[server-renovate]

This PR contains the following updates:

Package	Update	Change
grafana/grafana	minor	13.2.4 → 13.3.0

---

Release Notes

grafana/grafana

v13.3.0

Security

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-81841
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

Features and enhancements

• Access control: reject global role creation in single-org mode (Enterprise)
• Alerting: Add AccessControlAction entries for inhibition rules #​130977, @​rodrigopk
• Alerting: Add notifications API boundary module #​134537, @​rodrigopk
• Alerting: Add the Config API data layer for external Alertmanager auto-sync #​129478, @​rodrigopk
• Alerting: Allow drag and drop for yaml file as import source for import wizard #​132705, @​rodrigopk
• Alerting: Cleanup promote staged config code #​130974, @​rodrigopk
• Alerting: Disable datasource picker while an import is staged #​133181, @​rodrigopk
• Alerting: Make stage default import method in GMA import wizard #​130634, @​rodrigopk
• Alerting: Make the Import wizard review step preview look clickable #​132711, @​rodrigopk
• Alerting: Migrate the Import-to-GMA wizard's auto-sync integration #​131523, @​rodrigopk
• Alerting: Migrate the auto-sync settings hook and panel onto the Config API #​131521, @​rodrigopk
• Alerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1 #​134883, @​moustafab
• Alerting: Promote a staged import configuration #​130327, @​rodrigopk
• Alerting: Read staged config origin from the managed_by field #​130787, @​rodrigopk
• Alerting: Redact secrets from the Import-to-GMA preview modal #​132827, @​rodrigopk
• Alerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers #​131520, @​rodrigopk
• Alerting: Remove import method from import to GMA wizard #​130609, @​rodrigopk
• Alerting: Retire the legacy admin_config auto-sync path #​131524, @​rodrigopk
• Alerting: Show Auto-sync support in the import wizard picker #​131084, @​rodrigopk
• Alerting: Support Mimir alertmanager_config files in Import to GMA wizard #​135637, @​rodrigopk
• Alerting: Surface external Alertmanager sync health in the settings UI #​131527, @​rodrigopk
• Alerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard #​131072, @​rodrigopk
• Auth: Bound OAuth token refresh lock waits by time instead of attempts #​133929, @​cinaglia
• Canvas: Load the standalone plugin by default #​134873, @​gtk-grafana
• Chore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0) #​132571, @​stevesg
• Dashboard: Adds new a subtitle option for panel descriptions #​129164, @​torkelo
• Dashboard: Fall back when collection deletion is unsupported #​128259, @​bestend
• Dashboards: Add $__namespace global variable #​132167, @​ivanortegaalba
• Dashboards: Allow Add variable + btn to add filters, links and annos as well #​130841, @​mdvictor
• Dashboards: Hide links to deleted folders in Recently Deleted #​134469, @​Clarity-89
• Dashboards: Improve Recently Deleted performance with server-side search #​134126, @​pstibrany
• Dashboards: Make the auto grid to be default #​130749, @​bfmatei
• Dashboards: Show Git Sync badges in folder search #​132790, @​Clarity-89
• Faro: add support for trackResources #​130792, @​ashharrison90
• FieldOverrides: Add ShowIfOverride to field config options #​132419, @​gtk-grafana
• Frontend: add subresource integrity #​131596, @​jackw
• Git Sync: Clarify repository links for pure Git #​134238, @​ferruvich
• Git Sync: Ignore hidden paths in repository scans and diffs #​134731, @​ferruvich
• GrafanaBootData: Restrict config.datasources usage via lint rule #​130661, @​mckn
• Heatmap: Keep exemplar marker size consistent across displays #​134072, @​fastfrwrd
• Home: Send the traces setup CTA to the OpenTelemetry onboarding guide #​135135, @​Clarity-89
• Homepage: Add an On call schedules tab with your shifts and who's on call #​134747, @​Clarity-89
• Homepage: Let the Synthetic Monitoring card ignore checks, targets, and probes #​134217, @​Clarity-89
• Homepage: Let the metrics card exclude hosts and filesystems from its disk alert #​133472, @​Clarity-89
• Homepage: Move card filters to a footer dropdown and show page kinds as icons #​135851, @​Clarity-89
• Homepage: Replace the Recent tab with Recent activity #​134633, @​Clarity-89
• Homepage: Stop the homepage from jumping while it loads #​135321, @​Clarity-89
• Log Details Sidebar: Change default action to replace the current log instead of opening a new tab #​133129, @​matyax
• Log Details: Surface errors in logs and update links styles #​134427, @​matyax
• Logs Table: Disable hover overflow by default #​132882, @​matyax
• Logs: Invert the orientation of the arrow in the Logs Table and Logs Panel #​131156, @​matyax
• Packaging: Remove bash dependency from alpine Docker image #​132643, @​TheoBrigitte
• PanelEdit: Conditional field config display & edit context #​132398, @​gtk-grafana
• PanelOptions: Add context options to overrides #​132414, @​gtk-grafana
• Plugins: Avoid to delete RBAC roles when upgrading #​134143, @​andresmgot
• Plugins: Expose OpenFeature provider discovery to backend plugins #​129735, @​adamyeats
• Plugins: Forward SSL certificate environment variables #​131848, @​osmocomet
• Plugins: Show the correct warning when grafana.com is unreachable #​132028, @​lazerg
• Provisioning: Add generic git OAuth app connections #​134186, @​amalavet
• Provisioning: Add link back to the original dashboard in preview banner #​129037, @​MissingRoberto
• Provisioning: Allow permission updates on provisioned folders #​134725, @​ferruvich
• Provisioning: Allow resource previews in unsynced folders #​133250, @​ferruvich
• Provisioning: Always interpret folder metadata in resources and sync #​134726, @​ferruvich
• Provisioning: Always protect folder metadata from direct file writes #​135038, @​ferruvich
• Provisioning: Always use folder metadata in Git Sync #​134355, @​Clarity-89
• Provisioning: Default save from a branch preview to the previewed branch #​135136, @​Clarity-89
• Provisioning: GitHub-style doc tabs for folder README #​129073, @​MissingRoberto
• Provisioning: Handle repository build timeouts and branch outages #​135072, @​ferruvich
• Provisioning: Keep folder when removing _folder.json leaves its UID unchanged #​135574, @​ferruvich
• Provisioning: Link README items to Grafana pages when viewed in Grafana #​128455, @​MissingRoberto
• Provisioning: Make backend user attribution unconditional #​134709, @​ferruvich
• Provisioning: Never replace the repository root folder during incremental sync #​135397, @​ferruvich
• Provisioning: Reject invalid resource names before API calls #​133666, @​ferruvich
• Provisioning: Respect Git Sync polling intervals after unchanged refs #​134380, @​ferruvich
• Provisioning: Show last checked time in Pull status #​134476, @​ferruvich
• Provisioning: Skip previews for pull requests from forks #​132522, @​ferruvich
• Provisioning: Stop PR previews when refs disappear #​132547, @​ferruvich
• Provisioning: Style branch/target-branch as GitHub-like pills in preview banner #​131133, @​MissingRoberto
• Provisioning: Support generic git OAuth connections in the UI #​134187, @​amalavet
• Provisioning: Support legacy paths and diagnose missing source annotations #​133225, @​ferruvich
• Provisioning: Surface the finalizer blocking a stuck repository deletion #​133241, @​MissingRoberto
• Provisioning: Treat manager-kind conflicts as warnings #​132364, @​ferruvich
• Provisioning: Use resource.action for preview banner title accuracy #​131134, @​MissingRoberto
• Provisioning: recover from a deleted PR branch (pre-flight + save to new branch) #​128977, @​MissingRoberto
• Provisioning: render mermaid diagrams in folder README #​129096, @​MissingRoberto
• Provisioning: tolerate quota lookup failures for existing repositories #​131703, @​ferruvich
• QueryEditor: Add extension point to the top toolbar #​132289, @​aocenas
• RBAC: Allow removing unowned permissions through access-control APIs (Enterprise)
• RBAC: Document APIs allow removing unowned permissions through access-control APIs #​132518, @​gamab
• Replace subtitle switch UI string #​132965, @​imatwawana
• Reports: say in the report when a variable value no longer exists (Enterprise)
• Sandbox: Config flag deprecation message #​135329, @​jesdavpet
• Sandbox: Show deprecation warning in UI tooltip (Enterprise)
• Standard options: Add Ordinal unit. #​130091, @​simonprickett
• Table: Calculate column widths independently of scrollbar visibility #​134337, @​fastfrwrd
• Table: Prevent initial column width jump with vertical scrollbars #​133615, @​fastfrwrd
• TimeRangePicker: Default isOnCanvas to true #​135833, @​torkelo
• TopNav: Logo should not shrink #​131170, @​torkelo
• Trace View: Open Logs link in a new tab (Drilldown) or in split view (Explore) #​132987, @​matyax
• TraceView: Add Go to span on the header error banner #​132550, @​joey-grafana
• TraceView: Add a trace banner for error and warning spans #​132250, @​joey-grafana
• TraceView: Expand attribute plugin cross-sell promos #​131472, @​joey-grafana
• TraceView: Open the banner span from Go to span and surface exception #​133122, @​joey-grafana
• TraceView: Use design system tokens in the header, minimap and timeline #​133339, @​joey-grafana
• TraceView: Use design system tokens in waterfall rows and span details #​133434, @​joey-grafana
• Traces to logs: Extend support, and discover trace and span related logs from #​130515, @​matyax
• Transformations: Allow setting static refIDs per transformation #​131458, @​Develer
• Transformations: Resolve variables in the classic transformation editor #​135569, @​Develer
• UI: Luxon on by default #​134865, @​fastfrwrd
• Unified storage: Enable automatic cleanup of deleted resources by default #​133330, @​pstibrany
• alerting: Remove method step from import to GMA wizard #​130616, @​rodrigopk

Bug fixes

• Alerting: Fix alerts going to the built-in Alertmanager after startup for external-only orgs #​134481, @​gillesdemey
• Alerting: Fix instance rows vanishing at coarse query steps in Triage #​133516, @​rodrigopk
• Alerting: Fix notification policy drop and query drift in rule saves #​131645, @​rodrigopk
• Alerting: Fix rule groups missing from a folder until "Show more" is clicked #​131078, @​JacobsonMT
• Alerting: Fix stale dry-run validation and YAML errors in the Import wizard #​132707, @​rodrigopk
• Alerting: Fix useAutoSyncConfiguration's queries behind Org Admin + feature toggle #​130627, @​rodrigopk
• Alerting: fix GetManagedRoute returning imported route for unrelated names #​132563, @​JacobsonMT
• Alerting: reject managed route names with leading/trailing whitespace #​132566, @​JacobsonMT
• Dashboard: Preserve panel subtitle in V2 save model #​133723, @​adi-IL
• Dashboards: Fix Classic model returning v2 JSON when saving a provisioned dashboard #​131718, @​ivanortegaalba
• Dashboards: Fix adhoc and groupby variable datasource on UI import #​131817, @​ivanortegaalba
• Dashboards: Fix browse crash and hangs when a dashboard shares its folder's UID #​132634, @​Clarity-89
• Dashboards: Fix edit state props when swapping dashboard state in place #​132001, @​ifrost
• Dashboards: Fix missing deletion dates in Recently Deleted #​133734, @​pstibrany
• Dashboards: Fix query variable refresh reset to onDashboardLoad on v2 UI import #​131837, @​ivanortegaalba
• Dashboards: Keep tags set on a new dashboard when saving it #​131459, @​ivanortegaalba
• Dashboards: Keep variable values and time settings set by an applied spec instead of reverting them to the URL #​134200, @​ivanortegaalba
• Dashboards: Preserve query variable refresh setting on v2 dashboard import #​132007, @​Sergej-Vlasov
• Dashboards: Show values preview for data source variables in the edit pane #​131736, @​ivanortegaalba
• Library panels: Fix skeleton alignment #​133965, @​ashharrison90
• Navigation: Hide NetworkError when switching organization #​131955, @​AshrithaSB
• Packaging: Fix issue with bundled plugins not being moved properly #​131033, @​kminehart
• PanelEditor: Fix options pane not resizable beyond the preview's content width #​131581, @​ivanortegaalba
• Plugins: Don't report loaded plugins as not registered when a request times out #​135591, @​leventebalogh
• Provisioning: Fix PR dashboard previews when served from a sub-path #​132569, @​gustaff-weldon
• Provisioning: Fix folder cleanup and hidden directory scans #​135050, @​ferruvich
• Provisioning: Fix folder rename UID collision during full sync #​130401, @​ferruvich
• Provisioning: Fix sync step flicker in Git Sync wizard #​134108, @​Clarity-89
• Reporting: Fix race condition with repeat panels on the /d-render/ page #​128536, @​mmandrus
• SQL Expressions: Read enum fields as their text #​135225, @​nicwestvold
• SQL Expressions: Rename label columns that clash with generated column names #​134869, @​nicwestvold
• Security: Fix CVE-2026-17183 #​131061, @​github-actions[bot]
• Table: Fix nested apply-to-row coloring to use the nested frame's own fields #​129426, @​fastfrwrd
• Table: Fix the height a wrapped header row reserves #​132230, @​fastfrwrd
• Table: fix JSON cell indentation, styling, and hover reveal #​130452, @​fastfrwrd

Breaking changes

• Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace #​132172, @​xnyo

Plugin development fixes & changes

• ConfirmModal: Ensure focus correctly traps when invoked from a dropdown menu #​132764, @​ashharrison90
• Datasources: Remove deprecated isDefault from DataSourceInstanceListItem #​133886, @​leventebalogh
• GrafanaUI: Fix focus ring appearance #​132808, @​ashharrison90
• MultiCombobox: Ensure height is consistent between empty/filled states #​131255, @​ashharrison90
• Runtime: Stabilize async data source APIs #​134390, @​leventebalogh
• Runtime: Stabilize plugin settings APIs #​134723, @​leventebalogh

v13.2.5

Security

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-103506
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967

Features and enhancements

• Git Sync: Ignore hidden paths in repository scans and diffs #​135028, @​ferruvich
• Provisioning: Default save from a branch preview to the previewed branch #​135174, @​Clarity-89
• Provisioning: Never replace the repository root folder during incremental sync #​135463, @​ferruvich

Bug fixes

• Plugins: Don't report loaded plugins as not registered when a request times out #​135665, @​leventebalogh
• Provisioning: Fix PR dashboard previews when served from a sub-path #​135559, @​gustaff-weldon

---

Configuration

📅 Schedule: (in timezone Europe/Oslo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.