What changed in Grafana from 12 to 13

Download page What's new highlights

Security

• Security: Fix CVE-2026-12704
• Security: Fix CVE-2026-14199
• Security: Fix CVE-2026-19475

Bug fixes

• Dashboards: Fix version dates and user display names in the legacy version history page #131809, @ivanortegaalba

Download page What's new highlights

Security

• Security: Fix CVE-2026-12704
• Security: Fix CVE-2026-14199
• Security: Fix CVE-2026-19475

Download page What's new highlights

Security

• Security: Fix CVE-2026-12704
• Security: Fix CVE-2026-14199

Bug fixes

• Dashboards: Fix adhoc and groupby variable datasource on UI import #131819, @grafana-writer[bot]
• Packaging: Fix issue with bundled plugins not being moved properly #131037, @grafana-writer[bot]
• PanelEditor: Fix options pane not resizable beyond the preview's content width #131608, @grafana-writer[bot]

Download page What's new highlights

Security

• CVE-2026-17183

Bug fixes

• Reporting: batch dashboard lookups when listing reports (Enterprise)

Download page What's new highlights

Security

• CVE-2026-17183

Bug fixes

• Reporting: batch dashboard lookups when listing reports (Enterprise)

Download page What's new highlights

Security

• CVE-2026-17183

Features and enhancements

• Alerting: Add Import tab in alerting settings page #129051, @rodrigopk
• Alerting: Add notification template import to the import-to-GMA wizard #128329, @rodrigopk
• Alerting: Add promote and auto sync to ImportToGMAWizard #126907, @rodrigopk
• Alerting: Add staged configuration summary in import settings page #129204, @rodrigopk
• Alerting: Compute staged config origin server-side #130727, @rodrigopk
• Alerting: Migrate notifications API to v1beta1 #124702, @rodrigopk
• Alerting: Recognize "default" and "user-defined" as the default routing tree (1/4) #127880, @rodrigopk
• Alerting: Recognize "default" and "user-defined" as the default routing tree (2/4) #127881, @rodrigopk
• Alerting: Recognize "default" and "user-defined" as the default routing tree (3/4) #127883, @rodrigopk
• Alerting: Recognize "default" and "user-defined" as the default routing tree (4/4) #127884, @rodrigopk
• Alerting: Return 403 instead of 500 on contact point provenance mismatch #127699, @rwwiv
• Alerting: Revert a staged import configuration #129243, @rodrigopk
• Alerting: Show unusable time intervals as disabled in the mute timings selector #130323, @rodrigopk
• Alerting: Track import method analytics in import to gma #128142, @rodrigopk
• Alerting: remove AlertingCentralHistory FT #130164, @konstantinmv
• Analytics: Add public dashboard UID to loki usage insights events (Enterprise)
• Auditing: Record the user name on user deletion audit logs (Enterprise)
• Azure Monitor: Cache subscription lookups and collapse double Unmarshal in buildQuery #123556, @adamyeats
• Azure monitor: Azure Metrics Batch API Implementation backend #123696, @bossinc
• CloudWatch Logs: Add frontend support for querying by data source #123742, @kevinwcyu
• ColorScale: Remove live hoverValue, remove from HeatMap tooltip #128812, @leeoniya
• DashList: Show dashboard description tooltip when it's available #130006, @DeeGeeGit
• Dashboard: redirect from dashboard settings tabs to sidebar counterparts #125966, @bfmatei
• Dashboards: Allow threshold interpolation #128451, @mdvictor
• Dashboards: Deprecate scripted dashboards and disable them by default #130207, @kristinademeshchik
• Dashboards: Enable new view panel controls by default #129187, @torkelo
• Dashboards: Increase nesting depth to 4 and allow nested tabs #129174, @bfmatei
• Dashboards: Show panel query errors and notices in one UI #127436, @mdvictor
• Developer Guide: Add note about requiring signed commits #127162, @gelicia
• Docs: document the tracing file exporter #129339, @leandro-deveikis
• Explore Logs: log line highlight color lighten in dark, update deprecated pinned color #130516, @L2D2Grafana
• Folder API: Replace legacy access control logic with app platform API call #125642, @aocenas
• Go: Update version to 1.26.5 #128011, @macabu
• GrafanaUI: Add real magnification effect to GrotNotFound lens #130118, @xndcn
• Home: Enable unified homepage for all users (remove flag) #129054, @MattIPv4
• Live: Support redis:// and rediss:// (TLS) connection URLs in ha_engine_address #129938, @DeeGeeGit
• Logs: Add more suggested fields and integrate with the new Logs Table #128002, @matyax
• Logs: use gray (dimgray) for debug level color #129896, @L2D2Grafana
• Plugins: Force TLS 1.3 feature toggle #130390, @aangelisc
• Provisioning (enterprise): (4/8) Add OAuth app connections for GitLab and Bitbucket (Enterprise)
• Provisioning: Add Dashboard Previews to GitHub Enterprise #127614, @floriecai
• Provisioning: Add Github Enterprise frontend #127209, @floriecai
• Provisioning: Add filter for out-of-sync resources in Resources tab #128456, @MissingRoberto
• Provisioning: Add option to author commits as the signer #127970, @amalavet
• Provisioning: Add resource kind icons to job summary table #127237, @MissingRoberto
• Provisioning: Add webhook support for GithubEnterprise (Enterprise)
• Provisioning: Allow overriding the Git Sync commit author #130547, @amalavet
• Provisioning: Attribute jobs to their author and origin #128819, @amalavet
• Provisioning: Attribute webhook-created jobs to the sending user (Enterprise)
• Provisioning: Bitbucket webhook UI #128649, @amalavet
• Provisioning: Bitbucket webhooks (Enterprise)
• Provisioning: Change commit message template to multi-line textarea #128529, @cursoragent
• Provisioning: Diff Git Sync PR previews against the merge base #128149, @amalavet
• Provisioning: Diff GitLab Git Sync PR previews against the merge base (Enterprise)
• Provisioning: Enable Dashboard Previews for Github Enterprise in UI #127906, @floriecai
• Provisioning: Enable Git Sync conventions by default in public preview #130670, @MissingRoberto
• Provisioning: Enable Git Sync user attribution by default #130671, @MissingRoberto
• Provisioning: Enable Github Enterprise provider by default #128376, @floriecai
• Provisioning: Enable Github Enterprise provider by default for enterp… (Enterprise)
• Provisioning: Exclude SLO-apps from UI in migrate gitops workflow #128961, @floriecai
• Provisioning: Exclude SLO-managed dashboards from being exported #128815, @floriecai
• Provisioning: GitLab webhooks (backend) #127204, @amalavet
• Provisioning: Improve Git Sync pull-request comment #128100, @MissingRoberto
• Provisioning: Improve form errors for github connections #128133, @floriecai
• Provisioning: Link folder metadata and deleted files in PR comments #128895, @MissingRoberto
• Provisioning: Make Migrate to GitOps resource-agnostic for playlists #127028, @MissingRoberto
• Provisioning: Make Resources tab tree foldable #128453, @MissingRoberto
• Provisioning: Paginate the Migrate to GitOps resources table #128042, @MissingRoberto
• Provisioning: Pretty-print generated _folder.json #127947, @MissingRoberto
• Provisioning: Show folder path in Migrate resources list #128454, @MissingRoberto
• Provisioning: Show job author and origin in recent jobs #128820, @amalavet
• Provisioning: Show job errors in Migrate to GitOps drawer #127936, @MissingRoberto
• Provisioning: Show sync status for playlists in Resources tab #127021, @MissingRoberto
• Provisioning: Show who triggered repository jobs #127984, @amalavet
• Provisioning: Surface github error details #128059, @floriecai
• Provisioning: UI to set branch when migrating grafana -> gitops #128562, @floriecai
• Provisioning: adapt GitLab to the provider-agnostic webhook lifecycle (Enterprise)
• Provisioning: add "View repository" link next to provisioned badges #127409, @ywzheng1
• Provisioning: add ability to force full pull instead of incremental sync #128330, @floriecai
• Provisioning: add option to disable webhook in repository and connection #126790, @Shubham19032004
• Provisioning: add provider logo to repository page title #127223, @amalavet
• Provisioning: allow Git Sync option for root-level saves and new folders in folderless mode #127399, @Shubham19032004
• Provisioning: implement GitLab webhooks (Enterprise)
• Provisioning: link Git Sync PR footer to repo admin page #128353, @MissingRoberto
• Provisioning: make sync per-resource write timeout configurable #127862, @MissingRoberto
• Provisioning: regenerate token when its secret is missing #127878, @MissingRoberto
• Provisioning: show webhook UI for GitLab repositories #127806, @amalavet
• Provisioning: support migrating to a selected branch #128356, @MissingRoberto
• QueryVariable: Redesign the query variable editor #127048, @grafakus
• Reports: support template variables without a type allowlist (Enterprise)
• SQLite: Revert the journal mode when wal is disabled #130695, @pstibrany
• Table: Make cell tooltips dynamic height so content is not cut off #127107, @fastfrwrd
• Trace View: Check for the existence of logs when showing the trace-to-logs button #128702, @matyax
• Tracing: add file exporter to write traces as OTLP/JSON #128679, @leandro-deveikis
• Transformations: Keep Merge series/tables available with a single data series #129569, @nicwestvold
• Unified Storage: set garbage collection dry run default to false #130533, @filewalkwithme
• ViewPanel: Url sync for fanout option #128270, @torkelo
• alerting: allow import to gma wizard navigation for non admin users when sync is not active #127818, @rodrigopk
• provisioning: allow authoring commits as the signer #127969, @amalavet

Bug fixes

• ** Gauge:** Fix gradient stops out of order for negative thresholds #128532, @fastfrwrd
• Accessibility: Ensure InlineToast contents are announced by screenreaders #128488, @ashharrison90
• Accessibility: Properly announce section headings on variable edit pages #130706, @ashharrison90
• Alerting: Check managed routes when deleting a time interval #129247, @JacobsonMT
• Alerting: Fix alert rule detail showing "Inhibited" when nothing is inhibited #130264, @petergreen86
• Alerting: Fix reset default route wiping provenance for all managed routes #130553, @JacobsonMT
• Auth: Deduplicate concurrent login pings #129927, @cipher416
• Auth: Skip session token rotation when request is not session authenticated #129920, @thejamesgore
• Azure Monitor: fix migration for dimension filters #128786, @olivierlemasle
• Dashboard scene: Activate edit pane for programmatic panel mutations #128433, @ivanortegaalba
• DashboardDS: Fix chained dashboard datasource panels showing stale data #126378, @oscarkilhed
• Dashboards: Fix loading indicator not clipping to panel border radius #128040, @hckhanh
• Dashboards: Fixes panel header spacing issues #128910, @torkelo
• DataSourcePicker: Fix selected datasource not being highlighted #126948, @mikkancso
• Fix: Parse epoch ms strings correctly to prevent NaN in Postgres queries #122693, @Tarasusrus
• Logs Table: Fix data export by passing the raw table frame #130245, @matyax
• Logs Table: Fix missing results when logs stream #128870, @matyax
• Logs Table: Fix mixed usage of field name and display name #128677, @matyax
• Logs Table: Fix sticky filter after closing details #128398, @matyax
• Navigation: Inject orgId into all navigations #120978, @QuentinBisson
• PostgreSQL: Fix data source init failure when maxOpenConns=0 #122556, @Tarasusrus
• Provisioning: Disable next button until a branch is selected in the Git Sync wizard #127973, @amalavet
• Provisioning: Export v0 dashboards as v1 so synced files load #128357, @MissingRoberto
• Provisioning: Fix NPE when testing GHE repo on creation #127207, @floriecai
• Provisioning: Fix blank Action for deleted resources in PR comment #128522, @MissingRoberto
• Provisioning: Fix customServerURL resolution for GHE #127113, @floriecai
• Provisioning: Fix enforced branch name template dropping ref on save #130163, @ferruvich
• Provisioning: Fix job user attribution in multi-tenant deployments #129598, @amalavet
• Provisioning: Fix multi-org usage stats #127465, @ferruvich
• Provisioning: Fix selective export quota counting whole namespace #127927, @MissingRoberto
• Provisioning: Keep migrate reachable when connected repo can't push #127921, @MissingRoberto
• Provisioning: Only regenerate folder UIDs for folder/folderless migrations #127925, @MissingRoberto
• Provisioning: Preserve the original creator on job history records #128712, @amalavet
• Provisioning: Set FileToLarge error as warning instead of error #128822, @floriecai
• Provisioning: Strip deprecatedInternalId label for dashboards #128530, @floriecai
• Provisioning: Use neutral fallback in the jobs Triggered by column #128238, @amalavet
• Provisioning: abort in-flight worker when job lease is lost #127792, @MissingRoberto
• Provisioning: don't stamp a folder on org-scoped resources when writing #127142, @MissingRoberto
• Provisioning: drop stale and duplicate watch events in the frontend list cache #128766, @MissingRoberto
• Provisioning: fix zero-margin job lease renewal, raise claim expiry to 60s #127786, @MissingRoberto
• Provisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422) #128068, @floriecai
• Provisioning: normalize folder titles into safe export paths #127946, @MissingRoberto
• Provisioning: only push variable changes to git if save variables is … #128818, @floriecai
• Provisioning: retry connection status patch conflicts #127754, @MissingRoberto
• Provisioning: tolerate NotFound in expired job cleanup for multi-pod #127753, @MissingRoberto
• Provisioning: treat skip-delete of resource owned by another file as a warning #129029, @ferruvich
• Provisioning: verify claim ownership so two pods don't run the same job #127783, @MissingRoberto
• Reporting: batch dashboard lookups when listing reports (Enterprise)
• Secrets: Fix RBAC gate on AWS keeper creation route (Enterprise)
• SqlExpressions: Fix parsing for Table Names with spaces #117615, @NWRichmond
• Table: Fix apply to entire row when multiple columns enable it #128527, @fastfrwrd
• Transformations: Fix Filter by value regex matching null values #129572, @nicwestvold
• Transformations: Fix field lookup failing for the Countries and USA States gazetteers #129568, @nicwestvold
• Transformations: Fix field name deduplication in Extract fields #129889, @nicwestvold
• Transformations: Fix inner join returning rows when a frame is dropped #129576, @nicwestvold
• fix: fix panic for unimplemented gitlab webhook repo (Enterprise)

Breaking changes

• Alerting: Remove alertingSaveStateCompressed feature flag #129135, @yuri-tceretian

Plugin development fixes & changes

• Combobox: Fix duplicate async requests and stale errors overwriting fresh options #129788, @joshhunt
• PageLoader: Expose in @grafana/ui and apply custom branding automatically #124597, @ashharrison90
• Pagination: Set aria-current on active page #128494, @ashharrison90
• Tag: Fix crash when picking an out of bounds colorIndex #129579, @ashharrison90

Download page What's new highlights

Download page What's new highlights

Download page What's new highlights

Bug fixes

• Logs Table: Fix missing results when logs stream #128946, @grafana-writer[bot]
• Logs Table: Fix mixed usage of field name and display name #128698, @grafana-writer[bot]
• Security: Fix CVE-2026-13438

Download page What's new highlights

Download page What's new highlights

Features and enhancements

• Alerting: Return 403 instead of 500 on contact point provenance mismatch #127815, @rwwiv
• Go: Update version to 1.26.5 #128016, @macabu
• Provisioning: Improve form errors for github connections #128209, @floriecai

Bug fixes

• Dashboard: Fixes issue with interval variable with Auto value #127053, @grafana-writer[bot]
• Provisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422) #128196, @floriecai
• alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL #128751, @dhananjay6561

Download page What's new highlights

Features and enhancements

• Go: Update version to 1.26.5 #128015, @macabu
• Provisioning: Improve form errors for github connections #128177, @grafana-writer[bot]
• Provisioning: make sync per-resource write timeout configurable #127868, @grafana-writer[bot]

Bug fixes

• Accessibility: Ensure InlineToast contents are announced by screenreaders #128687, @grafana-writer[bot]
• DashboardDS: Fix chained dashboard datasource panels showing stale data #127248, @grafana-writer[bot]
• Provisioning: make GitHub webhook creation idempotent (fix repos stuck unhealthy with HTTP 422) #128201, @floriecai

Plugin development fixes & changes

• Pagination: Set aria-current on active page #128518, @grafana-writer[bot]

Download page What's new highlights

Features and enhancements

• A11y: Remove interactivity from UserIcon if onClick is not provided #120284, @idastambuk
• Accessibility: Add aria-pressed state to FilterPill #123069, @ashharrison90
• Accessibility: Colorblind-safe line style fill patterns #121386, @vijaygovindaraja
• Alerting: Add Mimir Alertmanager auto-sync configuration to settings page #124855, @rodrigopk
• Alerting: Add alerting.rulesAPIV2 feature flag #122606, @rodrigopk
• Alerting: Add common section to filter dropdown in Alerts Activity #124547, @laurenashleigh
• Alerting: Add feature flag for notifications api migration #124625, @rodrigopk
• Alerting: Add label section to enrichment view/edit drawers (Enterprise)
• Alerting: Add reusable hook to add enrichment query param to url on drawer open #123584, @laurenashleigh
• Alerting: Add support for label selectors in AlertRule and RecordingRule legacy storage #122293, @moustafab
• Alerting: Alert activity UI improvements part 3 #121790, @laurenashleigh
• Alerting: Alert activity groupBy not filtering by environment #121952, @rodrigopk
• Alerting: Alerts Activity Instance drawer drilldown, Silence flow #122317, @laurenashleigh
• Alerting: Allow restricting contact point integration types #118858, @chriscerie
• Alerting: Block Viewers from Alert Group edit route #125669, @laurenashleigh
• Alerting: Block editing plugin-provided and provisioned rule groups #123214, @konrad147
• Alerting: Deduplicate and validate groupBy labels in alerts #122983, @yuri-tceretian
• Alerting: Export external Alertmanager sender metrics with data source UIDs #121996, @santihernandezc
• Alerting: Include error in Loki state history when exec_err_state is Alerting #125775, @imankurpatel000
• Alerting: Mark notification provisioning endpoints deprecated #121995, @titolins
• Alerting: Move filters to sidebar alerts activity #121577, @laurenashleigh
• Alerting: Open new alert rule drawer from panel menu #125712, @laurenashleigh
• Alerting: Preview notification routing in the alert instances table #121699, @ppcano
• Alerting: Propagate plugin rule origin as X-Rule-Origin header #125206, @yuri-tceretian
• Alerting: Remove alertRuleUseFiredAtForStartsAt feature toggle #124677, @fayzal-g
• Alerting: Restrict email contact point recipients to org members #123173, @yuri-tceretian
• Alerting: Set enrichment uid in url for enrichment view/edit drawer (Enterprise)
• Alerting: Small improvements to instance drawer drilldown silence flow #123429, @laurenashleigh
• Alerting: Support creating Grafana-managed rules without a group #120228, @moustafab
• Alerting: Surface contact point save errors in the UI #123211, @konrad147
• Alerting: Surface errors on contact point creation #124339, @rodrigopk
• Alerting: Surface save and bulk-delete errors to the user #123690, @rodrigopk
• Alerting: Use Rules API v2 in panel alert rule drawer #125787, @laurenashleigh
• Annotations: Clustering GA #124173, @gtk-grafana
• Auth: Support inline public keys for JWT authentication #126184, @cinaglia
• Auth: Use GrafanaComProxyAPIToken for managed plugin API requests (Enterprise)
• Auth: Use dedicated token for requests to Grafana.com #122269, @s4kh
• Azure Monitor: Pool gzip writers in Log Analytics deep-link encoder #123555, @adamyeats
• Azure Monitor: Refactor fetchInitialRows to improve async utilisation #123278, @adamyeats
• Azure Monitor: Stream-decode responses and typed structs for portal deep link #123565, @adamyeats
• Browse Dashboards: Change messaging of delete/move modal and add counts to tabs in folder detail #124299, @aocenas
• Browse Dashboards: Refresh old parent folder on save dashboard #125323, @aocenas
• CloudWatch Logs: Remove data links from results #120348, @iwysiu
• Cloudwatch: Add id to metric expression datalinks #120526, @iwysiu
• Combobox: Add isOpen and onIsOpenChangeHandler #122992, @L2D2Grafana
• ConvertFieldType: Preserve null and empty string in string-to-number conversion #120893, @moktamd
• CsvExport: Remove legacy CsvExportPage (Enterprise)
• Dashboard variables: Improve accessibility #120758, @idastambuk
• Dashboard/DTO: Remove isStarred property #122118, @ryantxu
• Dashboard: Add annotation CRUD to mutation API #123939, @ivanortegaalba
• Dashboard: Display variable label in outline to better match what the users sees in the dashboard #123321, @oscarkilhed
• Dashboard: Edit pane go back action #122918, @torkelo
• Dashboard: Preserve timezone user-preference when converting V1 → V2 #122267, @ivanortegaalba
• Dashboard: Switch tab selects tab only when pane is open (docked or not) #121755, @torkelo
• Dashboards: Add panel screenshot API #124045, @dprokop
• Dashboards: Preserve query variable sort modes in v1->v2 conversion #124247, @oscarkilhed
• Dashboards: Remove dashboardScene and publicDashboardsScene feature toggles #121781, @Sergej-Vlasov
• Dashboards: Show k8s format in provisioned save #123033, @stephaniehingtgen
• Dashboards: Strip BOM characters in admission mutation hook #122677, @MissingRoberto
• Data Source: Add forward_user_agent option to preserve client User-Agent #124244, @marcsanmi
• DataSources: Introduce async APIs and hooks as replacement for datasourceSrv #123037, @mckn
• Datasources: Add dynamodb to supported plugins list in dsauth (Enterprise)
• Datasources: Allow editing data source title #122053, @MattIPv4
• Datasources: Finish decoupling mssql & postgresql - backend #119110, @njvrzm
• Datasources: Finish decoupling mssql, tempo, and graphite - frontend changes #119106, @njvrzm
• Docker: Bump Alpine-based images to 3.23.4 #122930, @Proximyst
• Docker: Bump Alpine-based images to 3.24.1 #126529, @macabu
• Dynamic dashboards: preserve tab/row URL slugs and keep legacy tab URLs working #123159, @idastambuk
• Expressions: Add memory limit for math expression binary operations #121945, @rwwiv
• Go: Update to 1.25.9 #122094, @macabu
• Google Cloud Monitoring: Add Forward OAuth Identity authentication (frontend) #124618, @ktw4071
• GrafanaUI: Remove feature toggle for new panel padding #124870, @torkelo
• Graphite: Strip tagged path from tags.name when aliasSub wrapping is detected #122277, @adamyeats
• Histogram: filter NaN and Infinity from bucket size calculation #117698, @ethervoid
• Homepage: Support v2 dashboards if defined by a file #122994, @stephaniehingtgen
• I18n: Prevents en-US localization resources from loading #125327, @hugohaggmark
• Import: Library panel missing DS when imported in v1 and classic #119980, @ivanortegaalba
• InfluxDB: Decouple backend #119167, @njvrzm
• InfluxDB: Decouple frontend #119169, @njvrzm
• InteractiveTable: Support specific column widths #121384, @vijaygovindaraja
• LibraryPanels: Return 403 instead of 500 for insufficient permissions #123407, @MissingRoberto
• Log Details: Add support for filtering from add-hoc stats and to include/exclude the log line #126782, @matyax
• Log Details: Add support to expand or shrink inline Log Details #123156, @matyax
• Logs Panel: Add support to copy a log entry with fields/labels as JSON #124816, @matyax
• Logs: Add emergency to supported LogLevel mapping #119957, @Kuehn-Andreas
• Logs: Add keyboard navigation support for Log Details #123406, @matyax
• Logs: Add optional download support for dashboards #123256, @matyax
• Logs: Highlight multi-unit durations in log syntax highlighting #124433, @o6ivp
• Logs: Log line menu is now sticky #126572, @matyax
• Logs: Removed logsPanelControls feature flag and related components #122114, @matyax
• Logs: introduce "unspecified" log level for missing log level and separate from "unknown" #125716, @matyax
• Migration: Widen team.updated to DATETIME(3) on MySQL #124314, @mgyongyosi
• PieChartPanel: Add gradient color scheme with WCAG-aware slice labels #121303, @fedir
• Plugins: Add plugins.marketplaceLicensing feature toggle #124246, @xnyo
• Plugins: Sanitise header values to printable ASCII for gRPC compatibility #122237, @adamyeats
• Prometheus: Fetch metric metadata on code editor mount #121339
• Prometheus: Prevent prometheus package to be released automatically #122824, @itsmylife
• Prometheus: Use @grafana/prometheus v13.1.2 #123024, @itsmylife
• Provisioning: Add commit signing configuration UI (GPG, SSH, S/MIME) #126023, @amalavet
• Provisioning: Don't mark folders pending due to _folder.json metadata #124118, @MissingRoberto
• Provisioning: Enforce folder version in finalizer handler #123179, @ferruvich
• Provisioning: Honor ruleset bypass for write workflow validation #123893, @MissingRoberto
• Provisioning: Include dashboard validation errors in pull request comments #122233, @gttrigger
• Provisioning: Invalid resources should cause a warning job #123047, @gttrigger
• Provisioning: List resources should return correct api version #122653, @gttrigger
• Provisioning: Negotiate receive-pack capabilities for git pushes #124122, @MissingRoberto
• Provisioning: Per-verb fallback for the files subresource #123867, @MissingRoberto
• Provisioning: Remove GET method from webhook connector #125539, @MissingRoberto
• Provisioning: Require new token when provisioning URL changes #125525, @ferruvich
• Provisioning: Retry SQLITE_BUSY on repository status patch #123873, @MissingRoberto
• Provisioning: Return Bad request for repo mismatch in webhook #124453, @ferruvich
• Provisioning: Return early for errors on resource creation in Parser #125122, @ferruvich
• Provisioning: Rotate webhook secret periodically #122797, @ferruvich
• Provisioning: Scope repository uniqueness by (URL, branch, path) #123498, @ferruvich
• Provisioning: Surface folder uid-too-long and other validation 4xx as sync warnings #123797, @MissingRoberto
• Provisioning: Use full sync instead of incremental if diff size exceeds a certain amount #123127, @ferruvich
• Provisioning: Write _folder.json when creating dashboards in new folders #126042, @ferruvich
• Provisioning: Write _folder.json when moving dashboards into new folders #126552, @ferruvich
• Provisioning: add PR comment if resources metadata is removed #122664, @ferruvich
• Provisioning: add new check for webhook creation in repository controller #122725, @ferruvich
• Provisioning: add public_root_url instance setting for external URLs #123613, @MissingRoberto
• Provisioning: replay protection for GitHub webhooks #125550, @MissingRoberto
• Provisioning: validate ref query parameter on files and history endpoints #125551, @MissingRoberto
• Pyroscope: Add support for heatmap query API #120995, @simonswine
• Pyroscope: Include profile ID and absolute times in assistant context #122665, @marcsanmi
• Removal: GroupAttributeSync routes #126247, @Jguer
• Reporting: Add backend support for URL-based report rendering (Enterprise)
• Reporting: Limit report emails to org members only (behind new config property) (Enterprise)
• Revert "Alerting: Migrate notifications.alerting.grafana.app from v0alpha1 to v1beta1" #121955, @rodrigopk
• Scenes: Upgrade to v8 #123698, @torkelo
• Search API: Filter out k6 technical folder in unified search #122674, @aocenas
• Secrets Keeper: AWS create form with instruction wizard (Enterprise)
• Secrets Keeper: Activate and deactivate keeper from the UI (Enterprise)
• Secrets Keeper: Add delete keeper functionality (Enterprise)
• Secrets Keeper: Add keeper edit page with form prepopulation (Enterprise)
• Sidebar: Open pane actions, dock, and go back redesign #123683, @torkelo
• SqlExpressions: Interpolate variables in schema queries #123779, @NWRichmond
• SqlExpressions: Migrate AI features to Grafana Assistant #122085, @NWRichmond
• Stats: Remove dashboard version metric #121900, @stephaniehingtgen
• Table: GroupToNestedTable v2 UI #121646, @fastfrwrd
• Team folders: Refresh browse dashboard cache after changes to team folders #123794, @aocenas
• Tempo: Unify dynamic int/double span attributes as float64 #121645, @zoltanbedi
• Tempo: Unify nested span subframe schema across span sets #124885, @zoltanbedi
• TimeRangePicker: Adjust accent color to be accessible #122040, @ashharrison90
• Transformations: Removes unused predicate matchers #124790, @hugohaggmark
• Unified Storage: Pass commit message when routing managed-resource writes #125556, @MissingRoberto
• Users: Use SHA-256 for Gravatar email identifier #122319, @Jguer
• Zipkin: Remove core datasource (Enterprise)
• patch(security): apply May 2026 patches #124824, @github-actions[bot]

Bug fixes

• Alerting: Fix named policy route showing as Default when routing toggle is off #125817, @rodrigopk
• Alerting: Add warning when editing grouped alert rule to ungrouped #126292, @rodrigopk
• Alerting: Fix AlertManagerPicker visibility to check Alertmanager datasources #123137, @konrad147
• Alerting: Fix Test button not shown for provisioned contact points #126371, @gillesdemey
• Alerting: Fix crash when MultiCombobox value contains duplicates #122180, @rodrigopk
• Alerting: Fix crash when ruler returns namespace with empty groups array #122704, @konrad147
• Alerting: Fix error toaster when removing last rule from group #126296, @rodrigopk
• Alerting: Fix inhibition status flickering during load of alert rule detail #126288, @rodrigopk
• Alerting: Fix missing permission check for routing preview #122344, @rodrigopk
• Alerting: Fix notification policies tab hidden for Viewer/Editor after managed routes migration #122123, @gillesdemey
• Alerting: Fix page title for /alerting/groups when V2 nav is enabled without triage #123286, @firasmosbehi
• Alerting: Fix rule matching when expressions contain inline comments #126152, @gillesdemey
• Alerting: Fix slug in alerting nested folder URL #123670, @laurenashleigh
• Alerting: Fix threshold value reset when changing condition type #122455, @gillesdemey
• Alerting: Fix toast spam when typing silence matcher regex #125643, @laurenashleigh
• Alerting: Make contact point settings redaction logic case insensitive #124955, @khalilhaji
• Alerting: Set 'ResolvedAt' when transitioning from Error to Normal #122329, @santihernandezc
• Auth: URL-encode redirectTo cookie value in OAuth login flow #121953, @jsclayton
• AzureMonitor: Fix focus trapping on ResourceField modal #123072, @ashharrison90
• Browse dashboards: Fix delete modal affected counts #122747, @aocenas
• Dashboads: Fixes flickering issues #118567, @torkelo
• Dashboard: DashboardCodePane width refactoring and fixes #122700, @torkelo
• Dashboard: Fixes issue with interval variable with Auto value #123889, @torkelo
• DashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams #124665, @ivanortegaalba
• DashboardDS: Fix Mixed panels with a time override stuck in permanent loading #125954, @oscarkilhed
• Dashboards: Fix broken add panel button after removing last panel #124551, @ifrost
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid #125398, @papagian
• Fix: Don't mutate shared SecureJSONData map in dsauth (Enterprise)
• Fix: Short-cut auth service Apply for non-handled plugin IDs (Enterprise)
• GrafanaUI: Correctly close Select/Combobox menus with the keyboard #122133, @ashharrison90
• HomePage: Fix redirect when served under a subpath #124557, @ashharrison90
• Jaeger: Fix log event timestamp unit conversion in trace view #123302, @ktw4071
• K8s Dashboards: Fix folder permission check to use dashboards:create #124612, @mihai-turdean
• Loki: Show Step option for all query types and fix volume reload on step change #122184, @paulojmdias
• Menu: Correctly show active state in forced colors mode #123633, @ashharrison90
• Portal: Fix nested portals to overlay correctly #122450, @ashharrison90
• PostgreSQL: Allow sql_engine to return results for EXPLAIN queries #122739, @sdague
• Provisioning: Bump nanogit to v0.17.0 to fix pushes with repositories using git modules #124114, @MissingRoberto
• Provisioning: Fix PR comments on multi-org Grafana instances #126700, @ferruvich
• Provisioning: Fix PR links when folder is renamed via UI #126695, @ferruvich
• Provisioning: Fix duplicate folder cleanup during full sync #124256, @ferruvich
• Provisioning: Fix race in PullStatus condition with controller patches #123358, @MissingRoberto
• Public Dashboards: Fix issues navigating to public dashboards from a logged-in session #121017, @mmandrus
• QueryEditor: Fix loss of query edits when switching queries #123001, @NWRichmond
• Tempo Datasource: Fix gRPC basic auth over non-TLS connections #123026, @RobertClarke64
• Tempo: Fix Ctrl+/ comment toggle in TraceQL editor #121460, @Krishnachaitanyakc
• Tempo: Fix trace rendering failure when span attributes contain NaN or Infinity #122504, @Tarasusrus
• TimePicker: Show label for fiscal-quarter relative ranges #122384, @jeanibarz
• Unified storage: Skip migrations if dualwrite state shows they were already migrated #122866, @stephaniehingtgen
• alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL #124935, @dhananjay6561
• fix(provisioning): ignore terminating repositories when validating connection delete #126822, @MissingRoberto
• fix: bad MySQL query in datasource_type column migration #126821, @gassiss

Breaking changes

• Prometheus: Remove azure and sigv4 auth from core prometheus #123089, @itsmylife
• Prometheus: Remove grafana-prometheus package#122953 #123035, @itsmylife
• Zipkin: Remove from core plugins #124148, @itsmylife

Plugin development fixes & changes

• Card: Improve responsiveness #123876, @ashharrison90
• Combobox: Fix caret jumping to the end of the input #123950, @joshhunt
• DataLinkInput: Expose prop to properly link labels to input #123795, @ashharrison90
• RadioButton: Fix selected visibility in forced colors mode #123952, @ashharrison90
• RadioButtonGroup: Prevent RadioButtonGroup overflow with ellipsis and hover title #119124, @Apahadi73
• TimeOfDayPicker: use Combobox #123777, @leeoniya

Download page What's new highlights

Features and enhancements

• Docker: Bump Alpine-based images to 3.24.1 #126548, @macabu
• Provisioning: Write _folder.json when creating dashboards in new folders #126323, @ferruvich
• Provisioning: Write _folder.json when moving dashboards into new folders #126676, @ferruvich

Bug fixes

• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid #125771, @papagian
• Provisioning: Fix PR comments on multi-org Grafana instances #126887, @ferruvich
• Provisioning: Fix PR links when folder is renamed via UI #126858, @grafana-writer[bot]
• fix(provisioning): ignore terminating repositories when validating connection delete #126862, @grafana-writer[bot]
• fix: bad MySQL query in datasource_type column migration #126897, @grafana-writer[bot]