Grafana 13.2.5 → 13.3.0

1 release · 1 breaking change · 11 security fixes · 0 advisories fixed

11security1breaking0deprecated28feature0fix

Is 13.2.5 affected?

Breaking changes

breaking Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace in 13.3.0

Security changes

security Security: Fix CVE-2026-100105 in 13.3.0
security Security: Fix CVE-2026-13719 in 13.3.0
security Security: Fix CVE-2026-13720 in 13.3.0
security Security: Fix CVE-2026-15577 in 13.3.0
security Security: Fix CVE-2026-33374 in 13.3.0
security Security: Fix CVE-2026-81841 in 13.3.0
security Security: Fix CVE-2026-88858 in 13.3.0
security Security: Fix CVE-2026-88967 in 13.3.0
security Security: Fix CVE-2026-93294 in 13.3.0
security Security: Fix CVE-2026-95502 in 13.3.0
security Security: Fix CVE-2026-17183 in 13.3.0

Every release in between

13.3.0 Oct 27, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-100105

securitySecurity: Fix CVE-2026-13719

securitySecurity: Fix CVE-2026-13720

securitySecurity: Fix CVE-2026-15577

securitySecurity: Fix CVE-2026-33374

securitySecurity: Fix CVE-2026-81841

securitySecurity: Fix CVE-2026-88858

securitySecurity: Fix CVE-2026-88967

securitySecurity: Fix CVE-2026-93294

securitySecurity: Fix CVE-2026-95502

featureAccess control: reject global role creation in single-org mode (Enterprise)

featureAlerting: Add AccessControlAction entries for inhibition rules

featureAlerting: Add notifications API boundary module

featureAlerting: Add the Config API data layer for external Alertmanager auto-sync

featureAlerting: Allow drag and drop for yaml file as import source for import wizard

featureAlerting: Cleanup promote staged config code

featureAlerting: Disable datasource picker while an import is staged

featureAlerting: Make stage default import method in GMA import wizard

featureAlerting: Make the Import wizard review step preview look clickable

featureAlerting: Migrate the Import-to-GMA wizard's auto-sync integration

featureAlerting: Migrate the auto-sync settings hook and panel onto the Config API

featureAlerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1

featureAlerting: Promote a staged import configuration

featureAlerting: Read staged config origin from the managed_by field

featureAlerting: Redact secrets from the Import-to-GMA preview modal

featureAlerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers

featureAlerting: Remove import method from import to GMA wizard

featureAlerting: Retire the legacy admin_config auto-sync path

featureAlerting: Show Auto-sync support in the import wizard picker

featureAlerting: Support Mimir alertmanager_config files in Import to GMA wizard

featureAlerting: Surface external Alertmanager sync health in the settings UI

featureAlerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard

featureAuth: Bound OAuth token refresh lock waits by time instead of attempts

featureCanvas: Load the standalone plugin by default

featureChore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0)

featureDashboard: Adds new a subtitle option for panel descriptions

featureDashboard: Fall back when collection deletion is unsupported

featureDashboards: Add $__namespace global variable

securitySecurity: Fix CVE-2026-17183

breakingPlugins marketplace: rename config.ini section from marketplace to plugins_marketplace

+123 more items in the release notes