[renovate]

This PR contains the following updates:

Package	Update	Change
grafana/grafana	minor	13.2.4 → 13.3.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

grafana/grafana

v13.3.0

Security

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-81841
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

Features and enhancements

• Access control: reject global role creation in single-org mode (Enterprise)
• Alerting: Add AccessControlAction entries for inhibition rules #​130977, @​rodrigopk
• Alerting: Add notifications API boundary module #​134537, @​rodrigopk
• Alerting: Add the Config API data layer for external Alertmanager auto-sync #​129478, @​rodrigopk
• Alerting: Allow drag and drop for yaml file as import source for import wizard #​132705, @​rodrigopk
• Alerting: Cleanup promote staged config code #​130974, @​rodrigopk
• Alerting: Disable datasource picker while an import is staged #​133181, @​rodrigopk
• Alerting: Make stage default import method in GMA import wizard #​130634, @​rodrigopk
• Alerting: Make the Import wizard review step preview look clickable #​132711, @​rodrigopk
• Alerting: Migrate the Import-to-GMA wizard's auto-sync integration #​131523, @​rodrigopk
• Alerting: Migrate the auto-sync settings hook and panel onto the Config API #​131521, @​rodrigopk
• Alerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1 #​134883, @​moustafab
• Alerting: Promote a staged import configuration #​130327, @​rodrigopk
• Alerting: Read staged config origin from the managed_by field #​130787, @​rodrigopk
• Alerting: Redact secrets from the Import-to-GMA preview modal #​132827, @​rodrigopk
• Alerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers #​131520, @​rodrigopk
• Alerting: Remove import method from import to GMA wizard #​130609, @​rodrigopk
• Alerting: Retire the legacy admin_config auto-sync path #​131524, @​rodrigopk
• Alerting: Show Auto-sync support in the import wizard picker #​131084, @​rodrigopk
• Alerting: Support Mimir alertmanager_config files in Import to GMA wizard #​135637, @​rodrigopk
• Alerting: Surface external Alertmanager sync health in the settings UI #​131527, @​rodrigopk
• Alerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard #​131072, @​rodrigopk
• Auth: Bound OAuth token refresh lock waits by time instead of attempts #​133929, @​cinaglia
• Canvas: Load the standalone plugin by default #​134873, @​gtk-grafana
• Chore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0) #​132571, @​stevesg
• Dashboard: Adds new a subtitle option for panel descriptions #​129164, @​torkelo
• Dashboard: Fall back when collection deletion is unsupported #​128259, @​bestend
• Dashboards: Add $__namespace global variable #​132167, @​ivanortegaalba
• Dashboards: Allow Add variable + btn to add filters, links and annos as well #​130841, @​mdvictor
• Dashboards: Hide links to deleted folders in Recently Deleted #​134469, @​Clarity-89
• Dashboards: Improve Recently Deleted performance with server-side search #​134126, @​pstibrany
• Dashboards: Make the auto grid to be default #​130749, @​bfmatei
• Dashboards: Show Git Sync badges in folder search #​132790, @​Clarity-89
• Faro: add support for trackResources #​130792, @​ashharrison90
• FieldOverrides: Add ShowIfOverride to field config options #​132419, @​gtk-grafana
• Frontend: add subresource integrity #​131596, @​jackw
• Git Sync: Clarify repository links for pure Git #​134238, @​ferruvich
• Git Sync: Ignore hidden paths in repository scans and diffs #​134731, @​ferruvich
• GrafanaBootData: Restrict config.datasources usage via lint rule #​130661, @​mckn
• Heatmap: Keep exemplar marker size consistent across displays #​134072, @​fastfrwrd
• Home: Send the traces setup CTA to the OpenTelemetry onboarding guide #​135135, @​Clarity-89
• Homepage: Add an On call schedules tab with your shifts and who's on call #​134747, @​Clarity-89
• Homepage: Let the Synthetic Monitoring card ignore checks, targets, and probes #​134217, @​Clarity-89
• Homepage: Let the metrics card exclude hosts and filesystems from its disk alert #​133472, @​Clarity-89
• Homepage: Move card filters to a footer dropdown and show page kinds as icons #​135851, @​Clarity-89
• Homepage: Replace the Recent tab with Recent activity #​134633, @​Clarity-89
• Homepage: Stop the homepage from jumping while it loads #​135321, @​Clarity-89
• Log Details Sidebar: Change default action to replace the current log instead of opening a new tab #​133129, @​matyax
• Log Details: Surface errors in logs and update links styles #​134427, @​matyax
• Logs Table: Disable hover overflow by default #​132882, @​matyax
• Logs: Invert the orientation of the arrow in the Logs Table and Logs Panel #​131156, @​matyax
• Packaging: Remove bash dependency from alpine Docker image #​132643, @​TheoBrigitte
• PanelEdit: Conditional field config display & edit context #​132398, @​gtk-grafana
• PanelOptions: Add context options to overrides #​132414, @​gtk-grafana
• Plugins: Avoid to delete RBAC roles when upgrading #​134143, @​andresmgot
• Plugins: Expose OpenFeature provider discovery to backend plugins #​129735, @​adamyeats
• Plugins: Forward SSL certificate environment variables #​131848, @​osmocomet
• Plugins: Show the correct warning when grafana.com is unreachable #​132028, @​lazerg
• Provisioning: Add generic git OAuth app connections #​134186, @​amalavet
• Provisioning: Add link back to the original dashboard in preview banner #​129037, @​MissingRoberto
• Provisioning: Allow permission updates on provisioned folders #​134725, @​ferruvich
• Provisioning: Allow resource previews in unsynced folders #​133250, @​ferruvich
• Provisioning: Always interpret folder metadata in resources and sync #​134726, @​ferruvich
• Provisioning: Always protect folder metadata from direct file writes #​135038, @​ferruvich
• Provisioning: Always use folder metadata in Git Sync #​134355, @​Clarity-89
• Provisioning: Default save from a branch preview to the previewed branch #​135136, @​Clarity-89
• Provisioning: GitHub-style doc tabs for folder README #​129073, @​MissingRoberto
• Provisioning: Handle repository build timeouts and branch outages #​135072, @​ferruvich
• Provisioning: Keep folder when removing _folder.json leaves its UID unchanged #​135574, @​ferruvich
• Provisioning: Link README items to Grafana pages when viewed in Grafana #​128455, @​MissingRoberto
• Provisioning: Make backend user attribution unconditional #​134709, @​ferruvich
• Provisioning: Never replace the repository root folder during incremental sync #​135397, @​ferruvich
• Provisioning: Reject invalid resource names before API calls #​133666, @​ferruvich
• Provisioning: Respect Git Sync polling intervals after unchanged refs #​134380, @​ferruvich
• Provisioning: Show last checked time in Pull status #​134476, @​ferruvich
• Provisioning: Skip previews for pull requests from forks #​132522, @​ferruvich
• Provisioning: Stop PR previews when refs disappear #​132547, @​ferruvich
• Provisioning: Style branch/target-branch as GitHub-like pills in preview banner #​131133, @​MissingRoberto
• Provisioning: Support generic git OAuth connections in the UI #​134187, @​amalavet
• Provisioning: Support legacy paths and diagnose missing source annotations #​133225, @​ferruvich
• Provisioning: Surface the finalizer blocking a stuck repository deletion #​133241, @​MissingRoberto
• Provisioning: Treat manager-kind conflicts as warnings #​132364, @​ferruvich
• Provisioning: Use resource.action for preview banner title accuracy #​131134, @​MissingRoberto
• Provisioning: recover from a deleted PR branch (pre-flight + save to new branch) #​128977, @​MissingRoberto
• Provisioning: render mermaid diagrams in folder README #​129096, @​MissingRoberto
• Provisioning: tolerate quota lookup failures for existing repositories #​131703, @​ferruvich
• QueryEditor: Add extension point to the top toolbar #​132289, @​aocenas
• RBAC: Allow removing unowned permissions through access-control APIs (Enterprise)
• RBAC: Document APIs allow removing unowned permissions through access-control APIs #​132518, @​gamab
• Replace subtitle switch UI string #​132965, @​imatwawana
• Reports: say in the report when a variable value no longer exists (Enterprise)
• Sandbox: Config flag deprecation message #​135329, @​jesdavpet
• Sandbox: Show deprecation warning in UI tooltip (Enterprise)
• Standard options: Add Ordinal unit. #​130091, @​simonprickett
• Table: Calculate column widths independently of scrollbar visibility #​134337, @​fastfrwrd
• Table: Prevent initial column width jump with vertical scrollbars #​133615, @​fastfrwrd
• TimeRangePicker: Default isOnCanvas to true #​135833, @​torkelo
• TopNav: Logo should not shrink #​131170, @​torkelo
• Trace View: Open Logs link in a new tab (Drilldown) or in split view (Explore) #​132987, @​matyax
• TraceView: Add Go to span on the header error banner #​132550, @​joey-grafana
• TraceView: Add a trace banner for error and warning spans #​132250, @​joey-grafana
• TraceView: Expand attribute plugin cross-sell promos #​131472, @​joey-grafana
• TraceView: Open the banner span from Go to span and surface exception #​133122, @​joey-grafana
• TraceView: Use design system tokens in the header, minimap and timeline #​133339, @​joey-grafana
• TraceView: Use design system tokens in waterfall rows and span details #​133434, @​joey-grafana
• Traces to logs: Extend support, and discover trace and span related logs from #​130515, @​matyax
• Transformations: Allow setting static refIDs per transformation #​131458, @​Develer
• Transformations: Resolve variables in the classic transformation editor #​135569, @​Develer
• UI: Luxon on by default #​134865, @​fastfrwrd
• Unified storage: Enable automatic cleanup of deleted resources by default #​133330, @​pstibrany
• alerting: Remove method step from import to GMA wizard #​130616, @​rodrigopk

Bug fixes

• Alerting: Fix alerts going to the built-in Alertmanager after startup for external-only orgs #​134481, @​gillesdemey
• Alerting: Fix instance rows vanishing at coarse query steps in Triage #​133516, @​rodrigopk
• Alerting: Fix notification policy drop and query drift in rule saves #​131645, @​rodrigopk
• Alerting: Fix rule groups missing from a folder until "Show more" is clicked #​131078, @​JacobsonMT
• Alerting: Fix stale dry-run validation and YAML errors in the Import wizard #​132707, @​rodrigopk
• Alerting: Fix useAutoSyncConfiguration's queries behind Org Admin + feature toggle #​130627, @​rodrigopk
• Alerting: fix GetManagedRoute returning imported route for unrelated names #​132563, @​JacobsonMT
• Alerting: reject managed route names with leading/trailing whitespace #​132566, @​JacobsonMT
• Dashboard: Preserve panel subtitle in V2 save model #​133723, @​adi-IL
• Dashboards: Fix Classic model returning v2 JSON when saving a provisioned dashboard #​131718, @​ivanortegaalba
• Dashboards: Fix adhoc and groupby variable datasource on UI import #​131817, @​ivanortegaalba
• Dashboards: Fix browse crash and hangs when a dashboard shares its folder's UID #​132634, @​Clarity-89
• Dashboards: Fix edit state props when swapping dashboard state in place #​132001, @​ifrost
• Dashboards: Fix missing deletion dates in Recently Deleted #​133734, @​pstibrany
• Dashboards: Fix query variable refresh reset to onDashboardLoad on v2 UI import #​131837, @​ivanortegaalba
• Dashboards: Keep tags set on a new dashboard when saving it #​131459, @​ivanortegaalba
• Dashboards: Keep variable values and time settings set by an applied spec instead of reverting them to the URL #​134200, @​ivanortegaalba
• Dashboards: Preserve query variable refresh setting on v2 dashboard import #​132007, @​Sergej-Vlasov
• Dashboards: Show values preview for data source variables in the edit pane #​131736, @​ivanortegaalba
• Library panels: Fix skeleton alignment #​133965, @​ashharrison90
• Navigation: Hide NetworkError when switching organization #​131955, @​AshrithaSB
• Packaging: Fix issue with bundled plugins not being moved properly #​131033, @​kminehart
• PanelEditor: Fix options pane not resizable beyond the preview's content width #​131581, @​ivanortegaalba
• Plugins: Don't report loaded plugins as not registered when a request times out #​135591, @​leventebalogh
• Provisioning: Fix PR dashboard previews when served from a sub-path #​132569, @​gustaff-weldon
• Provisioning: Fix folder cleanup and hidden directory scans #​135050, @​ferruvich
• Provisioning: Fix folder rename UID collision during full sync #​130401, @​ferruvich
• Provisioning: Fix sync step flicker in Git Sync wizard #​134108, @​Clarity-89
• Reporting: Fix race condition with repeat panels on the /d-render/ page #​128536, @​mmandrus
• SQL Expressions: Read enum fields as their text #​135225, @​nicwestvold
• SQL Expressions: Rename label columns that clash with generated column names #​134869, @​nicwestvold
• Security: Fix CVE-2026-17183 #​131061, @​github-actions[bot]
• Table: Fix nested apply-to-row coloring to use the nested frame's own fields #​129426, @​fastfrwrd
• Table: Fix the height a wrapped header row reserves #​132230, @​fastfrwrd
• Table: fix JSON cell indentation, styling, and hover reveal #​130452, @​fastfrwrd

Breaking changes

• Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace #​132172, @​xnyo

Plugin development fixes & changes

• ConfirmModal: Ensure focus correctly traps when invoked from a dropdown menu #​132764, @​ashharrison90
• Datasources: Remove deprecated isDefault from DataSourceInstanceListItem #​133886, @​leventebalogh
• GrafanaUI: Fix focus ring appearance #​132808, @​ashharrison90
• MultiCombobox: Ensure height is consistent between empty/filled states #​131255, @​ashharrison90
• Runtime: Stabilize async data source APIs #​134390, @​leventebalogh
• Runtime: Stabilize plugin settings APIs #​134723, @​leventebalogh

v13.2.5

Security

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-103506
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967

Features and enhancements

• Git Sync: Ignore hidden paths in repository scans and diffs #​135028, @​ferruvich
• Provisioning: Default save from a branch preview to the previewed branch #​135174, @​Clarity-89
• Provisioning: Never replace the repository root folder during incremental sync #​135463, @​ferruvich

Bug fixes

• Plugins: Don't report loaded plugins as not registered when a request times out #​135665, @​leventebalogh
• Provisioning: Fix PR dashboard previews when served from a sub-path #​135559, @​gustaff-weldon

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d88ee57b-0b03-4c90-b282-43e52907e3ad

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}