⬆️ Update grafana/grafana to v12.1.0

[renovate]

This PR contains the following updates:

Package	Update	Change
grafana/grafana	minor	v12.0.0 -> v12.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

grafana/grafana (grafana/grafana)

v12.1.0: 12.1.0

Compare Source

Download page
What's new highlights

Features and enhancements

• Access: Disable role none option if advanced access control is not enabled #​107378, @​Jguer
• Alerting: Add OAuth2 Support for Webhook Receiver #​106302, @​JacobsonMT
• Alerting: Add ability to import rules to GMA from Prometheus YAML #​105807, @​soniaAguilarPeiron
• Alerting: Add details to the payload when tracking import to GMA #​106404, @​soniaAguilarPeiron
• Alerting: Add export folder action to the new list view #​106256, @​soniaAguilarPeiron
• Alerting: Add filters for health and contact point in Prometheus Rules api #​106580, @​moustafab
• Alerting: Add loading spinner for loading groups state #​106289, @​soniaAguilarPeiron
• Alerting: Add need more info for import ui datasource field #​106364, @​soniaAguilarPeiron
• Alerting: Add provenance to Prometheus API #​106596, @​moustafab
• Alerting: Add provenance to remote-ruler extension response (Enterprise)
• Alerting: Add simplified routing metadata to the details tab #​106403, @​gillesdemey
• Alerting: Add state history backend to write ALERTS metric #​104361, @​alexander-akhmetov
• Alerting: Add support for Redis Sentinel for Alerting HA #​106322, @​vstpme
• Alerting: Allow disabling recording rules write for a data source in the UI #​106664, @​alexander-akhmetov
• Alerting: Correctly persist FiredAt in SyncRuleStatePersister #​106658, @​fayzal-g
• Alerting: Ensure errors cleared when Alerting after error #​105246, @​moustafab
• Alerting: Evaluate all imported from Prometheus rules sequentially #​106295, @​alexander-akhmetov
• Alerting: Extensible Settings module #​107831, @​konrad147
• Alerting: Filter out rules managed by integrations and add an info alert #​106602, @​soniaAguilarPeiron
• Alerting: Filter out synthetic datasource-managed rules when importing to GMA #​106358, @​soniaAguilarPeiron
• Alerting: List V2 - Add labels popup #​107193, @​konrad147
• Alerting: List V2 - Grouped view filters #​106400, @​konrad147
• Alerting: List V2 - Use backend filters for GMA rules #​106897, @​konrad147
• Alerting: Make paginated rules endpoint strongly consistent (Enterprise)
• Alerting: Optimize out unnecessary permission check for rule groups (Enterprise)
• Alerting: Optimize prometheus api permission checks #​106299, @​moustafab
• Alerting: Optimize prometheus api permission checks (Enterprise)
• Alerting: Persist alert instance FiredAt field #​105927, @​fayzal-g
• Alerting: Remove ruler from alert list view2 #​106778, @​soniaAguilarPeiron
• Alerting: Resend alerts for states that are missing in the eval results #​105965, @​alexander-akhmetov
• Alerting: Send notifications immediately on Error|NoData -> Normal transitions #​106421, @​alexander-akhmetov
• Alerting: Support PDC in Grafana-managed recording rules #​106677, @​alexander-akhmetov
• Alerting: Use default_datasource_uid as the default target for recording rules in UI #​106415, @​alexander-akhmetov
• Annotations: Use dashboard uids instead of dashboard ids #​106676, @​stephaniehingtgen
• App Platform Provisioning: Add experimental nanogit mode for Git Sync #​106763, @​MissingRoberto
• Auth: Add Azure/Entra workload identity support #​104807, @​mehighlow
• Auth: Enable improved session handling by default for OAuth and SAML #​107442, @​mgyongyosi
• Auth: Enable ssoSettingsLDAP by default #​106310, @​mgyongyosi
• Auth: Remove api key endpoints #​106019, @​dmihai
• Auth: Remove code for authenticating API keys #​105998, @​dmihai
• Azure: Support scope selection in Resource Graph queries #​105835, @​aangelisc
• Betterer: Only allow singleton Storage use #​105310, @​tskarhed
• Caching: Remove memcached reconnect_interval setting (Enterprise)
• Chore: Update k8s.io to v0.33.1 #​105307, @​ryantxu
• Cloud Monitoring: Add support for service account impersonation #​107022, @​zoltanbedi
• CloudMigrations: Add Mute Timings as dependency for Notification Policies #​106751, @​macabu
• CloudWatch: Backport aws-sdk-go-v2 update from external plugin #​107136, @​njvrzm
• CloudWatch: Improve instance attribute variable query editor #​105206, @​iwysiu
• Cloudwatch: Add missing AWS regions #​106304, @​chriscerie
• Dashboard Provisioning: Reduce db load #​106114, @​stephaniehingtgen
• Dashboard: Add Alert icon in library panels #​107723, @​axelavargas
• Dashboard: Add server-configurable quick ranges for the time picker #​102254, @​chodges15
• Dashboard: Formatting Currency - add new custom 'financial' currency format without abbreviations #​106604, @​axelavargas
• Dashboard: Library Panels - Add ability to search by folder name #​106997, @​axelavargas
• Dashboard: Schema V2 - Auto-transform V2 dashboards in V1Resource export mode #​105997, @​axelavargas
• Datasources: Migrate to new sigv4 middleware (Enterprise)
• Datasources: Update grafana-aws-sdk for new sigv4 middleware and aws-sdk-go v1 removal #​107522, @​njvrzm
• DatePicker: Add cursor not-allowed style and hover background color #​106451, @​ywzheng1
• Dependencies: Bump Go to v1.24.4 #​106533, @​macabu
• Dependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 #​107379, @​macabu
• Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 #​106064, @​macabu
• ElasticSearch: Remove frontend response parsing #​104148, @​nojaf
• Geomap: Add HiDPI support to CARTO basemap (#​81195) #​106211, @​cledwynl
• Git Sync UI: Delete Provisioned Dashboard Flow #​106593, @​ywzheng1
• Grafana/data: Extract fuzzy search core #​107110, @​Clarity-89
• I18n: Update eslint rule to catch some untranslated object properties #​105072, @​tomratcliffe
• InfluxDB: Add an optional time range filter for tag queries in the query panel autocompleteInflux tag filter #​107195, @​NikolayTsvetkov
• LBAC for data sources: Adds team filtering for lbac rules (Enterprise)
• Library Panels: Mark library panel RBAC as GA & enable by default #​106833, @​kaydelaney
• Library Panels: Modify connection api endpoint to be compatible with unified storage #​107088, @​stephaniehingtgen
• Library elements: Remove ability to set as "library variable" #​106594, @​stephaniehingtgen
• Library panels: Remove libraryPanelRBAC feature flag, and enable rbac by default #​107222, @​stephaniehingtgen
• Loki: Remove experimental lokiQuerySplittingConfig #​107298, @​ivanahuckova
• Loki: Remove experimental predefined operations #​107289, @​ivanahuckova
• OAuth: Add access token as third source for user info extraction #​107636, @​Jguer
• Plugin Extensions: Expose PluginMeta generic in usePluginContext #​107577, @​MattIPv4
• Postgres: Switch the datasource plugin from lib/pq to pgx #​103961, @​zoltanbedi
• Preferences: Use dashboard uid for the home dashboard #​106666, @​stephaniehingtgen
• Profiles: Stop passing response headers for Grafana-Pyroscope and parca datasources #​106577, @​simonswine
• Prometheus: Deprecation message for Azure auth #​106490, @​bossinc
• Prometheus: Facilitate tree shaking with exports and bundler mode #​105575, @​NWRichmond
• Prometheus: Migrate remaining selectors to data-testid #​106564, @​idastambuk
• ProvisionedFolder: Delete folder drawer #​107089, @​ywzheng1
• Provisioning: Add pure git repository type #​106815, @​MissingRoberto
• Querying: Pass dashboard and panel title as headers #​107032, @​ivanahuckova
• Remote Alertmanager: Send SMTP config #​106337, @​santihernandezc
• Restore dashboards: Add filters and search #​106994, @​Clarity-89
• SCIM: Ignore unsupported fields in user PATCH requests (Enterprise)
• SCIM: Implement operation for adding an externalId value to a team (Enterprise)
• SCIM: Implement the add members operation in group PATCH requests (Enterprise)
• SCIM: Implement the remove members operation in group PATCH requests (Enterprise)
• SCIM: Update externalId field in group PATCH request (Enterprise)
• SQL Expressions: Always convert on type first #​106083, @​kylebrandt
• Select: Set min width for the current selected item when width=auto #​106131, @​tskarhed
• StateTimeline: Display false and empty string values #​107059, @​jesdavpet
• StateTimeline: Support NaN and null value mappings #​105638, @​fastfrwrd
• Storage: Take migration_locking setting into account #​105938, @​JohnnyQQQQ
• TableNG: Refactor to better take advantage of react-data-grid #​103755, @​leeoniya
• Tables: Pills for Table Cells #​107485, @​timlevett
• Teams: Add support for updating externalId field #​106406, @​dmihai
• Tempo: Enable native histograms for Tempo service graph #​105989, @​bohandley
• TimeRangePicker: Highlight range on hover #​106616, @​joshhunt
• TraceView: Resource attributes links extension point #​104680, @​edvard-falkskar
• Transformations: Add "Auto" mode to Organize Fields #​103055, @​gelicia
• Transformations: GA the Regression transformation #​106074, @​gelicia
• Unified storage: Respect GF_DATABASE_URL override #​105331, @​pstibrany
• VQB: Add selected columns to GROUP BY dropdown (#​106349) #​106391, @​Shubham19032004
• VQB: Allow custom table names in TableSelector #​106420, @​Victorthedev
• XYChart: Add support for x=time #​106459, @​leeoniya

Bug fixes

• Alerting: Fix $value type when single data source is queried #​106080, @​alexander-akhmetov
• Alerting: Fix ImportToGMARules flaky test #​106495, @​soniaAguilarPeiron
• Alerting: Fix RefIds not being shown when creating or editing Grafana-managed recording rule #​106840, @​soniaAguilarPeiron
• Alerting: Fix contact points tab visibility when user can only create #​106735, @​JacobsonMT
• Alerting: Fix eval time unit in list view #​106488, @​ebuildy
• Alerting: Fix group interval override when adding new rules #​107324, @​konrad147
• Alerting: Fix group-level labels and query_offset in the import API #​106379, @​alexander-akhmetov
• Alerting: Fix notification policy conflicts originating from provenance mismatch #​107343, @​moustafab
• Alerting: Fix resolved notifications for same-label Error to Normal transitions #​106210, @​alexander-akhmetov
• Alerting: Hide labels section if we only have private labels #​105996, @​gillesdemey
• Annotations: Remove prometheus from legacy runner #​106737, @​scottlepp
• Azure: Fix Application Insights metadata requests #​105614, @​aangelisc
• Azure: Fix duplicated trace links #​105698, @​aangelisc
• Azure: Fix legend formatting #​106504, @​aangelisc
• Azure: Fix resource name determination in template variable queries #​105705, @​aangelisc
• BarChart/StateTimeline: Use noValue setting for error message when data is empty #​107147, @​fastfrwrd
• CloudWatch: Fix http client handling + assume role bug #​107893, @​njvrzm
• CloudWatch: Fix proxy transport issue #​107807, @​njvrzm
• Dashboard: FF dashboardNewLayouts Fix library panels non-editable when multiple added #​107052, @​axelavargas
• Dashboard: Fix cache validation to prevent stale cache #​105918, @​yashschandra
• Dashboard: Fixes issue with dashboard links that include all variables #​106356, @​torkelo
• Dashboards: Fix history list for dashboard uids that end in - #​107073, @​stephaniehingtgen
• Drilldown: Fix js crash when using http #​105646, @​chu121su12
• Fix: Increase login_attempt.ip_address column length for IPv6 support #​107035, @​Jguer
• FlameGraph: Fix bug for function names that conflict with JavaScript object prototype properties #​106338, @​simonswine
• Folders: Correctly resolve nested folder breadcrumbs #​106344, @​IevaVasiljeva
• GrafanaUI: Fix Combobox ignoring loading prop #​105584, @​ValeraS
• Graphite: Fix annotation queries #​106553, @​aangelisc
• Graphite: Fix date mutation #​107414, @​aangelisc
• Graphite: Fix nested variable interpolation for repeated rows #​106976, @​aangelisc
• K8s: Dashboards /apis: Fix library element connections #​106734, @​stephaniehingtgen
• Loki: Fix health check message #​107170, @​wooffie
• Loki: Fix issue where step parameter using a template variable was marked as invalid #​106541, @​ivanahuckova
• Loki: Fix label browser not sorted after selection of a label #​107394, @​paulojmdias
• Org: Fix org deletion #​106193, @​stephaniehingtgen
• Plugins: Fix and encode invalid gRPC header values #​107339, @​ivanahuckova
• PostgreSQL: Fix error on panel when toggling sqlDatasourceDatabaseSelection feature #​106965, @​HasithDeAlwis
• Profiles: Fix for passing the response headers #​106293, @​simonswine
• Reporting: Stop sending reports with Never schedule on creation (Enterprise)
• SCIM: Fix PUT request for deactivating a user (Enterprise)
• SCIM: Fix the removal of all members in group PUT requests (Enterprise)
• SCIM: Fix user patch operation (Enterprise)
• Security: Add fix for CVE-2025-3580 #​105976, @​baldm0mma
• Security: Fixes for CVE-2025-6197 and CVE-2025-6023 #​108333, @​mgyongyosi
• Settings: Fix reencryption and rollback of encrypted values in setting table (Enterprise)
• Tempo: Fix showing dangling edges in NodeGraph #​107245, @​ifrost
• ToolTip: Fix flexbox bug with tooltip when maxWidth is set manually #​107145, @​jdmarshall
• URLParams: Stringify true values as key=true always (fixes issues with variables with true value) #​106440, @​torkelo

Breaking changes

• Alerting: Enable recording rules by default #​105603, @​alexander-akhmetov

Plugin development fixes & changes

• Carousel: Always center image #​106468, @​ashharrison90
• Drawer: Include divider and close button when passing a custom title element #​106896, @​ashharrison90

v12.0.3: 12.0.3

Compare Source

Download page
What's new highlights

Bug fixes

• Security: Fixes for CVE-2025-6197 and CVE-2025-6023 #​108280, @​volcanonoodle

v12.0.2: 12.0.2

Compare Source

Download page
What's new highlights

Features and enhancements

• Dependencies: Bump Go to v1.24.4 #​106565, @​macabu
• Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 #​106116, @​macabu
• Storage: Take migration_locking setting into account #​105951, @​JohnnyQQQQ

Bug fixes

• Alerting: Fix $value type when single data source is queried #​106101, @​alexander-akhmetov
• Alerting: Fix group-level labels and query_offset in the import API #​106392, @​alexander-akhmetov
• Azure: Fix Application Insights metadata requests #​105838, @​aangelisc
• Org: Fix org deletion #​106461, @​stephaniehingtgen
• Security: Fixes CVE-2025-3415

v12.0.2+security-01: 12.0.2+security-01

Compare Source

Download page
What's new highlights

Features and enhancements

• Profiles: Stop passing response headers for Grafana-Pyroscope and parca datasources #​106730, @​simonswine

Bug fixes

• FlameGraph: Fix bug for function names that conflict with JavaScript object prototype properties #​106625, @​simonswine
• Security: Fixed CVE-2025-6023
• Security: Fixed CVE-2025-6197

v12.0.1: 12.0.1

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go version to 1.24.3 #​105101, @​macabu
• Dependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12 #​105368, @​macabu
• Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0 #​105249, @​macabu
• K8s: Dashboards: Add fine grained access control checks to /apis #​104419, @​stephaniehingtgen

Bug fixes

• Dashboard: Fix Panel Explore link subpath duplication (#​104952) #​105056, @​axelavargas
• Dashboard: Fixes issue with row repeats and first row #​104469, @​torkelo
• Graphite: Ensure template variables are interpolated correctly #​105389, @​aangelisc
• Graphite: Fix Graphite series interpolation #​104516, @​aangelisc
• InfluxDB: Fix nested variable interpolation #​104176, @​aangelisc
• MetricsDrilldown: Restore link to Metrics Drilldown from Explore #​104073, @​NWRichmond
• NestedFolderPicker: Fix scroll jumps back to top #​105769, @​samsch
• Preferences: Disable the save button whilst saving preferences #​105612, @​ashharrison90
• Prometheus: Fix semver import path #​104945, @​jackw
• Themes: Prevent duplicated API call in drawer #​105611, @​ashharrison90
• XYChart: Coerce threshold steps to numbers #​104492, @​leeoniya
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v12.0.1+security-01: 12.0.1+security-01

Compare Source

Download page
What's new highlights

Bug fixes

• Security: Fixed CVE-2025-3415

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.