource picker while an import is staged
featureAlerting: Make stage default import method in GMA import wizard
featureAlerting: Make the Import wizard review step preview look clickable
featureAlerting: Migrate the Import-to-GMA wizard's auto-sync integration
featureAlerting: Migrate the auto-sync settings hook and panel onto the Config API
featureAlerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1
featureAlerting: Promote a staged import configuration
featureAlerting: Read staged config origin from the managed_by field
featureAlerting: Redact secrets from the Import-to-GMA preview modal
featureAlerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers
featureAlerting: Remove import method from import to GMA wizard
featureAlerting: Retire the legacy admin_config auto-sync path
featureAlerting: Show Auto-sync support in the import wizard picker
featureAlerting: Support Mimir alertmanager_config files in Import to GMA wizard
featureAlerting: Surface external Alertmanager sync health in the settings UI
featureAlerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard
featureAuth: Bound OAuth token refresh lock waits by time instead of attempts
featureCanvas: Load the standalone plugin by default
featureChore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0)
featureDashboard: Adds new a subtitle option for panel descriptions
featureDashboard: Fall back when collection deletion is unsupported
featureDashboards: Add $__namespace global variable
securitySecurity: Fix CVE-2026-17183
breakingPlugins marketplace: rename config.ini section from marketplace to plugins_marketplace
+123 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-103506
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureGit Sync: Ignore hidden paths in repository scans and diffs
featureProvisioning: Default save from a branch preview to the previewed branch
featureProvisioning: Never replace the repository root folder during incremental sync
fixPlugins: Don't report loaded plugins as not registered when a request times out
fixProvisioning: Fix PR dashboard previews when served from a sub-path
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
featureGit Sync: Clarify repository links for pure Git
featureProvisioning: Allow resource previews in unsynced folders
featureProvisioning: Reject invalid resource names before API calls
featureProvisioning: Show last checked time in Pull status
featureProvisioning: Skip previews for pull requests from forks
featureProvisioning: Stop PR previews when refs disappear
featureProvisioning: Support legacy paths and diagnose missing source annotations
featureProvisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs
securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
fixDashboards: Fix adhoc and groupby variable datasource on UI import
fixPackaging: Fix issue with bundled plugins not being moved properly
fixPanelEditor: Fix options pane not resizable beyond the preview's content width
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
securityCVE-2026-17183
featureAlerting: Add Import tab in alerting settings page
featureAlerting: Add notification template import to the import-to-GMA wizard
featureAlerting: Add promote and auto sync to ImportToGMAWizard
featureAlerting: Add staged configuration summary in import settings page
featureAlerting: Compute staged config origin server-side
featureAlerting: Migrate notifications API to v1beta1
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (1/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (2/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (3/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (4/4)
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureAlerting: Revert a staged import configuration
featureAlerting: Show unusable time intervals as disabled in the mute timings selector
featureAlerting: Track import method analytics in import to gma
featureAlerting: remove AlertingCentralHistory FT
featureAnalytics: Add public dashboard UID to loki usage insights events (Enterprise)
featureAuditing: Record the user name on user deletion audit logs (Enterprise)
featureAzure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery
featureAzure monitor: Azure Metrics Batch API Implementation backend
featureCloudWatch Logs: Add frontend support for querying by data source
featureColorScale: Remove live hoverValue, remove from HeatMap tooltip
featureDashList: Show dashboard description tooltip when it's available
featureDashboard: redirect from dashboard settings tabs to sidebar counterparts
featureDashboards: Allow threshold interpolation
featureDashboards: Deprecate scripted dashboards and disable them by default
featureDashboards: Enable new view panel controls by default
featureDashboards: Increase nesting depth to 4 and allow nested tabs
featureDashboards: Show panel query errors and notices in one UI
featureDeveloper Guide: Add note about requiring signed commits
featureDocs: document the tracing file exporter
featureExplore Logs: log line highlight color lighten in dark, update deprecated pinned color
featureFolder API: Replace legacy access control logic with app platform API call
featureGo: Update version to 1.26.5
featureGrafanaUI: Add real magnification effect to GrotNotFound lens
featureHome: Enable unified homepage for all users (remove flag)
featureLive: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address
featureLogs: Add more suggested fields and integrate with the new Logs Table
featureLogs: use gray (dimgray) for debug level color
+122 more items in the release notessecuritySecurity: Fix CVE-2026-100105
securitySecurity: Fix CVE-2026-88858
securitySecurity: Fix CVE-2026-88967
featureProvisioning: Default save from a branch preview to the previewed branch
securitySecurity: Fix CVE-2026-15577
securitySecurity: Fix CVE-2026-33374
securitySecurity: Fix CVE-2026-93294
securitySecurity: Fix CVE-2026-95502
featureAlerting: Strip sensitive headers from oauth2 cross-host redirects
featureDashboard: Fall back when collection deletion is unsupported
securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)
securitySecurity: Fix CVE-2026-13719
securitySecurity: Fix CVE-2026-13720
securitySecurity: Fix CVE-2026-81841
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
securitySecurity: Fix CVE-2026-19475
securityCVE-2026-17183
fixReporting: batch dashboard lookups when listing reports (Enterprise)
fixLogs Table: Fix missing results when logs stream
fixLogs Table: Fix mixed usage of field name and display name
securitySecurity: Fix CVE-2026-13438
featureGo: Update version to 1.26.5
featureProvisioning: Improve form errors for github connections
featureProvisioning: make sync per-resource write timeout configurable
fixAccessibility: Ensure InlineToast contents are announced by screenreaders
fixDashboardDS: Fix chained dashboard datasource panels showing stale data
fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)
fixPagination: Set aria-current on active page