fix(deps): update npm dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@dagrejs/dagre	^1.1.4 -> ^1.1.5
@fortawesome/react-fontawesome	^0.2.2 -> ^0.2.6
@grafana/data (source)	11.5.0 -> 11.6.6
@grafana/ui (source)	11.5.0 -> 11.6.6
@svgr/webpack (source)	^8.0.1 -> ^8.1.0
@types/react (source)	^18.3.20 -> ^18.3.25
@types/react-dom (source)	^18.3.5 -> ^18.3.7
@xyflow/react (source)	^12.4.4 -> ^12.8.6
dompurify	^3.2.4 -> ^3.2.7
eslint-config-prettier	^9.1.0 -> ^9.1.2
eslint-plugin-prettier	^4.2.1 -> ^4.2.5
postcss (source)	^8.4.31 -> ^8.5.6
react-router-dom (source)	^6.30.0 -> ^6.30.1
react-syntax-highlighter	^15.6.1 -> ^15.6.6
typescript (source)	^5.8.2 -> ^5.9.3

---

Release Notes

dagrejs/dagre (@​dagrejs/dagre)

v1.1.5

Compare Source

FortAwesome/react-fontawesome (@​fortawesome/react-fontawesome)

v0.2.6

Compare Source

Fixed

• check for existence of process before reading process.env (#​585)

Full Changelog: FortAwesome/react-fontawesome@0.2.5...0.2.6

v0.2.5

Compare Source

What's Changed

• #​583 - fix interface definition by @​dom-the-dev in #​584

New Contributors

• @​dom-the-dev made their first contribution in #​584

Full Changelog: FortAwesome/react-fontawesome@0.2.4...0.2.5

v0.2.3

Compare Source

Changed

• Font Awesome Pro+ icons are now available with an active Pro+ subscription.

• Removed example directory and files

• Deprecated fa-fw prop

Added

• Added widthAuto prop

• Added rotateBy prop

grafana/grafana (@​grafana/data)

v11.6.6: 11.6.6

Compare Source

Download page
What's new highlights

Features and enhancements

• Alerting: Update alerting module #​110001, @​yuri-tceretian
• Auditing: Add settings to control recording of datasource query request and response body (Enterprise)
• Auditing: Document new options for recording datasource query request/response body #​109978, @​macabu

Bug fixes

• Alerting: Fix copying of recording rule fields #​110345, @​moustafab
• Fix: Fix redirection after login when Grafana is served from subpath #​111098, @​mgyongyosi

v11.6.5: 11.6.5

Compare Source

Download page
What's new highlights

Features and enhancements

• Alerting: Bump alerting package to include change to NewTLSClient #​108817, @​rwwiv
• Go: Update to 1.24.6 #​109314, @​Proximyst

v11.6.4: 11.6.4

Compare Source

Download page
What's new highlights

Features and enhancements

• Dependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 #​107555, @​macabu
• StateTimeline: Add endTime to tooltip #​107605, @​adela-almasan
• Unified storage: Respect GF_DATABASE_URL override #​107573, @​pstibrany

Bug fixes

• Alerting: Fix group interval override when adding new rules #​107496, @​konrad147
• Azure: Fix legend formatting #​106934, @​aangelisc
• Azure: Fix resource name determination in template variable queries #​106939, @​aangelisc
• Graphite: Fix annotation queries #​106940, @​aangelisc
• Graphite: Fix date mutation #​107523, @​aangelisc
• Graphite: Fix nested variable interpolation for repeated rows #​107564, @​aangelisc
• Security: Fixes for CVE-2025-6197 and CVE-2025-6023 #​108281, @​volcanonoodle

v11.6.3: 11.6.3

Compare Source

Download page
What's new highlights

Bug fixes

• Security: Fixes CVE-2025-3415

v11.6.2: 11.6.2

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go version to 1.24.3 #​105103, @​macabu
• Dependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.4-git to v2.5.0 #​105443, @​macabu
• Dependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12 #​105369, @​macabu
• Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0 #​105251, @​macabu

Bug fixes

• Dashboard: Fixes issue with row repeats and first row #​104467, @​torkelo
• Graphite: Ensure template variables are interpolated correctly #​105388, @​aangelisc
• Graphite: Fix Graphite series interpolation #​104568, @​aangelisc
• Prometheus: Fix semver import path #​104943, @​jackw
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.6.1: 11.6.1

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Update JWT library (CVE-2025-30204) #​102727, @​grambbledook
• DashboardScenePage: Correct slug in self referencing data links #​103854, @​Sergej-Vlasov
• Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 #​102863, @​macabu
• Go: Bump to 1.24.2 #​103523, @​Proximyst
• Go: Bump to 1.24.2 (Enterprise)
• GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay #​102869, @​mthorning
• Prometheus: Add support for cloud partners Prometheus data sources #​103941, @​kevinwcyu

Bug fixes

• Alertmanager: Add Role-Based Access Control via reqAction Field #​103479, @​olegpixel
• GrafanaUI: Remove blurred background from overlay backdrops to improve performance #​103647, @​joshhunt
• InfluxDB: Fix nested variable interpolation #​104096, @​aangelisc
• LDAP test: Fix page crash #​102684, @​ashharrison90
• Org redirection: Fix linking between orgs #​102870, @​ashharrison90
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703
• Security: Fix CVE-2025-3260

v11.6.0: 11.6.0

Compare Source

Download page
What's new highlights

Features and enhancements

• API keys: Migrate API keys to service accounts at startup #​96924, @​dmihai
• AccessControl: Allow plugin roles to include plugins:write #​101089, @​gamab
• Alerting: Add DAG errors to alert rule creation and view #​99423, @​soniaAguilarPeiron
• Alerting: Add Jira integration to cloud AMs #​100482, @​soniaAguilarPeiron
• Alerting: Add alert rule version history - part1 #​99490, @​soniaAguilarPeiron
• Alerting: Add migration to clean up rule versions table #​102562, @​yuri-tceretian
• Alerting: Add multiple threshold operators #​99516, @​paulojmdias
• Alerting: Add tracking for the mode used in query and notifications step when c… #​100824, @​soniaAguilarPeiron
• Alerting: Adding color option for slack receiver #​99615, @​wymangr
• Alerting: Allow selection of recording rule write target on per-rule basis. #​101778, @​stevesg
• Alerting: Allow specifying uid for new rules added to groups #​99858, @​moustafab
• Alerting: Improve template testing by trying non-root scopes #​101471, @​JacobsonMT
• Alerting: Include time range in template dashboard and panel urls #​101095, @​JacobsonMT
• Alerting: Keep the latest version of deleted rule in version table #​101481, @​yuri-tceretian
• Alerting: Promote alertingSaveStateCompressed flag to public preview #​99935, @​alexander-akhmetov
• Alerting: Remove ID and OrgID from hash calculation #​100140, @​yuri-tceretian
• Alerting: Remove feature toggle alertingNoNormalState #​99905, @​yuri-tceretian
• Alerting: Remove rule group edit from single rule editor #​100191, @​gillesdemey
• Alerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist #​100264, @​fayzal-g
• Alerting: Rule history restore feature #​100609, @​soniaAguilarPeiron
• Alerting: Support Jira Integration #​100480, @​yuri-tceretian
• Alerting: Track if new gm rules are created with queries and expressions transformable to simple mode #​101121, @​soniaAguilarPeiron
• Alerting: Update IRM copies in Configuration Tracker #​100069, @​teodosii
• Alerting: Update design of rule details tab and add updated by #​99895, @​tomratcliffe
• Alerting: Update irm links for incident and oncall in case new irm plugin is present #​99952, @​soniaAguilarPeiron
• Alerting: Use exponential backoff in the remote Alertmanager readiness check #​99756, @​santihernandezc
• Alerting: Use uid instead of id in AnnotationsStateHistory #​101207, @​soniaAguilarPeiron
• Auth: Add IP address login attempt validation #​98123, @​colin-stuart
• Auth: Add support for the TlsSkipVerify parameter to JWT Auth #​91514, @​Ret2Me
• Auth: Make ssoSettingsSAML GA and enabled by default #​101766, @​mgyongyosi
• Azure Monitor: Filter namespaces by resource group #​100325, @​alyssabull
• Azure: Resource picker improvements #​101462, @​aangelisc
• Azure: Variable editor and resource picker improvements #​101695, @​alyssabull
• Badge: Add darkgrey color #​100699, @​Clarity-89
• Canvas: One click links and actions #​99616, @​adela-almasan
• Chore: Bump Go to 1.23.7 #​101576, @​macabu
• Chore: Bump Go to 1.23.7 (Enterprise)
• Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 #​102533, @​macabu
• Chore: Remove sqlQuerybuilderFunctionParameters feature toggle #​100809, @​zoltanbedi
• CloudWatch: Track Logs Insights query language #​100254, @​idastambuk
• Configuration tracker: Update copy in IRM and point to new IRM slack integration #​100440, @​teodosii
• Dashboard: Folder move unexpected behavior #​100394, @​yincongcyincong
• Dashboards: Allow custom quick time ranges specified in dashboard model #​93724, @​sknaumov
• Dashboards: Monitor dashboard loading performance #​99629, @​dprokop
• Dashboards: Remove default empty string from variable create view #​98922, @​yincongcyincong
• Dashboards: WeekStart is now of type WeekStart | undefined instead of string #​101123, @​oscarkilhed
• DesignSystem: Menu and popover styling update to use new elevated background token #​100255, @​torkelo
• Docker: Use our own glibc 2.40 binaries #​99903, @​DanCech
• Docs: Add a note on query caching for Cloudwatch datasource #​100180, @​idastambuk
• Drilldown: Require datasources:explore RBAC action #​101366, @​svennergr
• Elasticsearch: Remove frontend testDatasource method #​99894, @​idastambuk
• Elasticsearch: Replace level in adhoc filters with level field name #​100315, @​iwysiu
• Elasticsearch: Replace term size dropdown with text input #​99718, @​iwysiu
• Explore: Add hide_logs_download and hide button to download logs #​99512, @​svennergr
• Explore: Move drilldown apps from Explore to a new navbar item "Drilldown" #​100409, @​adrapereira
• ExploreMetrics: Add toggle to enable routing to externalized Explore Metrics app plugin #​99481, @​NWRichmond
• Feat: OSS connections page state filter and update all added #​100688, @​s4kh
• Features: Remove openSearchBackendFlowEnabled feature toggle #​99068, @​idastambuk
• Folders: Add validation that folder is not a parent of itself #​101569, @​stephaniehingtgen
• Geomap: WebGL for Marker Layer #​95457, @​drew08t
• Grafana/ui: Export UsersIndicator #​100698, @​Clarity-89
• Graphite: Compare query builder query to raw query #​101104, @​bossinc
• Histogram: Handle multiple native histograms #​98404, @​domasx2
• Image Renderer: Add support for SSL in plugin mode #​98009, @​nmarrs
• ImportDashboards: Use NestedFolderPicker #​99696, @​joshhunt
• Loki: Removal of Resolution in query editors #​101860, @​svennergr
• Menu: Uniform padding to make menu item hover state look better #​100275, @​torkelo
• MetricsDrilldown: Update name of queryless metrics experience #​100675, @​yangkb09
• MultiCombobox: Export from grafana/ui #​100368, @​Clarity-89
• NodeGraph: Improve view traces for uninstrumented services #​98442, @​edvard-falkskar
• PluginExtensions: Added support for sharing functions #​98888, @​theSuess
• PluginExtensions: Added support for sharing functions (Enterprise)
• PluginExtensions: Exposing registry meta for components returned via usePluginComponents #​100587, @​mckn
• Plugins: Improve plugin details UX for core plugins #​99830, @​oshirohugo
• Plugins: Remove managedPluginsInstall feature toggle #​100416, @​oshirohugo
• Plugins: Remove managedPluginsInstall feature toggle (Enterprise)
• Plugins: Remove uninstall plugin step from cli plugins update-all #​101632, @​oshirohugo
• Prometheus: Get the utcOffset value of timezone when it's specified #​99910, @​itsmylife
• Prometheus: Remove query assistant and related components #​100669, @​edwardcqian
• QueryOptions: Handle invalid time shift values #​101670, @​ivanortegaalba
• RBAC: Remove accessControlOnCall feature toggle #​101222, @​gamab
• RBAC: Remove accessControlOnCall feature toggle (Enterprise)
• Reporting: Add email subject support (Enterprise)
• Security: Update to Go 1.23.5 (Enterprise)
• Tempo: Support TraceQL instant metrics queries #​99732, @​joey-grafana
• Tempo: TraceQL metrics streaming #​99037, @​adrapereira
• Time regions: Add option for cron syntax to support complex schedules #​99548, @​leeoniya
• TimePicker: Ability to manually specify quick ranges #​101465, @​Sergej-Vlasov
• TimeRangePicker: Options list padding #​100343, @​torkelo
• TopNav: Move news into profile menu #​99535, @​bergquist
• Trace View: Add link from the Trace View to the Profiles Drilldown #​101422, @​joey-grafana
• Transformation: Add support for variables to ALL transformations #​100225, @​dprokop
• Transformations: Add round() to Unary mode of Add field from calc #​101295, @​leeoniya
• VizActions: Add confirmation message #​100012, @​adela-almasan
• grafana-ui: Update InlineField error prop type to React.ReactNode #​100347, @​Clarity-89

Bug fixes

• Alerting: Add error handling for missing data source #​101508, @​gillesdemey
• Alerting: Call RLock() before reading sendAlertsTo map #​99812, @​santihernandezc
• Alerting: Disable create rule menu item from panel when unifiedAlerting is disabled #​100701, @​soniaAguilarPeiron
• Alerting: Fix KeyValueMap input bug #​101367, @​soniaAguilarPeiron
• Alerting: Fix crash when invalid matcher is used in silence query params #​101500, @​gillesdemey
• Alerting: Fix evaluation of rules with no-op math expressions #​101436, @​moustafab
• Alerting: Fix exporting new rule with a new group #​101404, @​soniaAguilarPeiron
• Alerting: Fix fieldSelector encoding #​99751, @​gillesdemey
• Alerting: Fix inheritance of the timing options for policy tree #​99398, @​gillesdemey
• Alerting: Fix notification templates layout #​101232, @​gillesdemey
• Alerting: Fix state reason #​101530, @​yuri-tceretian
• Alerting: Fix token-based Slack image upload to work with channel names #​100988, @​JacobsonMT
• App Platform: Pin bleve to fix CVE-2022-31022 #​102531, @​Proximyst
• App: Fix web app behaviour on iOS #​100382, @​ashharrison90
• Auth: Fix AzureAD config UI's ClientAuthentication dropdown #​100752, @​mgyongyosi
• Auth: Fix redirect with JWT auth URL login #​100295, @​mgyongyosi
• AuthN: Refetch user on "ErrUserAlreadyExists" #​100346, @​kalleep
• Caching: Fix duplicate metric registration for cache size (Enterprise)
• CloudWatch: Fix condition for running annotation queries to require dimensions #​101660, @​kevinwcyu
• Combobox: Fix list not being virtualized initially in some cases #​100188, @​tskarhed
• Dashboard: Fix for overwriting an edited dashboard in the old architecture #​100247, @​bfmatei
• Dashboard: Fix the unintentional time range and variables updates on saving #​101475, @​harisrozajac
• Dashboard: Playlist - Fix issue with back button #​99401, @​yincongcyincong
• DashboardList: Throttle the re-renders #​99982, @​bfmatei
• Dashboards: Bring back scripted dashboards #​100575, @​dprokop
• Dashboards: Fix missing v/e/i keybindings to return back to dashboard #​102364, @​mdvictor
• Explore: Fix resizing split view with Loki query editor #​100257, @​ifrost
• ExploreMetrics: Fix escaping of regex metacharacters in label filters #​100513, @​NWRichmond
• Fix: Optimise frontend Postgresql plugin cache busting #​100406, @​jackw
• InfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL) #​100762, @​aangelisc
• Interval variable: Fix $__auto value behavior #​100479, @​yincongcyincong
• Log Context: Fix bug where variables are not replaced in dashboards #​100433, @​svennergr
• OpenTSDB: Support v2.4 #​100673, @​aangelisc
• PDF: Fix repeating panels when there are less items than maxPerRow (Enterprise)
• Plugin Metrics: Eliminate data race in plugin metrics middleware #​99396, @​clord
• Plugins: Fix update button behavior on downgrade #​101048, @​oshirohugo
• Plugins: Fix version tab breaking for non semantic version #​101225, @​oshirohugo
• PromLib: Take AdHoc filters into account when requesting suggestions without label #​101555, @​tskarhed
• Prometheus: Fix cursor jump in prometheus code editor #​100273, @​itsmylife
• Prometheus: Fix operator handling when making label expressions utf-8 friendly #​100475, @​NWRichmond
• Prometheus: Fix setting utcOffset when absolute time range is used #​101065, @​itsmylife
• RBAC: Don't check folder access if annotationPermissionUpdate FT is enabled #​99717, @​IevaVasiljeva
• SSO: Fix team_ids validation for Generic OAuth #​100732, @​dmihai
• Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows #​101776, @​IevaVasiljeva
• Share: Fix short links when root_url is different from the browser URL #​99950, @​AgnesToulet

Breaking changes

• Data source: Change Permissions for query to only have query and not read OR query (Enterprise)

Plugin development fixes & changes

• GrafanaUI: Deprecate Select in favor of Combobox #​100294, @​joshhunt
• Multi/Combobox: Use pointer cursor when not focused #​100878, @​tskarhed
• Slider: Fix text input box being too wide #​100138, @​joshhunt

v11.5.9: 11.5.9

Compare Source

Download page
What's new highlights

Features and enhancements

• Auditing: Add settings to control recording of datasource query request and response body (Enterprise)
• Auditing: Document new options for recording datasource query request/response body #​109976, @​macabu

Bug fixes

• Fix: Fix redirection after login when Grafana is served from subpath #​111099, @​mgyongyosi

v11.5.8: 11.5.8

Compare Source

Download page
What's new highlights

Features and enhancements

• Go: Update to 1.24.6 #​109315, @​Proximyst

v11.5.7: 11.5.7

Compare Source

Download page
What's new highlights

Features and enhancements

• Dependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 #​107556, @​macabu

Bug fixes

• Azure: Fix legend formatting #​106933, @​aangelisc
• Azure: Fix resource name determination in template variable queries #​106938, @​aangelisc
• Security: Fixes for CVE-2025-6197 and CVE-2025-6023 #​108280, @​volcanonoodle

v11.5.6: 11.5.6

Compare Source

Download page
What's new highlights

Bug fixes

• Security: Fixes CVE-2025-3415

v11.5.5: 11.5.5

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go version to 1.24.3 #​105109, @​macabu
• Dependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.3 to v2.5.0 #​105441, @​macabu
• Dependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12 #​105373, @​macabu
• Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0 #​105252, @​macabu

Bug fixes

• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.5.4: 11.5.4

Compare Source

Download page
What's new highlights

Features and enhancements

• Azure Monitor: Filter namespaces by resource group #​103654, @​alyssabull
• Azure: Add support for custom namespace and custom metrics variable queries #​103650, @​aangelisc
• Azure: Resource picker improvements #​103638, @​aangelisc
• Azure: Support more complex variable interpolation #​103651, @​aangelisc
• Azure: Variable editor and resource picker improvements #​103657, @​aangelisc
• Chore: Update CVE-affected dependencies #​102709, @​grambbledook
• DashboardScenePage: Correct slug in self referencing data links #​103853, @​Sergej-Vlasov
• Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 #​102865, @​macabu
• Go: Bump to 1.24.2 #​103525, @​Proximyst
• Go: Bump to 1.24.2 (Enterprise)
• Prometheus: Add support for cloud partners Prometheus data sources #​103942, @​kevinwcyu

Bug fixes

• InfluxDB: Fix nested variable interpolation #​104095, @​aangelisc
• LDAP test: Fix page crash #​102683, @​ashharrison90
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.5.3: 11.5.3

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go to 1.23.7 #​101581, @​macabu
• Chore: Bump Go to 1.23.7 (Enterprise)

Bug fixes

• Alerting: Fix token-based Slack image upload to work with channel names #​101078, @​JacobsonMT
• Auth: Fix AzureAD config UI's ClientAuthentication dropdown #​100869, @​mgyongyosi
• Dashboard: Fix the unintentional time range and variables updates on saving #​101671, @​harisrozajac
• Dashboards: Fix missing v/e/i keybindings to return back to dashboard #​102365, @​mdvictor
• InfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL) #​100977, @​aangelisc
• Org redirection: Fix linking between orgs #​102089, @​ashharrison90

v11.5.2: 11.5.2

Compare Source

Download page
What's new highlights

Features and enhancements

• Docker: Use our own glibc 2.40 binaries #​99918, @​DanCech
• TransformationFilter: Include transformation outputs in transformation filtering options #​99878, @​Sergej-Vlasov
• grafana-ui: Update InlineF

---

Configuration

📅 Schedule: Branch creation - Between 06:00 AM and 10:59 AM, only on Monday ( * 6-10 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.