Grafana 13.1.8 → 13.2.2
3 releases · 1 breaking change · 7 security fixes · 1 advisory fixed
7security1breaking0deprecated38feature5fix
Vulnerabilities fixed by this upgrade
- 7.1 CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
Breaking changes
- breaking Alerting: Remove alertingSaveStateCompressed feature flag in 13.2.0
Security changes
- security Security: Fix CVE-2026-15815 in 13.2.2
- security Security: Fix CVE-2026-76154 in 13.2.2
- security Security: Fix CVE-2026-79656 in 13.2.2
- security Security: Fix CVE-2026-12704 in 13.2.1
- security Security: Fix CVE-2026-14199 in 13.2.1
- security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.2.0
- security CVE-2026-17183 in 13.2.0
Every release in between
securitySecurity: Fix CVE-2026-15815
securitySecurity: Fix CVE-2026-76154
securitySecurity: Fix CVE-2026-79656
fixDashboards: Preserve query variable refresh setting on v2 dashboard import
fixProvisioning: Fix folder rename UID collision during full sync
securitySecurity: Fix CVE-2026-12704
securitySecurity: Fix CVE-2026-14199
fixDashboards: Fix adhoc and groupby variable datasource on UI import
fixPackaging: Fix issue with bundled plugins not being moved properly
fixPanelEditor: Fix options pane not resizable beyond the preview's content width
securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
securityCVE-2026-17183
featureAlerting: Add Import tab in alerting settings page
featureAlerting: Add notification template import to the import-to-GMA wizard
featureAlerting: Add promote and auto sync to ImportToGMAWizard
featureAlerting: Add staged configuration summary in import settings page
featureAlerting: Compute staged config origin server-side
featureAlerting: Migrate notifications API to v1beta1
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (1/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (2/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (3/4)
featureAlerting: Recognize "default" and "user-defined" as the default routing tree (4/4)
featureAlerting: Return 403 instead of 500 on contact point provenance mismatch
featureAlerting: Revert a staged import configuration
featureAlerting: Show unusable time intervals as disabled in the mute timings selector
featureAlerting: Track import method analytics in import to gma
featureAlerting: remove AlertingCentralHistory FT
featureAnalytics: Add public dashboard UID to loki usage insights events (Enterprise)
featureAuditing: Record the user name on user deletion audit logs (Enterprise)
featureAzure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery
featureAzure monitor: Azure Metrics Batch API Implementation backend
featureCloudWatch Logs: Add frontend support for querying by data source
featureColorScale: Remove live hoverValue, remove from HeatMap tooltip
featureDashList: Show dashboard description tooltip when it's available
featureDashboard: redirect from dashboard settings tabs to sidebar counterparts
featureDashboards: Allow threshold interpolation
featureDashboards: Deprecate scripted dashboards and disable them by default
featureDashboards: Enable new view panel controls by default
featureDashboards: Increase nesting depth to 4 and allow nested tabs
featureDashboards: Show panel query errors and notices in one UI
featureDeveloper Guide: Add note about requiring signed commits
featureDocs: document the tracing file exporter
featureExplore Logs: log line highlight color lighten in dark, update deprecated pinned color
featureFolder API: Replace legacy access control logic with app platform API call
featureGo: Update version to 1.26.5
featureGrafanaUI: Add real magnification effect to GrotNotFound lens
featureHome: Enable unified homepage for all users (remove flag)
featureLive: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address
featureLogs: Add more suggested fields and integrate with the new Logs Table
featureLogs: use gray (dimgray) for debug level color
+122 more items in the release notes