[renovate]

This PR contains the following updates:

Package	Update	Change
grafana/grafana	patch	12.4.2 → 12.4.13

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

grafana/grafana

v12.4.13

Compare Source

Security

• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-93294

Features and enhancements

• Alerting: Strip sensitive headers from oauth2 cross-host redirects #​134424, @​JacobsonMT
• Dashboard: Fall back when collection deletion is unsupported (#​128259) #​134229, @​bestend

Bug fixes

• CVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise)

v12.4.12

Compare Source

Security

• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-81841
• Security: Fix CVE-2026-81842

Bug fixes

• Unified Storage: Return 403 instead of 500 on namespace mismatch #​133595, @​pstibrany

v12.4.11

Compare Source

Security

• Security: Fix CVE-2026-12704
• Security: Fix CVE-2026-15815
• Security: Fix CVE-2026-76154
• Security: Fix CVE-2026-79656

v12.4.10

Compare Source

Security

• Security: Fix CVE-2026-14199
• Security: Fix CVE-2026-19475

Bug fixes

• Dashboards: Fix adhoc and groupby variable datasource on UI import #​131821, @​ivanortegaalba
• Dashboards: Fix version dates and user display names in the legacy version history page #​131808, @​ivanortegaalba

v12.4.9

Compare Source

Security

• CVE-2026-17183

Features and enhancements

• Dashboard Import: Labels in v2 schema #​130428, @​harisrozajac

Bug fixes

• Azure Monitor: fix migration for dimension filters #​130521, @​olivierlemasle

v12.4.8

Compare Source

v12.4.7

Compare Source

Features and enhancements

• Dashboards: Get annotations and dashboard endpoint performance improvements #​129780, @​filewalkwithme

Bug fixes

• DashboardDS: Fix Mixed panels with a time override stuck in permanent loading #​129289, @​oscarkilhed

v12.4.6

Compare Source

Features and enhancements

• Alerting: Add protected fields authorization check to provisioning API #​127940, @​grafana-writer[bot]
• Alerting: Return 403 instead of 500 on contact point provenance mismatch #​127814, @​rwwiv
• Go: Update version to 1.26.5 #​128017, @​macabu

Bug fixes

• Jaeger: Handle gzip, deflate, and brotli compressed API responses #​128062, @​zoltanbedi
• alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL #​128753, @​dhananjay6561

v12.4.5

Compare Source

Features and enhancements

• Docker: Bump Alpine-based images to 3.24.1 #​126538, @​macabu

Bug fixes

• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid #​125769, @​papagian

v12.4.4

Features and enhancements

• Browse dashboards: Make elements visible and flow better when zoomed #​120678, @​aocenas
• Docker: Bump Alpine-based images to 3.23.4 #​123027, @​Proximyst
• Go: Update version to 1.26.3 #​124456, @​macabu
• Graphite: Strip tagged path from tags.name when aliasSub wrapping is detected #​122619, @​adamyeats
• LibraryPanels: Return 403 instead of 500 for insufficient permissions #​123470, @​MissingRoberto
• Plugins: Sanitise header values to printable ASCII for gRPC compatibility #​122474, @​adamyeats

Bug fixes

• Alerting: Fix AlertManagerPicker visibility to check Alertmanager datasources #​124073, @​konrad147
• Alerting: Treat not found error when fetching plugins as not installed #​122989, @​rodrigopk
• DashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams #​124893, @​ivanortegaalba
• Jaeger: Fix log event timestamp unit conversion in trace view #​123711, @​ktw4071
• PostgreSQL: Allow sql_engine to return results for EXPLAIN queries #​123245, @​sdague

v12.4.3

Compare Source

Bug fixes

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377
• Security: CVE-2026-33378
• Security: CVE-2026-33381
• Security: CVE-2026-33380

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 387948ee-f6be-42cd-a3b3-c4f29cd0e49a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}