szibis · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/workflows/compat-drilldown.yaml b/.github/workflows/compat-drilldown.yaml
@@ -41,7 +41,7 @@ jobs:
     env:
       LOKI_IMAGE: grafana/loki:3.7.7
       VICTORIALOGS_IMAGE: victoriametrics/victoria-logs:v1.52.0
-      GRAFANA_IMAGE: grafana/grafana:13.2.1
+      GRAFANA_IMAGE: grafana/grafana:13.2.3
       PROXY_IMAGE: loki-vl-proxy:compat-drilldown
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7

diff --git a/.github/workflows/compat-loki.yaml b/.github/workflows/compat-loki.yaml
@@ -34,7 +34,7 @@ jobs:
     env:
       LOKI_IMAGE: grafana/loki:3.7.7
       VICTORIALOGS_IMAGE: victoriametrics/victoria-logs:v1.52.0
-      GRAFANA_IMAGE: grafana/grafana:13.2.1
+      GRAFANA_IMAGE: grafana/grafana:13.2.3
       PROXY_IMAGE: loki-vl-proxy:compat-loki
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
@@ -104,7 +104,7 @@ jobs:
         loki_version: ${{ fromJson(needs.loki-matrix-source.outputs.loki_versions) }}
     env:
       VICTORIALOGS_IMAGE: victoriametrics/victoria-logs:v1.52.0
-      GRAFANA_IMAGE: grafana/grafana:13.2.1
+      GRAFANA_IMAGE: grafana/grafana:13.2.3
       PROXY_IMAGE: loki-vl-proxy:compat-loki
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7

diff --git a/.github/workflows/compat-vl.yaml b/.github/workflows/compat-vl.yaml
@@ -34,7 +34,7 @@ jobs:
     env:
       LOKI_IMAGE: grafana/loki:3.7.7
       VICTORIALOGS_IMAGE: victoriametrics/victoria-logs:v1.52.0
-      GRAFANA_IMAGE: grafana/grafana:13.2.1
+      GRAFANA_IMAGE: grafana/grafana:13.2.3
       PROXY_IMAGE: loki-vl-proxy:compat-vl
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
@@ -75,7 +75,7 @@ jobs:
         vl_version: ${{ fromJson(needs.vl-matrix-source.outputs.vl_versions) }}
     env:
       LOKI_IMAGE: grafana/loki:3.7.7
-      GRAFANA_IMAGE: grafana/grafana:13.2.1
+      GRAFANA_IMAGE: grafana/grafana:13.2.3
       PROXY_IMAGE: loki-vl-proxy:compat-vl
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **The compatibility stack runs Grafana 13.2.3 and Logs Drilldown 2.6.0**
+  (were Grafana 13.2.1 and Drilldown 2.5.2) in the e2e-compat stack, the root
+  compose file, the review override and the compatibility workflows; the
+  previous-family smoke runs Grafana 12.4.12 (was 12.4.10). The VictoriaLogs
+  datasource stays on 0.32.0. `compatibility-matrix.json` pins Drilldown 2.6.0
+  at commit `e894c0eb` and keeps the previous pins in the datasource and
+  Drilldown contract matrices. Drilldown 2.6.0 keeps the Patterns tab
+  initialisation guard of 2.0.4 to 2.5.2, so the patterns-autodetect variant
+  stays the default datasource; its volume aggregated by other fields is behind
+  the `drilldown.logs.logsVolumeByField` feature flag, off by default.
+
 ## [2.18.0] - 2026-10-18
 
 ### Fixed

diff --git a/conformance/registry/generated/matrix-link.json b/conformance/registry/generated/matrix-link.json
@@ -38,16 +38,18 @@
   "versions": {
     "grafana": {
       "matrix": [],
-      "pinned": "13.2.1"
+      "pinned": "13.2.3"
     },
     "grafana_client_detection": {
       "matrix": [],
       "pinned": null
     },
     "grafana_loki_datasource_contract": {
       "matrix": [
+        "13.2.3",
         "13.2.1",
         "13.0.1",
+        "12.4.12",
         "12.4.10",
         "12.4.2",
         "12.4.1"
@@ -56,6 +58,7 @@
     },
     "logs_drilldown_contract": {
       "matrix": [
+        "2.6.0",
         "2.5.2",
         "2.5.1",
         "2.5.0",
@@ -82,7 +85,7 @@
         "1.0.35",
         "1.0.34"
       ],
-      "pinned": "2.5.2"
+      "pinned": "2.6.0"
     },
     "loki": {
       "matrix": [

diff --git a/conformance/reports/compatibility-matrix.md b/conformance/reports/compatibility-matrix.md
@@ -6,10 +6,10 @@ Generated by `conformance/scripts/matrix_link.py`. Versions come from `test/e2e-
 
 | Component | Pinned | Also tested |
 |---|---|---|
-| grafana | `13.2.1` | — |
+| grafana | `13.2.3` | — |
 | grafana_client_detection | `—` | — |
-| grafana_loki_datasource_contract | `—` | 13.2.1, 13.0.1, 12.4.10, 12.4.2, 12.4.1 |
-| logs_drilldown_contract | `2.5.2` | 2.5.1, 2.5.0, 2.4.0, 2.3.0, 2.2.1, 2.2.0, 2.1.5, 2.1.3, 2.1.2, 2.1.1, 2.1.0, 2.0.4, 2.0.3, 2.0.2, 2.0.1, 2.0.0, 1.0.41, 1.0.40, 1.0.39, 1.0.38, 1.0.37, 1.0.36, 1.0.35, 1.0.34 |
+| grafana_loki_datasource_contract | `—` | 13.2.3, 13.2.1, 13.0.1, 12.4.12, 12.4.10, 12.4.2, 12.4.1 |
+| logs_drilldown_contract | `2.6.0` | 2.5.2, 2.5.1, 2.5.0, 2.4.0, 2.3.0, 2.2.1, 2.2.0, 2.1.5, 2.1.3, 2.1.2, 2.1.1, 2.1.0, 2.0.4, 2.0.3, 2.0.2, 2.0.1, 2.0.0, 1.0.41, 1.0.40, 1.0.39, 1.0.38, 1.0.37, 1.0.36, 1.0.35, 1.0.34 |
 | loki | `3.7.7` | 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.6.10, 3.6.11, 3.6.12, 3.6.13, 3.6.14, 3.6.15, 3.6.16, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6 |
 | victorialogs | `v1.52.0` | v1.47.0, v1.48.0, v1.49.0, v1.51.1, v1.53.0 |
 

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -51,7 +51,7 @@ services:
       start_period: 10s
 
   grafana:
-    image: grafana/grafana:13.2.1
+    image: grafana/grafana:13.2.3
     container_name: grafana-proxy-test
     ports:
       - "3000:3000"

diff --git a/docs/compatibility-drilldown.md b/docs/compatibility-drilldown.md
@@ -28,16 +28,17 @@ The Drilldown matrix is also a moving window. We support the current app family
 
 | Grafana version | Coverage path | Version-specific focus |
 |---|---|---|
-| `13.2.1` | PR/main pinned runtime + scheduled/manual runtime matrix | Full Drilldown runtime score; current pinned build; React 19 |
-| `12.4.10` | PR/main previous-family smoke + scheduled/manual runtime matrix | datasource catalog, base Drilldown resource contracts, explicit `2.x` runtime-family assertions |
+| `13.2.3` | PR/main pinned runtime + scheduled/manual runtime matrix | Full Drilldown runtime score; current pinned build; React 19 |
+| `12.4.12` | PR/main previous-family smoke + scheduled/manual runtime matrix | datasource catalog, base Drilldown resource contracts, explicit `2.x` runtime-family assertions |
 | `12.4.1` | Scheduled and manual runtime matrix | datasource catalog, base Drilldown resource contracts |
 | `11.6.6` | Scheduled and manual runtime matrix | datasource catalog, base Drilldown resource contracts, explicit `1.x` runtime-family assertions |
 
 ### Logs Drilldown app versions
 
 | Logs Drilldown version | Coverage path | Version-specific focus |
 |---|---|---|
-| `2.5.2` | PR/main pinned runtime + scheduled/manual contract matrix | Current pinned contract; label/field filter inputs located by placeholder; patterns tab requires patterns-autodetect as Grafana default |
+| `2.6.0` | PR/main pinned runtime + scheduled/manual contract matrix | Current pinned contract; label/field filter inputs located by placeholder; patterns tab requires patterns-autodetect as Grafana default; volume by other fields is behind the `drilldown.logs.logsVolumeByField` feature flag (off by default) |
+| `2.5.2` | Scheduled and manual contract matrix | Previous pinned contract |
 | `2.2.0`–`2.5.1` | Scheduled and manual contract matrix | Mixed parser expression in `MIXED_FORMAT_EXPR` |
 | `2.1.0`–`2.1.5` | Scheduled and manual contract matrix | `detected_level` coloring, service-detail panels |
 | `2.0.4` | Scheduled and manual contract matrix | Previous pinned contract; patterns tab requires patterns-autodetect as Grafana default |
@@ -226,9 +227,9 @@ These profiles are matrix-level compatibility profiles (contract and CI guidance
 
 ## Known Issues
 
-### Drilldown 2.0.4 through 2.5.2: Patterns Tab Initialization
+### Drilldown 2.0.4 through 2.6.0: Patterns Tab Initialization
 
-Drilldown 2.0.4 through 2.5.2 contain a bug in `ServiceScene.subscribeToLokiConfig()` where `void 0 === null` (always `false`) prevents re-enabling the Patterns tab after it was disabled. Concretely:
+Drilldown 2.0.4 through 2.6.0 contain a bug in `ServiceScene.subscribeToLokiConfig()` where `void 0 === null` (always `false`) prevents re-enabling the Patterns tab after it was disabled. Concretely:
 
 - If the Grafana default datasource has `pattern_ingester_enabled=false` in `/loki/api/v1/drilldown-limits`, `$patternsData` is set to `null`.
 - Switching to a datasource where `pattern_ingester_enabled=true` does NOT re-show the tab because the `void 0 === null` guard treats `null` as "already initialized".
@@ -241,7 +242,7 @@ In the e2e-compat compose stack, `loki-vl-proxy-patterns-autodetect` is set as `
 
 Potential next family move:
 
-- current: `2.x` (pinned: `2.5.2`)
+- current: `2.x` (pinned: `2.6.0`)
 - next expected family to evaluate: `3.0.x` when released
 
 Promotion criteria for a new family:

diff --git a/docs/compatibility-grafana-datasource.md b/docs/compatibility-grafana-datasource.md
@@ -29,9 +29,11 @@ This track focuses on the built-in Grafana Loki datasource contract (`/api/datas
 
 | Grafana runtime version | Coverage path | Focus |
 |---|---|---|
-| `13.2.1` | pinned runtime CI | current-family datasource + Drilldown runtime contract; React 19 |
+| `13.2.3` | pinned runtime CI | current-family datasource + Drilldown runtime contract; React 19 |
+| `13.2.1` | datasource contract matrix | previous pinned runtime |
 | `13.0.1` | datasource contract matrix | previous current-family pin |
-| `12.4.10` | PR smoke + scheduled/manual matrix | previous-family datasource contract drift detection |
+| `12.4.12` | PR smoke + scheduled/manual matrix | previous-family datasource contract drift detection |
+| `12.4.10` | datasource contract matrix | previous previous-family smoke pin |
 | `12.4.2` | datasource contract matrix | previous-family datasource contract coverage |
 | `12.4.1` | Scheduled and manual matrix | previous-family datasource contract coverage |
 | `11.6.6` | Scheduled and manual matrix | lts-family datasource contract coverage |
@@ -85,7 +87,7 @@ These are handled by strict contract tests and conservative runtime-family gatin
 
 Current runtime family state:
 
-- current: `13.x` (pinned: `13.2.1`)
+- current: `13.x` (pinned: `13.2.3`)
 - previous supported: `12.x`
 - lts supported: `11.x`
 - next expected family to evaluate: `14.x` when released

diff --git a/docs/compatibility-matrix.md b/docs/compatibility-matrix.md
@@ -89,7 +89,7 @@ When a new upstream family becomes current, the oldest family drops out of the m
 |---|---|---|
 | Loki | `3.6.x` and `3.7.x` | Real runtime matrix in GitHub Actions |
 | Grafana Loki datasource runtime | `12.x` and `13.x` | Runtime contracts through Grafana datasource API in GitHub Actions |
-| Logs Drilldown | `1.0.x` and `2.x` (current pinned: `2.5.2`) | Pinned runtime e2e plus source-contract matrix |
+| Logs Drilldown | `1.0.x` and `2.x` (current pinned: `2.6.0`) | Pinned runtime e2e plus source-contract matrix |
 | VictoriaLogs | `v1.47.x` to `v1.49.x` and `v1.51.x` to `v1.53.x` (latest 3 releases of `v1.4x` and `v1.5x`) | Real runtime matrix in GitHub Actions |
 
 ## Grafana Version Sensing Model

diff --git a/docs/patterns.md b/docs/patterns.md
@@ -58,9 +58,9 @@ References:
 
 The Patterns tab in Grafana Logs Drilldown is controlled by the `pattern_ingester_enabled` field in `/loki/api/v1/drilldown-limits`. The proxy returns `true` for this field when both `-patterns-enabled` and `-patterns-autodetect-from-queries` flags are set.
 
-### Known Issue: Patterns Tab in Drilldown 2.0.4 through 2.5.2
+### Known Issue: Patterns Tab in Drilldown 2.0.4 through 2.6.0
 
-Drilldown 2.0.4 through 2.5.2 contain a bug where the Patterns tab does not re-appear after switching from a datasource that returned `pattern_ingester_enabled=false`. The initialization guard (`void 0 === null`, always false) prevents the tab from being re-enabled once `$patternsData` is set to `null`.
+Drilldown 2.0.4 through 2.6.0 contain a bug where the Patterns tab does not re-appear after switching from a datasource that returned `pattern_ingester_enabled=false`. The initialization guard (`void 0 === null`, always false) prevents the tab from being re-enabled once `$patternsData` is set to `null`.
 
 **Workaround**: Use the `-patterns-enabled=true -patterns-autodetect-from-queries=true` proxy variant as the Grafana **default datasource**. With this configuration, the first Drilldown load returns `true`, correctly initializing `$patternsData`, and the Patterns tab appears.
 

diff --git a/docs/security-hardening-manual-acceptance.md b/docs/security-hardening-manual-acceptance.md
@@ -13,7 +13,7 @@ with the results. Automated checks on a proposed branch do not replace this pass
 
 From a clean checkout of the merged `main`, rebuild the E2E images and recreate
 the stack with its UI profile. Preserve volumes; no data reset is required.
-The review override pins Loki 3.7.7, Grafana 13.2.1 and Logs Drilldown 2.5.2,
+The review override pins Loki 3.7.7, Grafana 13.2.3 and Logs Drilldown 2.6.0,
 the current stable review baseline verified on September 14, 2026. The original
 Compose defaults remain available for testing the older compatibility baseline.
 

diff --git a/docs/testing-e2e-guide.md b/docs/testing-e2e-guide.md
@@ -45,10 +45,10 @@ The compose stack at `test/e2e-compat/docker-compose.yml` runs:
 | `vmalert` (vmalert v1.138.0) | 18880 | Alert/rule backend |
 | 12 proxy variants | 13100, 13102-13103, 13105-13111, 13150-13151 | See [Proxy Variants](#proxy-variants) |
 | `tail-ingress` (nginx 1.27) | 13104 | Nginx reverse proxy for tail WebSocket tests |
-| `grafana` (Grafana 13.2.1) | 3002 | UI with all datasources provisioned |
+| `grafana` (Grafana 13.2.3) | 3002 | UI with all datasources provisioned |
 | `log-generator` (profile `ui`) | (none) | Continuous dual-write of multi-service logs to Loki and VictoriaLogs |
 
-Grafana preinstalls `victoriametrics-logs-datasource@0.32.0` and `grafana-lokiexplore-app@2.5.2`.
+Grafana preinstalls `victoriametrics-logs-datasource@0.32.0` and `grafana-lokiexplore-app@2.6.0`.
 
 ## Dual-Write Pattern
 
@@ -213,7 +213,7 @@ Set environment variables before `docker compose up` to override image versions:
 |----------|---------|
 | `LOKI_IMAGE` | `grafana/loki:3.7.7` |
 | `VICTORIALOGS_IMAGE` | `victoriametrics/victoria-logs:v1.52.0` |
-| `GRAFANA_IMAGE` | `grafana/grafana:13.2.1` |
+| `GRAFANA_IMAGE` | `grafana/grafana:13.2.3` |
 | `PROXY_IMAGE` | `loki-vl-proxy:e2e-local` |
 | `VMAUTH_IMAGE` | `victoriametrics/vmauth:v1.138.0` |
 | `VMALERT_IMAGE` | `victoriametrics/vmalert:v1.138.0` |

diff --git a/docs/testing.md b/docs/testing.md
@@ -176,12 +176,12 @@ Test, security and quality jobs defined under `.github/workflows/` (release, doc
 | `ci.yaml` | `e2e-compat` | aggregates the five grouped jobs into one result |
 | `ci.yaml` | `e2e-fleet` | `test/e2e-fleet` 3-proxy stack, `TestFleetSmoke_QueryRangeWarmHitIncrementsCacheMetrics` only |
 | `ci.yaml` | `e2e-ui (9 shards)` | compose stack with `--profile ui`, one Playwright shard per job (see [CI Shards](#ci-shards)) |
-| `compat-loki.yaml` | `loki-pinned` | Loki 3.7.7, VictoriaLogs v1.52.0, Grafana 13.2.1: `TestLokiTrackScore` (must be 100%), `TestQuerySemantics*`, `TestLabelCache_*` |
+| `compat-loki.yaml` | `loki-pinned` | Loki 3.7.7, VictoriaLogs v1.52.0, Grafana 13.2.3: `TestLokiTrackScore` (must be 100%), `TestQuerySemantics*`, `TestLabelCache_*` |
 | `compat-loki.yaml` | `loki-matrix` | weekly: the same checks for every `stack.loki.matrix_versions` entry |
-| `compat-drilldown.yaml` | `drilldown-pinned-runtime` | Loki 3.7.7, VictoriaLogs v1.52.0, Grafana 13.2.1: `TestDrilldownTrackScore` |
-| `compat-drilldown.yaml` | `drilldown-grafana-pr-matrix` | runtime profiles with `run_on_pr` (Grafana 13.2.1 `current_smoke`, 12.4.10 `previous_smoke`) |
+| `compat-drilldown.yaml` | `drilldown-pinned-runtime` | Loki 3.7.7, VictoriaLogs v1.52.0, Grafana 13.2.3: `TestDrilldownTrackScore` |
+| `compat-drilldown.yaml` | `drilldown-grafana-pr-matrix` | runtime profiles with `run_on_pr` (Grafana 13.2.3 `current_smoke`, 12.4.12 `previous_smoke`) |
 | `compat-drilldown.yaml` | `drilldown-contract-matrix`, `drilldown-grafana-runtime-matrix` | weekly/manual: Drilldown app contract checks per version and every Grafana runtime profile |
-| `compat-vl.yaml` | `vl-pinned` | Loki 3.7.7, VictoriaLogs v1.52.0, Grafana 13.2.1: `TestVLTrackScore` |
+| `compat-vl.yaml` | `vl-pinned` | Loki 3.7.7, VictoriaLogs v1.52.0, Grafana 13.2.3: `TestVLTrackScore` |
 | `compat-vl.yaml` | `vl-matrix` | weekly/manual: `TestVLTrackScore` for every `stack.victorialogs.matrix_versions` entry |
 | `security-pr.yaml` | `Security / static` | Gitleaks v8.28.0, gosec v2.29.0, Trivy 0.71.0 filesystem scan, actionlint 1.7.7, hadolint v2.12.0, OpenSSF Scorecard guardrails |
 | `security-pr.yaml` | `Security / runtime` | compose stack, `scripts/ci/run_security_regressions.sh`, ZAP baseline |
@@ -544,8 +544,8 @@ The default local stack (`test/e2e-compat/docker-compose.yml`) is pinned to:
 - VictoriaLogs `v1.52.0`
 - vmalert `v1.138.0` and vmauth `v1.138.0`
 - VictoriaMetrics `v1.119.0` (remote-write target for vmalert recording rules and scrape store for the stack)
-- Grafana `13.2.1` with `GF_PLUGINS_PREINSTALL=victoriametrics-logs-datasource@0.32.0,grafana-lokiexplore-app@2.5.2`
-- Logs Drilldown contract `2.5.2` from `grafana/logs-drilldown` commit `7587eede6a3b0b26feb74281997d1f780cfd58c2`
+- Grafana `13.2.3` with `GF_PLUGINS_PREINSTALL=victoriametrics-logs-datasource@0.32.0,grafana-lokiexplore-app@2.6.0`
+- Logs Drilldown contract `2.6.0` from `grafana/logs-drilldown` commit `e894c0eb6a6d3924b1cdba5aca4bcaccf51cab05`
 
 `TestPinnedCompatibilityMatrixMatchesCompose` fails when the Loki, VictoriaLogs or Grafana image defaults in compose drift from the pinned versions in `compatibility-matrix.json`, so bump both together. The Grafana plugin pins are not checked by that test; keep `GF_PLUGINS_PREINSTALL` and `stack.logs_drilldown_contract.pinned_version` aligned by hand.
 
@@ -572,11 +572,11 @@ Support window policy:
 
 Grafana runtime profiles from the manifest:
 
-- `13.2.1` (`full`) runs `TestDrilldownTrackScore` and `TestDrilldown_RuntimeFamilyContracts` on scheduled and manual compatibility checks
-- `13.2.1` (`current_smoke`) runs `TestGrafanaDatasourceCatalogAndHealth`, `TestDrilldown_GrafanaResourceContracts` and `TestDrilldown_RuntimeFamilyContracts` on pull requests
-- `12.4.10` (`previous_smoke`) runs the same smoke tests on pull requests against the previous family
+- `13.2.3` (`full`) runs `TestDrilldownTrackScore` and `TestDrilldown_RuntimeFamilyContracts` on scheduled and manual compatibility checks
+- `13.2.3` (`current_smoke`) runs `TestGrafanaDatasourceCatalogAndHealth`, `TestDrilldown_GrafanaResourceContracts` and `TestDrilldown_RuntimeFamilyContracts` on pull requests
+- `12.4.12` (`previous_smoke`) runs the same smoke tests on pull requests against the previous family
 
-The Grafana Loki datasource contract tracks `13.2.1`, `13.0.1`, `12.4.10`, `12.4.2` and `12.4.1`.
+The Grafana Loki datasource contract tracks `13.2.3`, `13.2.1`, `13.0.1`, `12.4.12`, `12.4.10`, `12.4.2` and `12.4.1`.
 
 Logs Drilldown family assertions are explicit in the contract matrix: