grafana v13.3.0

Download page What’s new highlights

Security

Security: Fix CVE-2026-100105
Security: Fix CVE-2026-13719
Security: Fix CVE-2026-13720
Security: Fix CVE-2026-15577
Security: Fix CVE-2026-33374
Security: Fix CVE-2026-81841
Security: Fix CVE-2026-88858
Security: Fix CVE-2026-88967
Security: Fix CVE-2026-93294
Security: Fix CVE-2026-95502

Features and enhancements

Access control: reject global role creation in single-org mode (Enterprise)
Alerting: Add AccessControlAction entries for inhibition rules #130977, @rodrigopk
Alerting: Add notifications API boundary module #134537, @rodrigopk
Alerting: Add the Config API data layer for external Alertmanager auto-sync #129478, @rodrigopk
Alerting: Allow drag and drop for yaml file as import source for import wizard #132705, @rodrigopk
Alerting: Cleanup promote staged config code #130974, @rodrigopk
Alerting: Disable datasource picker while an import is staged #133181, @rodrigopk
Alerting: Make stage default import method in GMA import wizard #130634, @rodrigopk
Alerting: Make the Import wizard review step preview look clickable #132711, @rodrigopk
Alerting: Migrate the Import-to-GMA wizard’s auto-sync integration #131523, @rodrigopk
Alerting: Migrate the auto-sync settings hook and panel onto the Config API #131521, @rodrigopk
Alerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1 #134883, @moustafab
Alerting: Promote a staged import configuration #130327, @rodrigopk
Alerting: Read staged config origin from the managed_by field #130787, @rodrigopk
Alerting: Redact secrets from the Import-to-GMA preview modal #132827, @rodrigopk
Alerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers #131520, @rodrigopk
Alerting: Remove import method from import to GMA wizard #130609, @rodrigopk
Alerting: Retire the legacy admin_config auto-sync path #131524, @rodrigopk
Alerting: Show Auto-sync support in the import wizard picker #131084, @rodrigopk
Alerting: Support Mimir alertmanager_config files in Import to GMA wizard #135637, @rodrigopk
Alerting: Surface external Alertmanager sync health in the settings UI #131527, @rodrigopk
Alerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard #131072, @rodrigopk
Auth: Bound OAuth token refresh lock waits by time instead of attempts #133929, @cinaglia
Canvas: Load the standalone plugin by default #134873, @gtk-grafana
Chore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0) #132571, @stevesg
Dashboard: Adds new a subtitle option for panel descriptions #129164, @torkelo
Dashboard: Fall back when collection deletion is unsupported #128259, @bestend
Dashboards: Add $__namespace global variable #132167, @ivanortegaalba
Dashboards: Allow Add variable + btn to add filters, links and annos as well #130841, @mdvictor
Dashboards: Hide links to deleted folders in Recently Deleted #134469, @Clarity-89
Dashboards: Improve Recently Deleted performance with server-side search #134126, @pstibrany
Dashboards: Make the auto grid to be default #130749, @bfmatei
Dashboards: Show Git Sync badges in folder search #132790, @Clarity-89
Faro: add support for trackResources #130792, @ashharrison90
FieldOverrides: Add ShowIfOverride to field config options #132419, @gtk-grafana
Frontend: add subresource integrity #131596, @jackw
Git Sync: Clarify repository links for pure Git #134238, @ferruvich
Git Sync: Ignore hidden paths in repository scans and diffs #134731, @ferruvich
GrafanaBootData: Restrict config.datasources usage via lint rule #130661, @mckn
Heatmap: Keep exemplar marker size consistent across displays #134072, @fastfrwrd
Home: Send the traces setup CTA to the OpenTelemetry onboarding guide #135135, @Clarity-89
Homepage: Add an On call schedules tab with your shifts and who’s on call #134747, @Clarity-89
Homepage: Let the Synthetic Monitoring card ignore checks, targets, and probes #134217, @Clarity-89
Homepage: Let the metrics card exclude hosts and filesystems from its disk alert #133472, @Clarity-89
Homepage: Move card filters to a footer dropdown and show page kinds as icons #135851, @Clarity-89
Homepage: Replace the Recent tab with Recent activity #134633, @Clarity-89
Homepage: Stop the homepage from jumping while it loads #135321, @Clarity-89
Log Details Sidebar: Change default action to replace the current log instead of opening a new tab #133129, @matyax
Log Details: Surface errors in logs and update links styles #134427, @matyax
Logs Table: Disable hover overflow by default #132882, @matyax
Logs: Invert the orientation of the arrow in the Logs Table and Logs Panel #131156, @matyax
Packaging: Remove bash dependency from alpine Docker image #132643, @TheoBrigitte
PanelEdit: Conditional field config display & edit context #132398, @gtk-grafana
PanelOptions: Add context options to overrides #132414, @gtk-grafana
Plugins: Avoid to delete RBAC roles when upgrading #134143, @andresmgot
Plugins: Expose OpenFeature provider discovery to backend plugins #129735, @adamyeats
Plugins: Forward SSL certificate environment variables #131848, @osmocomet
Plugins: Show the correct warning when grafana.com is unreachable #132028, @lazerg
Provisioning: Add generic git OAuth app connections #134186, @amalavet
Provisioning: Add link back to the original dashboard in preview banner #129037, @MissingRoberto
Provisioning: Allow permission updates on provisioned folders #134725, @ferruvich
Provisioning: Allow resource previews in unsynced folders #133250, @ferruvich
Provisioning: Always interpret folder metadata in resources and sync #134726, @ferruvich
Provisioning: Always protect folder metadata from direct file writes #135038, @ferruvich
Provisioning: Always use folder metadata in Git Sync #134355, @Clarity-89
Provisioning: Default save from a branch preview to the previewed branch #135136, @Clarity-89
Provisioning: GitHub-style doc tabs for folder README #129073, @MissingRoberto
Provisioning: Handle repository build timeouts and branch outages #135072, @ferruvich
Provisioning: Keep folder when removing _folder.json leaves its UID unchanged #135574, @ferruvich
Provisioning: Link README items to Grafana pages when viewed in Grafana #128455, @MissingRoberto
Provisioning: Make backend user attribution unconditional #134709, @ferruvich
Provisioning: Never replace the repository root folder during incremental sync #135397, @ferruvich
Provisioning: Reject invalid resource names before API calls #133666, @ferruvich
Provisioning: Respect Git Sync polling intervals after unchanged refs #134380, @ferruvich
Provisioning: Show last checked time in Pull status #134476, @ferruvich
Provisioning: Skip previews for pull requests from forks #132522, @ferruvich
Provisioning: Stop PR previews when refs disappear #132547, @ferruvich
Provisioning: Style branch/target-branch as GitHub-like pills in preview banner #131133, @MissingRoberto
Provisioning: Support generic git OAuth connections in the UI #134187, @amalavet
Provisioning: Support legacy paths and diagnose missing source annotations #133225, @ferruvich
Provisioning: Surface the finalizer blocking a stuck repository deletion #133241, @MissingRoberto
Provisioning: Treat manager-kind conflicts as warnings #132364, @ferruvich
Provisioning: Use resource.action for preview banner title accuracy #131134, @MissingRoberto
Provisioning: recover from a deleted PR branch (pre-flight + save to new branch) #128977, @MissingRoberto
Provisioning: render mermaid diagrams in folder README #129096, @MissingRoberto
Provisioning: tolerate quota lookup failures for existing repositories #131703, @ferruvich
QueryEditor: Add extension point to the top toolbar #132289, @aocenas
RBAC: Allow removing unowned permissions through access-control APIs (Enterprise)
RBAC: Document APIs allow removing unowned permissions through access-control APIs #132518, @gamab
Replace subtitle switch UI string #132965, @imatwawana
Reports: say in the report when a variable value no longer exists (Enterprise)
Sandbox: Config flag deprecation message #135329, @jesdavpet
Sandbox: Show deprecation warning in UI tooltip (Enterprise)
Standard options: Add Ordinal unit. #130091, @simonprickett
Table: Calculate column widths independently of scrollbar visibility #134337, @fastfrwrd
Table: Prevent initial column width jump with vertical scrollbars #133615, @fastfrwrd
TimeRangePicker: Default isOnCanvas to true #135833, @torkelo
TopNav: Logo should not shrink #131170, @torkelo
Trace View: Open Logs link in a new tab (Drilldown) or in split view (Explore) #132987, @matyax
TraceView: Add Go to span on the header error banner #132550, @joey-grafana
TraceView: Add a trace banner for error and warning spans #132250, @joey-grafana
TraceView: Expand attribute plugin cross-sell promos #131472, @joey-grafana
TraceView: Open the banner span from Go to span and surface exception #133122, @joey-grafana
TraceView: Use design system tokens in the header, minimap and timeline #133339, @joey-grafana
TraceView: Use design system tokens in waterfall rows and span details #133434, @joey-grafana
Traces to logs: Extend support, and discover trace and span related logs from #130515, @matyax
Transformations: Allow setting static refIDs per transformation #131458, @Develer
Transformations: Resolve variables in the classic transformation editor #135569, @Develer
UI: Luxon on by default #134865, @fastfrwrd
Unified storage: Enable automatic cleanup of deleted resources by default #133330, @pstibrany
alerting: Remove method step from import to GMA wizard #130616, @rodrigopk

Bug fixes

Alerting: Fix alerts going to the built-in Alertmanager after startup for external-only orgs #134481, @gillesdemey
Alerting: Fix instance rows vanishing at coarse query steps in Triage #133516, @rodrigopk
Alerting: Fix notification policy drop and query drift in rule saves #131645, @rodrigopk
Alerting: Fix rule groups missing from a folder until “Show more” is clicked #131078, @JacobsonMT
Alerting: Fix stale dry-run validation and YAML errors in the Import wizard #132707, @rodrigopk
Alerting: Fix useAutoSyncConfiguration’s queries behind Org Admin + feature toggle #130627, @rodrigopk
Alerting: fix GetManagedRoute returning imported route for unrelated names #132563, @JacobsonMT
Alerting: reject managed route names with leading/trailing whitespace #132566, @JacobsonMT
Dashboard: Preserve panel subtitle in V2 save model #133723, @adi-IL
Dashboards: Fix Classic model returning v2 JSON when saving a provisioned dashboard #131718, @ivanortegaalba
Dashboards: Fix adhoc and groupby variable datasource on UI import #131817, @ivanortegaalba
Dashboards: Fix browse crash and hangs when a dashboard shares its folder’s UID #132634, @Clarity-89
Dashboards: Fix edit state props when swapping dashboard state in place #132001, @ifrost
Dashboards: Fix missing deletion dates in Recently Deleted #133734, @pstibrany
Dashboards: Fix query variable refresh reset to onDashboardLoad on v2 UI import #131837, @ivanortegaalba
Dashboards: Keep tags set on a new dashboard when saving it #131459, @ivanortegaalba
Dashboards: Keep variable values and time settings set by an applied spec instead of reverting them to the URL #134200, @ivanortegaalba
Dashboards: Preserve query variable refresh setting on v2 dashboard import #132007, @Sergej-Vlasov
Dashboards: Show values preview for data source variables in the edit pane #131736, @ivanortegaalba
Library panels: Fix skeleton alignment #133965, @ashharrison90
Navigation: Hide NetworkError when switching organization #131955, @AshrithaSB
Packaging: Fix issue with bundled plugins not being moved properly #131033, @kminehart
PanelEditor: Fix options pane not resizable beyond the preview’s content width #131581, @ivanortegaalba
Plugins: Don’t report loaded plugins as not registered when a request times out #135591, @leventebalogh
Provisioning: Fix PR dashboard previews when served from a sub-path #132569, @gustaff-weldon
Provisioning: Fix folder cleanup and hidden directory scans #135050, @ferruvich
Provisioning: Fix folder rename UID collision during full sync #130401, @ferruvich
Provisioning: Fix sync step flicker in Git Sync wizard #134108, @Clarity-89
Reporting: Fix race condition with repeat panels on the /d-render/ page #128536, @mmandrus
SQL Expressions: Read enum fields as their text #135225, @nicwestvold
SQL Expressions: Rename label columns that clash with generated column names #134869, @nicwestvold
Security: Fix CVE-2026-17183 #131061, @github-actions[bot]
Table: Fix nested apply-to-row coloring to use the nested frame’s own fields #129426, @fastfrwrd
Table: Fix the height a wrapped header row reserves #132230, @fastfrwrd
Table: fix JSON cell indentation, styling, and hover reveal #130452, @fastfrwrd

Breaking changes

Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace #132172, @xnyo

Plugin development fixes & changes

ConfirmModal: Ensure focus correctly traps when invoked from a dropdown menu #132764, @ashharrison90
Datasources: Remove deprecated isDefault from DataSourceInstanceListItem #133886, @leventebalogh
GrafanaUI: Fix focus ring appearance #132808, @ashharrison90
MultiCombobox: Ensure height is consistent between empty/filled states #131255, @ashharrison90
Runtime: Stabilize async data source APIs #134390, @leventebalogh
Runtime: Stabilize plugin settings APIs #134723, @leventebalogh

Source grafana/grafana · v13.3.0 · 2026-10-27 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.

Release notes are published by the upstream project and mirrored here for indexing. All rights belong to their authors.