Grafana 9.4.17 → 13.2.4

247 releases · 33 breaking changes · 289 security fixes · 18 advisories fixed

289security33breaking2deprecated1020feature787fix

Is 9.4.17 affected?

Vulnerabilities fixed by this upgrade

7.1 CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…
7.5 CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON p…
6.5 CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them.
6.5 CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…
7.4 CVE-2026-33376 When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…
7.1 CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
6.5 CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…
4.3 CVE-2026-28374 Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
6.5 CVE-2026-28376 The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…
6.5 CVE-2026-28379 A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…
3.3 CVE-2026-21727 A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…
6.5 CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as p…
7.5 CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
9.1 CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
5.3 CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…
7.5 CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…
7.6 CVE-2025-4123 A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
6.0 CVE-2024-1442 A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so…

Breaking changes

breaking Alerting: Remove alertingSaveStateCompressed feature flag in 13.2.0
breaking Prometheus: Remove azure and sigv4 auth from core prometheus in 13.1.0
breaking Prometheus: Remove grafana-prometheus package#122953 in 13.1.0
breaking Zipkin: Remove from core plugins in 13.1.0
breaking Plugins: Prevent passing host environment variables to plugin processes by default in 12.4.0
breaking Faro: Update configuration with best practices in 12.3.0
breaking LibraryPanels: Remove unique name constraints in 12.3.0
breaking RBAC: Only write action sets in 12.3.0
breaking Alerting: Enable alertingSaveStateCompressed by default in 12.2.0
breaking Dashboards: Repeating with no clone keys in 12.2.0
breaking Provisioning: Use inline secrets for gitsync in 12.2.0
breaking Stars: Remove deprecated internal ID apis in 12.2.0
breaking Alerting: Enable recording rules by default in 12.1.0
breaking Alerting: Make $value return the query value in case when a single datasource is used in 12.0.0
breaking Alerting: Relax permissions for access a rule in 12.0.0
breaking Alerting: Remove feature toggles relating to Loki Alert State History in 12.0.0
breaking Alerting: Remove the POST endpoint for the internal Grafana Alertmanager config in 12.0.0
breaking Anonymous: Enforce org role Viewer setting in 12.0.0
breaking Chore: Enable Grafana version check when installing plugins in 12.0.0
breaking Chore: Enabling failWrongDSUID by default in Grafana 12 in 12.0.0
breaking Frontend: Remove Angular (Enterprise) in 12.0.0
breaking Plugin Extensions: Clean up the deprecated APIs in 12.0.0
breaking Plugins: Remove plugin dependency version in 12.0.0
breaking Tempo: Remove traceQLStreaming feature toggle in 12.0.0
breaking Data source: Change Permissions for query to only have query and not read OR query (Enterprise) in 11.6.0
breaking Loki: Default to /labels API with query param instead of /series API in 11.5.0
breaking Folders: Allow folder editors and admins to create subfolders without any additional permissions in 11.2.0
breaking To resolve a technical issue within the Grafana release package management process, we are releasing both Grafana 10.3.0 and Grafana 10.3.1 simultaneously. The 10.3.1 release contains no breaking or functional changes from 10.3.0. Please refer to the What’s New post for Grafana 10.3.0 for details… in 10.3.1
breaking Update transformation in 10.2.1
breaking Update field override Issue in 10.2.1
breaking Using ${datasourceVariable} to display the data source name in text panel or in the panel title. in 10.1.0
breaking Using ${datasourceVariable} to use the data source name as part of the query content. in 10.1.0
breaking Using the ${datasourceVariable} to choose which data source to use for a query (through its data source picker) will not be affected since it can use both the name and the uid Issue in 10.1.0

Security changes

security Security: Fix CVE-2026-15577 in 13.2.4
security Security: Fix CVE-2026-33374 in 13.2.4
security Security: Fix CVE-2026-93294 in 13.2.4
security Security: Fix CVE-2026-95502 in 13.2.4
security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.2.4
security Security: Fix CVE-2026-13719 in 13.2.3
security Security: Fix CVE-2026-13720 in 13.2.3
security Security: Fix CVE-2026-81841 in 13.2.3
security Security: Fix CVE-2026-15815 in 13.2.2
security Security: Fix CVE-2026-76154 in 13.2.2
security Security: Fix CVE-2026-79656 in 13.2.2
security Security: Fix CVE-2026-12704 in 13.2.1
security Security: Fix CVE-2026-14199 in 13.2.1
security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.2.0
security CVE-2026-17183 in 13.2.0
security Security: Fix CVE-2026-15577 in 13.1.8
security Security: Fix CVE-2026-33374 in 13.1.8
security Security: Fix CVE-2026-93294 in 13.1.8
security Security: Fix CVE-2026-95502 in 13.1.8
security CVE-2026-92539: IAM: Fix: SCIM (Enterprise) in 13.1.8
security Security: Fix CVE-2026-13719 in 13.1.7
security Security: Fix CVE-2026-13720 in 13.1.7
security Security: Fix CVE-2026-81841 in 13.1.7
security Security: Fix CVE-2026-15815 in 13.1.6
security Security: Fix CVE-2026-76154 in 13.1.6
security Security: Fix CVE-2026-79656 in 13.1.6
security Security: Fix CVE-2026-12704 in 13.1.5
security Security: Fix CVE-2026-14199 in 13.1.5
security Security: Fix CVE-2026-19475 in 13.1.5
security CVE-2026-17183 in 13.1.4
security Security: Fix CVE-2026-13438 in 13.1.2
security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 13.1.0
security Security: Fix CVE-2026-15577 in 13.0.11
security Security: Fix CVE-2026-33374 in 13.0.11
security Security: Fix CVE-2026-93294 in 13.0.11
security Security: Fix CVE-2026-95502 in 13.0.11
security CVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise) in 13.0.11
security Security: Fix CVE-2026-13719 in 13.0.10
security Security: Fix CVE-2026-13720 in 13.0.10
security Security: Fix CVE-2026-81841 in 13.0.10
security Security: Fix CVE-2026-81842 in 13.0.10
security Security: Fix CVE-2026-15815 in 13.0.9
security Security: Fix CVE-2026-76154 in 13.0.9
security Security: Fix CVE-2026-79656 in 13.0.9
security Security: Fix CVE-2026-12704 in 13.0.8
security Security: Fix CVE-2026-14199 in 13.0.8
security Security: Fix CVE-2026-19475 in 13.0.8
security CVE-2026-17183 in 13.0.7
security Security: CVE-2026-9029 in 13.0.2
security Security: CVE-2026-33382 in 13.0.2
security Security: CVE-2026-42127 in 13.0.2
security Security: CVE-2026-42129 in 13.0.2
security Security: CVE-2026-10601 in 13.0.2
security Security: CVE-2026-8609 in 13.0.2
security Security: CVE-2026-8595 in 13.0.2
security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 13.0.1
security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 13.0.1
security Security: Fix CVE-2026-15577 in 12.4.13
security Security: Fix CVE-2026-33374 in 12.4.13
security Security: Fix CVE-2026-93294 in 12.4.13
security CVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise) in 12.4.13
security Security: Fix CVE-2026-13719 in 12.4.12
security Security: Fix CVE-2026-13720 in 12.4.12
security Security: Fix CVE-2026-81841 in 12.4.12
security Security: Fix CVE-2026-81842 in 12.4.12
security Security: Fix CVE-2026-12704 in 12.4.11
security Security: Fix CVE-2026-15815 in 12.4.11
security Security: Fix CVE-2026-76154 in 12.4.11
security Security: Fix CVE-2026-79656 in 12.4.11
security Security: Fix CVE-2026-14199 in 12.4.10
security Security: Fix CVE-2026-19475 in 12.4.10
security CVE-2026-17183 in 12.4.9
security Security: CVE-2026-9029 in 12.4.4
security Security: CVE-2026-33382 in 12.4.4
security Security: CVE-2026-42127 in 12.4.4
security Security: CVE-2026-42129 in 12.4.4
security Security: CVE-2026-10601 in 12.4.4
security Security: CVE-2026-8609 in 12.4.4
security Security: CVE-2026-8595 in 12.4.4
security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.4.3
security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.4.3
security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.4.3
security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.4.3
security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.4.3
security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.4.3
security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.4.3
security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.4.3
security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.4.3
security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.4.3
security Security: Fixes CVE-2026-27876 in 12.4.2
security Security: Fixes CVE-2026-27877 in 12.4.2
security Security: Fixes CVE-2026-28375 in 12.4.2
security Security: Fixes CVE-2026-27879 in 12.4.2
security Security: Fixes CVE-2026-27880 in 12.4.2
security Security: Fixes CVE-2026-33375 in 12.4.2
security Fixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions… in 12.4.1
security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.4.0
security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.4.0
security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.4.0
security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.4.0
security CVE-2026-17183 in 12.3.11
security Security: CVE-2026-33382 in 12.3.7
security Security: CVE-2026-42127 in 12.3.7
security Security: CVE-2026-42129 in 12.3.7
security Security: CVE-2026-10601 in 12.3.7
security Security: CVE-2026-8609 in 12.3.7
security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.3.6
security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.3.6
security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.3.6
security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.3.6
security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.3.6
security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.3.6
security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.3.6
security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.3.6
security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.3.6
security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.3.6
security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.3.6
security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.3.6
security Security: Fixes CVE-2026-27876 in 12.3.6
security Security: Fixes CVE-2026-27877 in 12.3.6
security Security: Fixes CVE-2026-28375 in 12.3.6
security Security: Fixes CVE-2026-27879 in 12.3.6
security Security: Fixes CVE-2026-27880 in 12.3.6
security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.3.3
security Fixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack… in 12.3.2
security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.3.0
security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.3.0
security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.3.0
security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.3.0
security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.3.0
security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.3.0
security Security: CVE-2026-33382 in 12.2.9
security Security: CVE-2026-42127 in 12.2.9
security Security: CVE-2026-42129 in 12.2.9
security Security: CVE-2026-10601 in 12.2.9
security Security: CVE-2026-8609 in 12.2.9
security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 12.2.8
security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 12.2.8
security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 12.2.8
security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 12.2.8
security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 12.2.8
security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 12.2.8
security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 12.2.8
security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.2.8
security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 12.2.8
security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 12.2.8
security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.2.8
security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 12.2.8
security Security: Fixes CVE-2026-27876 in 12.2.8
security Security: Fixes CVE-2026-27877 in 12.2.8
security Security: Fixes CVE-2026-28375 in 12.2.8
security Security: Fixes CVE-2026-27879 in 12.2.8
security Security: Fixes CVE-2026-27880 in 12.2.8
security Fixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack… in 12.2.4
security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.2.4
security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 12.2.3
security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 12.2.3
security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.2.2
security Fixes CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.… in 12.2.1
security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.2.0
security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.2.0
security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.2.0
security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.2.0
security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.2.0
security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 12.1.10
security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 12.1.10
security Security: Fix CVE-2026-27876 in 12.1.10
security Security: Fix CVE-2026-27877 in 12.1.10
security Security: Fix CVE-2026-28375 in 12.1.10
security Security: Fix CVE-2026-27879 in 12.1.10
security Security: Fix CVE-2026-27880 in 12.1.10
security Fixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi… in 12.1.6
security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.1.6
security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 12.1.5
security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 12.1.5
security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.1.4
security Fixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. in 12.1.0
security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 12.1.0
security Security: Add fix for CVE-2025-3580 in 12.1.0
security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 12.1.0
security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 12.0.9
security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 12.0.8
security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 12.0.8
security Security: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise) in 12.0.7
security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 12.0.3
security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 12.0.2
security Security: Fixes CVE-2025-3415 in 12.0.2
security Security: Fix CVE-2025-3454 in 12.0.1
security Security: Fix CVE-2025-2703 in 12.0.1
security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 12.0.0
security Fixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… in 12.0.0
security Fixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana. in 12.0.0
security Fixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana. in 12.0.0
security Security: Update JWT library (CVE-2025-30204) in 12.0.0
security App Platform: Pin bleve to fix CVE-2022-31022 in 12.0.0
security Security: CVE-2026-33382 in 11.6.15
security Security: CVE-2026-42127 in 11.6.15
security Security: CVE-2026-42129 in 11.6.15
security Security: CVE-2026-10601 in 11.6.15
security Security: CVE-2026-8609 in 11.6.15
security Fixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… in 11.6.14
security Fixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. in 11.6.14
security Fixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. in 11.6.14
security Fixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… in 11.6.14
security Fixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… in 11.6.14
security Fixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… in 11.6.14
security Fixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… in 11.6.14
security Fixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr… in 11.6.14
security Fixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v… in 11.6.14
security Fixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. in 11.6.14
security Fixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re… in 11.6.14
security Fixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. in 11.6.14
security Security: Fix CVE-2026-27876 in 11.6.14
security Security: Fix CVE-2026-27877 in 11.6.14
security Security: Fix CVE-2026-28375 in 11.6.14
security Security: Fix CVE-2026-27879 in 11.6.14
security Fixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… in 11.6.11
security Fixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi… in 11.6.10
security Fixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa… in 11.6.9
security Fixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… in 11.6.9
security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.6.4
security Security: Fixes CVE-2025-3415 in 11.6.3
security Security: Fix CVE-2025-3454 in 11.6.2
security Security: Fix CVE-2025-2703 in 11.6.2
security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.6.1
security Chore: Update JWT library (CVE-2025-30204) in 11.6.1
security Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 in 11.6.1
security Security: Fix CVE-2025-3454 in 11.6.1
security Security: Fix CVE-2025-2703 in 11.6.1
security Security: Fix CVE-2025-3260 in 11.6.1
security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 11.6.0
security Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 in 11.6.0
security App Platform: Pin bleve to fix CVE-2022-31022 in 11.6.0
security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.5.7
security Security: Fixes CVE-2025-3415 in 11.5.6
security Security: Fix CVE-2025-3454 in 11.5.5
security Security: Fix CVE-2025-2703 in 11.5.5
security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.5.4
security Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 in 11.5.4
security Security: Fix CVE-2025-3454 in 11.5.4
security Security: Fix CVE-2025-2703 in 11.5.4
security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.4.7
security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.4.6
security Security: Fixes CVE-2025-3415 in 11.4.6
security Security: Fix CVE-2025-3454 in 11.4.5
security Security: Fix CVE-2025-2703 in 11.4.5
security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.4.4
security Security: Fix CVE-2025-3454 in 11.4.4
security Security: Fix CVE-2025-2703 in 11.4.4
security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.3.9
security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.3.8
security Security: Fixes CVE-2025-3415 in 11.3.8
security Security: Fix CVE-2025-3454 in 11.3.7
security Security: Fix CVE-2025-2703 in 11.3.7
security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.3.6
security Security: Fix CVE-2025-3454 in 11.3.6
security Security: Fix CVE-2025-2703 in 11.3.6
security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.3.0
security Security: Fix CVE-2025-3454 in 11.2.10
security Security: Fix CVE-2025-2703 in 11.2.10
security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.2.9
security Security: Fix CVE-2025-3454 in 11.2.9
security Security: Fix CVE-2025-2703 in 11.2.9
security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.2.3
security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.1.8
security Alerting: Fixed CVE-2024-8118. in 11.1.7
security Swagger: Fixed CVE-2024-6837. in 11.1.4
security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.0.7
security Alerting: Fixed CVE-2024-8118. in 11.0.6
security Swagger: Fixed CVE-2024-6837. in 11.0.3
security Fixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… in 11.0.0
security Security: Fix CVE-2025-4123 in 10.4.19
security Security: Fix CVE-2025-3580 in 10.4.19
security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 10.4.18
security Security: Fix CVE-2025-3454 in 10.4.18
security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 10.4.11
security Swagger: Fixed CVE-2024-6837. in 10.4.7
security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 10.3.12
security Fixes CVE-2024-1442: A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so… in 10.3.4
security Fixes CVE-2024-1442: A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so… in 10.2.5
security Fixes CVE-2024-1442: A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so… in 10.1.8
security Fixes CVE-2023-4399: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance d… in 10.1.5
security Fixes CVE-2024-1442: A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so… in 10.0.12
security Fixes CVE-2023-4399: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance d… in 10.0.9
security Fixes CVE-2023-4399: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance d… in 9.5.13
security Fixes CVE-2024-1442: A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so… in 9.5.7
security Fixes CVE-2023-2801: Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibili… in 9.5.3
security Fixes CVE-2023-2183: Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible… in 9.5.3

Deprecations

deprecated re-provision any correlations that were created as part of provisioning in 10.2.0
deprecated re-create any correlations created with Admin/Correlations page Issue in 10.2.0

Every release in between

13.2.4 Oct 13, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15577

securitySecurity: Fix CVE-2026-33374

securitySecurity: Fix CVE-2026-93294

securitySecurity: Fix CVE-2026-95502

featureAlerting: Strip sensitive headers from oauth2 cross-host redirects

featureDashboard: Fall back when collection deletion is unsupported

featureGit Sync: Clarify repository links for pure Git

featureProvisioning: Allow resource previews in unsynced folders

featureProvisioning: Reject invalid resource names before API calls

featureProvisioning: Show last checked time in Pull status

featureProvisioning: Skip previews for pull requests from forks

featureProvisioning: Stop PR previews when refs disappear

featureProvisioning: Support legacy paths and diagnose missing source annotations

featureProvisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs

securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)

13.2.3 Sep 29, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-13719

securitySecurity: Fix CVE-2026-13720

securitySecurity: Fix CVE-2026-81841

13.2.2 Sep 15, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15815

securitySecurity: Fix CVE-2026-76154

securitySecurity: Fix CVE-2026-79656

fixDashboards: Preserve query variable refresh setting on v2 dashboard import

fixProvisioning: Fix folder rename UID collision during full sync

13.2.1 Sep 2, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-12704

securitySecurity: Fix CVE-2026-14199

fixDashboards: Fix adhoc and groupby variable datasource on UI import

fixPackaging: Fix issue with bundled plugins not being moved properly

fixPanelEditor: Fix options pane not resizable beyond the preview's content width

13.2.0 Aug 18, 2026 Release notes ↗

securityFixes CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for…

securityCVE-2026-17183

featureAlerting: Add Import tab in alerting settings page

featureAlerting: Add notification template import to the import-to-GMA wizard

featureAlerting: Add promote and auto sync to ImportToGMAWizard

featureAlerting: Add staged configuration summary in import settings page

featureAlerting: Compute staged config origin server-side

featureAlerting: Migrate notifications API to v1beta1

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (1/4)

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (2/4)

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (3/4)

featureAlerting: Recognize "default" and "user-defined" as the default routing tree (4/4)

featureAlerting: Return 403 instead of 500 on contact point provenance mismatch

featureAlerting: Revert a staged import configuration

featureAlerting: Show unusable time intervals as disabled in the mute timings selector

featureAlerting: Track import method analytics in import to gma

featureAlerting: remove AlertingCentralHistory FT

featureAnalytics: Add public dashboard UID to loki usage insights events (Enterprise)

featureAuditing: Record the user name on user deletion audit logs (Enterprise)

featureAzure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery

featureAzure monitor: Azure Metrics Batch API Implementation backend

featureCloudWatch Logs: Add frontend support for querying by data source

featureColorScale: Remove live hoverValue, remove from HeatMap tooltip

featureDashList: Show dashboard description tooltip when it's available

featureDashboard: redirect from dashboard settings tabs to sidebar counterparts

featureDashboards: Allow threshold interpolation

featureDashboards: Deprecate scripted dashboards and disable them by default

featureDashboards: Enable new view panel controls by default

featureDashboards: Increase nesting depth to 4 and allow nested tabs

featureDashboards: Show panel query errors and notices in one UI

featureDeveloper Guide: Add note about requiring signed commits

featureDocs: document the tracing file exporter

featureExplore Logs: log line highlight color lighten in dark, update deprecated pinned color

featureFolder API: Replace legacy access control logic with app platform API call

featureGo: Update version to 1.26.5

featureGrafanaUI: Add real magnification effect to GrotNotFound lens

featureHome: Enable unified homepage for all users (remove flag)

featureLive: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address

featureLogs: Add more suggested fields and integrate with the new Logs Table

featureLogs: use gray (dimgray) for debug level color

+122 more items in the release notes

13.1.8 Oct 13, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15577

securitySecurity: Fix CVE-2026-33374

securitySecurity: Fix CVE-2026-93294

securitySecurity: Fix CVE-2026-95502

featureAlerting: Strip sensitive headers from oauth2 cross-host redirects

featureDashboard: Fall back when collection deletion is unsupported

securityCVE-2026-92539: IAM: Fix: SCIM (Enterprise)

13.1.7 Sep 29, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-13719

securitySecurity: Fix CVE-2026-13720

securitySecurity: Fix CVE-2026-81841

13.1.6 Sep 15, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15815

securitySecurity: Fix CVE-2026-76154

securitySecurity: Fix CVE-2026-79656

fixDashboards: Preserve query variable refresh setting on v2 dashboard import

fixProvisioning: Fix folder rename UID collision during full sync

13.1.5 Sep 2, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-12704

securitySecurity: Fix CVE-2026-14199

securitySecurity: Fix CVE-2026-19475

13.1.4 Aug 18, 2026 Release notes ↗

securityCVE-2026-17183

fixReporting: batch dashboard lookups when listing reports (Enterprise)

13.1.3 Aug 7, 2026 Release notes ↗

13.1.2 Aug 4, 2026 Release notes ↗

fixLogs Table: Fix missing results when logs stream

fixLogs Table: Fix mixed usage of field name and display name

securitySecurity: Fix CVE-2026-13438

13.1.1 Jul 21, 2026 Release notes ↗

featureGo: Update version to 1.26.5

featureProvisioning: Improve form errors for github connections

featureProvisioning: make sync per-resource write timeout configurable

fixAccessibility: Ensure InlineToast contents are announced by screenreaders

fixDashboardDS: Fix chained dashboard datasource panels showing stale data

fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)

fixPagination: Set aria-current on active page

13.1.0 Jul 1, 2026 Release notes ↗

featureA11y: Remove interactivity from UserIcon if onClick is not provided

featureAccessibility: Add aria-pressed state to FilterPill

featureAccessibility: Colorblind-safe line style fill patterns

featureAlerting: Add Mimir Alertmanager auto-sync configuration to settings page

featureAlerting: Add alerting.rulesAPIV2 feature flag

featureAlerting: Add common section to filter dropdown in Alerts Activity

featureAlerting: Add feature flag for notifications api migration

featureAlerting: Add label section to enrichment view/edit drawers (Enterprise)

featureAlerting: Add reusable hook to add enrichment query param to url on drawer open

featureAlerting: Add support for label selectors in AlertRule and RecordingRule legacy storage

featureAlerting: Alert activity UI improvements part 3

featureAlerting: Alert activity groupBy not filtering by environment

featureAlerting: Alerts Activity Instance drawer drilldown, Silence flow

featureAlerting: Allow restricting contact point integration types

featureAlerting: Block Viewers from Alert Group edit route

featureAlerting: Block editing plugin-provided and provisioned rule groups

featureAlerting: Deduplicate and validate groupBy labels in alerts

featureAlerting: Export external Alertmanager sender metrics with data source UIDs

featureAlerting: Include error in Loki state history when exec_err_state is Alerting

featureAlerting: Mark notification provisioning endpoints deprecated

featureAlerting: Move filters to sidebar alerts activity

featureAlerting: Open new alert rule drawer from panel menu

featureAlerting: Preview notification routing in the alert instances table

featureAlerting: Propagate plugin rule origin as X-Rule-Origin header

featureAlerting: Remove alertRuleUseFiredAtForStartsAt feature toggle

featureAlerting: Restrict email contact point recipients to org members

featureAlerting: Set enrichment uid in url for enrichment view/edit drawer (Enterprise)

featureAlerting: Small improvements to instance drawer drilldown silence flow

featureAlerting: Support creating Grafana-managed rules without a group

featureAlerting: Surface contact point save errors in the UI

featureAlerting: Surface errors on contact point creation

featureAlerting: Surface save and bulk-delete errors to the user

featureAlerting: Use Rules API v2 in panel alert rule drawer

featureAnnotations: Clustering GA

featureAuth: Support inline public keys for JWT authentication

featureAuth: Use GrafanaComProxyAPIToken for managed plugin API requests (Enterprise)

featureAuth: Use dedicated token for requests to Grafana.com

breakingPrometheus: Remove azure and sigv4 auth from core prometheus

breakingPrometheus: Remove grafana-prometheus package#122953

+171 more items in the release notes

13.0.11 Oct 13, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15577

securitySecurity: Fix CVE-2026-33374

securitySecurity: Fix CVE-2026-93294

securitySecurity: Fix CVE-2026-95502

featureAlerting: Strip sensitive headers from oauth2 cross-host redirects

featureDashboard: Fall back when collection deletion is unsupported

securityCVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise)

13.0.10 Sep 29, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-13719

securitySecurity: Fix CVE-2026-13720

securitySecurity: Fix CVE-2026-81841

securitySecurity: Fix CVE-2026-81842

13.0.9 Sep 15, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15815

securitySecurity: Fix CVE-2026-76154

securitySecurity: Fix CVE-2026-79656

fixDashboards: Preserve query variable refresh setting on v2 dashboard import

13.0.8 Sep 2, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-12704

securitySecurity: Fix CVE-2026-14199

securitySecurity: Fix CVE-2026-19475

fixDashboards: Fix version dates and user display names in the legacy version history page

13.0.7 Aug 18, 2026 Release notes ↗

securityCVE-2026-17183

fixReporting: batch dashboard lookups when listing reports (Enterprise)

13.0.6 Aug 7, 2026 Release notes ↗

13.0.5 Aug 4, 2026 Release notes ↗

13.0.4 Jul 21, 2026 Release notes ↗

featureAlerting: Return 403 instead of 500 on contact point provenance mismatch

featureGo: Update version to 1.26.5

featureProvisioning: Improve form errors for github connections

fixDashboard: Fixes issue with interval variable with Auto value

fixProvisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422)

fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

13.0.3 Jun 23, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.24.1

featureProvisioning: Write _folder.json when creating dashboards in new folders

featureProvisioning: Write _folder.json when moving dashboards into new folders

fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

fixProvisioning: Fix PR comments on multi-org Grafana instances

fixProvisioning: Fix PR links when folder is renamed via UI

fixfix(provisioning): ignore terminating repositories when validating connection delete

fixfix: bad MySQL query in datasource_type column migration

13.0.2 Jun 9, 2026 Release notes ↗

featureDashboards: Show k8s format in provisioned save

featureDocker: Bump Alpine-based images to 3.23.4

featureGo: Update version to 1.26.3

featureHomepage: Support v2 dashboards if defined by a file

featureLibraryPanels: Return 403 instead of 500 for insufficient permissions

featureProvisioning: Don't mark folders pending due to _folder.json metadata

featureProvisioning: Honor ruleset bypass for write workflow validation

featureProvisioning: Negotiate receive-pack capabilities for git pushes

featureProvisioning: Per-verb fallback for the files subresource

featureProvisioning: Scope repository uniqueness by (URL, branch, path)

featureProvisioning: Surface folder uid-too-long and other validation 4xx as sync warnings

featureProvisioning: add public_root_url instance setting for external URLs

fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams

fixJaeger: Fix log event timestamp unit conversion in trace view

fixK8s Dashboards: Fix folder permission check to use dashboards:create

fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries

fixProvisioning: Bump nanogit to v0.17.0 to fix pushes with repositories using git modules

fixRBAC: Quick fix for global datasource permissions (Enterprise)

securitySecurity: CVE-2026-9029

securitySecurity: CVE-2026-33382

securitySecurity: CVE-2026-42127

securitySecurity: CVE-2026-42129

securitySecurity: CVE-2026-10601

securitySecurity: CVE-2026-8609

securitySecurity: CVE-2026-8595

13.0.1 Apr 17, 2026 Release notes ↗

securityFixes CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are v…

securityFixes CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

featureDashboard: Preserve timezone user-preference when converting V1 → V2

featureProvisioning: Include dashboard validation errors in pull request comments

fixUnified storage: Skip migrations if dualwrite state shows they were already migrated

12.4.13 Oct 13, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-15577

securitySecurity: Fix CVE-2026-33374

securitySecurity: Fix CVE-2026-93294

featureAlerting: Strip sensitive headers from oauth2 cross-host redirects

featureDashboard: Fall back when collection deletion is unsupported (#128259)

securityCVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise)

12.4.12 Sep 29, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-13719

securitySecurity: Fix CVE-2026-13720

securitySecurity: Fix CVE-2026-81841

securitySecurity: Fix CVE-2026-81842

fixUnified Storage: Return 403 instead of 500 on namespace mismatch

12.4.11 Sep 15, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-12704

securitySecurity: Fix CVE-2026-15815

securitySecurity: Fix CVE-2026-76154

securitySecurity: Fix CVE-2026-79656

12.4.10 Sep 2, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-14199

securitySecurity: Fix CVE-2026-19475

fixDashboards: Fix adhoc and groupby variable datasource on UI import

fixDashboards: Fix version dates and user display names in the legacy version history page

12.4.9 Aug 18, 2026 Release notes ↗

securityCVE-2026-17183

featureDashboard Import: Labels in v2 schema

fixAzure Monitor: fix migration for dimension filters

12.4.8 Aug 7, 2026 Release notes ↗

12.4.7 Aug 4, 2026 Release notes ↗

featureDashboards: Get annotations and dashboard endpoint performance improvements

fixDashboardDS: Fix Mixed panels with a time override stuck in permanent loading

12.4.6 Jul 21, 2026 Release notes ↗

featureAlerting: Add protected fields authorization check to provisioning API

featureAlerting: Return 403 instead of 500 on contact point provenance mismatch

featureGo: Update version to 1.26.5

fixJaeger: Handle gzip, deflate, and brotli compressed API responses

fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

12.4.5 Jun 23, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.24.1

fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

12.4.4 Jun 9, 2026 Release notes ↗

featureBrowse dashboards: Make elements visible and flow better when zoomed

featureDocker: Bump Alpine-based images to 3.23.4

featureGo: Update version to 1.26.3

featureGraphite: Strip tagged path from tags.name when aliasSub wrapping is detected

featureLibraryPanels: Return 403 instead of 500 for insufficient permissions

featurePlugins: Sanitise header values to printable ASCII for gRPC compatibility

fixAlerting: Fix AlertManagerPicker visibility to check Alertmanager datasources

fixAlerting: Treat not found error when fetching plugins as not installed

fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams

fixJaeger: Fix log event timestamp unit conversion in trace view

fixPostgreSQL: Allow sql_engine to return results for EXPLAIN queries

securitySecurity: CVE-2026-9029

securitySecurity: CVE-2026-33382

securitySecurity: CVE-2026-42127

securitySecurity: CVE-2026-42129

securitySecurity: CVE-2026-10601

securitySecurity: CVE-2026-8609

securitySecurity: CVE-2026-8595

12.4.3 Apr 14, 2026 Release notes ↗

securityFixes CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1…

securityFixes CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.

securityFixes CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-…

securityFixes CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th…

securityFixes CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated…

securityFixes CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s…

securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

featureAnalytics: Keep internal dashboard id

featureGo: Update to 1.25.9

featureReporting: Correctly apply appSubURL to report settings requests (Enterprise)

fixAlerting: Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4

12.4.2 Mar 25, 2026 Release notes ↗

featureAnalytics tab: Improve voice over accessibility (Enterprise)

featureDashboards a11y: Do not open time zonemenu on focus

featureDashboards: Resolve display names by identity in version history

featurePlugins: Forward AWS SDK credential chain env vars to external AWS plugins

featurePublic Dashboards: Prevent unintended CRUD operations from different orgs

fixIAM: Handle NULL team_member.external column to fix dashboard loading

fixPlugins: Fix installer IsDisabled condition

fixPlugins: Forward PLUGIN_UNIX_SOCKET_DIR to plugin processes to fix tmp dir in restricted environments

securitySecurity: Fixes CVE-2026-27876

securitySecurity: Fixes CVE-2026-27877

securitySecurity: Fixes CVE-2026-28375

securitySecurity: Fixes CVE-2026-27879

securitySecurity: Fixes CVE-2026-27880

securitySecurity: Fixes CVE-2026-33375

12.4.1 Mar 9, 2026 Release notes ↗

securityFixes CVE-2026-21725: A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions…

featureAccessControl: Invalidate scope resolver cache on datasource deletion

featureGo: Update to 1.25.8

featureRendering: Add support for custom CA certs in Image Renderer

fixAccessControl: Fix test utility for datasource deletion permissions cleanup (Enterprise)

fixAlerting: Change scope for testing new receivers to use supported resource type.

fixAlerting: Fix CollateAlertRuleGroup migration for MariaDB compatibility

12.4.0 Feb 25, 2026 Release notes ↗

securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…

securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

securityFixes CVE-2026-27877: When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco…

securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.

securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

featureAPI: Add missing scope check on dashboards

featureAlerting Enrichment: Add new RBAC permissions for reading and writing enrichments (Enterprise)

featureAlerting: Add Alert Rules tabs navigation with feature toggle

featureAlerting: Add Alert activity card to alerting home page

featureAlerting: Add Cursor frontmatter to CLAUDE.md for auto-loading

featureAlerting: Add Edit/Export actions to group rows, clickable folders, and square icon for recording rules

featureAlerting: Add RBAC for enrichment

featureAlerting: Add RBAC to enrichments (Enterprise)

featureAlerting: Add UI for imported time intervals

featureAlerting: Add alert labels as tags on annotations (#28610)

featureAlerting: Add alertingSyncNotifiersApiMigration feature flag

featureAlerting: Add compressed periodic save for alert instances

featureAlerting: Add counts for firing and pending alert rules

featureAlerting: Add empty state to triage page WIP

featureAlerting: Add expression type information to webhook valueString

featureAlerting: Add feature toggle to disable DMA creation in UI

featureAlerting: Add first CLAUDE.md in the frontend alerting folder

featureAlerting: Add folder_uid label to the grafana_alerting_rule_group_rules metric

featureAlerting: Add gh in CLAUDE.md

featureAlerting: Add limits for the size of expanded notification templates

featureAlerting: Add managed folder validation frontend

featureAlerting: Add policy selector in the alert rule form

featureAlerting: Add saved searches feature for alert rules page

featureAlerting: Add viz wrapper for run queries in enrichment (Enterprise)

featureAlerting: Alerts page performance improvements

featureAlerting: Analyze an alert rule with Grafana Assistant

featureAlerting: Apply pending period to NoData and Error alerts

featureAlerting: Change group filtering to search-based using lightweight BE endpoint

featureAlerting: Collate alert_rule.namespace_uid column as binary

featureAlerting: Collate rule_group column as binary

featureAlerting: Config option to set default datasource in Prometheus rule import

featureAlerting: Correct relative paths in CLAUDE.md Required Reading links

featureAlerting: Dedicated permission for Template testing API

featureAlerting: Deprecate OpsGenie integration

featureAlerting: Filter out imported contact points from simplified routing dropdown

+320 more items in the release notes

12.3.11 Aug 18, 2026 Release notes ↗

securityCVE-2026-17183

12.3.10 Aug 4, 2026 Release notes ↗

12.3.9 Jul 21, 2026 Release notes ↗

featureAlerting: Return 403 instead of 500 on contact point provenance mismatch

featureGo: Update version to 1.26.5

fixalerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

12.3.8 Jun 23, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.24.1

fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

12.3.7 Jun 9, 2026 Release notes ↗

featureDashboards: Get annotations and dashboard endpoint performance improvements

featureDocker: Bump Alpine-based images to 3.23.4

featureGo: Update version to 1.26.3

featureLibraryPanels: Return 403 instead of 500 for insufficient permissions

securitySecurity: CVE-2026-33382

securitySecurity: CVE-2026-42127

securitySecurity: CVE-2026-42129

securitySecurity: CVE-2026-10601

securitySecurity: CVE-2026-8609

12.3.6 Mar 26, 2026 Release notes ↗

securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.

securityFixes CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, cr…

securityFixes CVE-2026-21724: A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the re…

securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

featurePublic Dashboards: Prevent unintended CRUD operations from different orgs

securitySecurity: Fixes CVE-2026-27876

securitySecurity: Fixes CVE-2026-27877

securitySecurity: Fixes CVE-2026-28375

securitySecurity: Fixes CVE-2026-27879

securitySecurity: Fixes CVE-2026-27880

12.3.5 Mar 9, 2026 Release notes ↗

featureGo: Update to 1.25.8

featureRendering: Add support for custom CA certs in Image Renderer

fixDashboards: Fix start parameter in list versions API for K8s backend

12.3.4 Feb 24, 2026 Release notes ↗

fixDashboard Export: Fix datasource variable templating in dashboard export

fixProvisioning: Bump nanogit v0.3.1 with missing objects fixes

12.3.3 Feb 12, 2026 Release notes ↗

securityFixes CVE-2026-21727: A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be…

featureAlerting: Add limits for the size of expanded notification templates

featureCorrelations: Remove support for org_id=0

featureGo: Update to 1.25.7

featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled

featureSecurity(TraceView): Sanitize html

12.3.2 Jan 27, 2026 Release notes ↗

securityFixes CVE-2025-41117: Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack…

featureAPI: Add missing scope check on dashboards

featureAvatar: Require sign-in, remove queue, respect timeout

featureElasticSearch: Update annotation time-range properties

featureExplore: Reset legend when a new query is run

featureGo: Update to 1.25.6

fixAlerting: Fix a race condition panic in ResetStateByRuleUID

fixAlerting: Fix data source recording rules editor

12.3.1 Dec 16, 2025 Release notes ↗

featureAlerting: Update alerting dependency

featureAzure: Improved column handling in logs query builder

featureAzure: Include aggregate columns in logs builder

featureDependencies: Bump Go to v1.25.5

featureDocs: Clarify section title for repeating rows and tabs

featurePlugins: Add PluginContext to plugins when scenes is disabled

featureQueryEditorRows: Clear hideSeriesFrom override on query edit

fixAzure: Fix dcount aggregation

fixAzure: Fix percentile syntax

fixDashboards: Fix empty space under time controls when a dashboard has a lot of variables

fixPlugins: Datasource breadcrumb link should link to settings tab

fixPostgresql: Fix variable interpolation logic when the variable has multiple values

12.3.0 Nov 19, 2025 Release notes ↗

securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.

securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

featureAPI Clients: Add lazy hooks to clients

featureAPI clients: Automatically set PATCH headers

featureAPI clients: Extract into a package

featureAPI clients: Extract into a package (Enterprise)

featureAPI clients: Update API clients to include all endpoints & add hooks

featureAccessControl: Include hidden roles in service account role display

featureAccessControl: Increase limit of LBAC for Datasources rules

featureAccessibility: Wrap data source info onto 2 lines at small viewports

featureAlert Enrichment: Add mutator to insert rule UID labels to allow for efficient use of labelSelector (Enterprise)

featureAlerting: Add enrichment components to rule view page (Enterprise)

featureAlerting: Add enrichment section to rule view page (Enterprise)

featureAlerting: Add jitter support for periodic alert state storage to reduce database load spikes

featureAlerting: Add position-based matching for identical alert rules

featureAlerting: Create alertingAlertRuleFormSchema in restrictedGrafanaApis

featureAlerting: Display error message in central state history view

featureAlerting: Enrichment per rule wip-2 (Enterprise)

featureAlerting: Hide metadata if grouping by folder

featureAlerting: Improve template ai helper prompt and add some examples (Enterprise)

featureAlerting: Move enrichment tab between details and versions

featureAlerting: Remove ai feedback button from alert form

featureAlerting: Remove unused components

featureAlerting: Remove useRulesSourcesWithRuler for SmartAlertTypeDetector

featureAlerting: Surface remote AM silence creation errors properly

featureAlerting: Triage

featureAlerting: Triage rule details drawer

featureAlerting: Update prompt examples for template AI Helper (Enterprise)

featureAlerting: Update width to instance details drawer in Triage page

featureAlerting: Use new enrichment endpoints in FE (Enterprise)

featureAlerting: Use ruleUid as a prop instead of extracting it from the rule context (Enterprise)

featureAnalytics: Aggregate daily summary in datasources analytics (Enterprise)

featureAnalytics: Apply proper batching to Loki exports and add configurable settings (Enterprise)

featureAnnotations: Exclude internal dashboard id when saved via UID

featureAzure: Use SSO settings in plugin context

featureButtons: Active style for buttons

featureCaching: Disable cache if datasource has oauthPassThru=true (Enterprise)

+116 more items in the release notes

12.2.10 Jun 23, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.24.1

fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

12.2.9 Jun 9, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.23.4

featureGo: Update version to 1.26.3

securitySecurity: CVE-2026-33382

securitySecurity: CVE-2026-42127

securitySecurity: CVE-2026-42129

securitySecurity: CVE-2026-10601

securitySecurity: CVE-2026-8609

12.2.8 Mar 26, 2026 Release notes ↗

securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.

securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

securitySecurity: Fixes CVE-2026-27876

securitySecurity: Fixes CVE-2026-27877

securitySecurity: Fixes CVE-2026-28375

securitySecurity: Fixes CVE-2026-27879

securitySecurity: Fixes CVE-2026-27880

12.2.7 Mar 9, 2026 Release notes ↗

featureGo: Update to 1.25.8

featureRendering: Add support for custom CA certs in Image Renderer

fixDashboards: Fix start parameter in list versions API for K8s backend

12.2.6 Feb 24, 2026 Release notes ↗

fixDashboard Export: Fix datasource variable templating in dashboard export

12.2.5 Feb 12, 2026 Release notes ↗

featureAlerting: Add limits for the size of expanded notification templates

featureCorrelations: Remove support for org_id=0

featureGo: Update to 1.25.7

featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled

featureSecurity(TraceView): Sanitize html

12.2.4 Jan 27, 2026 Release notes ↗

featureAPI: Add missing scope check on dashboards

featureAvatar: Require sign-in, remove queue, respect timeout

featureDocs: Clarify section title for repeating rows and tabs

featureElasticSearch: Update annotation time-range properties

featureExplore: Reset legend when a new query is run

featureGo: Update to 1.25.6

fixAlerting: Fix a race condition panic in ResetStateByRuleUID

12.2.3 Dec 16, 2025 Release notes ↗

securityFixes CVE-2026-21721: The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboa…

securityFixes CVE-2026-21720: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops…

featureAlerting: Update alerting dependency

featureAzure: Improved column handling in logs query builder

featureAzure: Include aggregate columns in logs builder

featureDependencies: Bump Go to v1.25.5

featurePlugins: Add PluginContext to plugins when scenes is disabled

featureQueryEditorRows: Clear hideSeriesFrom override on query edit

fixAlerting: Fix contact points issue

fixAzure: Fix dcount aggregation

fixAzure: Fix percentile syntax

fixPostgresql: Fix variable interpolation logic when the variable has multiple values

12.2.2 Nov 19, 2025 Release notes ↗

featureAccess control: Reduce memory usage when fetching user's permissions

featureTable: Pill and JSON Cells should allow formatting

fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)

fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)

securitySecurity: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise)

12.2.1 Oct 21, 2025 Release notes ↗

securityFixes CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.…

featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0

featureGo: Update to 1.25.3

fixAuth: Fix render user OAuth passthrough

fixDashboards: Fix missing Ctrl+O keyboard shortcut for crosshair toggle

fixFix: Fix redirection after login when Grafana is served from subpath

fixFlameGraph: Ensure total is only counted once for recursive function calls

fixLDAP Authentication: Fix URL to propagate username context as parameter

fixPlugins: Dependencies do not inherit parent URL for preinstall

fixTable: Backport the Safari 26 fixes to 12.2.1

12.2.0 Sep 23, 2025 Release notes ↗

securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.

securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

featureAlerting: Add feedback buttons for the new AI helpers (Enterprise)

featureAccess: Remove plugin app access in plugin basic role seeder (Enterprise)

featureActions: Infinity authentication

featureAlerting: Add GMA export to the new list page

featureAlerting: Add alerting AI buttons for cloud (Enterprise)

featureAlerting: Add contact point filter to Active Notifications page

featureAlerting: Add enrichment per rule extension component (Enterprise)

featureAlerting: Add extension point link from alert rule to grafana-metricsdrilldown-app

featureAlerting: Add feature toggle and extension point

featureAlerting: Add keepFiringFor and missing_series_evals_to_resolve to file provisioning

featureAlerting: Add observability to enrichment UI (Enterprise)

featureAlerting: Add tooltips in enrichment list for enrichment type (Enterprise)

featureAlerting: Alert enrichment list page (Enterprise)

featureAlerting: Allow filter by rule source in Filter V2

featureAlerting: Auto refresh contact points in the rule form

featureAlerting: Check if TimeInterval is used in ActiveTimings when deleting

featureAlerting: Disable group consistency check for GMA rules

featureAlerting: Display Error Message in Alert History View

featureAlerting: Enrichment Config Form (Enterprise)

featureAlerting: Filter out private labels before writing recording rules

featureAlerting: List V2 - Add a group link to the rule list item

featureAlerting: List V2 - datasource icons for rules

featureAlerting: Load labels in drop-downs without blocking the interaction with the form inputs

featureAlerting: Mark Prometheus to Grafana conversion API as stable

featureAlerting: Move alerting file to an alerting folder

featureAlerting: Support JSON responses in the Prometheus conversion API

featureAlerting: Support extra labels in the Prometheus conversion API

featureAlerting: Support retry with backoff in alert rule evaluation

featureAlerting: Triage alert history with Assistant if available (Enterprise)

featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)

featureAuth: Add setting to disable username based brute force login protection

featureAuth: Support JWT configs tls_client_ca and jwk_set_bearer_token_file

featureAzure: Resource picker improvements (#109458)

featureAzure: Show resource group in picker

featureCanvas: Add option to disable tooltips for one-click elements

+101 more items in the release notes

12.1.10 Mar 26, 2026 Release notes ↗

securitySecurity: Fix CVE-2026-27876

securitySecurity: Fix CVE-2026-27877

securitySecurity: Fix CVE-2026-28375

securitySecurity: Fix CVE-2026-27879

securitySecurity: Fix CVE-2026-27880

12.1.9 Mar 9, 2026 Release notes ↗

featureGo: Update to 1.25.8

featureRendering: Add support for custom CA certs in Image Renderer

12.1.8 Feb 24, 2026 Release notes ↗

fixDashboard Export: Fix datasource variable templating in dashboard export

12.1.7 Feb 12, 2026 Release notes ↗

featureAlerting: Add limits for the size of expanded notification templates

featureCorrelations: Remove support for org_id=0

featureGo: Update to 1.25.7

featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled

12.1.6 Jan 27, 2026 Release notes ↗

securityFixes CVE-2026-21722: Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visi…

featureAPI: Add missing scope check on dashboards

featureAvatar: Require sign-in, remove queue, respect timeout

featureGo: Update to 1.25.6

fixAlerting: Fix a race condition panic in ResetStateByRuleUID

12.1.5 Dec 16, 2025 Release notes ↗

featureAlerting: Update alerting dependency

featureDependencies: Bump Go to v1.25.5

featureDocs: Clarify section title for repeating rows and tabs

featurePlugins: Add PluginContext to plugins when scenes is disabled

fixAlerting: Fix contact points issue

fixAzure: Fix dcount aggregation

fixAzure: Fix percentile syntax

fixPostgresql: Fix variable interpolation logic when the variable has multiple values

12.1.4 Nov 19, 2025 Release notes ↗

fixAlerting: Fix unmarshalling of GettableStatus to include time intervals

fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)

fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)

securitySecurity: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise)

12.1.3 Oct 21, 2025 Release notes ↗

featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0

featureGo: Update to 1.25.3

featureTable: Avoid thrown error due to internal React issue

fixAuth: Fix render user OAuth passthrough

fixFlameGraph: Ensure total is only counted once for recursive function calls

fixLDAP Authentication: Fix URL to propagate username context as parameter

fixPlugins: Dependencies do not inherit parent URL for preinstall

12.1.2 Sep 23, 2025 Release notes ↗

featureAlerting: Update alerting module

featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)

featureAuditing: Document new options for recording datasource query request/response body

featureChore: Don't show a "Not found" for public-dashboard fetches if the service is disabled via config

featureCloudWatch: Use default region when query region is unset

fixAlerting: Fix bug where rules with identical mute/active intervals produced conflicting routes

fixAlerting: Fix copying of recording rule fields

fixFix: Fix redirection after login when Grafana is served from subpath

fixFix: Prevent Rollup from treeshaking NPM packages

12.1.1 Aug 13, 2025 Release notes ↗

featureAlerting: Add rule group name validation to the Prometheus conversion API

featureCloudWatch: Update grafana/aws-sdk-go with STS endpo…

featureGo: Update to 1.24.6

fixAlerting: Fix active time intervals when time interval is renamed

fixAlerting: Fix subpath handling in the alerting package

fixConfig: Fix date_formats options being moved to a different section

12.1.0 Jul 23, 2025 Release notes ↗

securityFixes CVE-2026-27880: The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

featureAccess: Disable role none option if advanced access control is not enabled

featureAlerting: Add OAuth2 Support for Webhook Receiver

featureAlerting: Add ability to import rules to GMA from Prometheus YAML

featureAlerting: Add details to the payload when tracking import to GMA

featureAlerting: Add export folder action to the new list view

featureAlerting: Add filters for health and contact point in Prometheus Rules api

featureAlerting: Add loading spinner for loading groups state

featureAlerting: Add need more info for import ui datasource field

featureAlerting: Add provenance to Prometheus API

featureAlerting: Add provenance to remote-ruler extension response (Enterprise)

featureAlerting: Add simplified routing metadata to the details tab

featureAlerting: Add state history backend to write ALERTS metric

featureAlerting: Add support for Redis Sentinel for Alerting HA

featureAlerting: Allow disabling recording rules write for a data source in the UI

featureAlerting: Correctly persist FiredAt in SyncRuleStatePersister

featureAlerting: Ensure errors cleared when Alerting after error

featureAlerting: Evaluate all imported from Prometheus rules sequentially

featureAlerting: Extensible Settings module

featureAlerting: Filter out rules managed by integrations and add an info alert

featureAlerting: Filter out synthetic datasource-managed rules when importing to GMA

featureAlerting: List V2 - Add labels popup

featureAlerting: List V2 - Grouped view filters

featureAlerting: List V2 - Use backend filters for GMA rules

featureAlerting: Make paginated rules endpoint strongly consistent (Enterprise)

featureAlerting: Optimize out unnecessary permission check for rule groups (Enterprise)

featureAlerting: Optimize prometheus api permission checks

featureAlerting: Optimize prometheus api permission checks (Enterprise)

featureAlerting: Persist alert instance FiredAt field

featureAlerting: Remove ruler from alert list view2

featureAlerting: Resend alerts for states that are missing in the eval results

featureAlerting: Send notifications immediately on Error|NoData -> Normal transitions

featureAlerting: Support PDC in Grafana-managed recording rules

featureAlerting: Use default_datasource_uid as the default target for recording rules in UI

featureAnnotations: Use dashboard uids instead of dashboard ids

featureApp Platform Provisioning: Add experimental nanogit mode for Git Sync

featureAuth: Add Azure/Entra workload identity support

securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371

securitySecurity: Add fix for CVE-2025-3580

securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023

+121 more items in the release notes

12.0.10 Feb 12, 2026 Release notes ↗

featureAlerting: Add limits for the size of expanded notification templates

featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled

12.0.9 Jan 27, 2026 Release notes ↗

featureAPI: Add missing scope check on dashboards

featureAvatar: Require sign-in, remove queue, respect timeout

featureGo: Update to 1.25.6

fixAlerting: Fix a race condition panic in ResetStateByRuleUID

12.0.8 Dec 16, 2025 Release notes ↗

featureAlerting: Update alerting dependency

featureDependencies: Bump Go to v1.25.5

featureDocs: Clarify section title for repeating rows and tabs

featurePlugins: Add PluginContext to plugins when scenes is disabled

fixAlerting: Fix contact points issue

fixAzure: Fix dcount aggregation

fixAzure: Fix percentile syntax

fixPostgresql: Fix variable interpolation logic when the variable has multiple values

12.0.7 Nov 19, 2025 Release notes ↗

fixAlerting: Fix unmarshalling of GettableStatus to include time intervals

fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)

fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)

securitySecurity: fix for CVE-2025-41115 in SCIM (System for Cross-domain Identity Management) (Enterprise)

12.0.6 Oct 21, 2025 Release notes ↗

featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0

featureGo: Update to 1.25.3

fixAuth: Fix render user OAuth passthrough

fixFlameGraph: Ensure total is only counted once for recursive function calls

fixLDAP Authentication: Fix URL to propagate username context as parameter

fixPlugins: Dependencies do not inherit parent URL for preinstall

12.0.5 Sep 23, 2025 Release notes ↗

featureAlerting: Update alerting module

featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)

featureAuditing: Document new options for recording datasource query request/response body

fixAlerting: Fix copying of recording rule fields

fixAzure: Fix time management field

fixFix: Fix redirection after login when Grafana is served from subpath

fixFix: Prevent Rollup from treeshaking NPM packages

12.0.4 Aug 13, 2025 Release notes ↗

featureGo: Update to 1.24.6

fixAzure: Fix time management field

12.0.3 Jul 23, 2025 Release notes ↗

securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023

12.0.2 Jun 17, 2025 Release notes ↗

featureDependencies: Bump Go to v1.24.4

securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371

featureStorage: Take migration_locking setting into account

fixAlerting: Fix $value type when single data source is queried

fixAlerting: Fix group-level labels and query_offset in the import API

fixAzure: Fix Application Insights metadata requests

fixOrg: Fix org deletion

securitySecurity: Fixes CVE-2025-3415

12.0.1 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12

featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0

featureK8s: Dashboards: Add fine grained access control checks to /apis

fixDashboard: Fix Panel Explore link subpath duplication (#104952)

fixDashboard: Fixes issue with row repeats and first row

fixGraphite: Ensure template variables are interpolated correctly

fixGraphite: Fix Graphite series interpolation

fixInfluxDB: Fix nested variable interpolation

fixMetricsDrilldown: Restore link to Metrics Drilldown from Explore

fixNestedFolderPicker: Fix scroll jumps back to top

fixPreferences: Disable the save button whilst saving preferences

fixPrometheus: Fix semver import path

fixThemes: Prevent duplicated API call in drawer

fixXYChart: Coerce threshold steps to numbers

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

12.0.0 May 5, 2025 Release notes ↗

securityFixes CVE-2026-27879: A resample query can be used to trigger out-of-memory crashes in Grafana.

securityFixes CVE-2026-28375: A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

featureAlerting: API to convert submitted Prometheus rules to GMA

featureAlerting: Add HMAC signature config to the webhook integration

featureAlerting: Add MissingSeriesEvalsToResolve to the APIs

featureAlerting: Add UI migration feature toggle

featureAlerting: Add backend support for keep_firing_for

featureAlerting: Add details and edit pages for groups

featureAlerting: Add keep_firing_for and Recovering state

featureAlerting: Add migration to clean up rule versions table

featureAlerting: Add missing_series_evals_to_resolve option to alert rule form

featureAlerting: Delete permanently deleted alert rules.

featureAlerting: Detect target folder rules and show warning

featureAlerting: Migration UI

featureAlerting: Recover deleted alert rules

featureAlerting: Remove constraints for uniqueness of rule title

featureAlerting: Remove feature flag alertingNoDataErrorExecution

featureAlerting: Sequential evaluation of rules in group

featureAlerting: Skip rules that are managed by plugins when importing datasource-managed rules

featureAlerting: Stop allowing manual editing/restore of internal AM config via settings

featureAlerting: Template preview enhancements

featureAlerting: Update alerting module to 58ba6c617ff05eb1d6f65c59d369a6a16923dff6

featureAlerting: Use 'Grafana IRM' wording in alerting contact point

featureAlerting: Webhook Improvements - Templateable Payloads

featureAppChrome: Move kiosk button into profile menu

featureAppPlatform: Introduce experimental Github integration for dashboard configuration management

featureAuthorization: Add group to role DisplayName to make filtered list more clear

featureAzure Monitor: Add logs query builder

featureAzure: Mark Azure Prometheus exemplars as GA and enable by default

securitySecurity: Update JWT library (CVE-2025-30204)

securityApp Platform: Pin bleve to fix CVE-2022-31022

breakingAlerting: Make $value return the query value in case when a single datasource is used

breakingAlerting: Relax permissions for access a rule

breakingAlerting: Remove feature toggles relating to Loki Alert State History

breakingAlerting: Remove the POST endpoint for the internal Grafana Alertmanager config

breakingAnonymous: Enforce org role Viewer setting

breakingChore: Enable Grafana version check when installing plugins

breakingChore: Enabling failWrongDSUID by default in Grafana 12

+97 more items in the release notes

11.6.16 Jun 23, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.24.1

fixDatasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

11.6.15 Jun 9, 2026 Release notes ↗

featureDocker: Bump Alpine-based images to 3.23.4

featureGo: Update version to 1.26.3

fixDashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams

securitySecurity: CVE-2026-33382

securitySecurity: CVE-2026-42127

securitySecurity: CVE-2026-42129

securitySecurity: CVE-2026-10601

securitySecurity: CVE-2026-8609

11.6.14 Mar 26, 2026 Release notes ↗

securityFixes CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them.

securityFixes CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

securitySecurity: Fix CVE-2026-27876

securitySecurity: Fix CVE-2026-27877

securitySecurity: Fix CVE-2026-28375

securitySecurity: Fix CVE-2026-27879

11.6.13 Mar 9, 2026 Release notes ↗

featureGo: Update to 1.25.8

11.6.12 Feb 24, 2026 Release notes ↗

11.6.11 Feb 12, 2026 Release notes ↗

featureAlerting: Add limits for the size of expanded notification templates

featureCorrelations: Remove support for org_id=0

featureGo: Update to 1.25.7

featureSecurity(Public dashboards annotations): use dashboard timerange if time selection disabled

11.6.10 Jan 27, 2026 Release notes ↗

featureAPI: Add missing scope check on dashboards

featureAvatar: Require sign-in, remove queue, respect timeout

featureGo: Update to 1.25.6

fixAlerting: Fix a race condition panic in ResetStateByRuleUID

11.6.9 Dec 16, 2025 Release notes ↗

featureAlerting: Update alerting dependency

featureDependencies: Bump Go to v1.25.5

featurePDFTables: Dynamically shrink font to try and fit whole table in pdf page width (Enterprise)

featurePlugins: Add PluginContext to plugins when scenes is disabled

fixAlerting: Fix contacts point issues

11.6.8 Nov 19, 2025 Release notes ↗

fixAlerting: Fix unmarshalling of GettableStatus to include time intervals

fixAnalyticsSummaries: Fix dashboard rollup not resetting "last X days" metrics to zero (Enterprise)

fixAnalyticsSummaries: Fix dashboard rollup totals resetting incorrectly (Enterprise)

fixSeeder: Add check in filterRemovedPermissions for already existing new permissions before seeding (Enterprise)

11.6.7 Oct 21, 2025 Release notes ↗

featureAnalytics: Apply proper batching to Loki exports and add configurable settings (Enterprise)

featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0

featureGo: Update to 1.25.3

fixAuth: Fix render user OAuth passthrough

fixLDAP Authentication: Fix URL to propagate username context as parameter

fixPlugins: Dependencies do not inherit parent URL for preinstall

fixURLParams: Stringify true values as key=true always (fixes issues with variables with true value)

11.6.6 Sep 23, 2025 Release notes ↗

featureAlerting: Update alerting module

featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)

featureAuditing: Document new options for recording datasource query request/response body

fixAlerting: Fix copying of recording rule fields

fixFix: Fix redirection after login when Grafana is served from subpath

11.6.5 Aug 13, 2025 Release notes ↗

featureAlerting: Bump alerting package to include change to NewTLSClient

featureGo: Update to 1.24.6

11.6.4 Jul 23, 2025 Release notes ↗

featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0

featureStateTimeline: Add endTime to tooltip

featureUnified storage: Respect GF_DATABASE_URL override

fixAlerting: Fix group interval override when adding new rules

fixAzure: Fix legend formatting

fixAzure: Fix resource name determination in template variable queries

fixGraphite: Fix annotation queries

fixGraphite: Fix date mutation

fixGraphite: Fix nested variable interpolation for repeated rows

securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023

11.6.3 Jun 17, 2025 Release notes ↗

securitySecurity: Fixes CVE-2025-3415

11.6.2 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.4-git to v2.5.0

featureDependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12

featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0

fixDashboard: Fixes issue with row repeats and first row

fixGraphite: Ensure template variables are interpolated correctly

fixGraphite: Fix Graphite series interpolation

fixPrometheus: Fix semver import path

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.6.1 Apr 23, 2025 Release notes ↗

securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…

securityChore: Update JWT library (CVE-2025-30204)

featureDashboardScenePage: Correct slug in self referencing data links

securityDependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923

featureGo: Bump to 1.24.2

featureGo: Bump to 1.24.2 (Enterprise)

featureGrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay

featurePrometheus: Add support for cloud partners Prometheus data sources

fixAlertmanager: Add Role-Based Access Control via reqAction Field

fixGrafanaUI: Remove blurred background from overlay backdrops to improve performance

fixInfluxDB: Fix nested variable interpolation

fixLDAP test: Fix page crash

fixOrg redirection: Fix linking between orgs

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

securitySecurity: Fix CVE-2025-3260

11.6.0 Mar 25, 2025 Release notes ↗

featureAPI keys: Migrate API keys to service accounts at startup

featureAccessControl: Allow plugin roles to include plugins:write

featureAlerting: Add DAG errors to alert rule creation and view

featureAlerting: Add Jira integration to cloud AMs

featureAlerting: Add alert rule version history - part1

featureAlerting: Add migration to clean up rule versions table

featureAlerting: Add multiple threshold operators

featureAlerting: Add tracking for the mode used in query and notifications step when c…

featureAlerting: Adding color option for slack receiver

featureAlerting: Allow selection of recording rule write target on per-rule basis.

featureAlerting: Allow specifying uid for new rules added to groups

featureAlerting: Improve template testing by trying non-root scopes

featureAlerting: Include time range in template dashboard and panel urls

featureAlerting: Keep the latest version of deleted rule in version table

featureAlerting: Promote alertingSaveStateCompressed flag to public preview

featureAlerting: Remove ID and OrgID from hash calculation

featureAlerting: Remove feature toggle alertingNoNormalState

featureAlerting: Remove rule group edit from single rule editor

featureAlerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist

featureAlerting: Rule history restore feature

featureAlerting: Support Jira Integration

featureAlerting: Track if new gm rules are created with queries and expressions transformable to simple mode

featureAlerting: Update IRM copies in Configuration Tracker

featureAlerting: Update design of rule details tab and add updated by

featureAlerting: Update irm links for incident and oncall in case new irm plugin is present

featureAlerting: Use exponential backoff in the remote Alertmanager readiness check

featureAlerting: Use uid instead of id in AnnotationsStateHistory

featureAuth: Add IP address login attempt validation

featureAuth: Add support for the TlsSkipVerify parameter to JWT Auth

featureAuth: Make ssoSettingsSAML GA and enabled by default

featureAzure Monitor: Filter namespaces by resource group

featureAzure: Resource picker improvements

featureAzure: Variable editor and resource picker improvements

featureBadge: Add darkgrey color

featureCanvas: One click links and actions

featureChore: Bump Go to 1.23.7

featureChore: Bump Go to 1.23.7 (Enterprise)

securityChore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786

securityApp Platform: Pin bleve to fix CVE-2022-31022

+105 more items in the release notes

11.5.10 Oct 21, 2025 Release notes ↗

featureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0

featureGo: Update to 1.25.3

fixAuth: Fix render user OAuth passthrough

fixLDAP Authentication: Fix URL to propagate username context as parameter

fixPlugins: Dependencies do not inherit parent URL for preinstall

11.5.9 Sep 23, 2025 Release notes ↗

featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)

featureAuditing: Document new options for recording datasource query request/response body

fixFix: Fix redirection after login when Grafana is served from subpath

11.5.8 Aug 12, 2025 Release notes ↗

featureGo: Update to 1.24.6

11.5.7 Jul 23, 2025 Release notes ↗

featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0

fixAzure: Fix legend formatting

fixAzure: Fix resource name determination in template variable queries

securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023

11.5.6 Jun 17, 2025 Release notes ↗

securitySecurity: Fixes CVE-2025-3415

11.5.5 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.3 to v2.5.0

featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12

featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.5.4 Apr 23, 2025 Release notes ↗

featureAzure Monitor: Filter namespaces by resource group

featureAzure: Add support for custom namespace and custom metrics variable queries

featureAzure: Resource picker improvements

featureAzure: Support more complex variable interpolation

featureAzure: Variable editor and resource picker improvements

featureChore: Update CVE-affected dependencies

featureDashboardScenePage: Correct slug in self referencing data links

securityDependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923

featureGo: Bump to 1.24.2

featureGo: Bump to 1.24.2 (Enterprise)

featurePrometheus: Add support for cloud partners Prometheus data sources

fixInfluxDB: Fix nested variable interpolation

fixLDAP test: Fix page crash

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.5.3 Mar 25, 2025 Release notes ↗

featureChore: Bump Go to 1.23.7

featureChore: Bump Go to 1.23.7 (Enterprise)

fixAlerting: Fix token-based Slack image upload to work with channel names

fixAuth: Fix AzureAD config UI's ClientAuthentication dropdown

fixDashboard: Fix the unintentional time range and variables updates on saving

fixDashboards: Fix missing v/e/i keybindings to return back to dashboard

fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)

fixOrg redirection: Fix linking between orgs

11.5.2 Feb 19, 2025 Release notes ↗

featureDocker: Use our own glibc 2.40 binaries

featureTransformationFilter: Include transformation outputs in transformation filtering options

featuregrafana-ui: Update InlineField error prop type to React.ReactNode

fixAlerting: Allow specifying uid for new rules added to groups

fixAlerting: Call RLock() before reading sendAlertsTo map

fixAuth: Fix redirect with JWT auth URL login

fixAuthN: Refetch user on "ErrUserAlreadyExists"

fixAzure: Correctly set application insights resource values

fixCodeEditor: Fix cursor alignment

fixDashboardList: Throttle the re-renders

fixDashboards: Bring back scripted dashboards

fixPlugin Metrics: Eliminate data race in plugin metrics middleware

fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled

11.5.1 Feb 3, 2025 Release notes ↗

fixCodeEditor: Fix cursor alignment

fixTransformationFilter: Include transformation outputs in transformation filtering options: Include transformation outputs in transformation filtering options

11.5.0 Jan 28, 2025 Release notes ↗

featureCloudMigration: Create authapi service

featureAlerting: Add new button for exporting new alert rule in HCL format

featureAlerting: Add option to show inactive alerts in alert list panel

featureAlerting: Add state_periodic_save_batch_size config option

featureAlerting: Change default for max_attempts to 3.

featureAlerting: Consume k8s API for notification policies tree

featureAlerting: Enable flag alertingApiServer by default

featureAlerting: Explore button in Insights view

featureAlerting: Improve performance ash page

featureAlerting: Make alert rule policies preview use k8s API

featureAlerting: Return default builtin templates in k8s templategroup API and UI

featureAlerting: Simplify notification step

featureAlerting: Update state manager to take image only once per rule evaluation

featureAnalytics Views: Deprecate :dashboardID endpoints in favor of uid/:dashboardUID (Enterprise)

featureAnalytics: Summaries: Deprecate dashboard_id endpoints in favor of dashboard_uid (Enterprise)

featureAnnouncement Banners: Enable feature for all cloud tiers (Enterprise)

featureAnnouncement banner: Remove feature toggle

featureAnnouncement banner: Remove feature toggle (Enterprise)

featureAnnouncement banner: Sort by last updated (Enterprise)

featureAuth: Return error when retries have been exhausted for OAuth token refresh

featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only

featureAzure: Improve Azure Prometheus exemplars UI/UX

featureAzure: Unify credentials in frontend for Prometheus

featureChore: Bump Go to 1.23.4

featureChore: Bump Go to 1.23.4 (Enterprise)

featureChore: Remove experimental Storage UI

featureChore: Update to node 22

featureCloudMigrations: Enable feature toggle by default in 11.5

featureCloudMigrations: Introduce RBAC role for migration assistant

featureCloudWatch: Add OpenSearch PPL and SQL support in Logs Insights

featureCloudWatch: Batch different time ranges separately

featureCloudwatch: Accept empty string for logstimeout and mark errors downstream

featureCloudwatch: Update grafana-aws-sdk for AWS/AmplifyHosting metrics

featureDashboard Scene: Shows usages in variables list

featureDashboards: Add option to specify explicit percent change text size for stat panels

featureDashboards: Allow DashboardDS subqueries in MixedDS

featureDashboards: Update docs of the overwrite param in Save Dashboard API Call

featureDatasources: Add toggle to control default behaviour of 'Manage alerts via Alerts UI' toggle

featureDatasources: Allow clearing trace to logs, metrics and profiles datasource pickers

breakingLoki: Default to /labels API with query param instead of /series API

+111 more items in the release notes

11.4.8 Aug 12, 2025 Release notes ↗

featureGo: Update to 1.24.6

fixDashboards: Panel react for timeFrom and timeShift changes using variables

11.4.7 Jul 23, 2025 Release notes ↗

featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0

fixAzure: Fix legend formatting

securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023

11.4.6 Jun 17, 2025 Release notes ↗

featureDependencies: Bump Go to v1.24.4

securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371

securitySecurity: Fixes CVE-2025-3415

11.4.5 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0

featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12

featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.4.4 Apr 23, 2025 Release notes ↗

featureGo: Bump to 1.24.2 (Enterprise)

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.4.3 Mar 25, 2025 Release notes ↗

featureChore: Bump Go to 1.23.7

featureChore: Bump Go to 1.23.7 (Enterprise)

fixAlerting: Fix token-based Slack image upload to work with channel names

fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)

fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows

11.4.2 Feb 19, 2025 Release notes ↗

featureDocker: Use our own glibc 2.40 binaries

fixAuth: Fix redirect with JWT auth URL login

fixAuthN: Refetch user on "ErrUserAlreadyExists"

fixAzure: Correctly set application insights resource values

fixDashboards: Bring back scripted dashboards

fixPlugin Metrics: Eliminate data race in plugin metrics middleware

fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled

11.4.1 Jan 28, 2025 Release notes ↗

featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x

featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x (Enterprise)

fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries

fixAlerting: Fix alert rules unpausing after moving rule to different folder

fixAlerting: Fix label escaping in rule export

fixAlerting: Fix slack image uploading to use new api

fixAzure/GCM: Improve error display

fixDashboards: Fix issue where filtered panels would not react to variable changes

fixDashboards: Fixes issue with panel header showing even when hide time override was enabled

fixDashboards: Fixes week relative time ranges when weekStart was changed

fixDashboards: Panel react for timeFrom and timeShift changes using variables

fixDateTimePicker: Fixes issue with date picker showing invalid date

fixFix: Add support for datasource variable queries

fixInfluxDB: Adhoc filters can use template vars as values

fixLibraryPanel: Fallback to panel title if library panel title is not set

fixGrafana UI: Re-add react-router-dom as a dependency

11.4.0 Dec 5, 2024 Release notes ↗

featureCloudwatch: OpenSearch PPL and SQL support in Logs Insights

11.3.9 Jul 23, 2025 Release notes ↗

featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0

fixAzure: Fix legend formatting

securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023

11.3.8 Jun 17, 2025 Release notes ↗

featureDependencies: Bump Go to v1.24.4

securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371

securitySecurity: Fixes CVE-2025-3415

11.3.7 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0

featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12

featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.3.6 Apr 23, 2025 Release notes ↗

featureChore: Update libs with CVE in dependencies

featureGo: Bump to 1.24.2

featureGo: Bump to 1.24.2 (Enterprise)

fixAuth: Fix SAML user IsExternallySynced not being set correctly

fixAuthN: Refetch user on "ErrUserAlreadyExists"

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.3.5 Mar 25, 2025 Release notes ↗

featureChore: Bump Go to 1.23.7

featureChore: Bump Go to 1.23.7 (Enterprise)

fixAlerting: Fix token-based Slack image upload to work with channel names

fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows

11.3.4 Feb 19, 2025 Release notes ↗

featureDocker: Use our own glibc 2.40 binaries

fixAuth: Fix redirect with JWT auth URL login

fixAzure: Correctly set application insights resource values

fixDashboards: Bring back scripted dashboards

fixPlugin Metrics: Eliminate data race in plugin metrics middleware

11.3.3 Jan 28, 2025 Release notes ↗

featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only

featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x

featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x (Enterprise)

fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries

fixAzure/GCM: Improve error display

fixDashboard: Fixes issue with compatability of old DashboardModel.annotations

fixDashboards: Fix issue where filtered panels would not react to variable changes

fixDashboards: Fixes issue with panel header showing even when hide time override was enabled

fixDashboards: Fixes week relative time ranges when weekStart was changed

fixDateTimePicker: Fixes issue with date picker showing invalid date

fixFix: Add support for datasource variable queries

fixInfluxDB: Adhoc filters can use template vars as values

fixUnified Storage: Use tls preferred when grafana db using ssl

fixGrafana UI: Re-add react-router-dom as a dependency

11.3.2 Dec 4, 2024 Release notes ↗

featureBackport: Announcement Banners: Enable feature for all cloud tiers (Enterprise)

fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key

11.3.1 Nov 19, 2024 Release notes ↗

featureAlerting: Make context deadline on AlertNG service startup configurable

featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user

featureUser: Check SignedInUser OrgID in RevokeInvite

fixAlerting: Fix escaping of silence matchers in utf8 mode

fixAlerting: Fix overflow for long receiver names

fixAlerting: Fix saving advanced mode toggle state in the alert rule editor

fixAlerting: Fix setting datasource uid, when datasource is string in old version

fixAlerting: Force refetch prom rules when refreshing panel

fixAnonymous User: Adds validator service for anonymous users

fixAnonymous User: Adds validator service for anonymous users (Enterprise)

fixAzure Monitor: Support metric namespaces fallback

fixAzure: Fix duplicated traces in multi-resource trace query

fixAzure: Handle namespace request rejection

fixCloudWatch: Interpolate region in log context query

fixDashboard datasource: Return annotations as series when query topic is "annotations"

fixDashboard: Append orgId to URL

fixDashboards: Fixes performance issue expanding a row

fixFlame Graph: Fix crash when it receives empty data

fixFolders: Add admin permissions upon creation of a folder w. SA

fixFolders: Don't show error pop-up if the user can't fetch the root folder

fixMigration: Remove table aliasing in delete statement to make it work for mariadb

fixServerLock: Fix pg concurrency/locking issue

fixService Accounts: Run service account creation in transaction

fixTable: Fix text wrapping applying to wrong field

fixUnified Storage: Use ssl_mode instead of sslmode

11.3.0 Oct 22, 2024 Release notes ↗

featureAlerting: Add manage permissions UI logic for Contact Points

featureAlerting: Allow linking to silence form with alert_rule_uid value preset

featureAlerting: Hide query name when using simplified mode in the alert rule

featureAlerting: Limit and clean up old alert rules versions

featureAlerting: Style nits for the simple query mode

featureAlerting: Update texts in annotations step

featureAlerting: Use useProduceNewAlertmanagerConfiguration for contact points

featureAuth: Attach external session info to Grafana session

featureAuth: Replace jmespath/go-jmespath with jmespath-community/go-jmespath

featureCloudMigrations: Add support for migration of Library Elements (Panels) resources

featureCloudwatch: Update grafana-aws-sdk

featureExplore Logs: Preinstall for onprem Grafana instances

featureExploreMetrics: Ensure compatibility with Incremental Querying

featureFieldConfig: Add support for Actions

featurePlugin Extensions: Require meta-data to be defined in plugin.json during development mode

featureReporting: Display template variables in the PDF (Enterprise)

featureTempo: Add deprecation notice for Aggregate By

fixAlerting/Chore: Fix TimeRangeInput not working across multiple months

fixAlerting: Fix default value for input in simple condition

fixAlerting: Fix eval interval not being saved when creating a new group

securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]

fixAlerting: Fix panics when attempting to create an Alertmanager after failing

fixDashboardScene: Fixes url issue with subpath when exiting edit mode

fixDashboards: Enable scenes by default

fixDashboards: Fixes view & edit keyboard shortcuts when grafana is behind a subpath

fixElasticSearch: Fix errorsource in newInstanceSettings

fixReporting: Fix reports on multi-org instance (Enterprise)

fixSubMenu: Fix expanding sub menu items on touch devices

11.2.10 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12

featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.2.9 Apr 22, 2025 Release notes ↗

featureChore: Update libs with CVE in dependencies

featureGo: Bump to 1.24.2

featureGo: Bump to 1.24.2 (Enterprise)

fixAuth: Fix SAML user IsExternallySynced not being set correctly

fixAuthN: Refetch user on "ErrUserAlreadyExists"

securitySecurity: Fix CVE-2025-3454

securitySecurity: Fix CVE-2025-2703

11.2.8 Mar 25, 2025 Release notes ↗

featureChore: Bump Go version to 1.23.7

featureChore: Bump Go version to 1.23.7 (Enterprise)

fixAlerting: Update slack image upload to use new API

fixCloudMigrations: Fix OrderBy clause in GetSnapshotList sql handler

fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows

11.2.7 Feb 19, 2025 Release notes ↗

featureDocker: Use our own glibc 2.40 binaries

fixAzure: Correctly set application insights resource values

11.2.6 Jan 28, 2025 Release notes ↗

featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only

featureSecurity: Update to Go 1.22.11 - Backport to v11.2.x

featureSecurity: Update to Go 1.22.11 - Backport to v11.2.x (Enterprise)

fixAzure/GCM: Improve error display

11.2.5 Dec 4, 2024 Release notes ↗

fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key

11.2.4 Nov 19, 2024 Release notes ↗

featureAlerting: Make context deadline on AlertNG service startup configurable

featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user

featureTransformations: Add 'transpose' transform

featureUser: Check SignedInUser OrgID in RevokeInvite

fixAlerting: Force refetch prom rules when refreshing panel

fixAnonymous User: Adds validator service for anonymous users

fixAnonymous User: Adds validator service for anonymous users (Enterprise)

fixAzure Monitor: Support metric namespaces fallback

fixAzure: Fix duplicated traces in multi-resource trace query

fixAzure: Handle namespace request rejection

fixFolders: Add admin permissions upon creation of a folder w. SA

fixMigration: Remove table aliasing in delete statement to make it work for mariadb

fixServerLock: Fix pg concurrency/locking issue

fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability

11.2.3 Oct 22, 2024 Release notes ↗

securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]

fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries

fixCanvas: Allow API calls to grafana origin

fixFolders: Correctly show new folder button under root folder

fixOrgSync: Do not set default Organization for a user to a non-existent Organization

fixPlugins: Skip install errors if dependency plugin already exists

fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability

11.2.2 Oct 9, 2024 Release notes ↗

featureChore: Bump Go to 1.22.7

featureChore: Bump Go to 1.22.7 (Enterprise)

featureData sources: Hide the datasource redirection banner for users who can't interact with data sources

fixAlerting: Fix preview of silences when label name contains spaces

fixAlerting: Make query wrapper match up datasource UIDs if necessary

fixAzureMonitor: Deduplicate resource picker rows

fixAzureMonitor: Improve resource picker efficiency

fixAzureMonitor: Remove Basic Logs retention warning

fixCloudWatch: Fix segfault when migrating legacy queries

fixCorrelations: Limit access to correlations page to users who can access Explore

fixDashboardScene: Fix broken error handling and error rendering

fixPlugins: Avoid returning 404 for AutoEnabled apps

11.2.1 Sep 26, 2024 Release notes ↗

featureAlerting: Support for optimistic concurrency in priovisioning Tempate API

featureLogs panel: Enable displayedFields in dashboards and apps

featureState timeline: Add pagination support

fixAuthn: No longer hash service account token twice during authentication

fixCloudMigrations: Fix snapshot creation on Windows systems

fixDashGPT: Fixes issue with generation on Safari

fixDashboard: Fix Annotation runtime error when a data source does not support annotations

fixGrafana SQL: Fix broken import in NumberInput component

fixLogs: Show older logs button when infinite scroll is enabled and sort order is descending

fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to

fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to (Enterprise)

fixReporting: Disable dashboardSceneSolo when rendering PDFs the old way (Enterprise)

fixTemplating: Fix searching non-latin template variables

fixTutorialCard: Fix link to tutorial not opening

fixAutoSizeInput: Allow to be controlled by value

11.2.0 Aug 27, 2024 Release notes ↗

feature@grafana/data: Introduce new getTagKeys/getTagValues response interface

featureAWS: Update deprecated aws-sdk functions from env variable versions

featureAlerting: Add ha_reconnect_timeout configuration option

featureAlerting: Add setting for maximum allowed rule evaluation results

featureAlerting: Add warning in telegram contact point

featureAlerting: Central alert history part4

featureAlerting: Don't crash the page when trying to filter rules by regex

featureAlerting: Enable remote primary mode using feature toggles

featureAlerting: Hide edit/view rule buttons according to deleting/creating state

featureAlerting: Implement UI for grafana-managed recording rules

featureAlerting: Improve performance of /api/prometheus for large numbers of alerts.

featureAlerting: Include a list of ref_Id and aggregated datasource UIDs to alerts when state reason is NoData

featureAlerting: Instrument outbound requests for Loki Historian and Remote Alertmanager with tracing

featureAlerting: Limit instances on alert detail view unless in instances tab

featureAlerting: Make alert group editing safer

featureAlerting: Make whitespace more visible on labels

featureAlerting: Remove option to return settings from api/v1/receivers and restrict provisioning action access

featureAlerting: Resend resolved notifications for ResolvedRetention duration

featureAlerting: Show Insights page only on cloud (when required ds's are available)

featureAlerting: Show repeat interval in timing options meta

featureAlerting: Support median in reduce expressions

featureAlerting: Track central ash interactions

featureAlerting: Update alerting state history API to authorize access using RBAC

featureAlerting: Update warning message for Telegram parse_mode and default to empty value

featureAlerting: Use Runbook URL label everywhere and add validation in the alert rule…

featureAlerting: Use cloud notifier types for metadata on Cloud AMs

featureAlerting: Use stable identifier of a group when export to HCL

featureAlerting: Use stable identifier of a group,contact point,mute timing when export to HCL

featureAlertmanager: Support limits for silences

featureAngular deprecation: Disable dynamic angular inspector if CheckForPluginUpdates is false

featureApp events: Add "info" variant

featureAuth: Add org to role mappings support to AzureAD/Entra integration

featureAuth: Add organization mapping configuration to the UI

featureAuth: Add support for escaping colon characters in org_mapping

featureAzure: Add new Azure infrastructure dashboards

featureBrowseDashboards: Update results when starred param changes

featureCaching: Handle memcached reconnects

featureCalendar: Add labels for next/previous month

featureCanvas: Element level data links

breakingFolders: Allow folder editors and admins to create subfolders without any additional permissions

+142 more items in the release notes

11.1.13 Mar 25, 2025 Release notes ↗

featureChore: Bump Go version to 1.23.7

featureChore: Bump Go version to 1.23.7 (Enterprise)

fixAlerting: Update slack image upload to use new API

fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows

11.1.11 Jan 28, 2025 Release notes ↗

featureSecurity: Update to Go 1.22.11 - Backport to v11.1.x

featureSecurity: Update to Go 1.22.11 - Backport to v11.1.x (Enterprise)

fixAzure/GCM: Improve error display

11.1.10 Dec 4, 2024 Release notes ↗

fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key

11.1.9 Nov 19, 2024 Release notes ↗

featureAlerting: Make context deadline on AlertNG service startup configurable

featureUser: Check SignedInUser OrgID in RevokeInvite

fixAlerting: Force refetch prom rules when refreshing panel

fixAnonymous User: Adds validator service for anonymous users

fixAnonymous User: Adds validator service for anonymous users (Enterprise)

fixAzure Monitor: Support metric namespaces fallback

fixAzure: Fix duplicated traces in multi-resource trace query

fixAzure: Handle namespace request rejection

fixMigration: Remove table aliasing in delete statement to make it work for mariadb

fixPrometheus: Fix interpolating adhoc filters with template variables

fixServerLock: Fix pg concurrency/locking issue

fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability

11.1.8 Oct 22, 2024 Release notes ↗

securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]

fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries

fixOrgSync: Do not set default Organization for a user to a non-existent Organization

fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability

11.1.7 Oct 1, 2024 Release notes ↗

featureChore: Bump Go to 1.22.7

featureChore: Bump Go to 1.22.7 (Enterprise)

fixAlerting: Fix preview of silences when label name contains spaces

fixAlerting: Make query wrapper match up datasource UIDs if necessary

fixAzureMonitor: Deduplicate resource picker rows

fixAzureMonitor: Improve resource picker efficiency

fixAzureMonitor: Remove Basic Logs retention warning

fixCorrelations: Limit access to correlations page to users who can access Explore

fixPlugins: Avoid returning 404 for AutoEnabled apps

securityAlerting: Fixed CVE-2024-8118.

11.1.6 Sep 26, 2024 Release notes ↗

featureChore: Update swagger ui (4.3.0 to 5.17.14)

fixTemplating: Fix searching non-latin template variables

fixTutorialCard: Fix link to tutorial not opening

fixBugfix: QueryField typeahead missing background color

11.1.5 Aug 27, 2024 Release notes ↗

fixAlerting: Fix permissions for prometheus rule endpoints

fixAlerting: Fix persisting result fingerprint that is used by recovery threshold

fixAuditing: Fix a possible crash when audit logger parses responses for failed requests (Enterprise)

fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to

fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they dont belong to (Enterprise)

fixRBAC: Fix seeder failures when inserting duplicated permissions (Enterprise)

fixSnapshots: Fix panic when snapshot_remove_expired is true

fixVizTooltip: Fix positioning at bottom and right edges on mobile

fixBugfix: QueryField typeahead missing background color

11.1.4 Aug 14, 2024 Release notes ↗

securitySwagger: Fixed CVE-2024-6837.

11.1.3 Jul 26, 2024 Release notes ↗

fixRBAC: Allow plugins to use scoped actions

11.1.2 Jul 26, 2024 Release notes ↗

11.1.1 Jul 26, 2024 Release notes ↗

fixAlerting: Skip fetching alerts for unsaved dashboards

fixAlerting: Skip loading alert rules for dashboards when disabled

fixAlerting: Support utf8_strict_mode: false in Mimir

fixScenes: Fixes issue with panel repeat height calculation

fixTable Panel: Fix Image hover without datalinks

fixTempo: Fix grpc streaming support over pdc-agent

fixRBAC: Allow plugins to use scoped actions

11.1.0 Jun 25, 2024 Release notes ↗

featureTracing: Enable traces to profiles.

featureAuth: Add org to role mappings support to Google integration.

featureAlerting: Support AWS SNS integration in Grafana.

featureAuth: Add org to role mappings support to Okta integration.

featureAuth: Add org to role mappings support to Gitlab integration.

featureCloudwatch: Use the metric map from grafana-aws-sdk.

featureAlerting: Add option to use Redis in cluster mode for Alerting HA.

featureVizTooltip: Allow setting the maxWidth option.

featureAuth: Add org to role mappings support to GitHub integration .

featureCloudWatch: Handle permissions error and update docs.

featureAlerting: Correctly handle duplicating notification templates.

featureAlerting: Mute Timing service to prevent changing provenance status to none.

featureAlerting: Ensure we fetch AM config before saving new configuration.

featureAlerting: Remove regex reference in silences filter tooltip.

featureCloudwatch: Update AWS DynamoDB Metrics.

featureAlerting: Make regex notification routing preview consistent with notification policies implementation.

featureDateTimePicker: Return cleared value in onChange.

featureNodeGraph: Add msagl and the layered layout code.

featureAPI: Add in theme support to /render/* endpoint.

featureAlerting: Add filters for RouteGetRuleStatuses.

featurePlugins: Update the plugin.json schema with UI extensions meta-data.

featureAuth: Update SAML lib to improve HTTP-Post binding.

featureTempo: Send current filters when retrieving tags for AdHocFilters.

featureTempo: Support standard span convention.

featureValueFormats: Add Uruguay peso currency.

featureDateTimePicker: Add clearable prop.

featureCorrelations: Enable feature toggle by default (on-prem).

featureStat: Add percent change color modes.

featureLogs: Added multi-line display control to the "wrap lines" option.

featureTempo: Update lezer autocomplete (histogram, quantile) and add missing functions.

featureAnnotationsPlugin2: Implement support for rectangular annotations in Heatmap.

featureCodeEditor: Improved styles when the code editor is loading.

featureCloudWatch: Add additional AWS/KinesisAnalytics metrics .

featureCloudwatch: Add AWS/Events Metrics.

featureAzure: Basic Logs support.

featureDashboard: Make dashboard search faster.

featureAlerting: Support custom API URL for PagerDuty integration.

featureAlerting: Add optional metadata via query param to silence GET requests.

featureStore: Enable adding extra middleware.

featureTempo: Don't modify the passed time range when using timeShiftEnabled.

+182 more items in the release notes

11.0.10 Jan 28, 2025 Release notes ↗

featureSecurity: Update to Go 1.22.11 - Backport to v11.0.x

featureSecurity: Update to Go 1.22.11 - Backport to v11.0.x (Enterprise)

fixAzure/GCM: Improve error display

11.0.9 Dec 4, 2024 Release notes ↗

fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key

11.0.8 Nov 19, 2024 Release notes ↗

featureAlerting: Make context deadline on AlertNG service startup configurable

featureUser: Check SignedInUser OrgID in RevokeInvite

fixAnonymous User: Adds validator service for anonymous users

fixAnonymous User: Adds validator service for anonymous users (Enterprise)

fixAzure Monitor: Support metric namespaces fallback

fixAzure: Fix duplicated traces in multi-resource trace query

fixAzure: Handle namespace request rejection

fixMigration: Remove table aliasing in delete statement to make it work for mariadb

fixPrometheus: Fix interpolating adhoc filters with template variables

fixServerLock: Fix pg concurrency/locking issue

fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability

11.0.7 Oct 22, 2024 Release notes ↗

securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]

fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries

fixDashboard: Make dashboard search faster

fixOrgSync: Do not set default Organization for a user to a non-existent Organization

fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability

11.0.6 Oct 1, 2024 Release notes ↗

featureChore: Bump Go to 1.22.7

featureChore: Bump Go to 1.22.7 (Enterprise)

fixAzureMonitor: Deduplicate resource picker rows

fixAzureMonitor: Improve resource picker efficiency

fixCorrelations: Limit access to correlations page to users who can access Explore

fixPlugins: Avoid returning 404 for AutoEnabled apps

securityAlerting: Fixed CVE-2024-8118.

11.0.5 Sep 26, 2024 Release notes ↗

featureChore: Update swagger ui (4.3.0 to 5.17.14)

fixProvisioning: Prevent provisioning folder errors from failing startup

fixTutorialCard: Fix link to tutorial not opening

11.0.4 Aug 27, 2024 Release notes ↗

fixAlerting: Fix persisting result fingerprint that is used by recovery threshold

fixAuditing: Fix a possible crash when audit logger parses responses for failed requests (Enterprise)

fixRBAC: Fix seeder failures when inserting duplicated permissions (Enterprise)

fixSnapshots: Fix panic when snapshot_remove_expired is true

11.0.3 Aug 14, 2024 Release notes ↗

securitySwagger: Fixed CVE-2024-6837.

11.0.2 Jul 26, 2024 Release notes ↗

featureAlerting: Update grafana/alerting to c340765c985a12603bbdfcd10576ddfdbf9dc284

featurePrometheus: Reintroduce Azure audience override feature flag

fixAlerting: Skip loading alert rules for dashboards when disabled

11.0.1 Jun 25, 2024 Release notes ↗

fixEcho: Suppress errors from frontend-metrics API call failing.

fixFix: Portuguese Brazilian wasn't loading translations.

fixAnalytics: Fix ApplicationInsights integration.

fixDashboardScene: Fixes issue removing override rule.

fixBrowseDashboards: Prepend subpath to New Browse Dashboard actions.

fixAlerting: Fix rule storage to filter by group names using case-sensitive comparison.

fixRBAC: List only the folders that the user has access to.

fixDashboardScene: Fixes lack of re-render when updating field override properties.

fixDashboardScene: Fixes inspect with transforms issue.

fixAzureMonitor: Fix bug detecting app insights queries.

fixAccess Control: Clean up permissions for deprovisioned data sources.

fixLoki: Fix editor history in wrong order.

fixSSE: Fix threshold unmarshal to avoid panic.

fixLibraryPanels/RBAC: Ignore old folder permission check when deleting/patching lib panel.

fixDashboards: Correctly display Admin access to dashboards in the UI.

fixLogsTable: Fix default sort by time.

fixAlerting: Fix rules deleting when reordering whilst filtered.

fixAlerting: Fix typo in JSON response for rule export.

fixCloudMonitoring: Fix query type selection issue.

fixAlerting: Fix scheduler to sort rules before evaluation.

fixDashboardScene: Skip panel repeats when values are the same.

fixAlerting: Do not store series values from past evaluations in state manager for no reason.

fixDashboardScene: Fixing major row repeat issues.

fixDashboardScene: Fixes checkbox orienation in save forms.

fixProvisioning: Add override option to role provisioning. (Enterprise)

11.0.0 May 14, 2024 Release notes ↗

featureAlerting: Add two sets of provisioning actions for rules and notifications .

featureChore: Upgrade go to 1.21.10.

featureAuth: Force lowercase login/email for users.

featureNavigation: Add a return to previous button when navigating to different sections.

featureDashboardScene: Move add library panel view from grid item to drawer.

featureCloudWatch : Add missing AWS/ES metrics.

featureAlerting: Reduce set of fields that could trigger alert state change.

featureOAuth: Make sub claim required for generic oauth behind feature toggle.

featureGrafana E2E: Add deprecation notice and update docs.

featureLoki: Remove API restrictions on resource calls.

featureChore: Upgrade go to 1.21.10. (Enterprise)

fixAuthN: Fix signout redirect url.

fixCloudMonitoring: Improve legacy query migrations.

fixAzure data sources: Set selected config type before save.

fixLoki: Fix log context when no label types are present.

fixDashboardScene: Fixes editing transformations after toggling table view.

fixDashboardDataSource: Fixes issue where sometimes untransformed data could be returned .

fixProvisioning: Look up provisioned folders by UID when possible.

fixCloudwatch: Update grafana-aws-sdk to fix sts endpoints.

fixSelect: Fixes issue preserving search term (input) when selecting a value.

fixAlerting: Prevent search from locking the browser.

fixDashboardScene: Fixes issue referring to library panel in dashboard data source .

fixData source: Maintain the default data source permissions when switching from unlicensed to licensed Grafana.

fixAlerting: Allow deleting contact points referenced only by auto-generated policies.

fixAuth: Sign sigV4 request after adding headers.

fixDashboardScene: Fixes issues with relative time range in panel edit.

fixDashboardScene: Fixes issue with dashboard links and variables.

fixSQLStore: Disable redundant create and drop unique index migrations on dashboard table.

fixLogContext: Fix structured metadata labels being added as stream selectors.

fixDashboardScene: Fixes issue with editing panels that uses instanceState.

fixDashboardScene: Fixes deleting dirty dashboard.

fixAlerting: Take receivers into account when custom grouping Alertmanager groups.

fixLDAP: Fix listing all non-matching groups.

fixAlerting: Fix simplified routing group by override.

fixNodeGraph: Fix invisible arrow tips in Editor.

fixDashboard: DashboardPageProxy - Use chaining operators to prevent runtime error.

fixCli: Check missing plugin parameter of plugin update command.

fixDashboardScene: Fixes issue saving new dashboard from panel edit.

fixDashboardScene: Fixes minor issue transitioning between dashboards.

+25 more items in the release notes

10.4.19 May 22, 2025 Release notes ↗

featureChore: Bump Go version to 1.24.3

featureDependencies: Bump golang.org/x/net from v0.37.0 to v0.40.0

securitySecurity: Fix CVE-2025-4123

securitySecurity: Fix CVE-2025-3580

10.4.18 Apr 22, 2025 Release notes ↗

featureChore: Bump golang-jwt/jwt/v4 and golang-jwt/jwt/v5 to address security issues

featureGo: Bump to 1.24.2

featureGo: Bump to 1.24.2 (Enterprise)

fixAuth: Fix SAML user IsExternallySynced not being set correctly (#98487)

fixAuthN: Refetch user on "ErrUserAlreadyExists"

securitySecurity: Fix CVE-2025-3454

10.4.17 Mar 25, 2025 Release notes ↗

featureChore: Bump Go version to 1.23.7

featureChore: Bump Go version to 1.23.7 (Enterprise)

fixAlerting: Update slack image upload to use new API

fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows

10.4.15 Jan 28, 2025 Release notes ↗

featureSecurity: Update to Go 1.22.11 - Backport to v10.4.x

featureSecurity: Update to Go 1.22.11 - Backport to v10.4.x (Enterprise)

fixAzure/GCM: Improve error display

10.4.14 Dec 4, 2024 Release notes ↗

fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key

10.4.13 Nov 19, 2024 Release notes ↗

10.4.12 Nov 8, 2024 Release notes ↗

fixAlerting: Make context deadline on AlertNG service startup configurable

10.4.11 Oct 22, 2024 Release notes ↗

fixAlerting: Fix broken panelId links

securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]

fixDashboard: Make dashboard search faster

10.4.10 Oct 1, 2024 Release notes ↗

featureChore: Bump Go to 1.22.7

featureChore: Bump Go to 1.22.7 (Enterprise)

fixAzureMonitor: Deduplicate resource picker rows

fixCorrelations: Limit access to correlations page to users who can access Explore

10.4.9 Sep 26, 2024 Release notes ↗

featureChore: Update swagger ui (4.3.0 to 5.17.14)

fixProvisioning: Prevent provisioning folder errors from failing startup

10.4.8 Aug 27, 2024 Release notes ↗

fixAlerting: Fix persisting result fingerprint that is used by recovery threshold

fixAuditing: Fix a possible crash when audit logger parses responses for failed requests (Enterprise)

fixRBAC: Fix seeder failures when inserting duplicated permissions (Enterprise)

fixSnapshots: Fix panic when snapshot_remove_expired is true

10.4.7 Aug 14, 2024 Release notes ↗

securitySwagger: Fixed CVE-2024-6837.

10.4.6 Jul 26, 2024 Release notes ↗

featureAlerting: Update grafana/alerting to ce0d024b67ea714b06d0f5309025466f50e381ef

featurePrometheus: Reintroduce Azure audience override feature flag

fixAlerting: Fix panic in provisioning filter contacts by unknown name

fixAlerting: Skip loading alert rules for dashboards when disabled [v10.4.x]

fixEcho: Suppress errors from frontend-metrics API call failing

10.4.5 Jun 25, 2024 Release notes ↗

fixEcho: Suppress errors from frontend-metrics API call failing.

fixAzure Monitor: Add validation for namespace field in AdvancedResourcePicker when entering a forward slash.

10.4.4 Jun 13, 2024 Release notes ↗

fixBrowseDashboards: Prepend subpath to New Browse Dashboard actions.

fixAlerting: Fix rule storage to filter by group names using case-sensitive comparison.

fixAlerting: Fix editing Grafana folder via alert rule editor.

fixAzureMonitor: Fix bug detecting app insights queries.

fixAuthN: Fix signout redirect url.

fixSSE: Fix threshold unmarshal to avoid panic.

fixAlerting: Fix typo in JSON response for rule export.

fixCloudMonitoring: Fix query type selection issue.

fixProvisioning: Add override option to role provisioning. (Enterprise)

10.4.3 May 14, 2024 Release notes ↗

featureChore: Upgrade go to 1.21.10.

featureChore: Upgrade go to 1.21.10. (Enterprise)

fixCloudMonitoring: Improve legacy query migrations.

fixAzure data sources: Set selected config type before save.

fixProvisioning: Look up provisioned folders by UID when possible.

fixCloudwatch: Update grafana-aws-sdk to fix sts endpoints.

fixAlerting: Prevent search from locking the browser.

fixSQLStore: Disable redundant create and drop unique index migrations on dashboard table.

fixAlerting: Take receivers into account when custom grouping Alertmanager groups.

fixLDAP: Fix listing all non-matching groups.

fixAlerting: Fix simplified routing group by override.

fixAlerting: Return a 400 and errutil error when trying to delete a contact point that is referenced by a policy.

fixLibraryPanelRBAC: Fix issue with importing dashboards containing library panels.

fixGoogle Cloud Monitor: Fix res being accessed after it becomes nil in promql_query.go.

fixGoogle Cloud Monitor: Fix interface conversion for incorrect type in cloudMonitoringProm.run.

fixDashboard: Allow auto refresh option when saving a dashboard.

fixReporting: Fix monthly schedule text and modify monthly schedule inputs behavior. (Enterprise)

fixSAML: Fix Authn request generation in case of HTTP-POST binding. (Enterprise)

10.4.2 Apr 11, 2024 Release notes ↗

fixAngular deprecation: Prefer local "angularDetected" value to the remote one.

fixAuthProxy: Fix missing session for ldap auth proxy users.

fixAlerting: Fix receiver inheritance when provisioning a notification policy.

fixCloudMonitoring: Only run query if filters are complete.

10.4.1 Mar 21, 2024 Release notes ↗

featureAlerting: Add "Keep Last State" backend functionality.

featurePostgres: Allow disabling SNI on SSL-enabled connections.

featureDataQuery: Track panel plugin id not type.

fixElasticsearch: Fix legend for alerting, expressions and previously frontend queries.

fixAlerting: Fix optional fields requiring validation rule.

fixExtSvcAccounts: FIX prevent service account deletion.

fixLoki: Fix null pointer exception in case request returned an error.

fixDashboard: Fix issue where out-of-view shared query panels caused blank dependent panels.

fixAuth: Only call rotate token if we have a session expiry cookie.

fixServiceaccounts: Add ability to add samename SA for different orgs.

fixGenAI: Update the component only when the response is fully generated.

fixTempo: Better fallbacks for metrics query.

fixTempo: Add template variable interpolation for filters.

fixAlerting: Fix saving evaluation group.

fixQueryVariableEditor: Select a variable ds does not work.

fixLogs Panel: Add option extra UI functionality for log context.

10.4.0 Mar 6, 2024 Release notes ↗

featureAuthToken: Remove client token rotation feature toggle.

featurePlugins: Enable feature toggle angularDeprecationUI by default.

featureTable Component: Improve text-wrapping behavior of cells.

featureAlerting: Dry-run legacy upgrade on startup.

featureTempo: Upgrade @grafana/lezer-traceql patch version to use trace metrics syntax.

featureLogs Panel: Add CSV to download options.

featureFolders: Switch order of the columns in folder table indexes so that org_id becomes first.

featureLogs panel: Table UI - Guess string field types.

featureAlerting: Send alerts to APIv2 when using the Alertmanager contact point.

featureAlerting: Emit warning when creating or updating unusually large groups.

featureKeybindings: Change 'h' to 'mod+h' to open help modal.

featureChore: Update arrow and prometheus dependencies.

featureAlerting: Enable group-level rule evaluation jittering by default, remove feature toggle.

featureLoki Log Context: Always show label filters with at least one parsed label.

featureLogs Panel: Table UI - better default column spacing.

featureRBAC: Migration to remove the scope from permissions where action is alert.instances:read.

featureJWT Authentication: Add support for specifying groups in auth.jwt for teamsync.

featureAlerting: GA alertingPreviewUpgrade and enable by default.

featureElasticsearch: Apply ad-hoc filters to annotation queries.

featureAlerting: Show legacy provisioned alert rules warning.

featureTempo: Support TraceQL metrics queries.

featureTempo: Support backtick strings.

featureDashboards: Remove advancedDataSourcePicker feature toggle.

featureCloudWatch: Remove references to pkg/infra/metrics.

featureLicensing: Redact license when overriden by env variable.

featureExplore: Disable cursor sync.

featureTempo: Add custom headers middleware for grpc client.

featureChore: Update test database initialization.

featureElasticsearch: Implement CheckHealth method in the backend.

featureTooltips: Hide dimension configuration when tooltip mode is hidden.

featureAlerting: Show warning when cp does not exist and invalidate the form.

featureUser: Add uid colum to user table.

featureCloudwatch: Remove core imports from infra/log.

featureAlerting: Add pagination and improved search for notification policies.

featureAlerting: Move action buttons in the alert list view.

featureGrafana/ui: Add deprecation notices to the legacy layout components.

featureCloudwatch: Deprecate cloudwatchNewRegionsHandler feature toggle and remove core imports from featuremgmt.

featureCandlestick: Add tooltip options.

featureFolders: Forbid performing operations on folders via dashboards HTTP API.

featureFeature Management: Move awsDatasourcesNewFormStyling to Public Preview.

+145 more items in the release notes

10.3.12 Oct 22, 2024 Release notes ↗

securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]

fixDashboard: Make dashboard search faster

10.3.11 Oct 1, 2024 Release notes ↗

featureChore: Bump Go to 1.22.7

featureChore: Bump Go to 1.22.7 (Enterprise)

fixCorrelations: Limit access to correlations page to users who can access Explore

10.3.10 Sep 26, 2024 Release notes ↗

10.3.9 Aug 27, 2024 Release notes ↗

10.3.7 Jun 25, 2024 Release notes ↗

fixEcho: Suppress errors from frontend-metrics API call failing.

10.3.6 May 14, 2024 Release notes ↗

featureChore: Upgrade go to 1.21.10.

featureChore: Upgrade go to 1.21.10. (Enterprise)

fixAzure data sources: Set selected config type before save.

fixLibraryPanelRBAC: Fix issue with importing dashboards containing library panels.

fixAuthProxy: Fix missing session for ldap auth proxy users.

fixPDF: Fix initialization when SMTP is disabled. (Enterprise)

10.3.5 Mar 21, 2024 Release notes ↗

featurePostgres: Allow disabling SNI on SSL-enabled connections.

fixSnapshots: Require delete within same org (backport).

fixElasticsearch: Fix legend for alerting, expressions and previously frontend queries.

fixDashboard: Fix issue where out-of-view shared query panels caused blank dependent panels.

fixAlerting: Fix preview getting the correct queries from the form.

10.3.4 Mar 6, 2024 Release notes ↗

securityFixes CVE-2024-1442: A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so…

featureChore: Improve domain validation for Google OAuth - Backport 83229 to v10.3.x.

fixLDAP: Fix LDAP users authenticated via auth proxy not being able to use LDAP active sync.

fixTempo: Add template variable interpolation for filters (#83213).

fixElasticsearch: Fix adhoc filters not applied in frontend mode.

fixDashboards: Fixes issue where panels would not refresh if time range updated while in panel view mode.

fixAuth: Fix email verification bypass when using basic authentication.

fixAuthProxy: Invalidate previous cached item for user when changes are made to any header.

fixLibraryPanels/RBAC: Fix issue where folder scopes weren't being correctly inherited.

fixLibraryPanels: Fix issue with repeated library panels.

fixPlugins: Don't auto prepend app sub url to plugin asset paths.

fixElasticsearch: Set middlewares from Grafana's httpClientProvider.

fixFolders: Fix failure to update folder in SQLite.

fixLoki/Elastic: Assert queryfix value to always be string.

10.3.3 Feb 13, 2024 Release notes ↗

fixElasticsearch: Fix creating of legend so it is backward compatible with frontend produced frames.

fixShareModal: Fixes url sync issue that caused issue with save drawer.

10.3.1 Jan 23, 2024 Release notes ↗

breakingTo resolve a technical issue within the Grafana release package management process, we are releasing both Grafana 10.3.0 and Grafana 10.3.1 simultaneously. The 10.3.1 release contains no breaking or functional changes from 10.3.0. Please refer to the What’s New post for Grafana 10.3.0 for details…

10.3.0 Jan 23, 2024 Release notes ↗

featureAlerting: Guided legacy alerting upgrade dry-run.

featureExplore: Preserve time range when creating a dashboard panel from Explore.

featureExplore: Init with mixed DS if there's no root DS in the URL and queries have multiple datasources.

featureQueryEditor: Display error even if error field is empty.

featureK8s: Enable api-server by default.

featureParca: Add standalone building configuration.

featureAuth: Hide forgot password if grafana auth is disabled.

featurePlugins: Add uninstall requested message for cloud plugins.

featureLoki: Open log context in new tab.

featureAlerting: Allow linking to library panels.

featureLoki: Drop all errors in volume requests.

featureLoki Logs volume: Added a query splitting loading indicator to the Logs Volume graph.

featurePlugins: Disable add new data source for incomplete install.

featureRBAC: Render team, service account and user list when a user can see entities but not roles attached to them.

featureInfluxDB: Use database input for SQL configuration instead of metadata.

featureTempo: Support special characters in identifiers.

featureAlerting: Display "Show all" button for cloud rules.

featureReact Hook Form: Update to v 7.49.2.

featureLoki: Add timeRange to labels requests in LogContext to reduce loading times.

featureInfluxDB: Enable SQL support by default.

featureOAuth: Remove accessTokenExpirationCheck feature toggle.

featureUnits: Add scalable unit option.

featureAlerting: Add export mute timings feature to the UI.

featureConfig: Can add static headers to email messages.

featureAlerting: Drop NamespaceID from responses on unstable ngalert API endpoints in favor of NamespaceUID.

featureCloudwatch: Update cloudwatchNewRegionsHandler to General Availability.

featurePlugins: Include Azure settings as a part of Grafana config sent in plugin requests.

featurePlugins: Add hide_angular_deprecation setting.

featureTable: Add select/unselect all column values to table filter.

featureAnonymous: Add configurable device limit.

featureFrontend: Detect new assets / versions / config changes.

featurePlugins: Add option to disable TLS in the socks proxy.

featureFrontend: Reload the browser when backend configuration/assets change.

featureChore: Refactor dataviz aria-label e2e selectors to data-testid.

featureSSO: Add GitHub auth configuration page.

featurePublicDashboards: Add setting to disable the feature.

featureVariables: Interpolate variables used in custom variable definition.

featureTable: Highlight row on shared crosshair.

featureStat: Add Percent Change Option.

featurePlugins: Add Command Palette extension point.

+39 more items in the release notes

10.2.8 Jun 25, 2024 Release notes ↗

fixElasticsearch: Fix URL creation and allowlist for /_mapping requests.

10.2.7 May 14, 2024 Release notes ↗

featureChore: Upgrade go to 1.21.10.

featureChore: Upgrade go to 1.21.10. (Enterprise)

fixAzure data sources: Set selected config type before save.

10.2.6 Mar 26, 2024 Release notes ↗

featurePostgres: Allow disabling SNI on SSL-enabled connections.

fixCloudMonitoring: Only run query if filters are complete.

fixSnapshots: Require delete within same org (backport).

fixDashboard: Fix issue where out-of-view shared query panels caused blank dependent panels.

fixDashboards: Run shared queries even when source panel is in collapsed row.

fixPrometheus: Fix calculating rate interval when there is no interval specified.

fixPrometheus: Fix $__rate_interval calculation.

10.2.5 Mar 6, 2024 Release notes ↗

featureAlerting: Add setting to distribute rule group evaluations over time.

fixCloudwatch: Fix errors while loading queries/datasource on Safari.

fixElasticsearch: Fix adhoc filters not applied in frontend mode.

fixAuth: Fix email verification bypass when using basic authentication.

fixAlerting: Fix queries and expressions in rule view details.

fixPlugins: Don't auto prepend app sub url to plugin asset paths.

fixFolders: Fix failure to update folder in SQLite.

10.2.4 Feb 14, 2024 Release notes ↗

featureChore: Upgrade Go to 1.21.5.

fixField: Fix perf regression in getUniqueFieldName().

fixAlerting: Fix Graphite subqueries.

fixAnnotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL.

fixLoki: Fix bug duplicating parsed labels across multiple log lines.

fixAlerting: Fix NoData & Error alerts not resolving when rule is reset.

fixAuth: Fix a panic during logout when OAuth provider is not set.

fixGauges: Fixing broken auto sizing.

fixTemplating: Json interpolation of single-value default selection does not create valid json.

fixTempo: Fix cache in TraceQL editor.

fixAlerting: Fix for data source filter on cloud rules. (#79327).

10.2.3 Dec 19, 2023 Release notes ↗

featureAuth: Improve groups claim setup docs for AzureAD.

featureAlerting: Attempt to retry retryable errors.

featureUnified Alerting: Set max_attempts to 1 by default.

featureAuth: Add anonymous users view and stats.

fixAlerting: Fix deleting rules in a folder with matching UID in another organization.

fixCloudWatch: Correctly quote metric names with special characters.

fixDeleteDashboard: Redirect to home after deleting a dashboard.

fixAlerting: Fixes combination of multiple predicates for rule search.

fixCloudWatch: Fetch Dimension keys correctly from Dimension Picker.

fixTempo: Fix read-only access error.

fixBug: Fix broken ui components when angular is disabled.

fixInfluxDB: Parse data for table view to have parity with frontend parser.

fixElasticsearch: Fix processing of raw_data with not-recognized time format.

fixRecorded Queries: Add org isolation (remote write target per org), and fix cross org Delete/List. (Enterprise)

fixAuditing: Fix missing action in alert manager routes. (Enterprise)

10.2.2 Nov 21, 2023 Release notes ↗

fixFeatureToggle: Disable dashgpt by default and mark it as preview.

fixSaveDashboardPrompt: Reduce time to open drawer when many changes applied.

fixAlerting: Fix export with modifications URL when mounted on subpath.

fixExplore: Fix queries (cached & non) count in usage insights.

fixPlugins: Keep working when there is no internet access.

10.2.1 Nov 14, 2023 Release notes ↗

featureStat: Add panel option to control wide layout.

fixDashboards: Fix dashboard listing when user can't list any folders.

fixSearch: Modify query for better performance.

fixDashboards: Fix issue causing crashes when saving new dashboard.

fixRBAC: Allow scoping access to root level dashboards.

fixCloudWatch Logs: Add labels to alert and expression queries.

fixBug Fix: Respect data source version when provisioning.

fixExplore: Fix support for angular based datasource editors.

fixPlugins: Fix status_source always being "plugin" in plugin request logs.

fixInfluxDB: Fix aliasing with $measurement or $m on backend mode.

fixInfluxDB: Fix parsing multiple tags on backend mode.

fixExplore: Fix panes vertical scrollbar not being draggable.

fixExplore: Avoid reinitializing graph on every query run.

fixBug fix: Correctly set permissions on provisioned dashboards.

fixInfluxDB: Fix adhoc filter calls by properly checking optional parameter in metricFindQuery.

fixInfluxDB: Fix table parsing with backend mode.

fixAlerting: Alert rule constraint violations return as 400s in provisioning API.

fixPresenceIndicators: Do not retry failed views/recent API calls. (Enterprise)

fixAnalytics: Use panel renderer rather than legacy flot graph. (Enterprise)

breakingUpdate transformation

breakingUpdate field override Issue

10.2.0 Oct 24, 2023 Release notes ↗

featureCanvas: Promote Button to beta.

featureBarChart: Improve data links UX in tooltip.

featurePluginExtensions: Make sure to pass default timeZone in context.

featurePublicDashboards: Enable feature by default for GA and remove public preview text.

featureGrafana UI: Add Avatar component.

featureAlerting: Add support for msteams contact point in external Alertmanagers.

featureAlerting: Enable Insights landing page.

featureTransformations: De-emphasize non-applicable transformations.

featureExplore: Use short units in graphs.

featureAuth: Enable None role for 10.2.

featureTransformations: Add context to transformation editor.

featureTransformations: Add support for setting timezone in Format time and Convert field type transformations.

featurePlaylist: Add create+update timestamps to the database.

featureLive: Allow setting the engine password.

featureAuth: Add support for role mapping and allowed groups in Google OIDC.

featureAlerting: Add provenance field to /api/v1/provisioning/alert-rules.

featurePlugins: Add status_source label to plugin request metrics.

featurePluginExtensions: Made it possible to control modal size from extension.

featureLoki: Change run query button text based on number of queries.

featureCloudWatch Logs: Add pattern command to syntax.

featureCaching: Add feature toggle for memory efficient cache payload serialization.

featureFlamegraph: Make color by package the default color mode.

featureService Accounts: Enable adding folder, dashboard and data source permissions to service accounts.

featureSparklineCell: Display absolute value.

featureFeatureToggle: Add awsDatasourcesNewFormStyling feature toggle.

featureCloudWatch: Add missing AWS/Transfer metrics.

featureTransformations: Add variable support to join by field.

featureAlerting: Add rules export on a folder level.

featurePanelConfig: Add option to calculate min/max per field instead of using the global min/max in the data frame.

featureTransformations: Add unary operations to Add field from calculation.

featureBar Gauge: Add field name placement option.

featureAzureMonitor: Azure Monitor Cheat sheet.

featureChore: Bump grafana-plugin-sdk-go to v0.179.0.

featureDashboards: Add template variables to selectable options.

featureDocs: Update RBAC documentation.

featureAlerting: Export of contact points to HCL.

featureBrowseDashboards: Enable new Browse Dashboards UI by default.

featureAlerting: Use new endpoints in the Modify Export.

deprecatedre-provision any correlations that were created as part of provisioning

deprecatedre-create any correlations created with Admin/Correlations page Issue

+247 more items in the release notes

10.1.10 May 14, 2024 Release notes ↗

featureChore: Upgrade go to 1.21.10.

featureChore: Upgrade go to 1.21.10. (Enterprise)

10.1.9 Mar 26, 2024 Release notes ↗

fixSnapshots: Require delete within same org (backport).

10.1.8 Mar 6, 2024 Release notes ↗

fixAuth: Fix email verification bypass when using basic authentication.

10.1.7 Feb 13, 2024 Release notes ↗

fixAnnotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL.

10.1.6 Dec 19, 2023 Release notes ↗

featureAlerting: Attempt to retry retryable errors.

featureUnified Alerting: Set max_attempts to 1 by default.

fixAlerting: Fix deleting rules in a folder with matching UID in another organization.

fixChore: Fix timeout issues when gathering prometheus datasource stats.

fixProvisioning: Ensure that enterprise provisioning runs [10.1.x].

fixAlerting: Make shareable alert rule link work if rule name contains forward slashes.

fixLoki: Cache extracted labels.

fixDataSourcePicker: Disable autocomplete for the search input .

fixPlugins: Refresh plugin info after installation.

fixLDAP: FIX Enable users on successfull login .

fixLoki: Fix filters not being added with multiple expressions and parsers.

fixRecorded Queries: Add org isolation (remote write target per org), and fix cross org Delete/List. (Enterprise)

fixAuditing and UsageInsights: FIX Loki configuration to use proxy env variables. (Enterprise)

10.1.5 Oct 12, 2023 Release notes ↗

securityFixes CVE-2023-4399: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance d…

featureChore: Upgrade Go to 1.20.10.

featureCloudwatch: Backport 73524 Bring Back Legacy Log Group Picker.

fixCloudwatch: Prevent log group requests with ARNs if feature flag is off.

fixAlerting: Add support for keep_firing_for field from external rulers.

fixCanvas: Avoid conflicting stylesheets when loading SVG icons.

fixAlerting: Prevent showing "Permissions denied" alert when not accurate.

fixBrowseDashboards: Only remember the most recent expanded folder.

fixTempo Service Map: Fix context menu links in service map when namespace is present.

fixLogs Panel: Performance issue while scrolling within panel in safari.

fixBug: Allow to uninstall a deprecated plugin.

fixLicensing: Pass func to update env variables when starting plugin.

fixNested folders: Fix folder hierarchy in folder responses.

fixShare link: Use panel relative time for direct link rendered image.

fixAlerting: Do not exit if Redis ping fails when using redis-based Alertmanager clustering.

fixAlerting: Refactor AlertRuleForm and fix annotations step description for cloud rules.

fixRBAC: Chore fix hasPermissionInOrg. (Enterprise)

fixLicensing: Updated grpc plugin factory newPlugin signature. (Enterprise)

fixReporting: Add support for old dashboard schema. (Enterprise)

10.1.4 Sep 29, 2023 Release notes ↗

featureAzure: Add support for Workload Identity authentication.

10.1.2 Sep 19, 2023 Release notes ↗

featureChore: Upgrade Alpine base image to 3.18.3.

featureChore: Upgrade Go to 1.20.8.

10.1.1 Aug 31, 2023 Release notes ↗

featureLoki: Remove distinct operation.

featureWhitelabeling: Add a config option to hide the Grafana edition from the footer.

featureAlerting: Optimize rule details page data fetching.

featureAlerting: Optimize external Loki queries.

fixAlerting: Limit redis pool size to 5 and make configurable.

fixElasticsearch: Fix respecting of precision in geo hash grid.

fixDashboard: Fix Variable Dropdown to Enforce Minimum One Selection when 'All' Option is Configured.

fixChore: Fix Random Walk scenario for Grafana DS.

fixAuthProxy: Fix user retrieval through cache.

fixAlerting: Fix auto-completion snippets for KV properties.

fixAlerting: Fix incorrect timing meta information for policy.

fixAlerting: Add new Recording Rule button when the list is empty.

fixDrawer: Clicking a Select arrow within a Drawer no longer causes it to close.

fixLogs: Fix log samples not present with empty first frame.

fixAlerting: Fix Recording Rule QueryEditor builder view.

fixTransforms: Catch errors while running transforms.

fixDashboard: Fix version restore.

fixLogs: Fix permalinks not scrolling into view.

fixSqlDataSources: Update metricFindQuery to pass on scopedVars to templateSrv.

fixRendering: Fix dashboard screenshot.

fixLoki: Fix validation of step values to also allow e.g. ms values.

fixDashboard: Fix repeated row panel placement with larger number of rows.

fixCodeEditor: Correctly fires onChange handler.

fixDrawer: Fix scrolling drawer content on Safari.

fixAlerting: Remove dump wrapper for yaml config.

fixAlerting: Always invalidate the AM config after mutation.

fixSlug: Combine various slugify fixes for special character handling.

fixLogs: Fix displaying the wrong field as body.

fixAlerting: Fix "see graph button" for cloud rules.

10.1.0 Aug 23, 2023 Release notes ↗

featureUsage stats: Tune collector execution startup and interval.

featurePrometheus: Add support for day_of_year.

featureTransforms: Add Alpha Format Time Transform.

featurePrometheus: Add present_over_time syntax highlighting.

featureLogin: Show oauth error messages inline.

featureGeomap: Promote route + photos layer to beta, promote geojson layer to stable.

featureDashboards: Add Angular deprecation alert in data source query editor.

featureAuth: Lock organization roles for users who are managed through an external auth provider.

featureTranformations: True OUTER JOIN in the join by field transformation used for tabular data .

featureNestedFolders: Enable new nested folder picker by default for nested folders.

featureAlerting: Add dashboardUID and panelID query parameters for loki state history.

featureFeature toggles management: Define get feature toggles api.

featurePrometheus: Turn browser resource cache on by default.

featureAlerting: Improve alerts names visibility on narrow panels.

featureData Sources: Remove Admin/Data sources page in favour of Connections/Data sources.

featureLoki: Enable Query Splitting by default.

featureAuthN: Lock down manual role updates for users synced through Grafana Com portal.

featureTempo: Remove traceqlSearch feature toggle.

featureAlerting: Keep legacy alert rule maxDataPoints and intervalMs during migration.

featureAlerting: Add min interval option to alert rule query creation.

featureAlerting: Add View YAML button for Grafana/provisioned rules.

featurePlugin: Remove error on invalid version.

featureTraces: Enable showing trace ids.

featureRBAC: Split non-empty scopes into kind, attribute and identifier fields for better search performance.

featureAdminstration: Feature toggle for feature toggle admin page.

featureAlerting: Improve performance of matching captures.

featureCommandPalette: Remove parent search and fuzzy search for pages.

featureTracing: Remove newTraceViewHeader feature toggle.

featureFlameGraph: Add column in table with buttons to filter and sandwich a symbol.

featureUnits: Added support for Candela (cd).

featureAlerting: Add contact point provisioning file export.

featureRedshift: Support caching async aws queries.

featureAlerting: Save and restore condition reference while switching type.

featureExplore: Remove exploreMixedDatasource feature toggle.

featureOAuth: Introduce user_refresh_token setting and make it default for the selected providers.

featureAlerting: Adds support for toggling common labels.

featurePlugin: Validate plugin version on installation.

breakingUsing ${datasourceVariable} to display the data source name in text panel or in the panel title.

breakingUsing ${datasourceVariable} to use the data source name as part of the query content.

breakingUsing the ${datasourceVariable} to choose which data source to use for a query (through its data source picker) will not be affected since it can use both the name and the uid Issue

+265 more items in the release notes

10.0.13 Mar 26, 2024 Release notes ↗

fixSnapshots: Require delete within same org (backport).

10.0.12 Mar 6, 2024 Release notes ↗

fixAuth: Fix email verification bypass when using basic authentication.

10.0.11 Feb 13, 2024 Release notes ↗

fixAnnotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL.

10.0.10 Dec 19, 2023 Release notes ↗

featureAlerting: Attempt to retry retryable errors.

featureUnified Alerting: Set max_attempts to 1 by default.

fixRecorded Queries: Add org isolation (remote write target per org), and fix cross org Delete/List. (Enterprise)

10.0.9 Oct 12, 2023 Release notes ↗

featureChore: Upgrade Go to 1.20.10.

fixBrowseDashboards: Only remember the most recent expanded folder.

fixLicensing: Pass func to update env variables when starting plugin.

fixNested folders: Fix folder hierarchy in folder responses.

fixRBAC: Chore fix hasPermissionInOrg. (Enterprise)

fixLicensing: Updated grpc plugin factory newPlugin signature. (Enterprise)

10.0.8 Sep 29, 2023 Release notes ↗

featureAzure: Add support for Workload Identity authentication.

10.0.6 Sep 19, 2023 Release notes ↗

featureChore: Upgrade Alpine base image to 3.18.3.

featureChore: Upgrade Go to 1.20.8.

10.0.5 Sep 5, 2023 Release notes ↗

featureSSE: DSNode to update result with names to make each value identifiable by labels (only Graphite and TestData.

fixLDAP: Fix user disabling.

10.0.4 Aug 23, 2023 Release notes ↗

featureUsage stats: Tune collector execution startup and interval.

featurePrometheus: Add present_over_time syntax highlighting.

featureAlerting: Improve performance of matching captures.

fixAzureMonitor: Allow serviceTags and tags to be empty for trace results.

fixCloud Monitoring: Support AliasBy property in MQL mode.

fixAlerting: Exclude expression refIDs from NoData state.

fixAlerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error.

fixDashboard: New Datasource picker link is keyboard accessible.

fixAzureMonitor: Fix ResourcePicker hanging.

fixAlerting: Fix refetching grafana rules on alert list panel.

fixAlerting: Fix contact point testing with secure settings.

fixTimeSeries: Fix zoom not working after editing panel.

fixCloudMonitoring: Correctly set title and text fields for annotations.

10.0.3 Jul 26, 2023 Release notes ↗

featureAlerting: Sort NumberCaptureValues in EvaluationString.

featureAlerting: No longer silence paused alerts during legacy migration.

featureAuth: Add support for custom signing keys in auth.azure_ad.

featureChore: Upgrade Go to 1.20.6.

featureAuth: Remove ldap init sync. (Enterprise)

featureChore: Upgrade Go to 1.20.6. (Enterprise)

fixAlerting: Fix edit / view of webhook contact point when no authorization is set.

fixAzureMonitor: Set timespan in Logs Portal URL link.

fixPlugins: Only configure plugin proxy transport once.

fixElasticsearch: Fix multiple max depth flatten of multi-level objects.

fixElasticsearch: Fix histogram colors in backend mode.

fixAlerting: Fix state in expressions footer.

fixAppChromeService: Fixes update to breadcrumb parent URL.

fixElasticsearch: Fix using multiple indexes with comma separated string.

fixAlerting: Fix Alertmanager change detection for receivers with secure settings.

fixTransformations: Fix extractFields throwing Error if one value is undefined or null.

fixXYChart: Point size editor should reflect correct default (5).

fixAnnotations: Fix database lock while updating annotations.

fixTimePicker: Fix issue with previous fiscal quarter not parsing correctly.

fixAzureMonitor: Correctly build multi-resource queries for Application Insights components.

fixAzureMonitor: Fix metric names for multi-resources.

fixLogs: Do not insert log-line into log-fields in json download.

fixLoki: Fix wrong query expression with inline comments.

fixLicense: Enable FeatureUserLimit for all products. (Enterprise)

10.0.2 Jul 11, 2023 Release notes ↗

feature[v10.0.x] Alerting: Add limit query parameter to Loki-based ASH api, drop default limit from 5000 to 1000, extend visible time range for new ASH UI.

feature[v10.0.x] Alerting: Allow selecting the same custom group when swapping folders.

feature[v10.0.x] Alerting: Move rule UID from Loki stream labels into log lines.

feature[v10.0.x] Explore: Clean up query subscriptions when a query is canceled.

fixLogs: Fix wrong before and after texts in log context.

fix[v10.0.x] Alerting: Add file and rule_group query params in request for filtering the res….

fix[v10.0.x] Alerting: Convert 'Both' type Prometheus queries to 'Range' in migration.

fix[v10.0.x] Alerting: Display correct results when using different filters on alerting panels.

fix[v10.0.x] Alerting: Fix HA alerting membership sync.

fix[v10.0.x] Alerting: Fix unique violation when updating rule group with title chains/cycles.

fix[v10.0.x] Dashboard: Fix issue where a panel with a description and a cached response displays 2 info icons.

fix[v10.0.x] Elasticsearch: Make it compatible with the new log context functionality.

fix[v10.0.x] Fix: Change getExistingDashboardByTitleAndFolder to get dashboard by title, not slug.

fix[v10.0.x] LogContext: Fix filtering out log lines with the same entry.

fix[v10.0.x] Login: Fix footer from displaying under the login box.

fix[v10.0.x] Navigation: Fix toolbar actions flickering on mobile.

fix[v10.0.x] SAML UI: Enforce one option for configuring IdP metadata. (Enterprise)

fix[v10.0.x] Variables: Detect a name for duplicated variable.

fix[v10.0.x] XYChart: Ensure color scale is field-local and synced with data updates.

fix[v10.0.x] XYChart: Fix axis range and scale overrides.

fix[v10.0.x] Grafana UI: Fix behaviour regression on Tooltip component.

10.0.1 Jun 22, 2023 Release notes ↗

featureAlerting: Update alerting module to 20230524181453-a8e75e4dfdda.

featureCaching: Update labels for cache insertions counter. (Enterprise)

featureSchema: Improve Dashboard kind docs and remove deprecated props.

fixAlerting: Fix notification policies inheritance algorithm (#69304).

fixCaching: Fix issue in which caching can cause HTTP resource response bodies to be written twice. (Enterprise)

fixCodeEditor: Ensure suggestions only apply to the instance of the edit….

fixPlugins: Wrap original check health error.

fixUsage Insights: Fix last viewed date. (Enterprise)

fix[v10.0.x] Alerting: Add heuristics back to datasource healthchecks.

fix[v10.0.x] Alerting: Fix "show all instances".

fix[v10.0.x] Alerting: Fix broken UI because of query being optional for some ExpressionQuer….

fix[v10.0.x] Alerting: Fix email template for text/plain emails.

fix[v10.0.x] Alerting: Fix provisioned templates being ignored by alertmanager.

fix[v10.0.x] Alerting: Support newer http_config struct.

fix[v10.0.x] Auth: Show invite button if disable login form is set to false.

fix[v10.0.x] Azure: Fix Kusto auto-completion for Azure datasources (#69685).

fix[v10.0.x] CloudMonitoring: Improve parsing of GCM labels.

fix[v10.0.x] Command Palette: Links opened in a new tab now route correctly when Grafana is served under a subpath.

fix[v10.0.x] Command palette: Include help links.

fix[v10.0.x] Dashboards: Remove Explore option from panel menu when panel's datasource uid is "-- Dashboard --".

fix[v10.0.x] Dashboards: Variables - Improve slow template variable loading due same variable loaded multiple times on time range change.

fix[v10.0.x] Explore: Fixed Starred query history tab to show all starred queries.

fix[v10.0.x] Explore: Improve logs volume panel empty state.

fix[v10.0.x] Explore: Run remaining queries when one is removed from a pane.

fix[v10.0.x] Heatmap: Sort fields by numeric names when single frame.

fix[v10.0.x] InfluxDB: Interpolate retention policies.

fix[v10.0.x] Log Context: Fix split view button using the wrong query.

fix[v10.0.x] Loki: Fix error when empty template variables response.

fix[v10.0.x] Loki: Fix including of template variables in variable query editor.

fix[v10.0.x] NestedFolders: Fix select all in folder view selecting items out of folder.

fix[v10.0.x] Pyroscope: Fix wrong defaults when importing query from different datasource.

fix[v10.0.x] SQLStore: Align SQLite IsUniqueConstraintViolation() with other backend implementations.

fix[v10.0.x] Templating: Fix updating of definition to empty string.

fix[v10.0.x] Tempo: Use pipe in TraceQL by default for multi-value variables.

fix[v10.0.x] TextPanel: Fix styling missing the disclosure triangle.

fix[v10.0.x] Util: Fix panic when generating UIDs concurrently.

fix[v10.0.x] XYChart/Trend: Fix min/max and units/decimals X field overrides.

fix[v10.0.x] XYChart: Fix formatting of axis ticks (units, decimals).

fix[v10.0.x] XYChart: Fix variable interpolation in datalinks/toggletip.

10.0.0 Jun 22, 2023 Release notes ↗

featureThemes: Unify secondary button and ToolbarButton.

featurePublicDashboards: Email sharing users with active sessions added in Users list . (Enterprise)

featureCaching: Ensure context-canceled are not reported as errors . (Enterprise)

featureSAML: Configuration UI. (Enterprise)

fixQuery Editor: Ensure dropdown menus position correctly.

fixDrawer: Fixes closeOnMaskClick false issue.

fixSAML: Fix IdP metadata caching so that invalid metadata doesn't get cached. (Enterprise)

9.5.20 Jun 25, 2024 Release notes ↗

9.5.19 May 14, 2024 Release notes ↗

featureChore: Upgrade go to 1.21.10.

featureChore: Upgrade go to 1.21.10. (Enterprise)

fixProvisioning: Look up provisioned folders by UID when possible.

9.5.18 Mar 26, 2024 Release notes ↗

fixSnapshots: Require delete within same org (backport).

9.5.17 Mar 6, 2024 Release notes ↗

featureBump go-git to v5.11.0.

featurePlugins: Bump otelgrpc instrumentation to 0.47.0.

fixAuth: Fix email verification bypass when using basic authentication.

9.5.16 Feb 13, 2024 Release notes ↗

fixAnnotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL.

9.5.15 Dec 19, 2023 Release notes ↗

featureAlerting: Attempt to retry retryable errors.

featureUnified Alerting: Set to 1 by default.

fixRecorded Queries: Add org isolation (remote write target per org), and fix cross org Delete/List. (Enterprise)

9.5.14 Nov 14, 2023 Release notes ↗

fixAlerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error.

fixTransformations: Config overrides being lost when config from query transform is applied.

fixLDAP: FIX Enable users on successfull login .

fixAuditing and UsageInsights: FIX Loki configuration to use proxy env variables. (Enterprise)

9.5.13 Oct 12, 2023 Release notes ↗

featureChore: Upgrade Go to 1.20.10.

featureLicensing: Updated grpc plugin factory newPlugin signature. (Enterprise)

fixBrowseDashboards: Only remember the most recent expanded folder.

fixLicensing: Pass func to update env variables when starting plugin.

fixRBAC: Chore fix hasPermissionInOrg. (Enterprise)

9.5.12 Sep 29, 2023 Release notes ↗

featureAzure: Add support for Workload Identity authentication.

9.5.10 Sep 19, 2023 Release notes ↗

featureChore: Upgrade Alpine base image to 3.18.3.

featureChore: Upgrade Go to 1.20.8.

9.5.9 Sep 5, 2023 Release notes ↗

featureSSE: DSNode to update result with names to make each value identifiable by labels (only Graphite and TestData).

featurePrometheus: Add present_over_time syntax highlighting.

featureAlerting: Improve performance of matching captures.

fixLDAP: Fix user disabling.

9.5.8 Aug 17, 2023 Release notes ↗

featureGenericOAuth: Set sub as auth id.

fixDataSourceProxy: Fix url validation error handling.

9.5.7 Jul 26, 2023 Release notes ↗

featureAlerting: Sort NumberCaptureValues in EvaluationString.

featureAlerting: No longer silence paused alerts during legacy migration.

featureChore: Upgrade Go to 1.20.6.

featureAlerting: Remove and revert flag alertingBigTransactions.

featureAlerting: Migrate unknown NoData\Error settings to the default.

featureTempo: Escape regex-sensitive characters in span name before building promql query.

featureAlerting: Update grafana/alerting to ce9fba9.

featureChore: Upgrade Go to 1.20.6. (Enterprise)

fixPlugins: Only configure plugin proxy transport once.

fixAlerting: Fix unique violation when updating rule group with title chains/cycles.

fixFix: Change getExistingDashboardByTitleAndFolder to get dashboard by title, not slug.

fixAlerting: Convert 'Both' type Prometheus queries to 'Range' in migration.

fixAlerting: Support newer http_config struct.

fixInfluxDB: Interpolate retention policies.

fixStatusHistory: Fix rendering of value-mapped null.

fixAlerting: Fix provenance guard checks for Alertmanager configuration to not cause panic when compared nested objects.

fixAnonymousAuth: Fix concurrent read-write crash.

fixAzureMonitor: Ensure legacy properties containing template variables are correctly migrated.

fixExplore: Remove data source onboarding page.

fixDashboard: Re-align Save form.

fixAzure Monitor: Fix bug that did not show alert rule preview.

fixHistogram: Respect min/max panel settings for x-axis.

fixHeatmap: Fix color rendering for value ranges < 1.

fixHeatmap: Handle unsorted timestamps in calculate mode.

fixGoogle Cloud Monitor: Fix mem usage for dropdown.

fixAzureMonitor: Fix logs query multi-resource and timespan values.

fixUtils: Reimplement util.GetRandomString to avoid modulo bias.

fixLicense: Enable FeatureUserLimit for all products. (Enterprise)

fixAuth: Remove ldap init sync. (Enterprise)

9.5.6 Jul 11, 2023 Release notes ↗

fixDashboard: Fix library panels in collapsed rows not getting updated.

fixAuth: Add and document option for enabling email lookup.

9.5.5 Jun 22, 2023 Release notes ↗

fix[v9.5.x] Auth: Show invite button if disable login form is set to false.

fix[v9.5.x] Azure: Fix Kusto auto-completion for Azure datasources (#69685).

fix[v9.5.x] RBAC: Remove legacy AC editor and admin role on new dashboard route.

fix[v9.5.x] Revert: Allow editors to access GET /datasources.

fix[v9.5.x] Settings: Add ability to override skip_org_role_sync with Env variables.

9.5.3 Jun 6, 2023 Release notes ↗

securityFixes CVE-2023-2801: Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibili…

securityFixes CVE-2023-2183: Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible…

fixQuery: Prevent crash while executing concurrent mixed queries

fixAlerting: Require alert.notifications:write permissions to test receivers and templates

9.5.2 May 10, 2023 Release notes ↗

featureChore: Upgrade Go to 1.20.4.

featureAlerting: Scheduler use rule fingerprint instead of version.

fixTimeSeries: Fix leading null-fill for missing intervals.

fixDashboard: Revert fixed header shown on mobile devices in the new panel header.

fixPostgreSQL: Fix tls certificate issue by downgrading lib/pq.

fixProvisioning: Fix provisioning issues with legacy alerting and data source permissions.

fixAlerting: Fix misleading status code in provisioning API.

fixExplore: Update table min height (#67321).

fixDataLinks: Encoded URL fixed.

fixLoki: Fix log samples using instant queries (#67271).

fixPanel Header Fix: Implement new Panel Header on Angular Panels .

fixAzure Monitor: Fix bug that was not showing resources for certain locations.

fixAlerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning.

fixCloudwatch Logs: Clarify Cloudwatch Logs Limits.

fixSAML: Fix IdP metadata caching so that invalid metadata doesn't get cached. (Enterprise)

9.5.1 Apr 26, 2023 Release notes ↗

9.5.0 Apr 26, 2023 Release notes ↗

featureAPI keys: Add deprecation to api keys.

featureAPI: Enable serving Swagger UI by default and add docs and guidelines.

featureAPI: Permit Cache-Control (browser caching) for datasource resources.

featureAccessibility: Make row actions keyboard accessible.

featureAdmin/Plugins: Set category filter in connections link.

featureAlerting: Add CustomDetails field in PagerDuty contact point.

featureAlerting: Add dashboard and panel links to rule and instance annotations.

featureAlerting: Add filter and remove funcs for custom labels and annotations.

featureAlerting: Add fuzzy search to alert list view.

featureAlerting: Add metrics for active receiver and integrations.

featureAlerting: Better printing of labels.

featureAlerting: Create new state history "fanout" backend that dispatches to multiple other backends at once.

featureAlerting: Enable preview for recording rules.

featureAlerting: Fetch all applied alerting configurations.

featureAlerting: Introduce proper feature toggles for common state history backend combinations.

featureAlerting: Make time range query parameters not required when querying Loki.

featureAlerting: New notification policies view.

featureAlerting: No longer index state history log streams by instance labels.

featureAlerting: Respect "For" Duration for NoData alerts.

featureAlerting: Support filtering rules by multiple datasources.

featureAlerting: Switch to snappy-compressed-protobuf for outgoing push requests to Loki.

featureAngular: Prevent angular from loading when disabled.

featureAuth: Add Generic oauth skip org role sync setting.

featureAuth: Add feature flag to move token rotation to client.

featureAuth: Show user sync external Authentication status.

featureBackend: Use sdk version 0.148.0.

featureChore: Add stat for remote cache config.

featureChore: Replace short UID generation with more standard UUIDs.

featureChore: Use DOMPurify to sanitize strings rather than js-xss.

featureCloudMonitoring: Add possibility to use path for private key.

featureCloudWatch Logs: Update default timeout to 30m.

featureCloudWatch: Add AWS/IotSiteWise namespace and metrics.

featureCloudWatch: Add account support to variable queries.

featureCloudWatch: Make deeplinks work for us-gov and china regions.

featureCloudwatch: Add MeteredIOBytes metric for EFS.

featureCommand Palette: Display dashboard location.

featureCommand palette: Enable folder searching.

featureConnections: Turn on feature toggle by default.

featureCookies: Provide a mechanism for per user control over cookies.

featureDashboard Datasource: Update Query List & Improve UX.

+192 more items in the release notes