<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="5">
<package pkgid="2182790f6d926df1a878f51bab7c85e45809b4919218f5868631aa146ff0bfd72141791325418501eed40b50ef00a5c3256cfb9d35748d509c6fa10f3b106f9d" name="grafana" arch="aarch64">
  <version epoch="0" ver="12.4.5" rel="60003.3.1.uyuni"/>
  <changelog author="witold.bedyk@suse.com" date="1741608000">- CVE-2025-27144: Fix Go JOSE's Parsing Vulnerability (bsc#1237671)
  * Add 0003-Bump-go-jose.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748260800">- Update to version 11.5.2:
  * Bug fixes:
    Alerting: Allow specifying uid for new rules added to groups.
    Alerting: Call RLock() before reading sendAlertsTo map.
    Auth: Fix redirect with JWT auth URL login.
    AuthN: Refetch user on "ErrUserAlreadyExists".
    Azure: Correctly set application insights resource values.
    DashboardList: Throttle the re-renders.
    Dashboards: Bring back scripted dashboards.
    Plugin Metrics: Eliminate data race in plugin metrics
    middleware.
    RBAC: Don't check folder access if annotationPermissionUpdate
    FT is enabled.
- Update to version 11.5.1:
  * Bug fixes:
    CodeEditor: Fix cursor alignment.
    TransformationFilter: Include transformation outputs in
    transformation filtering options.
- Upgrade to version 11.5.0:
  * Breaking changes:
    Loki: Default to /labels API with query param instead of
    /series API.
  * Features and enhancements:
    Extended Cloud Migration Assistent support for plugins and
    alerts.
    Redesigned filters for dashboards.
    New regular expression option for Extract fields
    transformation.
    Redesigned sharing experience in Dashboards.
    Customizable shareable dashboard panel images.
    RBAC for alerting notifications and notification policies.
    Add support for Elasticsearch cross-cluster search.
    Time series macro support in visual query builder for SQL data
    sources.
    OAuth and SAML session handling improvements.
    Plugin Frontend Sandbox for additiona security.
    Renamed Public dashboards to Shared dashboards.
- Update to version 11.4.1:
  * Bug fixes:
    Alerting: AlertingQueryRunner should skip descendant nodes of
    invalid queries.
    Alerting: Fix alert rules unpausing after moving rule to
    different folder.
    Alerting: Fix label escaping in rule export.
    Alerting: Fix slack image uploading to use new api.
    Azure/GCM: Improve error display.
    Dashboards: Fix issue where filtered panels would not react to
    variable changes.
    Dashboards: Fixes issue with panel header showing even when
    hide time override was enabled.
    Dashboards: Fixes week relative time ranges when weekStart was
    changed.
    Dashboards: Panel react for timeFrom and timeShift changes
    using variables.
    DateTimePicker: Fixes issue with date picker showing invalid
    date.
    Fix: Add support for datasource variable queries.
    InfluxDB: Adhoc filters can use template vars as values.
    LibraryPanel: Fallback to panel title if library panel title is
    not set.
- Upgrade to version 11.4.0:
  * Features and enhancements:
    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.
- Update to version 11.3.1:
  * Features and enhancements:
    Alerting: Make context deadline on AlertNG service startup
    configurable.
    MigrationAssistant: Restrict dashboards, folders and
    datasources by the org id of the signed in
    user.
    User: Check SignedInUser OrgID in RevokeInvite.
  * Bug fixes:
    Alerting: Fix escaping of silence matchers in utf8 mode.
    Alerting: Fix overflow for long receiver names.
    Alerting: Fix saving advanced mode toggle state in the alert
    rule editor.
    Alerting: Fix setting datasource uid, when datasource is string
    in old version.
    Alerting: Force refetch prom rules when refreshing panel.
    Anonymous User: Adds validator service for anonymous users.
    Azure Monitor: Support metric namespaces fallback.
    Azure: Fix duplicated traces in multi-resource trace query.
    Azure: Handle namespace request rejection.
    CloudWatch: Interpolate region in log context query.
    Dashboard datasource: Return annotations as series when query
    topic is "annotations".
    Dashboard: Append orgId to URL.
    Dashboards: Fixes performance issue expanding a row.
    Flame Graph: Fix crash when it receives empty data.
    Folders: Add admin permissions upon creation of a folder w. SA.
    Folders: Don't show error pop-up if the user can't fetch the
    root folder.
    Migration: Remove table aliasing in delete statement to make it
    work for mariadb.
    ServerLock: Fix pg concurrency/locking issue.
    Service Accounts: Run service account creation in transaction.
    Table: Fix text wrapping applying to wrong field.
    Unified Storage: Use ssl_mode instead of sslmode.
- Update to version 11.3.0+security-01:
  * Security:
    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
- Upgrade to version 11.3.0:
  * Features and enhancements:
    View mode and Edit mode are generally available.
    Template variables and the time range picker remain visible
    when scrolling.
    Added timezone parameter in Grafana URL.
    Kiosk mode displays dashboard controls.
    Auto-formatted table cell values in Cell Inspect.
    Allow adding actions to canvas elements.
    Legend support in bar gauge visualizations.
    Apply the same binary transformation to all the number fields
    in a given table at once.
    Add support for data links and actions in several
    visualizations.
    The Explore Logs plugin is installed by default.
    Added correlations to external URLs in Explore.
    Simplified query section for alert rule creation.
    Introduced recording rules for Grafana-managed alerts.
    GitHub App authentication for the GitHub data source.
    Improved subfolder creation flow.
    Redesigned plugin details page.
    Added UI for LDAP configuration.
    Added RBAC support in Plugins.
- Update to version 11.2.2+security-01:
  * Bug fix:
    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)
- Update to version 11.2.2:
  * Features and enhancements:
    Data sources: Hide the datasource redirection banner for users
    who can't interact with data sources.
  * Bug fixes:
    Alerting: Fix preview of silences when label name contains
    spaces.
    Alerting: Make query wrapper match up datasource UIDs if
    necessary.
    AzureMonitor: Improve resource picker efficiency.
    AzureMonitor: Remove Basic Logs retention warning.
    CloudWatch: Fix segfault when migrating legacy queries.
    DashboardScene: Fix broken error handling and error rendering.
    Plugins: Avoid returning 404 for AutoEnabled apps.
- Update to version 11.2.1:
  * Features and enhancements:
    Alerting: Support for optimistic concurrency in priovisioning
    Tempate API.
    Logs panel: Enable displayedFields in dashboards and apps.
    State timeline: Add pagination support.
  * Bug fixes:
    Authn: No longer hash service account token twice during
    authentication.
    CloudMigrations: Fix snapshot creation on Windows systems.
    DashGPT: Fixes issue with generation on Safari.
    Dashboard: Fix Annotation runtime error when a data source does
    not support annotations.
    Grafana SQL: Fix broken import in NumberInput component.
    Logs: Show older logs button when infinite scroll is enabled
    and sort order is descending.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Templating: Fix searching non-latin template variables.
- Upgrade to version 11.2.0:
  * Features and enhancements:
    Grafana Cloud Migration Assistant is in public preview.
    Added navigation bookmarks.
    Added template variables support in some transformations.
    Introduced Transpose transformation.
    Group to nested tables is now generally available.
    Format string transformation is now generally available.
    New cumulative and window calculations available in Add field
    from calculation.
    Canvas: Standardized tooltips.
    Canvas: Allow adding data links without using an override.
    Canvas: Allow opening data links with a single click.
    Canvas: Add the ability to control the order in which data
    links are displayed.
    Added pagination support for state timeline.
    Centralized alert history page.
    Grafana Explore now allows for logs filtering and pinning in
    content outline.
    Added forward direction search for Loki.
    Added Cloudwatch Metric Insights cross account observability
    support.
    Added Yugabyte data source.
    Map org-specific user roles from your OAuth provider.
    Better SAML integration for Azure AD.
    API support for LDAP configuration (experimental).
    OpenID Connect Discovery URL for Generic OAuth.
- Update to version 11.1.5:
  * Bug fixes:
    Alerting: Fix permissions for prometheus rule endpoints.
    Alerting: Fix persisting result fingerprint that is used by
    recovery threshold.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Snapshots: Fix panic when snapshot_remove_expired is true.
    VizTooltip: Fix positioning at bottom and right edges on
    mobile.
    Plugins: Fix QueryField typeahead missing background color.
- Update to version 11.1.3:
  * Bug fix:
    RBAC: Allow plugins to use scoped actions.
- Update to version 11.1.1:
  * Bug fixes:
    Alerting: Skip fetching alerts for unsaved dashboards.
    Alerting: Support utf8_strict_mode: false in Mimir.
    Scenes: Fixes issue with panel repeat height calculation.
    Table Panel: Fix Image hover without datalinks.
    Tempo: Fix grpc streaming support over pdc-agent.
    RBAC: Allow plugins to use scoped actions.
- Upgrade to version 11.1.0:
  * Security:
    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  * Features and improvements:
    Allow table cell text wrapping.
    Added stat visualization percent change color mode options.
    XA chart is generally available.
    Redesigned settings page for Alerting.
    Added alerting template selector.
    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.
    Improved paused alert visibility.
    Rule-specific silences with permissions.
    Support for AWS SNS integration in Grafana-managed alerts.
    Added GeoMap and panel shortcut keyboard support.
    Accessability headings improvements.
    Added reduced motion support.
- Update to version 11.0.1:
  * Breaking changes:
    If you had selected your language as "Português Brasileiro"
    previously, this will be reset. You have to select it again in
    your Preferences for the fix to be applied and the translations
    will then be shown.
  * Bug fixes:
    Echo: Suppress errors from frontend-metrics API call failing.
    Analytics: Fix ApplicationInsights integration.
    DashboardScene: Fixes issue removing override rule.
    BrowseDashboards: Prepend subpath to New Browse Dashboard
    actions.
    Alerting: Fix rule storage to filter by group names using
    case-sensitive comparison.
    RBAC: List only the folders that the user has access to.
    DashboardScene: Fixes lack of re-render when updating field
    override properties.
    DashboardScene: Fixes inspect with transforms issue.
    AzureMonitor: Fix bug detecting app insights queries.
    Access Control: Clean up permissions for deprovisioned data
    sources.
    Loki: Fix editor history in wrong order.
    SSE: Fix threshold unmarshal to avoid panic.
    LibraryPanels/RBAC: Ignore old folder permission check when
    deleting/patching lib panel.
    Dashboards: Correctly display Admin access to dashboards in the
    UI.
    LogsTable: Fix default sort by time.
    Alerting: Fix rules deleting when reordering whilst filtered.
    Alerting: Fix typo in JSON response for rule export.
    CloudMonitoring: Fix query type selection issue.
    Alerting: Fix scheduler to sort rules before evaluation.
    DashboardScene: Skip panel repeats when values are the same.
    Alerting: Do not store series values from past evaluations in
    state manager for no reason.
    DashboardScene: Fixing major row repeat issues.
    DashboardScene: Fixes checkbox orienation in save forms.
- Upgrade to version 11.0.0:
  * Breaking changes:
    AngularJS support is turned off by default.
    Legacy alerting is entirely removed.
    Subfolders cause very rare issues with folders which have
    slashes in their names.
    The input data source is removed.
    Data sources: Responses which are associated with hidden
    queries will be removed (filtered) by Grafana.
    The URL which is generated when viewing an individual repeated
    panel has changed.
    React Router is deprecated.
    The grafana/e2e testing tool is deprecated.
  * Features and enhancements:
    Introduced Explore Metrics (public preview) and Explore Logs
    (experimental).
    Introduced edit mode to provide an easier way to discover and
    interact with the dashboard edit exprerience.
    Fixed positioning of template variables and time picker.
    Introduced dashboard subfolders.
    Use AI to generate titles and descriptions for panels and
    dashboards.
    Canvas: Enhanced flowcharting functionality.
    Canvas: Universal data link support.
    Canvas: Added infinite panning editor option.
    Added colored table rows with conditional formatting.
    Set threshold colors in the Config from query transformation.
    Substring matcher added to the Filter by value transformation.
    Keep Last State for Grafana Managed Alerting.
    Redesigned alert detail view.
    The Alerting Provisioning HTTP API has been updated to enforce
    RBAC.
    Removed old Tempo Search and Loki Search.
    MSSQL: Windows Active Directory (Kerberos) authentication.
    New strong password policy.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748606400">- Drop patches:
  * 0002-Fix-msagl-and-remove-esfx.patch
  * 0004-Bump-glog.patch
  * 0005-Bump-jwt.patch
  * 0006-Bump-go-jose.patch
- Add patch:
  * 0002-Add-grafana-authlib-types.patch
- Require Go 1.24 or newer for building
- Update to version 11.5.5 (jsc#PED-12918):
  * Security:
    CVE-2025-4123: Fix cross-site scripting vulnerability
    (bsc#1243714).
    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    CVE-2025-3580: Prevent unauthorized server admin deletion
    (bsc#1243672).
- Update to version 11.5.4:
  * Security:
    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    CVE-2025-3454: Sanitize paths before evaluating access to route
    (bsc#1241683).
    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  * Features and enhancements:
    Azure Monitor: Filter namespaces by resource group.
    Azure: Add support for custom namespace and custom metrics
    variable queries.
    Azure: Resource picker improvements.
    Azure: Support more complex variable interpolation.
    Azure: Variable editor and resource picker improvements.
    DashboardScenePage: Correct slug in self referencing data
    links.
    Prometheus: Add support for cloud partners Prometheus data
    sources.
  * Bug fixes:
    InfluxDB: Fix nested variable interpolation.
    LDAP test: Fix page crash.
- Update to version 11.5.3:
  * Security:
    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  * Bug fixes:
    Alerting: Fix token-based Slack image upload to work with
    channel names.
    Auth: Fix AzureAD config UI's ClientAuthentication dropdown.
    Dashboard: Fix the unintentional time range and variables
    updates on saving.
    Dashboards: Fix missing v/e/i keybindings to return back to
    dashboard.
    InfluxDB: Improve handling of template variables contained in
    regular expressions (InfluxQL).
    Org redirection: Fix linking between orgs.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1749211200">- Exclude ix86 architectures. They are not supported and fail to
  build.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1752235200">- Update to version 11.5.6:
  * Security:
    CVE-2025-3415: Fix exposure of DingDing alerting integration
    URL to Viewer level users (bsc#1245302)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1753358400">- Update to version 11.5.7:
  * Security:
    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards
    (bsc#1246735)
    CVE-2025-6197: Fix open redirect in organization switching
    (bsc#1246736)
  * Bug fixes:
    Azure: Fix legend formatting.
    Azure: Fix resource name determination in template variable
    queries.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1759924800">- Drop 0002-Add-grafana-authlib-types.patch
- Update to version 11.5.9:
  * Security:
    CVE-2025-11065: Fix sensitive information leak in logs
    (bsc#1250616)
  * Features and enhancements:
    Auditing: Document new options for recording datasource query
    request/response body.
  * Bug fixes:
    Login: Fix redirection after login when Grafana is served from
    subpath.
- Update to version 11.5.8:
  * No relevant changes</changelog>
  <changelog author="witold.bedyk@suse.com" date="1761566400">- Use forked wire from Grafana repository instead of external
  package (jsc#PED-14178).
- Update to version 11.5.10:
  Security:
  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
  Features and enhancements:
  * Update to Go 1.25
  * Update to golang.org/x/net v0.45.0
  Bug fixes:
  * Auth: Fix render user OAuth passthrough.
  * LDAP Authentication: Fix URL to propagate username context as
    parameter.
  * Plugins: Dependencies do not inherit parent URL for preinstall.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1763985600">- Fix CVE-2025-64751: Drop experimental implementation of
  authorization Zanzana server/client (bsc#1254113)
- Add 0002-Drop-zanzana.patch
- Require gcc7-c++ for building</changelog>
  <changelog author="witold.bedyk@suse.com" date="1765281600">- Require gcc11-c++ for building with SLE 12 SP5</changelog>
  <changelog author="witold.bedyk@suse.com" date="1768564800">- CVE-2025-68156: Fix potential DoS via unbounded recursion in
  builtin functions (bsc#1255340)
- Add 0004-Bump-expr-lang.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1769688000">- CVE-2026-21721: Fix access control by the dashboard permissions
  API (bsc#1257337)
- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)
- Add patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Build only for SUSE distributions</changelog>
  <changelog author="witold.bedyk@suse.com" date="1771588800">- Update patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
- Drop patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Update to version 11.6.11:
  Features and enhancements:
  * Alerting: Add limits for the size of expanded notification
    templates
  * Correlations: Remove support for org_id=0
  Security:
  * CVE-2026-21722: Public dashboards annotations: use dashboard
    timerange if time selection disabled (bsc#1258136)
- Update to version 11.6.10:
  Features and enhancements:
  * API: Add missing scope check on dashboards
  * Avatar: Require sign-in, remove queue, respect timeout
  Bug fixes:
  * Alerting: Fix a race condition panic in ResetStateByRuleUID
  Security:
  * CVE-2025-30153: Fix Improper Handling of Highly Compressed Data
    (Data Amplification) in
    github.com/getkin/kin-openapi/openapi3filter
    (bsc#1264764)
- Update to version 11.6.9:
  Features and enhancements:
  * Plugins: Add PluginContext to plugins when scenes is disabled
  Bug fixes:
  * Alerting: Fix contacts point issues
- Update to version 11.6.8:
  Bug fixes:
  * Alerting: Fix unmarshalling of GettableStatus to include time
    intervals
- Update to version 11.6.7:
  Bug fixes:
  * Auth: Fix render user OAuth passthrough
  * LDAP Authentication: Fix URL to propagate username context as
    parameter
  * Plugins: Dependencies do not inherit parent URL for preinstall
  * URLParams: Stringify true values as key=true always (fixes
    issues with variables with true value)
- Update to version 11.6.6:
  Bug fixes:
  * Alerting: Fix copying of recording rule fields
  * Fix redirection after login when Grafana is served from subpath
- Update to version 11.6.5:
  Features and enhancements:
  * Alerting: Bump alerting package to include change to
    NewTLSClient
- Update to version 11.6.4:
  Features and enhancements:
  * StateTimeline: Add endTime to tooltip
  * Unified storage: Respect GF_DATABASE_URL override
  Bug fixes:
  * Alerting: Fix group interval override when adding new rules
  * Azure: Fix legend formatting
  * Azure: Fix resource name determination in template variable
    queries
  * Graphite: Fix annotation queries
  * Graphite: Fix date mutation
  * Graphite: Fix nested variable interpolation for repeated rows
- Update to version 11.6.3:
  Security:
  * Fixes CVE-2025-3415
- Update to version 11.6.2:
  Bug fixes:
  * Dashboard: Fixes issue with row repeats and first row
  * Graphite: Ensure template variables are interpolated correctly
  * Graphite: Fix Graphite series interpolation
  * Prometheus: Fix semver import path
- Update to version 11.6.1:
  Features and enhancements:
  * DashboardScenePage: Correct slug in self referencing data links
  * GrafanaUI: Use safePolygon close handler for interactive
    tooltips instead of a delay
  * Prometheus: Add support for cloud partners Prometheus data
    sources
  Bug fixes:
  * Alertmanager: Add Role-Based Access Control via reqAction Field
  * GrafanaUI: Remove blurred background from overlay backdrops to
    improve performance
  * InfluxDB: Fix nested variable interpolation
  * LDAP test: Fix page crash
  * Org redirection: Fix linking between orgs
  Security:
  * CVE-2025-29923: Fix potential out of order responses when
    `CLIENT SETINFO` times out during connection establishment
    (bsc#1259999)
- Upgrade to version 11.6.0:
  Features and enhancements:
  * Visualisations: One click links and actions
  * Annotations: Add cron syntax support
  * WebGL-powered geomaps for better performance
  * Alerting: Add alert rule version history
  Security:
  * API keys: Migrate API keys to service accounts at startup</changelog>
  <changelog author="witold.bedyk@suse.com" date="1772193600">- Drop support for SLE 12 (jsc#PED-15474)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1774958400">- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1
  (bsc#1258595)
  * Add 0005-Bump-edwards25519.patch
- CVE-2026-21725: Fix missing UID when deleting datasource by name
  (bsc#1258873)
  * Add 0006-Fix-CVE-2026-21725.patch
- Rebase 0002-Drop-zanzana.patch
- Update to version 11.6.14+security-01:
  Security:
  * CVE-2026-33375: Fix denial of Service via out-of-memory
    exhaustion in MSSQL data source plugin (bsc#1260881)
- Update to version 11.6.14:
  Security:
  * CVE-2026-27876: Fix remote arbitrary code execution via chained
    SQL Expressions (bsc#1261025)
  * CVE-2026-27877: Fix information disclosure of data-source
    passwords via public dashboards (bsc#1261026)
  * CVE-2026-28375: Fix denial of service via testdata data-source
    (bsc#1261029)
  * CVE-2026-27879: Fix denial of service via resample query
    (bsc#1261027)
  * CVE-2026-33186: Fix authorization bypass due to improper
    validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  * CVE-2026-21724: Fix authorization bypass allows modification of
    protected webhook URLs (bsc#1260878)
- Update to version 11.6.13:
  Enhancement:
  * Wire the public dashboard service to the HTTP server
- Update to version 11.6.12:
  Enhancement:
  * Update authentication redirect logic
  Bug fix:
  * Fix single panel render with variable references</changelog>
  <changelog author="witold.bedyk@suse.com" date="1777896000">- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
  * Add 0007-Bump-github.com-go-jose-go-jose.patch
- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability
  in Apache Thrift (bsc#1263501)
  * Add 0008-Bump-github.com-apache-thrift.patch
- CVE-2026-41607: Fix potential information disclosure in Apache
  Thrift (bsc#1263272)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780401600">- Update to version 11.6.14+security-04:
  Security:
  * CVE-2026-28374: Fix insecure direct object reference in
    Annotations API (bsc#1265290)
  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live
    push endpoint (bsc#1265289)
  * CVE-2026-28383: Fix unbounded memory allocation in Grafana
    plugin resources (bsc#1265286)
  * CVE-2026-28380: Fix broken access control in Snapshot API
    (bsc#1265287)
  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass
    (bsc#1265285)
  * CVE-2026-28379: Fix viewer-triggered race condition in
    Grafana Live (bsc#1265288)
  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation
    (bsc#1265284)
  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin
    (bsc#1265283)
  * CVE-2026-33381: Prevent users from generating Service Account
    tokens after permissions removal (bsc#1265281)
  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing
    an authenticated attacker to read arbitrary files from the
    Grafana server’s filesystem (bsc#1265282)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780660800">- CVE-2026-39821: Fix validation bypass and privilege escalation by
  updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  * Fix multiple issues when parsing HTML files (bsc#1267153):
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681,
    CVE-2026-42506
  * Added 0009-Bump-golang.org-x-net.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1783598400">- Require Go &gt;= 1.26 for building
- Add UI web assets as additional source tarball
- Update to version 12.4.5 (jsc#PED-16512):
  * Datasources: return 400 when payload UID does not match URL UID
    in PUT /api/datasources/uid/:uid
- Update to version 12.4.4:
  * Security and quality updates:
    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
    OTLP HTTP exporters by updating to v1.43.0.
    (bsc#1274217)
    CVE-2026-33382: Limit the size of the request body before
    processing it at several Grafana API endpoints
    (bsc#1271331)
    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
    CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
    public dashboard query endpoint (bsc#1268868)
    CVE-2026-9029: Fix arbitrary code execution and information
    disclosure via XSS in geomap panel (bsc#1272328)
    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
    updating golang.org/x/net (bsc#1265763)
    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
    route (bsc#1271330)
  * Various bug fixes and enhancements.
- Update to version 12.4.3:
  * Analytics: Keep internal dashboard id.
  * Go: Update to 1.25.9.
  * Reporting: Correctly apply appSubURL to report settings
    requests.
  * Alerting: Document Grafana HA Alertmanager cluster metrics
    prefix change.
- Update to version 12.4.2:
  * Various bug fixes and performance improvements.
  * Dependency updates to core plugins and UI libraries.
  * CVE-2026-1229: Update github.com/cloudflare/circl to fix
    producing incorect output for specific inputs
    (bsc#1265525)
- Update to version 12.4.1:
  * Bug fixes and minor quality-of-life enhancements.
  * Updates to data source provisioning and dashboard schemas.
- Update to version 12.4.0:
  * Introduced dynamic dashboards in public preview.
  * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
  * Added the ability to create dashboards from templates using
    sample data.
  * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
  * Added support to map one variable to multiple values.
  * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)
  * CVE-2026-21723: Fix DoS vulnerability in Templates Test
    endpoint (bsc#1272427)
- Update to version 12.3.0:
  * Released a completely redesigned logs visualization.
  * Added the ability to export dashboards directly as PNG images.
  * Introduced an interactive learning experience within the
    Grafana UI.
  * Added a Switch template variable type to quickly toggle between
    values in queries.
  * Added functionality to style table cells using CSS properties
    via the field cell option.
- Update to version 12.2.0:
  * Routine feature enhancements, minor bug fixes, and security
    patches.
- Update to version 12.1.0:
  * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
  * Redesigned the alert rule list page.
  * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
  * Added support for Service Account Impersonation in the BigQuery
    data source.
  * Introduced the Grafana Advisor in public preview.
- Update to version 12.0.0:
  * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
  * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
  * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
  * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
  * Introduced a new dashboard schema to replace the original
    single grid layout.
- Removed patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
  * 0006-Fix-CVE-2026-21725.patch
  * 0007-Bump-github.com-go-jose-go-jose.patch
  * 0008-Bump-github.com-apache-thrift.patch
  * 0009-Bump-golang.org-x-net.patch
- Rebased 0005-Bump-edwards25519.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1784030400">- Add Legal-Review-Notice (bsc#1271327)</changelog>
</package>
<package pkgid="d8704c116820dceef64c662535ef315698f920ce808eeef1a56aa54f8e95b119d62b7c765350136284364b5a7a583a55c836565706edbf5f60936b20aa485c02" name="grafana" arch="ppc64le">
  <version epoch="0" ver="12.4.5" rel="60003.3.1.uyuni"/>
  <changelog author="witold.bedyk@suse.com" date="1741608000">- CVE-2025-27144: Fix Go JOSE's Parsing Vulnerability (bsc#1237671)
  * Add 0003-Bump-go-jose.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748260800">- Update to version 11.5.2:
  * Bug fixes:
    Alerting: Allow specifying uid for new rules added to groups.
    Alerting: Call RLock() before reading sendAlertsTo map.
    Auth: Fix redirect with JWT auth URL login.
    AuthN: Refetch user on "ErrUserAlreadyExists".
    Azure: Correctly set application insights resource values.
    DashboardList: Throttle the re-renders.
    Dashboards: Bring back scripted dashboards.
    Plugin Metrics: Eliminate data race in plugin metrics
    middleware.
    RBAC: Don't check folder access if annotationPermissionUpdate
    FT is enabled.
- Update to version 11.5.1:
  * Bug fixes:
    CodeEditor: Fix cursor alignment.
    TransformationFilter: Include transformation outputs in
    transformation filtering options.
- Upgrade to version 11.5.0:
  * Breaking changes:
    Loki: Default to /labels API with query param instead of
    /series API.
  * Features and enhancements:
    Extended Cloud Migration Assistent support for plugins and
    alerts.
    Redesigned filters for dashboards.
    New regular expression option for Extract fields
    transformation.
    Redesigned sharing experience in Dashboards.
    Customizable shareable dashboard panel images.
    RBAC for alerting notifications and notification policies.
    Add support for Elasticsearch cross-cluster search.
    Time series macro support in visual query builder for SQL data
    sources.
    OAuth and SAML session handling improvements.
    Plugin Frontend Sandbox for additiona security.
    Renamed Public dashboards to Shared dashboards.
- Update to version 11.4.1:
  * Bug fixes:
    Alerting: AlertingQueryRunner should skip descendant nodes of
    invalid queries.
    Alerting: Fix alert rules unpausing after moving rule to
    different folder.
    Alerting: Fix label escaping in rule export.
    Alerting: Fix slack image uploading to use new api.
    Azure/GCM: Improve error display.
    Dashboards: Fix issue where filtered panels would not react to
    variable changes.
    Dashboards: Fixes issue with panel header showing even when
    hide time override was enabled.
    Dashboards: Fixes week relative time ranges when weekStart was
    changed.
    Dashboards: Panel react for timeFrom and timeShift changes
    using variables.
    DateTimePicker: Fixes issue with date picker showing invalid
    date.
    Fix: Add support for datasource variable queries.
    InfluxDB: Adhoc filters can use template vars as values.
    LibraryPanel: Fallback to panel title if library panel title is
    not set.
- Upgrade to version 11.4.0:
  * Features and enhancements:
    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.
- Update to version 11.3.1:
  * Features and enhancements:
    Alerting: Make context deadline on AlertNG service startup
    configurable.
    MigrationAssistant: Restrict dashboards, folders and
    datasources by the org id of the signed in
    user.
    User: Check SignedInUser OrgID in RevokeInvite.
  * Bug fixes:
    Alerting: Fix escaping of silence matchers in utf8 mode.
    Alerting: Fix overflow for long receiver names.
    Alerting: Fix saving advanced mode toggle state in the alert
    rule editor.
    Alerting: Fix setting datasource uid, when datasource is string
    in old version.
    Alerting: Force refetch prom rules when refreshing panel.
    Anonymous User: Adds validator service for anonymous users.
    Azure Monitor: Support metric namespaces fallback.
    Azure: Fix duplicated traces in multi-resource trace query.
    Azure: Handle namespace request rejection.
    CloudWatch: Interpolate region in log context query.
    Dashboard datasource: Return annotations as series when query
    topic is "annotations".
    Dashboard: Append orgId to URL.
    Dashboards: Fixes performance issue expanding a row.
    Flame Graph: Fix crash when it receives empty data.
    Folders: Add admin permissions upon creation of a folder w. SA.
    Folders: Don't show error pop-up if the user can't fetch the
    root folder.
    Migration: Remove table aliasing in delete statement to make it
    work for mariadb.
    ServerLock: Fix pg concurrency/locking issue.
    Service Accounts: Run service account creation in transaction.
    Table: Fix text wrapping applying to wrong field.
    Unified Storage: Use ssl_mode instead of sslmode.
- Update to version 11.3.0+security-01:
  * Security:
    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
- Upgrade to version 11.3.0:
  * Features and enhancements:
    View mode and Edit mode are generally available.
    Template variables and the time range picker remain visible
    when scrolling.
    Added timezone parameter in Grafana URL.
    Kiosk mode displays dashboard controls.
    Auto-formatted table cell values in Cell Inspect.
    Allow adding actions to canvas elements.
    Legend support in bar gauge visualizations.
    Apply the same binary transformation to all the number fields
    in a given table at once.
    Add support for data links and actions in several
    visualizations.
    The Explore Logs plugin is installed by default.
    Added correlations to external URLs in Explore.
    Simplified query section for alert rule creation.
    Introduced recording rules for Grafana-managed alerts.
    GitHub App authentication for the GitHub data source.
    Improved subfolder creation flow.
    Redesigned plugin details page.
    Added UI for LDAP configuration.
    Added RBAC support in Plugins.
- Update to version 11.2.2+security-01:
  * Bug fix:
    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)
- Update to version 11.2.2:
  * Features and enhancements:
    Data sources: Hide the datasource redirection banner for users
    who can't interact with data sources.
  * Bug fixes:
    Alerting: Fix preview of silences when label name contains
    spaces.
    Alerting: Make query wrapper match up datasource UIDs if
    necessary.
    AzureMonitor: Improve resource picker efficiency.
    AzureMonitor: Remove Basic Logs retention warning.
    CloudWatch: Fix segfault when migrating legacy queries.
    DashboardScene: Fix broken error handling and error rendering.
    Plugins: Avoid returning 404 for AutoEnabled apps.
- Update to version 11.2.1:
  * Features and enhancements:
    Alerting: Support for optimistic concurrency in priovisioning
    Tempate API.
    Logs panel: Enable displayedFields in dashboards and apps.
    State timeline: Add pagination support.
  * Bug fixes:
    Authn: No longer hash service account token twice during
    authentication.
    CloudMigrations: Fix snapshot creation on Windows systems.
    DashGPT: Fixes issue with generation on Safari.
    Dashboard: Fix Annotation runtime error when a data source does
    not support annotations.
    Grafana SQL: Fix broken import in NumberInput component.
    Logs: Show older logs button when infinite scroll is enabled
    and sort order is descending.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Templating: Fix searching non-latin template variables.
- Upgrade to version 11.2.0:
  * Features and enhancements:
    Grafana Cloud Migration Assistant is in public preview.
    Added navigation bookmarks.
    Added template variables support in some transformations.
    Introduced Transpose transformation.
    Group to nested tables is now generally available.
    Format string transformation is now generally available.
    New cumulative and window calculations available in Add field
    from calculation.
    Canvas: Standardized tooltips.
    Canvas: Allow adding data links without using an override.
    Canvas: Allow opening data links with a single click.
    Canvas: Add the ability to control the order in which data
    links are displayed.
    Added pagination support for state timeline.
    Centralized alert history page.
    Grafana Explore now allows for logs filtering and pinning in
    content outline.
    Added forward direction search for Loki.
    Added Cloudwatch Metric Insights cross account observability
    support.
    Added Yugabyte data source.
    Map org-specific user roles from your OAuth provider.
    Better SAML integration for Azure AD.
    API support for LDAP configuration (experimental).
    OpenID Connect Discovery URL for Generic OAuth.
- Update to version 11.1.5:
  * Bug fixes:
    Alerting: Fix permissions for prometheus rule endpoints.
    Alerting: Fix persisting result fingerprint that is used by
    recovery threshold.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Snapshots: Fix panic when snapshot_remove_expired is true.
    VizTooltip: Fix positioning at bottom and right edges on
    mobile.
    Plugins: Fix QueryField typeahead missing background color.
- Update to version 11.1.3:
  * Bug fix:
    RBAC: Allow plugins to use scoped actions.
- Update to version 11.1.1:
  * Bug fixes:
    Alerting: Skip fetching alerts for unsaved dashboards.
    Alerting: Support utf8_strict_mode: false in Mimir.
    Scenes: Fixes issue with panel repeat height calculation.
    Table Panel: Fix Image hover without datalinks.
    Tempo: Fix grpc streaming support over pdc-agent.
    RBAC: Allow plugins to use scoped actions.
- Upgrade to version 11.1.0:
  * Security:
    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  * Features and improvements:
    Allow table cell text wrapping.
    Added stat visualization percent change color mode options.
    XA chart is generally available.
    Redesigned settings page for Alerting.
    Added alerting template selector.
    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.
    Improved paused alert visibility.
    Rule-specific silences with permissions.
    Support for AWS SNS integration in Grafana-managed alerts.
    Added GeoMap and panel shortcut keyboard support.
    Accessability headings improvements.
    Added reduced motion support.
- Update to version 11.0.1:
  * Breaking changes:
    If you had selected your language as "Português Brasileiro"
    previously, this will be reset. You have to select it again in
    your Preferences for the fix to be applied and the translations
    will then be shown.
  * Bug fixes:
    Echo: Suppress errors from frontend-metrics API call failing.
    Analytics: Fix ApplicationInsights integration.
    DashboardScene: Fixes issue removing override rule.
    BrowseDashboards: Prepend subpath to New Browse Dashboard
    actions.
    Alerting: Fix rule storage to filter by group names using
    case-sensitive comparison.
    RBAC: List only the folders that the user has access to.
    DashboardScene: Fixes lack of re-render when updating field
    override properties.
    DashboardScene: Fixes inspect with transforms issue.
    AzureMonitor: Fix bug detecting app insights queries.
    Access Control: Clean up permissions for deprovisioned data
    sources.
    Loki: Fix editor history in wrong order.
    SSE: Fix threshold unmarshal to avoid panic.
    LibraryPanels/RBAC: Ignore old folder permission check when
    deleting/patching lib panel.
    Dashboards: Correctly display Admin access to dashboards in the
    UI.
    LogsTable: Fix default sort by time.
    Alerting: Fix rules deleting when reordering whilst filtered.
    Alerting: Fix typo in JSON response for rule export.
    CloudMonitoring: Fix query type selection issue.
    Alerting: Fix scheduler to sort rules before evaluation.
    DashboardScene: Skip panel repeats when values are the same.
    Alerting: Do not store series values from past evaluations in
    state manager for no reason.
    DashboardScene: Fixing major row repeat issues.
    DashboardScene: Fixes checkbox orienation in save forms.
- Upgrade to version 11.0.0:
  * Breaking changes:
    AngularJS support is turned off by default.
    Legacy alerting is entirely removed.
    Subfolders cause very rare issues with folders which have
    slashes in their names.
    The input data source is removed.
    Data sources: Responses which are associated with hidden
    queries will be removed (filtered) by Grafana.
    The URL which is generated when viewing an individual repeated
    panel has changed.
    React Router is deprecated.
    The grafana/e2e testing tool is deprecated.
  * Features and enhancements:
    Introduced Explore Metrics (public preview) and Explore Logs
    (experimental).
    Introduced edit mode to provide an easier way to discover and
    interact with the dashboard edit exprerience.
    Fixed positioning of template variables and time picker.
    Introduced dashboard subfolders.
    Use AI to generate titles and descriptions for panels and
    dashboards.
    Canvas: Enhanced flowcharting functionality.
    Canvas: Universal data link support.
    Canvas: Added infinite panning editor option.
    Added colored table rows with conditional formatting.
    Set threshold colors in the Config from query transformation.
    Substring matcher added to the Filter by value transformation.
    Keep Last State for Grafana Managed Alerting.
    Redesigned alert detail view.
    The Alerting Provisioning HTTP API has been updated to enforce
    RBAC.
    Removed old Tempo Search and Loki Search.
    MSSQL: Windows Active Directory (Kerberos) authentication.
    New strong password policy.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748606400">- Drop patches:
  * 0002-Fix-msagl-and-remove-esfx.patch
  * 0004-Bump-glog.patch
  * 0005-Bump-jwt.patch
  * 0006-Bump-go-jose.patch
- Add patch:
  * 0002-Add-grafana-authlib-types.patch
- Require Go 1.24 or newer for building
- Update to version 11.5.5 (jsc#PED-12918):
  * Security:
    CVE-2025-4123: Fix cross-site scripting vulnerability
    (bsc#1243714).
    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    CVE-2025-3580: Prevent unauthorized server admin deletion
    (bsc#1243672).
- Update to version 11.5.4:
  * Security:
    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    CVE-2025-3454: Sanitize paths before evaluating access to route
    (bsc#1241683).
    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  * Features and enhancements:
    Azure Monitor: Filter namespaces by resource group.
    Azure: Add support for custom namespace and custom metrics
    variable queries.
    Azure: Resource picker improvements.
    Azure: Support more complex variable interpolation.
    Azure: Variable editor and resource picker improvements.
    DashboardScenePage: Correct slug in self referencing data
    links.
    Prometheus: Add support for cloud partners Prometheus data
    sources.
  * Bug fixes:
    InfluxDB: Fix nested variable interpolation.
    LDAP test: Fix page crash.
- Update to version 11.5.3:
  * Security:
    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  * Bug fixes:
    Alerting: Fix token-based Slack image upload to work with
    channel names.
    Auth: Fix AzureAD config UI's ClientAuthentication dropdown.
    Dashboard: Fix the unintentional time range and variables
    updates on saving.
    Dashboards: Fix missing v/e/i keybindings to return back to
    dashboard.
    InfluxDB: Improve handling of template variables contained in
    regular expressions (InfluxQL).
    Org redirection: Fix linking between orgs.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1749211200">- Exclude ix86 architectures. They are not supported and fail to
  build.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1752235200">- Update to version 11.5.6:
  * Security:
    CVE-2025-3415: Fix exposure of DingDing alerting integration
    URL to Viewer level users (bsc#1245302)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1753358400">- Update to version 11.5.7:
  * Security:
    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards
    (bsc#1246735)
    CVE-2025-6197: Fix open redirect in organization switching
    (bsc#1246736)
  * Bug fixes:
    Azure: Fix legend formatting.
    Azure: Fix resource name determination in template variable
    queries.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1759924800">- Drop 0002-Add-grafana-authlib-types.patch
- Update to version 11.5.9:
  * Security:
    CVE-2025-11065: Fix sensitive information leak in logs
    (bsc#1250616)
  * Features and enhancements:
    Auditing: Document new options for recording datasource query
    request/response body.
  * Bug fixes:
    Login: Fix redirection after login when Grafana is served from
    subpath.
- Update to version 11.5.8:
  * No relevant changes</changelog>
  <changelog author="witold.bedyk@suse.com" date="1761566400">- Use forked wire from Grafana repository instead of external
  package (jsc#PED-14178).
- Update to version 11.5.10:
  Security:
  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
  Features and enhancements:
  * Update to Go 1.25
  * Update to golang.org/x/net v0.45.0
  Bug fixes:
  * Auth: Fix render user OAuth passthrough.
  * LDAP Authentication: Fix URL to propagate username context as
    parameter.
  * Plugins: Dependencies do not inherit parent URL for preinstall.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1763985600">- Fix CVE-2025-64751: Drop experimental implementation of
  authorization Zanzana server/client (bsc#1254113)
- Add 0002-Drop-zanzana.patch
- Require gcc7-c++ for building</changelog>
  <changelog author="witold.bedyk@suse.com" date="1765281600">- Require gcc11-c++ for building with SLE 12 SP5</changelog>
  <changelog author="witold.bedyk@suse.com" date="1768564800">- CVE-2025-68156: Fix potential DoS via unbounded recursion in
  builtin functions (bsc#1255340)
- Add 0004-Bump-expr-lang.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1769688000">- CVE-2026-21721: Fix access control by the dashboard permissions
  API (bsc#1257337)
- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)
- Add patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Build only for SUSE distributions</changelog>
  <changelog author="witold.bedyk@suse.com" date="1771588800">- Update patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
- Drop patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Update to version 11.6.11:
  Features and enhancements:
  * Alerting: Add limits for the size of expanded notification
    templates
  * Correlations: Remove support for org_id=0
  Security:
  * CVE-2026-21722: Public dashboards annotations: use dashboard
    timerange if time selection disabled (bsc#1258136)
- Update to version 11.6.10:
  Features and enhancements:
  * API: Add missing scope check on dashboards
  * Avatar: Require sign-in, remove queue, respect timeout
  Bug fixes:
  * Alerting: Fix a race condition panic in ResetStateByRuleUID
  Security:
  * CVE-2025-30153: Fix Improper Handling of Highly Compressed Data
    (Data Amplification) in
    github.com/getkin/kin-openapi/openapi3filter
    (bsc#1264764)
- Update to version 11.6.9:
  Features and enhancements:
  * Plugins: Add PluginContext to plugins when scenes is disabled
  Bug fixes:
  * Alerting: Fix contacts point issues
- Update to version 11.6.8:
  Bug fixes:
  * Alerting: Fix unmarshalling of GettableStatus to include time
    intervals
- Update to version 11.6.7:
  Bug fixes:
  * Auth: Fix render user OAuth passthrough
  * LDAP Authentication: Fix URL to propagate username context as
    parameter
  * Plugins: Dependencies do not inherit parent URL for preinstall
  * URLParams: Stringify true values as key=true always (fixes
    issues with variables with true value)
- Update to version 11.6.6:
  Bug fixes:
  * Alerting: Fix copying of recording rule fields
  * Fix redirection after login when Grafana is served from subpath
- Update to version 11.6.5:
  Features and enhancements:
  * Alerting: Bump alerting package to include change to
    NewTLSClient
- Update to version 11.6.4:
  Features and enhancements:
  * StateTimeline: Add endTime to tooltip
  * Unified storage: Respect GF_DATABASE_URL override
  Bug fixes:
  * Alerting: Fix group interval override when adding new rules
  * Azure: Fix legend formatting
  * Azure: Fix resource name determination in template variable
    queries
  * Graphite: Fix annotation queries
  * Graphite: Fix date mutation
  * Graphite: Fix nested variable interpolation for repeated rows
- Update to version 11.6.3:
  Security:
  * Fixes CVE-2025-3415
- Update to version 11.6.2:
  Bug fixes:
  * Dashboard: Fixes issue with row repeats and first row
  * Graphite: Ensure template variables are interpolated correctly
  * Graphite: Fix Graphite series interpolation
  * Prometheus: Fix semver import path
- Update to version 11.6.1:
  Features and enhancements:
  * DashboardScenePage: Correct slug in self referencing data links
  * GrafanaUI: Use safePolygon close handler for interactive
    tooltips instead of a delay
  * Prometheus: Add support for cloud partners Prometheus data
    sources
  Bug fixes:
  * Alertmanager: Add Role-Based Access Control via reqAction Field
  * GrafanaUI: Remove blurred background from overlay backdrops to
    improve performance
  * InfluxDB: Fix nested variable interpolation
  * LDAP test: Fix page crash
  * Org redirection: Fix linking between orgs
  Security:
  * CVE-2025-29923: Fix potential out of order responses when
    `CLIENT SETINFO` times out during connection establishment
    (bsc#1259999)
- Upgrade to version 11.6.0:
  Features and enhancements:
  * Visualisations: One click links and actions
  * Annotations: Add cron syntax support
  * WebGL-powered geomaps for better performance
  * Alerting: Add alert rule version history
  Security:
  * API keys: Migrate API keys to service accounts at startup</changelog>
  <changelog author="witold.bedyk@suse.com" date="1772193600">- Drop support for SLE 12 (jsc#PED-15474)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1774958400">- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1
  (bsc#1258595)
  * Add 0005-Bump-edwards25519.patch
- CVE-2026-21725: Fix missing UID when deleting datasource by name
  (bsc#1258873)
  * Add 0006-Fix-CVE-2026-21725.patch
- Rebase 0002-Drop-zanzana.patch
- Update to version 11.6.14+security-01:
  Security:
  * CVE-2026-33375: Fix denial of Service via out-of-memory
    exhaustion in MSSQL data source plugin (bsc#1260881)
- Update to version 11.6.14:
  Security:
  * CVE-2026-27876: Fix remote arbitrary code execution via chained
    SQL Expressions (bsc#1261025)
  * CVE-2026-27877: Fix information disclosure of data-source
    passwords via public dashboards (bsc#1261026)
  * CVE-2026-28375: Fix denial of service via testdata data-source
    (bsc#1261029)
  * CVE-2026-27879: Fix denial of service via resample query
    (bsc#1261027)
  * CVE-2026-33186: Fix authorization bypass due to improper
    validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  * CVE-2026-21724: Fix authorization bypass allows modification of
    protected webhook URLs (bsc#1260878)
- Update to version 11.6.13:
  Enhancement:
  * Wire the public dashboard service to the HTTP server
- Update to version 11.6.12:
  Enhancement:
  * Update authentication redirect logic
  Bug fix:
  * Fix single panel render with variable references</changelog>
  <changelog author="witold.bedyk@suse.com" date="1777896000">- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
  * Add 0007-Bump-github.com-go-jose-go-jose.patch
- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability
  in Apache Thrift (bsc#1263501)
  * Add 0008-Bump-github.com-apache-thrift.patch
- CVE-2026-41607: Fix potential information disclosure in Apache
  Thrift (bsc#1263272)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780401600">- Update to version 11.6.14+security-04:
  Security:
  * CVE-2026-28374: Fix insecure direct object reference in
    Annotations API (bsc#1265290)
  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live
    push endpoint (bsc#1265289)
  * CVE-2026-28383: Fix unbounded memory allocation in Grafana
    plugin resources (bsc#1265286)
  * CVE-2026-28380: Fix broken access control in Snapshot API
    (bsc#1265287)
  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass
    (bsc#1265285)
  * CVE-2026-28379: Fix viewer-triggered race condition in
    Grafana Live (bsc#1265288)
  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation
    (bsc#1265284)
  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin
    (bsc#1265283)
  * CVE-2026-33381: Prevent users from generating Service Account
    tokens after permissions removal (bsc#1265281)
  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing
    an authenticated attacker to read arbitrary files from the
    Grafana server’s filesystem (bsc#1265282)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780660800">- CVE-2026-39821: Fix validation bypass and privilege escalation by
  updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  * Fix multiple issues when parsing HTML files (bsc#1267153):
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681,
    CVE-2026-42506
  * Added 0009-Bump-golang.org-x-net.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1783598400">- Require Go &gt;= 1.26 for building
- Add UI web assets as additional source tarball
- Update to version 12.4.5 (jsc#PED-16512):
  * Datasources: return 400 when payload UID does not match URL UID
    in PUT /api/datasources/uid/:uid
- Update to version 12.4.4:
  * Security and quality updates:
    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
    OTLP HTTP exporters by updating to v1.43.0.
    (bsc#1274217)
    CVE-2026-33382: Limit the size of the request body before
    processing it at several Grafana API endpoints
    (bsc#1271331)
    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
    CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
    public dashboard query endpoint (bsc#1268868)
    CVE-2026-9029: Fix arbitrary code execution and information
    disclosure via XSS in geomap panel (bsc#1272328)
    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
    updating golang.org/x/net (bsc#1265763)
    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
    route (bsc#1271330)
  * Various bug fixes and enhancements.
- Update to version 12.4.3:
  * Analytics: Keep internal dashboard id.
  * Go: Update to 1.25.9.
  * Reporting: Correctly apply appSubURL to report settings
    requests.
  * Alerting: Document Grafana HA Alertmanager cluster metrics
    prefix change.
- Update to version 12.4.2:
  * Various bug fixes and performance improvements.
  * Dependency updates to core plugins and UI libraries.
  * CVE-2026-1229: Update github.com/cloudflare/circl to fix
    producing incorect output for specific inputs
    (bsc#1265525)
- Update to version 12.4.1:
  * Bug fixes and minor quality-of-life enhancements.
  * Updates to data source provisioning and dashboard schemas.
- Update to version 12.4.0:
  * Introduced dynamic dashboards in public preview.
  * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
  * Added the ability to create dashboards from templates using
    sample data.
  * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
  * Added support to map one variable to multiple values.
  * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)
  * CVE-2026-21723: Fix DoS vulnerability in Templates Test
    endpoint (bsc#1272427)
- Update to version 12.3.0:
  * Released a completely redesigned logs visualization.
  * Added the ability to export dashboards directly as PNG images.
  * Introduced an interactive learning experience within the
    Grafana UI.
  * Added a Switch template variable type to quickly toggle between
    values in queries.
  * Added functionality to style table cells using CSS properties
    via the field cell option.
- Update to version 12.2.0:
  * Routine feature enhancements, minor bug fixes, and security
    patches.
- Update to version 12.1.0:
  * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
  * Redesigned the alert rule list page.
  * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
  * Added support for Service Account Impersonation in the BigQuery
    data source.
  * Introduced the Grafana Advisor in public preview.
- Update to version 12.0.0:
  * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
  * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
  * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
  * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
  * Introduced a new dashboard schema to replace the original
    single grid layout.
- Removed patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
  * 0006-Fix-CVE-2026-21725.patch
  * 0007-Bump-github.com-go-jose-go-jose.patch
  * 0008-Bump-github.com-apache-thrift.patch
  * 0009-Bump-golang.org-x-net.patch
- Rebased 0005-Bump-edwards25519.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1784030400">- Add Legal-Review-Notice (bsc#1271327)</changelog>
</package>
<package pkgid="e77cbe78d8c5e4815b6b028a86d327e476229611250df13f849c354460c46b0c3042e706fb64c409aad8a5e0b8d7940c9f01febf877716f1224766d5a1dc6a42" name="grafana" arch="s390x">
  <version epoch="0" ver="12.4.5" rel="60003.3.1.uyuni"/>
  <changelog author="witold.bedyk@suse.com" date="1741608000">- CVE-2025-27144: Fix Go JOSE's Parsing Vulnerability (bsc#1237671)
  * Add 0003-Bump-go-jose.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748260800">- Update to version 11.5.2:
  * Bug fixes:
    Alerting: Allow specifying uid for new rules added to groups.
    Alerting: Call RLock() before reading sendAlertsTo map.
    Auth: Fix redirect with JWT auth URL login.
    AuthN: Refetch user on "ErrUserAlreadyExists".
    Azure: Correctly set application insights resource values.
    DashboardList: Throttle the re-renders.
    Dashboards: Bring back scripted dashboards.
    Plugin Metrics: Eliminate data race in plugin metrics
    middleware.
    RBAC: Don't check folder access if annotationPermissionUpdate
    FT is enabled.
- Update to version 11.5.1:
  * Bug fixes:
    CodeEditor: Fix cursor alignment.
    TransformationFilter: Include transformation outputs in
    transformation filtering options.
- Upgrade to version 11.5.0:
  * Breaking changes:
    Loki: Default to /labels API with query param instead of
    /series API.
  * Features and enhancements:
    Extended Cloud Migration Assistent support for plugins and
    alerts.
    Redesigned filters for dashboards.
    New regular expression option for Extract fields
    transformation.
    Redesigned sharing experience in Dashboards.
    Customizable shareable dashboard panel images.
    RBAC for alerting notifications and notification policies.
    Add support for Elasticsearch cross-cluster search.
    Time series macro support in visual query builder for SQL data
    sources.
    OAuth and SAML session handling improvements.
    Plugin Frontend Sandbox for additiona security.
    Renamed Public dashboards to Shared dashboards.
- Update to version 11.4.1:
  * Bug fixes:
    Alerting: AlertingQueryRunner should skip descendant nodes of
    invalid queries.
    Alerting: Fix alert rules unpausing after moving rule to
    different folder.
    Alerting: Fix label escaping in rule export.
    Alerting: Fix slack image uploading to use new api.
    Azure/GCM: Improve error display.
    Dashboards: Fix issue where filtered panels would not react to
    variable changes.
    Dashboards: Fixes issue with panel header showing even when
    hide time override was enabled.
    Dashboards: Fixes week relative time ranges when weekStart was
    changed.
    Dashboards: Panel react for timeFrom and timeShift changes
    using variables.
    DateTimePicker: Fixes issue with date picker showing invalid
    date.
    Fix: Add support for datasource variable queries.
    InfluxDB: Adhoc filters can use template vars as values.
    LibraryPanel: Fallback to panel title if library panel title is
    not set.
- Upgrade to version 11.4.0:
  * Features and enhancements:
    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.
- Update to version 11.3.1:
  * Features and enhancements:
    Alerting: Make context deadline on AlertNG service startup
    configurable.
    MigrationAssistant: Restrict dashboards, folders and
    datasources by the org id of the signed in
    user.
    User: Check SignedInUser OrgID in RevokeInvite.
  * Bug fixes:
    Alerting: Fix escaping of silence matchers in utf8 mode.
    Alerting: Fix overflow for long receiver names.
    Alerting: Fix saving advanced mode toggle state in the alert
    rule editor.
    Alerting: Fix setting datasource uid, when datasource is string
    in old version.
    Alerting: Force refetch prom rules when refreshing panel.
    Anonymous User: Adds validator service for anonymous users.
    Azure Monitor: Support metric namespaces fallback.
    Azure: Fix duplicated traces in multi-resource trace query.
    Azure: Handle namespace request rejection.
    CloudWatch: Interpolate region in log context query.
    Dashboard datasource: Return annotations as series when query
    topic is "annotations".
    Dashboard: Append orgId to URL.
    Dashboards: Fixes performance issue expanding a row.
    Flame Graph: Fix crash when it receives empty data.
    Folders: Add admin permissions upon creation of a folder w. SA.
    Folders: Don't show error pop-up if the user can't fetch the
    root folder.
    Migration: Remove table aliasing in delete statement to make it
    work for mariadb.
    ServerLock: Fix pg concurrency/locking issue.
    Service Accounts: Run service account creation in transaction.
    Table: Fix text wrapping applying to wrong field.
    Unified Storage: Use ssl_mode instead of sslmode.
- Update to version 11.3.0+security-01:
  * Security:
    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
- Upgrade to version 11.3.0:
  * Features and enhancements:
    View mode and Edit mode are generally available.
    Template variables and the time range picker remain visible
    when scrolling.
    Added timezone parameter in Grafana URL.
    Kiosk mode displays dashboard controls.
    Auto-formatted table cell values in Cell Inspect.
    Allow adding actions to canvas elements.
    Legend support in bar gauge visualizations.
    Apply the same binary transformation to all the number fields
    in a given table at once.
    Add support for data links and actions in several
    visualizations.
    The Explore Logs plugin is installed by default.
    Added correlations to external URLs in Explore.
    Simplified query section for alert rule creation.
    Introduced recording rules for Grafana-managed alerts.
    GitHub App authentication for the GitHub data source.
    Improved subfolder creation flow.
    Redesigned plugin details page.
    Added UI for LDAP configuration.
    Added RBAC support in Plugins.
- Update to version 11.2.2+security-01:
  * Bug fix:
    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)
- Update to version 11.2.2:
  * Features and enhancements:
    Data sources: Hide the datasource redirection banner for users
    who can't interact with data sources.
  * Bug fixes:
    Alerting: Fix preview of silences when label name contains
    spaces.
    Alerting: Make query wrapper match up datasource UIDs if
    necessary.
    AzureMonitor: Improve resource picker efficiency.
    AzureMonitor: Remove Basic Logs retention warning.
    CloudWatch: Fix segfault when migrating legacy queries.
    DashboardScene: Fix broken error handling and error rendering.
    Plugins: Avoid returning 404 for AutoEnabled apps.
- Update to version 11.2.1:
  * Features and enhancements:
    Alerting: Support for optimistic concurrency in priovisioning
    Tempate API.
    Logs panel: Enable displayedFields in dashboards and apps.
    State timeline: Add pagination support.
  * Bug fixes:
    Authn: No longer hash service account token twice during
    authentication.
    CloudMigrations: Fix snapshot creation on Windows systems.
    DashGPT: Fixes issue with generation on Safari.
    Dashboard: Fix Annotation runtime error when a data source does
    not support annotations.
    Grafana SQL: Fix broken import in NumberInput component.
    Logs: Show older logs button when infinite scroll is enabled
    and sort order is descending.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Templating: Fix searching non-latin template variables.
- Upgrade to version 11.2.0:
  * Features and enhancements:
    Grafana Cloud Migration Assistant is in public preview.
    Added navigation bookmarks.
    Added template variables support in some transformations.
    Introduced Transpose transformation.
    Group to nested tables is now generally available.
    Format string transformation is now generally available.
    New cumulative and window calculations available in Add field
    from calculation.
    Canvas: Standardized tooltips.
    Canvas: Allow adding data links without using an override.
    Canvas: Allow opening data links with a single click.
    Canvas: Add the ability to control the order in which data
    links are displayed.
    Added pagination support for state timeline.
    Centralized alert history page.
    Grafana Explore now allows for logs filtering and pinning in
    content outline.
    Added forward direction search for Loki.
    Added Cloudwatch Metric Insights cross account observability
    support.
    Added Yugabyte data source.
    Map org-specific user roles from your OAuth provider.
    Better SAML integration for Azure AD.
    API support for LDAP configuration (experimental).
    OpenID Connect Discovery URL for Generic OAuth.
- Update to version 11.1.5:
  * Bug fixes:
    Alerting: Fix permissions for prometheus rule endpoints.
    Alerting: Fix persisting result fingerprint that is used by
    recovery threshold.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Snapshots: Fix panic when snapshot_remove_expired is true.
    VizTooltip: Fix positioning at bottom and right edges on
    mobile.
    Plugins: Fix QueryField typeahead missing background color.
- Update to version 11.1.3:
  * Bug fix:
    RBAC: Allow plugins to use scoped actions.
- Update to version 11.1.1:
  * Bug fixes:
    Alerting: Skip fetching alerts for unsaved dashboards.
    Alerting: Support utf8_strict_mode: false in Mimir.
    Scenes: Fixes issue with panel repeat height calculation.
    Table Panel: Fix Image hover without datalinks.
    Tempo: Fix grpc streaming support over pdc-agent.
    RBAC: Allow plugins to use scoped actions.
- Upgrade to version 11.1.0:
  * Security:
    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  * Features and improvements:
    Allow table cell text wrapping.
    Added stat visualization percent change color mode options.
    XA chart is generally available.
    Redesigned settings page for Alerting.
    Added alerting template selector.
    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.
    Improved paused alert visibility.
    Rule-specific silences with permissions.
    Support for AWS SNS integration in Grafana-managed alerts.
    Added GeoMap and panel shortcut keyboard support.
    Accessability headings improvements.
    Added reduced motion support.
- Update to version 11.0.1:
  * Breaking changes:
    If you had selected your language as "Português Brasileiro"
    previously, this will be reset. You have to select it again in
    your Preferences for the fix to be applied and the translations
    will then be shown.
  * Bug fixes:
    Echo: Suppress errors from frontend-metrics API call failing.
    Analytics: Fix ApplicationInsights integration.
    DashboardScene: Fixes issue removing override rule.
    BrowseDashboards: Prepend subpath to New Browse Dashboard
    actions.
    Alerting: Fix rule storage to filter by group names using
    case-sensitive comparison.
    RBAC: List only the folders that the user has access to.
    DashboardScene: Fixes lack of re-render when updating field
    override properties.
    DashboardScene: Fixes inspect with transforms issue.
    AzureMonitor: Fix bug detecting app insights queries.
    Access Control: Clean up permissions for deprovisioned data
    sources.
    Loki: Fix editor history in wrong order.
    SSE: Fix threshold unmarshal to avoid panic.
    LibraryPanels/RBAC: Ignore old folder permission check when
    deleting/patching lib panel.
    Dashboards: Correctly display Admin access to dashboards in the
    UI.
    LogsTable: Fix default sort by time.
    Alerting: Fix rules deleting when reordering whilst filtered.
    Alerting: Fix typo in JSON response for rule export.
    CloudMonitoring: Fix query type selection issue.
    Alerting: Fix scheduler to sort rules before evaluation.
    DashboardScene: Skip panel repeats when values are the same.
    Alerting: Do not store series values from past evaluations in
    state manager for no reason.
    DashboardScene: Fixing major row repeat issues.
    DashboardScene: Fixes checkbox orienation in save forms.
- Upgrade to version 11.0.0:
  * Breaking changes:
    AngularJS support is turned off by default.
    Legacy alerting is entirely removed.
    Subfolders cause very rare issues with folders which have
    slashes in their names.
    The input data source is removed.
    Data sources: Responses which are associated with hidden
    queries will be removed (filtered) by Grafana.
    The URL which is generated when viewing an individual repeated
    panel has changed.
    React Router is deprecated.
    The grafana/e2e testing tool is deprecated.
  * Features and enhancements:
    Introduced Explore Metrics (public preview) and Explore Logs
    (experimental).
    Introduced edit mode to provide an easier way to discover and
    interact with the dashboard edit exprerience.
    Fixed positioning of template variables and time picker.
    Introduced dashboard subfolders.
    Use AI to generate titles and descriptions for panels and
    dashboards.
    Canvas: Enhanced flowcharting functionality.
    Canvas: Universal data link support.
    Canvas: Added infinite panning editor option.
    Added colored table rows with conditional formatting.
    Set threshold colors in the Config from query transformation.
    Substring matcher added to the Filter by value transformation.
    Keep Last State for Grafana Managed Alerting.
    Redesigned alert detail view.
    The Alerting Provisioning HTTP API has been updated to enforce
    RBAC.
    Removed old Tempo Search and Loki Search.
    MSSQL: Windows Active Directory (Kerberos) authentication.
    New strong password policy.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748606400">- Drop patches:
  * 0002-Fix-msagl-and-remove-esfx.patch
  * 0004-Bump-glog.patch
  * 0005-Bump-jwt.patch
  * 0006-Bump-go-jose.patch
- Add patch:
  * 0002-Add-grafana-authlib-types.patch
- Require Go 1.24 or newer for building
- Update to version 11.5.5 (jsc#PED-12918):
  * Security:
    CVE-2025-4123: Fix cross-site scripting vulnerability
    (bsc#1243714).
    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    CVE-2025-3580: Prevent unauthorized server admin deletion
    (bsc#1243672).
- Update to version 11.5.4:
  * Security:
    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    CVE-2025-3454: Sanitize paths before evaluating access to route
    (bsc#1241683).
    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  * Features and enhancements:
    Azure Monitor: Filter namespaces by resource group.
    Azure: Add support for custom namespace and custom metrics
    variable queries.
    Azure: Resource picker improvements.
    Azure: Support more complex variable interpolation.
    Azure: Variable editor and resource picker improvements.
    DashboardScenePage: Correct slug in self referencing data
    links.
    Prometheus: Add support for cloud partners Prometheus data
    sources.
  * Bug fixes:
    InfluxDB: Fix nested variable interpolation.
    LDAP test: Fix page crash.
- Update to version 11.5.3:
  * Security:
    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  * Bug fixes:
    Alerting: Fix token-based Slack image upload to work with
    channel names.
    Auth: Fix AzureAD config UI's ClientAuthentication dropdown.
    Dashboard: Fix the unintentional time range and variables
    updates on saving.
    Dashboards: Fix missing v/e/i keybindings to return back to
    dashboard.
    InfluxDB: Improve handling of template variables contained in
    regular expressions (InfluxQL).
    Org redirection: Fix linking between orgs.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1749211200">- Exclude ix86 architectures. They are not supported and fail to
  build.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1752235200">- Update to version 11.5.6:
  * Security:
    CVE-2025-3415: Fix exposure of DingDing alerting integration
    URL to Viewer level users (bsc#1245302)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1753358400">- Update to version 11.5.7:
  * Security:
    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards
    (bsc#1246735)
    CVE-2025-6197: Fix open redirect in organization switching
    (bsc#1246736)
  * Bug fixes:
    Azure: Fix legend formatting.
    Azure: Fix resource name determination in template variable
    queries.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1759924800">- Drop 0002-Add-grafana-authlib-types.patch
- Update to version 11.5.9:
  * Security:
    CVE-2025-11065: Fix sensitive information leak in logs
    (bsc#1250616)
  * Features and enhancements:
    Auditing: Document new options for recording datasource query
    request/response body.
  * Bug fixes:
    Login: Fix redirection after login when Grafana is served from
    subpath.
- Update to version 11.5.8:
  * No relevant changes</changelog>
  <changelog author="witold.bedyk@suse.com" date="1761566400">- Use forked wire from Grafana repository instead of external
  package (jsc#PED-14178).
- Update to version 11.5.10:
  Security:
  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
  Features and enhancements:
  * Update to Go 1.25
  * Update to golang.org/x/net v0.45.0
  Bug fixes:
  * Auth: Fix render user OAuth passthrough.
  * LDAP Authentication: Fix URL to propagate username context as
    parameter.
  * Plugins: Dependencies do not inherit parent URL for preinstall.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1763985600">- Fix CVE-2025-64751: Drop experimental implementation of
  authorization Zanzana server/client (bsc#1254113)
- Add 0002-Drop-zanzana.patch
- Require gcc7-c++ for building</changelog>
  <changelog author="witold.bedyk@suse.com" date="1765281600">- Require gcc11-c++ for building with SLE 12 SP5</changelog>
  <changelog author="witold.bedyk@suse.com" date="1768564800">- CVE-2025-68156: Fix potential DoS via unbounded recursion in
  builtin functions (bsc#1255340)
- Add 0004-Bump-expr-lang.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1769688000">- CVE-2026-21721: Fix access control by the dashboard permissions
  API (bsc#1257337)
- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)
- Add patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Build only for SUSE distributions</changelog>
  <changelog author="witold.bedyk@suse.com" date="1771588800">- Update patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
- Drop patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Update to version 11.6.11:
  Features and enhancements:
  * Alerting: Add limits for the size of expanded notification
    templates
  * Correlations: Remove support for org_id=0
  Security:
  * CVE-2026-21722: Public dashboards annotations: use dashboard
    timerange if time selection disabled (bsc#1258136)
- Update to version 11.6.10:
  Features and enhancements:
  * API: Add missing scope check on dashboards
  * Avatar: Require sign-in, remove queue, respect timeout
  Bug fixes:
  * Alerting: Fix a race condition panic in ResetStateByRuleUID
  Security:
  * CVE-2025-30153: Fix Improper Handling of Highly Compressed Data
    (Data Amplification) in
    github.com/getkin/kin-openapi/openapi3filter
    (bsc#1264764)
- Update to version 11.6.9:
  Features and enhancements:
  * Plugins: Add PluginContext to plugins when scenes is disabled
  Bug fixes:
  * Alerting: Fix contacts point issues
- Update to version 11.6.8:
  Bug fixes:
  * Alerting: Fix unmarshalling of GettableStatus to include time
    intervals
- Update to version 11.6.7:
  Bug fixes:
  * Auth: Fix render user OAuth passthrough
  * LDAP Authentication: Fix URL to propagate username context as
    parameter
  * Plugins: Dependencies do not inherit parent URL for preinstall
  * URLParams: Stringify true values as key=true always (fixes
    issues with variables with true value)
- Update to version 11.6.6:
  Bug fixes:
  * Alerting: Fix copying of recording rule fields
  * Fix redirection after login when Grafana is served from subpath
- Update to version 11.6.5:
  Features and enhancements:
  * Alerting: Bump alerting package to include change to
    NewTLSClient
- Update to version 11.6.4:
  Features and enhancements:
  * StateTimeline: Add endTime to tooltip
  * Unified storage: Respect GF_DATABASE_URL override
  Bug fixes:
  * Alerting: Fix group interval override when adding new rules
  * Azure: Fix legend formatting
  * Azure: Fix resource name determination in template variable
    queries
  * Graphite: Fix annotation queries
  * Graphite: Fix date mutation
  * Graphite: Fix nested variable interpolation for repeated rows
- Update to version 11.6.3:
  Security:
  * Fixes CVE-2025-3415
- Update to version 11.6.2:
  Bug fixes:
  * Dashboard: Fixes issue with row repeats and first row
  * Graphite: Ensure template variables are interpolated correctly
  * Graphite: Fix Graphite series interpolation
  * Prometheus: Fix semver import path
- Update to version 11.6.1:
  Features and enhancements:
  * DashboardScenePage: Correct slug in self referencing data links
  * GrafanaUI: Use safePolygon close handler for interactive
    tooltips instead of a delay
  * Prometheus: Add support for cloud partners Prometheus data
    sources
  Bug fixes:
  * Alertmanager: Add Role-Based Access Control via reqAction Field
  * GrafanaUI: Remove blurred background from overlay backdrops to
    improve performance
  * InfluxDB: Fix nested variable interpolation
  * LDAP test: Fix page crash
  * Org redirection: Fix linking between orgs
  Security:
  * CVE-2025-29923: Fix potential out of order responses when
    `CLIENT SETINFO` times out during connection establishment
    (bsc#1259999)
- Upgrade to version 11.6.0:
  Features and enhancements:
  * Visualisations: One click links and actions
  * Annotations: Add cron syntax support
  * WebGL-powered geomaps for better performance
  * Alerting: Add alert rule version history
  Security:
  * API keys: Migrate API keys to service accounts at startup</changelog>
  <changelog author="witold.bedyk@suse.com" date="1772193600">- Drop support for SLE 12 (jsc#PED-15474)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1774958400">- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1
  (bsc#1258595)
  * Add 0005-Bump-edwards25519.patch
- CVE-2026-21725: Fix missing UID when deleting datasource by name
  (bsc#1258873)
  * Add 0006-Fix-CVE-2026-21725.patch
- Rebase 0002-Drop-zanzana.patch
- Update to version 11.6.14+security-01:
  Security:
  * CVE-2026-33375: Fix denial of Service via out-of-memory
    exhaustion in MSSQL data source plugin (bsc#1260881)
- Update to version 11.6.14:
  Security:
  * CVE-2026-27876: Fix remote arbitrary code execution via chained
    SQL Expressions (bsc#1261025)
  * CVE-2026-27877: Fix information disclosure of data-source
    passwords via public dashboards (bsc#1261026)
  * CVE-2026-28375: Fix denial of service via testdata data-source
    (bsc#1261029)
  * CVE-2026-27879: Fix denial of service via resample query
    (bsc#1261027)
  * CVE-2026-33186: Fix authorization bypass due to improper
    validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  * CVE-2026-21724: Fix authorization bypass allows modification of
    protected webhook URLs (bsc#1260878)
- Update to version 11.6.13:
  Enhancement:
  * Wire the public dashboard service to the HTTP server
- Update to version 11.6.12:
  Enhancement:
  * Update authentication redirect logic
  Bug fix:
  * Fix single panel render with variable references</changelog>
  <changelog author="witold.bedyk@suse.com" date="1777896000">- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
  * Add 0007-Bump-github.com-go-jose-go-jose.patch
- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability
  in Apache Thrift (bsc#1263501)
  * Add 0008-Bump-github.com-apache-thrift.patch
- CVE-2026-41607: Fix potential information disclosure in Apache
  Thrift (bsc#1263272)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780401600">- Update to version 11.6.14+security-04:
  Security:
  * CVE-2026-28374: Fix insecure direct object reference in
    Annotations API (bsc#1265290)
  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live
    push endpoint (bsc#1265289)
  * CVE-2026-28383: Fix unbounded memory allocation in Grafana
    plugin resources (bsc#1265286)
  * CVE-2026-28380: Fix broken access control in Snapshot API
    (bsc#1265287)
  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass
    (bsc#1265285)
  * CVE-2026-28379: Fix viewer-triggered race condition in
    Grafana Live (bsc#1265288)
  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation
    (bsc#1265284)
  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin
    (bsc#1265283)
  * CVE-2026-33381: Prevent users from generating Service Account
    tokens after permissions removal (bsc#1265281)
  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing
    an authenticated attacker to read arbitrary files from the
    Grafana server’s filesystem (bsc#1265282)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780660800">- CVE-2026-39821: Fix validation bypass and privilege escalation by
  updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  * Fix multiple issues when parsing HTML files (bsc#1267153):
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681,
    CVE-2026-42506
  * Added 0009-Bump-golang.org-x-net.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1783598400">- Require Go &gt;= 1.26 for building
- Add UI web assets as additional source tarball
- Update to version 12.4.5 (jsc#PED-16512):
  * Datasources: return 400 when payload UID does not match URL UID
    in PUT /api/datasources/uid/:uid
- Update to version 12.4.4:
  * Security and quality updates:
    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
    OTLP HTTP exporters by updating to v1.43.0.
    (bsc#1274217)
    CVE-2026-33382: Limit the size of the request body before
    processing it at several Grafana API endpoints
    (bsc#1271331)
    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
    CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
    public dashboard query endpoint (bsc#1268868)
    CVE-2026-9029: Fix arbitrary code execution and information
    disclosure via XSS in geomap panel (bsc#1272328)
    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
    updating golang.org/x/net (bsc#1265763)
    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
    route (bsc#1271330)
  * Various bug fixes and enhancements.
- Update to version 12.4.3:
  * Analytics: Keep internal dashboard id.
  * Go: Update to 1.25.9.
  * Reporting: Correctly apply appSubURL to report settings
    requests.
  * Alerting: Document Grafana HA Alertmanager cluster metrics
    prefix change.
- Update to version 12.4.2:
  * Various bug fixes and performance improvements.
  * Dependency updates to core plugins and UI libraries.
  * CVE-2026-1229: Update github.com/cloudflare/circl to fix
    producing incorect output for specific inputs
    (bsc#1265525)
- Update to version 12.4.1:
  * Bug fixes and minor quality-of-life enhancements.
  * Updates to data source provisioning and dashboard schemas.
- Update to version 12.4.0:
  * Introduced dynamic dashboards in public preview.
  * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
  * Added the ability to create dashboards from templates using
    sample data.
  * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
  * Added support to map one variable to multiple values.
  * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)
  * CVE-2026-21723: Fix DoS vulnerability in Templates Test
    endpoint (bsc#1272427)
- Update to version 12.3.0:
  * Released a completely redesigned logs visualization.
  * Added the ability to export dashboards directly as PNG images.
  * Introduced an interactive learning experience within the
    Grafana UI.
  * Added a Switch template variable type to quickly toggle between
    values in queries.
  * Added functionality to style table cells using CSS properties
    via the field cell option.
- Update to version 12.2.0:
  * Routine feature enhancements, minor bug fixes, and security
    patches.
- Update to version 12.1.0:
  * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
  * Redesigned the alert rule list page.
  * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
  * Added support for Service Account Impersonation in the BigQuery
    data source.
  * Introduced the Grafana Advisor in public preview.
- Update to version 12.0.0:
  * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
  * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
  * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
  * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
  * Introduced a new dashboard schema to replace the original
    single grid layout.
- Removed patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
  * 0006-Fix-CVE-2026-21725.patch
  * 0007-Bump-github.com-go-jose-go-jose.patch
  * 0008-Bump-github.com-apache-thrift.patch
  * 0009-Bump-golang.org-x-net.patch
- Rebased 0005-Bump-edwards25519.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1784030400">- Add Legal-Review-Notice (bsc#1271327)</changelog>
</package>
<package pkgid="fd841690a42a9ff0cb2d5dcdb775b81a8c7ffe74bcac3ff607365cdc0e9a2eff08b440695268f3a00c7beaeadfe6a3dfe91e9840d5e79d37178c298ede47b3ca" name="grafana" arch="src">
  <version epoch="0" ver="12.4.5" rel="60003.3.1.uyuni"/>
  <changelog author="witold.bedyk@suse.com" date="1741608000">- CVE-2025-27144: Fix Go JOSE's Parsing Vulnerability (bsc#1237671)
  * Add 0003-Bump-go-jose.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748260800">- Update to version 11.5.2:
  * Bug fixes:
    Alerting: Allow specifying uid for new rules added to groups.
    Alerting: Call RLock() before reading sendAlertsTo map.
    Auth: Fix redirect with JWT auth URL login.
    AuthN: Refetch user on "ErrUserAlreadyExists".
    Azure: Correctly set application insights resource values.
    DashboardList: Throttle the re-renders.
    Dashboards: Bring back scripted dashboards.
    Plugin Metrics: Eliminate data race in plugin metrics
    middleware.
    RBAC: Don't check folder access if annotationPermissionUpdate
    FT is enabled.
- Update to version 11.5.1:
  * Bug fixes:
    CodeEditor: Fix cursor alignment.
    TransformationFilter: Include transformation outputs in
    transformation filtering options.
- Upgrade to version 11.5.0:
  * Breaking changes:
    Loki: Default to /labels API with query param instead of
    /series API.
  * Features and enhancements:
    Extended Cloud Migration Assistent support for plugins and
    alerts.
    Redesigned filters for dashboards.
    New regular expression option for Extract fields
    transformation.
    Redesigned sharing experience in Dashboards.
    Customizable shareable dashboard panel images.
    RBAC for alerting notifications and notification policies.
    Add support for Elasticsearch cross-cluster search.
    Time series macro support in visual query builder for SQL data
    sources.
    OAuth and SAML session handling improvements.
    Plugin Frontend Sandbox for additiona security.
    Renamed Public dashboards to Shared dashboards.
- Update to version 11.4.1:
  * Bug fixes:
    Alerting: AlertingQueryRunner should skip descendant nodes of
    invalid queries.
    Alerting: Fix alert rules unpausing after moving rule to
    different folder.
    Alerting: Fix label escaping in rule export.
    Alerting: Fix slack image uploading to use new api.
    Azure/GCM: Improve error display.
    Dashboards: Fix issue where filtered panels would not react to
    variable changes.
    Dashboards: Fixes issue with panel header showing even when
    hide time override was enabled.
    Dashboards: Fixes week relative time ranges when weekStart was
    changed.
    Dashboards: Panel react for timeFrom and timeShift changes
    using variables.
    DateTimePicker: Fixes issue with date picker showing invalid
    date.
    Fix: Add support for datasource variable queries.
    InfluxDB: Adhoc filters can use template vars as values.
    LibraryPanel: Fallback to panel title if library panel title is
    not set.
- Upgrade to version 11.4.0:
  * Features and enhancements:
    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.
- Update to version 11.3.1:
  * Features and enhancements:
    Alerting: Make context deadline on AlertNG service startup
    configurable.
    MigrationAssistant: Restrict dashboards, folders and
    datasources by the org id of the signed in
    user.
    User: Check SignedInUser OrgID in RevokeInvite.
  * Bug fixes:
    Alerting: Fix escaping of silence matchers in utf8 mode.
    Alerting: Fix overflow for long receiver names.
    Alerting: Fix saving advanced mode toggle state in the alert
    rule editor.
    Alerting: Fix setting datasource uid, when datasource is string
    in old version.
    Alerting: Force refetch prom rules when refreshing panel.
    Anonymous User: Adds validator service for anonymous users.
    Azure Monitor: Support metric namespaces fallback.
    Azure: Fix duplicated traces in multi-resource trace query.
    Azure: Handle namespace request rejection.
    CloudWatch: Interpolate region in log context query.
    Dashboard datasource: Return annotations as series when query
    topic is "annotations".
    Dashboard: Append orgId to URL.
    Dashboards: Fixes performance issue expanding a row.
    Flame Graph: Fix crash when it receives empty data.
    Folders: Add admin permissions upon creation of a folder w. SA.
    Folders: Don't show error pop-up if the user can't fetch the
    root folder.
    Migration: Remove table aliasing in delete statement to make it
    work for mariadb.
    ServerLock: Fix pg concurrency/locking issue.
    Service Accounts: Run service account creation in transaction.
    Table: Fix text wrapping applying to wrong field.
    Unified Storage: Use ssl_mode instead of sslmode.
- Update to version 11.3.0+security-01:
  * Security:
    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
- Upgrade to version 11.3.0:
  * Features and enhancements:
    View mode and Edit mode are generally available.
    Template variables and the time range picker remain visible
    when scrolling.
    Added timezone parameter in Grafana URL.
    Kiosk mode displays dashboard controls.
    Auto-formatted table cell values in Cell Inspect.
    Allow adding actions to canvas elements.
    Legend support in bar gauge visualizations.
    Apply the same binary transformation to all the number fields
    in a given table at once.
    Add support for data links and actions in several
    visualizations.
    The Explore Logs plugin is installed by default.
    Added correlations to external URLs in Explore.
    Simplified query section for alert rule creation.
    Introduced recording rules for Grafana-managed alerts.
    GitHub App authentication for the GitHub data source.
    Improved subfolder creation flow.
    Redesigned plugin details page.
    Added UI for LDAP configuration.
    Added RBAC support in Plugins.
- Update to version 11.2.2+security-01:
  * Bug fix:
    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)
- Update to version 11.2.2:
  * Features and enhancements:
    Data sources: Hide the datasource redirection banner for users
    who can't interact with data sources.
  * Bug fixes:
    Alerting: Fix preview of silences when label name contains
    spaces.
    Alerting: Make query wrapper match up datasource UIDs if
    necessary.
    AzureMonitor: Improve resource picker efficiency.
    AzureMonitor: Remove Basic Logs retention warning.
    CloudWatch: Fix segfault when migrating legacy queries.
    DashboardScene: Fix broken error handling and error rendering.
    Plugins: Avoid returning 404 for AutoEnabled apps.
- Update to version 11.2.1:
  * Features and enhancements:
    Alerting: Support for optimistic concurrency in priovisioning
    Tempate API.
    Logs panel: Enable displayedFields in dashboards and apps.
    State timeline: Add pagination support.
  * Bug fixes:
    Authn: No longer hash service account token twice during
    authentication.
    CloudMigrations: Fix snapshot creation on Windows systems.
    DashGPT: Fixes issue with generation on Safari.
    Dashboard: Fix Annotation runtime error when a data source does
    not support annotations.
    Grafana SQL: Fix broken import in NumberInput component.
    Logs: Show older logs button when infinite scroll is enabled
    and sort order is descending.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Templating: Fix searching non-latin template variables.
- Upgrade to version 11.2.0:
  * Features and enhancements:
    Grafana Cloud Migration Assistant is in public preview.
    Added navigation bookmarks.
    Added template variables support in some transformations.
    Introduced Transpose transformation.
    Group to nested tables is now generally available.
    Format string transformation is now generally available.
    New cumulative and window calculations available in Add field
    from calculation.
    Canvas: Standardized tooltips.
    Canvas: Allow adding data links without using an override.
    Canvas: Allow opening data links with a single click.
    Canvas: Add the ability to control the order in which data
    links are displayed.
    Added pagination support for state timeline.
    Centralized alert history page.
    Grafana Explore now allows for logs filtering and pinning in
    content outline.
    Added forward direction search for Loki.
    Added Cloudwatch Metric Insights cross account observability
    support.
    Added Yugabyte data source.
    Map org-specific user roles from your OAuth provider.
    Better SAML integration for Azure AD.
    API support for LDAP configuration (experimental).
    OpenID Connect Discovery URL for Generic OAuth.
- Update to version 11.1.5:
  * Bug fixes:
    Alerting: Fix permissions for prometheus rule endpoints.
    Alerting: Fix persisting result fingerprint that is used by
    recovery threshold.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Snapshots: Fix panic when snapshot_remove_expired is true.
    VizTooltip: Fix positioning at bottom and right edges on
    mobile.
    Plugins: Fix QueryField typeahead missing background color.
- Update to version 11.1.3:
  * Bug fix:
    RBAC: Allow plugins to use scoped actions.
- Update to version 11.1.1:
  * Bug fixes:
    Alerting: Skip fetching alerts for unsaved dashboards.
    Alerting: Support utf8_strict_mode: false in Mimir.
    Scenes: Fixes issue with panel repeat height calculation.
    Table Panel: Fix Image hover without datalinks.
    Tempo: Fix grpc streaming support over pdc-agent.
    RBAC: Allow plugins to use scoped actions.
- Upgrade to version 11.1.0:
  * Security:
    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  * Features and improvements:
    Allow table cell text wrapping.
    Added stat visualization percent change color mode options.
    XA chart is generally available.
    Redesigned settings page for Alerting.
    Added alerting template selector.
    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.
    Improved paused alert visibility.
    Rule-specific silences with permissions.
    Support for AWS SNS integration in Grafana-managed alerts.
    Added GeoMap and panel shortcut keyboard support.
    Accessability headings improvements.
    Added reduced motion support.
- Update to version 11.0.1:
  * Breaking changes:
    If you had selected your language as "Português Brasileiro"
    previously, this will be reset. You have to select it again in
    your Preferences for the fix to be applied and the translations
    will then be shown.
  * Bug fixes:
    Echo: Suppress errors from frontend-metrics API call failing.
    Analytics: Fix ApplicationInsights integration.
    DashboardScene: Fixes issue removing override rule.
    BrowseDashboards: Prepend subpath to New Browse Dashboard
    actions.
    Alerting: Fix rule storage to filter by group names using
    case-sensitive comparison.
    RBAC: List only the folders that the user has access to.
    DashboardScene: Fixes lack of re-render when updating field
    override properties.
    DashboardScene: Fixes inspect with transforms issue.
    AzureMonitor: Fix bug detecting app insights queries.
    Access Control: Clean up permissions for deprovisioned data
    sources.
    Loki: Fix editor history in wrong order.
    SSE: Fix threshold unmarshal to avoid panic.
    LibraryPanels/RBAC: Ignore old folder permission check when
    deleting/patching lib panel.
    Dashboards: Correctly display Admin access to dashboards in the
    UI.
    LogsTable: Fix default sort by time.
    Alerting: Fix rules deleting when reordering whilst filtered.
    Alerting: Fix typo in JSON response for rule export.
    CloudMonitoring: Fix query type selection issue.
    Alerting: Fix scheduler to sort rules before evaluation.
    DashboardScene: Skip panel repeats when values are the same.
    Alerting: Do not store series values from past evaluations in
    state manager for no reason.
    DashboardScene: Fixing major row repeat issues.
    DashboardScene: Fixes checkbox orienation in save forms.
- Upgrade to version 11.0.0:
  * Breaking changes:
    AngularJS support is turned off by default.
    Legacy alerting is entirely removed.
    Subfolders cause very rare issues with folders which have
    slashes in their names.
    The input data source is removed.
    Data sources: Responses which are associated with hidden
    queries will be removed (filtered) by Grafana.
    The URL which is generated when viewing an individual repeated
    panel has changed.
    React Router is deprecated.
    The grafana/e2e testing tool is deprecated.
  * Features and enhancements:
    Introduced Explore Metrics (public preview) and Explore Logs
    (experimental).
    Introduced edit mode to provide an easier way to discover and
    interact with the dashboard edit exprerience.
    Fixed positioning of template variables and time picker.
    Introduced dashboard subfolders.
    Use AI to generate titles and descriptions for panels and
    dashboards.
    Canvas: Enhanced flowcharting functionality.
    Canvas: Universal data link support.
    Canvas: Added infinite panning editor option.
    Added colored table rows with conditional formatting.
    Set threshold colors in the Config from query transformation.
    Substring matcher added to the Filter by value transformation.
    Keep Last State for Grafana Managed Alerting.
    Redesigned alert detail view.
    The Alerting Provisioning HTTP API has been updated to enforce
    RBAC.
    Removed old Tempo Search and Loki Search.
    MSSQL: Windows Active Directory (Kerberos) authentication.
    New strong password policy.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748606400">- Drop patches:
  * 0002-Fix-msagl-and-remove-esfx.patch
  * 0004-Bump-glog.patch
  * 0005-Bump-jwt.patch
  * 0006-Bump-go-jose.patch
- Add patch:
  * 0002-Add-grafana-authlib-types.patch
- Require Go 1.24 or newer for building
- Update to version 11.5.5 (jsc#PED-12918):
  * Security:
    CVE-2025-4123: Fix cross-site scripting vulnerability
    (bsc#1243714).
    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    CVE-2025-3580: Prevent unauthorized server admin deletion
    (bsc#1243672).
- Update to version 11.5.4:
  * Security:
    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    CVE-2025-3454: Sanitize paths before evaluating access to route
    (bsc#1241683).
    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  * Features and enhancements:
    Azure Monitor: Filter namespaces by resource group.
    Azure: Add support for custom namespace and custom metrics
    variable queries.
    Azure: Resource picker improvements.
    Azure: Support more complex variable interpolation.
    Azure: Variable editor and resource picker improvements.
    DashboardScenePage: Correct slug in self referencing data
    links.
    Prometheus: Add support for cloud partners Prometheus data
    sources.
  * Bug fixes:
    InfluxDB: Fix nested variable interpolation.
    LDAP test: Fix page crash.
- Update to version 11.5.3:
  * Security:
    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  * Bug fixes:
    Alerting: Fix token-based Slack image upload to work with
    channel names.
    Auth: Fix AzureAD config UI's ClientAuthentication dropdown.
    Dashboard: Fix the unintentional time range and variables
    updates on saving.
    Dashboards: Fix missing v/e/i keybindings to return back to
    dashboard.
    InfluxDB: Improve handling of template variables contained in
    regular expressions (InfluxQL).
    Org redirection: Fix linking between orgs.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1749211200">- Exclude ix86 architectures. They are not supported and fail to
  build.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1752235200">- Update to version 11.5.6:
  * Security:
    CVE-2025-3415: Fix exposure of DingDing alerting integration
    URL to Viewer level users (bsc#1245302)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1753358400">- Update to version 11.5.7:
  * Security:
    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards
    (bsc#1246735)
    CVE-2025-6197: Fix open redirect in organization switching
    (bsc#1246736)
  * Bug fixes:
    Azure: Fix legend formatting.
    Azure: Fix resource name determination in template variable
    queries.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1759924800">- Drop 0002-Add-grafana-authlib-types.patch
- Update to version 11.5.9:
  * Security:
    CVE-2025-11065: Fix sensitive information leak in logs
    (bsc#1250616)
  * Features and enhancements:
    Auditing: Document new options for recording datasource query
    request/response body.
  * Bug fixes:
    Login: Fix redirection after login when Grafana is served from
    subpath.
- Update to version 11.5.8:
  * No relevant changes</changelog>
  <changelog author="witold.bedyk@suse.com" date="1761566400">- Use forked wire from Grafana repository instead of external
  package (jsc#PED-14178).
- Update to version 11.5.10:
  Security:
  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
  Features and enhancements:
  * Update to Go 1.25
  * Update to golang.org/x/net v0.45.0
  Bug fixes:
  * Auth: Fix render user OAuth passthrough.
  * LDAP Authentication: Fix URL to propagate username context as
    parameter.
  * Plugins: Dependencies do not inherit parent URL for preinstall.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1763985600">- Fix CVE-2025-64751: Drop experimental implementation of
  authorization Zanzana server/client (bsc#1254113)
- Add 0002-Drop-zanzana.patch
- Require gcc7-c++ for building</changelog>
  <changelog author="witold.bedyk@suse.com" date="1765281600">- Require gcc11-c++ for building with SLE 12 SP5</changelog>
  <changelog author="witold.bedyk@suse.com" date="1768564800">- CVE-2025-68156: Fix potential DoS via unbounded recursion in
  builtin functions (bsc#1255340)
- Add 0004-Bump-expr-lang.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1769688000">- CVE-2026-21721: Fix access control by the dashboard permissions
  API (bsc#1257337)
- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)
- Add patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Build only for SUSE distributions</changelog>
  <changelog author="witold.bedyk@suse.com" date="1771588800">- Update patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
- Drop patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Update to version 11.6.11:
  Features and enhancements:
  * Alerting: Add limits for the size of expanded notification
    templates
  * Correlations: Remove support for org_id=0
  Security:
  * CVE-2026-21722: Public dashboards annotations: use dashboard
    timerange if time selection disabled (bsc#1258136)
- Update to version 11.6.10:
  Features and enhancements:
  * API: Add missing scope check on dashboards
  * Avatar: Require sign-in, remove queue, respect timeout
  Bug fixes:
  * Alerting: Fix a race condition panic in ResetStateByRuleUID
  Security:
  * CVE-2025-30153: Fix Improper Handling of Highly Compressed Data
    (Data Amplification) in
    github.com/getkin/kin-openapi/openapi3filter
    (bsc#1264764)
- Update to version 11.6.9:
  Features and enhancements:
  * Plugins: Add PluginContext to plugins when scenes is disabled
  Bug fixes:
  * Alerting: Fix contacts point issues
- Update to version 11.6.8:
  Bug fixes:
  * Alerting: Fix unmarshalling of GettableStatus to include time
    intervals
- Update to version 11.6.7:
  Bug fixes:
  * Auth: Fix render user OAuth passthrough
  * LDAP Authentication: Fix URL to propagate username context as
    parameter
  * Plugins: Dependencies do not inherit parent URL for preinstall
  * URLParams: Stringify true values as key=true always (fixes
    issues with variables with true value)
- Update to version 11.6.6:
  Bug fixes:
  * Alerting: Fix copying of recording rule fields
  * Fix redirection after login when Grafana is served from subpath
- Update to version 11.6.5:
  Features and enhancements:
  * Alerting: Bump alerting package to include change to
    NewTLSClient
- Update to version 11.6.4:
  Features and enhancements:
  * StateTimeline: Add endTime to tooltip
  * Unified storage: Respect GF_DATABASE_URL override
  Bug fixes:
  * Alerting: Fix group interval override when adding new rules
  * Azure: Fix legend formatting
  * Azure: Fix resource name determination in template variable
    queries
  * Graphite: Fix annotation queries
  * Graphite: Fix date mutation
  * Graphite: Fix nested variable interpolation for repeated rows
- Update to version 11.6.3:
  Security:
  * Fixes CVE-2025-3415
- Update to version 11.6.2:
  Bug fixes:
  * Dashboard: Fixes issue with row repeats and first row
  * Graphite: Ensure template variables are interpolated correctly
  * Graphite: Fix Graphite series interpolation
  * Prometheus: Fix semver import path
- Update to version 11.6.1:
  Features and enhancements:
  * DashboardScenePage: Correct slug in self referencing data links
  * GrafanaUI: Use safePolygon close handler for interactive
    tooltips instead of a delay
  * Prometheus: Add support for cloud partners Prometheus data
    sources
  Bug fixes:
  * Alertmanager: Add Role-Based Access Control via reqAction Field
  * GrafanaUI: Remove blurred background from overlay backdrops to
    improve performance
  * InfluxDB: Fix nested variable interpolation
  * LDAP test: Fix page crash
  * Org redirection: Fix linking between orgs
  Security:
  * CVE-2025-29923: Fix potential out of order responses when
    `CLIENT SETINFO` times out during connection establishment
    (bsc#1259999)
- Upgrade to version 11.6.0:
  Features and enhancements:
  * Visualisations: One click links and actions
  * Annotations: Add cron syntax support
  * WebGL-powered geomaps for better performance
  * Alerting: Add alert rule version history
  Security:
  * API keys: Migrate API keys to service accounts at startup</changelog>
  <changelog author="witold.bedyk@suse.com" date="1772193600">- Drop support for SLE 12 (jsc#PED-15474)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1774958400">- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1
  (bsc#1258595)
  * Add 0005-Bump-edwards25519.patch
- CVE-2026-21725: Fix missing UID when deleting datasource by name
  (bsc#1258873)
  * Add 0006-Fix-CVE-2026-21725.patch
- Rebase 0002-Drop-zanzana.patch
- Update to version 11.6.14+security-01:
  Security:
  * CVE-2026-33375: Fix denial of Service via out-of-memory
    exhaustion in MSSQL data source plugin (bsc#1260881)
- Update to version 11.6.14:
  Security:
  * CVE-2026-27876: Fix remote arbitrary code execution via chained
    SQL Expressions (bsc#1261025)
  * CVE-2026-27877: Fix information disclosure of data-source
    passwords via public dashboards (bsc#1261026)
  * CVE-2026-28375: Fix denial of service via testdata data-source
    (bsc#1261029)
  * CVE-2026-27879: Fix denial of service via resample query
    (bsc#1261027)
  * CVE-2026-33186: Fix authorization bypass due to improper
    validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  * CVE-2026-21724: Fix authorization bypass allows modification of
    protected webhook URLs (bsc#1260878)
- Update to version 11.6.13:
  Enhancement:
  * Wire the public dashboard service to the HTTP server
- Update to version 11.6.12:
  Enhancement:
  * Update authentication redirect logic
  Bug fix:
  * Fix single panel render with variable references</changelog>
  <changelog author="witold.bedyk@suse.com" date="1777896000">- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
  * Add 0007-Bump-github.com-go-jose-go-jose.patch
- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability
  in Apache Thrift (bsc#1263501)
  * Add 0008-Bump-github.com-apache-thrift.patch
- CVE-2026-41607: Fix potential information disclosure in Apache
  Thrift (bsc#1263272)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780401600">- Update to version 11.6.14+security-04:
  Security:
  * CVE-2026-28374: Fix insecure direct object reference in
    Annotations API (bsc#1265290)
  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live
    push endpoint (bsc#1265289)
  * CVE-2026-28383: Fix unbounded memory allocation in Grafana
    plugin resources (bsc#1265286)
  * CVE-2026-28380: Fix broken access control in Snapshot API
    (bsc#1265287)
  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass
    (bsc#1265285)
  * CVE-2026-28379: Fix viewer-triggered race condition in
    Grafana Live (bsc#1265288)
  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation
    (bsc#1265284)
  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin
    (bsc#1265283)
  * CVE-2026-33381: Prevent users from generating Service Account
    tokens after permissions removal (bsc#1265281)
  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing
    an authenticated attacker to read arbitrary files from the
    Grafana server’s filesystem (bsc#1265282)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780660800">- CVE-2026-39821: Fix validation bypass and privilege escalation by
  updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  * Fix multiple issues when parsing HTML files (bsc#1267153):
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681,
    CVE-2026-42506
  * Added 0009-Bump-golang.org-x-net.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1783598400">- Require Go &gt;= 1.26 for building
- Add UI web assets as additional source tarball
- Update to version 12.4.5 (jsc#PED-16512):
  * Datasources: return 400 when payload UID does not match URL UID
    in PUT /api/datasources/uid/:uid
- Update to version 12.4.4:
  * Security and quality updates:
    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
    OTLP HTTP exporters by updating to v1.43.0.
    (bsc#1274217)
    CVE-2026-33382: Limit the size of the request body before
    processing it at several Grafana API endpoints
    (bsc#1271331)
    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
    CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
    public dashboard query endpoint (bsc#1268868)
    CVE-2026-9029: Fix arbitrary code execution and information
    disclosure via XSS in geomap panel (bsc#1272328)
    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
    updating golang.org/x/net (bsc#1265763)
    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
    route (bsc#1271330)
  * Various bug fixes and enhancements.
- Update to version 12.4.3:
  * Analytics: Keep internal dashboard id.
  * Go: Update to 1.25.9.
  * Reporting: Correctly apply appSubURL to report settings
    requests.
  * Alerting: Document Grafana HA Alertmanager cluster metrics
    prefix change.
- Update to version 12.4.2:
  * Various bug fixes and performance improvements.
  * Dependency updates to core plugins and UI libraries.
  * CVE-2026-1229: Update github.com/cloudflare/circl to fix
    producing incorect output for specific inputs
    (bsc#1265525)
- Update to version 12.4.1:
  * Bug fixes and minor quality-of-life enhancements.
  * Updates to data source provisioning and dashboard schemas.
- Update to version 12.4.0:
  * Introduced dynamic dashboards in public preview.
  * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
  * Added the ability to create dashboards from templates using
    sample data.
  * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
  * Added support to map one variable to multiple values.
  * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)
  * CVE-2026-21723: Fix DoS vulnerability in Templates Test
    endpoint (bsc#1272427)
- Update to version 12.3.0:
  * Released a completely redesigned logs visualization.
  * Added the ability to export dashboards directly as PNG images.
  * Introduced an interactive learning experience within the
    Grafana UI.
  * Added a Switch template variable type to quickly toggle between
    values in queries.
  * Added functionality to style table cells using CSS properties
    via the field cell option.
- Update to version 12.2.0:
  * Routine feature enhancements, minor bug fixes, and security
    patches.
- Update to version 12.1.0:
  * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
  * Redesigned the alert rule list page.
  * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
  * Added support for Service Account Impersonation in the BigQuery
    data source.
  * Introduced the Grafana Advisor in public preview.
- Update to version 12.0.0:
  * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
  * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
  * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
  * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
  * Introduced a new dashboard schema to replace the original
    single grid layout.
- Removed patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
  * 0006-Fix-CVE-2026-21725.patch
  * 0007-Bump-github.com-go-jose-go-jose.patch
  * 0008-Bump-github.com-apache-thrift.patch
  * 0009-Bump-golang.org-x-net.patch
- Rebased 0005-Bump-edwards25519.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1784030400">- Add Legal-Review-Notice (bsc#1271327)</changelog>
</package>
<package pkgid="a0b05acb26cc914007ed635d5f57bf395c9082fcb4a43f51983d46036814932d142329e0cd114365eed821f46743bbb0bf8624a36e5f80d006052a065d562d38" name="grafana" arch="x86_64">
  <version epoch="0" ver="12.4.5" rel="60003.3.1.uyuni"/>
  <changelog author="witold.bedyk@suse.com" date="1741608000">- CVE-2025-27144: Fix Go JOSE's Parsing Vulnerability (bsc#1237671)
  * Add 0003-Bump-go-jose.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748260800">- Update to version 11.5.2:
  * Bug fixes:
    Alerting: Allow specifying uid for new rules added to groups.
    Alerting: Call RLock() before reading sendAlertsTo map.
    Auth: Fix redirect with JWT auth URL login.
    AuthN: Refetch user on "ErrUserAlreadyExists".
    Azure: Correctly set application insights resource values.
    DashboardList: Throttle the re-renders.
    Dashboards: Bring back scripted dashboards.
    Plugin Metrics: Eliminate data race in plugin metrics
    middleware.
    RBAC: Don't check folder access if annotationPermissionUpdate
    FT is enabled.
- Update to version 11.5.1:
  * Bug fixes:
    CodeEditor: Fix cursor alignment.
    TransformationFilter: Include transformation outputs in
    transformation filtering options.
- Upgrade to version 11.5.0:
  * Breaking changes:
    Loki: Default to /labels API with query param instead of
    /series API.
  * Features and enhancements:
    Extended Cloud Migration Assistent support for plugins and
    alerts.
    Redesigned filters for dashboards.
    New regular expression option for Extract fields
    transformation.
    Redesigned sharing experience in Dashboards.
    Customizable shareable dashboard panel images.
    RBAC for alerting notifications and notification policies.
    Add support for Elasticsearch cross-cluster search.
    Time series macro support in visual query builder for SQL data
    sources.
    OAuth and SAML session handling improvements.
    Plugin Frontend Sandbox for additiona security.
    Renamed Public dashboards to Shared dashboards.
- Update to version 11.4.1:
  * Bug fixes:
    Alerting: AlertingQueryRunner should skip descendant nodes of
    invalid queries.
    Alerting: Fix alert rules unpausing after moving rule to
    different folder.
    Alerting: Fix label escaping in rule export.
    Alerting: Fix slack image uploading to use new api.
    Azure/GCM: Improve error display.
    Dashboards: Fix issue where filtered panels would not react to
    variable changes.
    Dashboards: Fixes issue with panel header showing even when
    hide time override was enabled.
    Dashboards: Fixes week relative time ranges when weekStart was
    changed.
    Dashboards: Panel react for timeFrom and timeShift changes
    using variables.
    DateTimePicker: Fixes issue with date picker showing invalid
    date.
    Fix: Add support for datasource variable queries.
    InfluxDB: Adhoc filters can use template vars as values.
    LibraryPanel: Fallback to panel title if library panel title is
    not set.
- Upgrade to version 11.4.0:
  * Features and enhancements:
    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.
- Update to version 11.3.1:
  * Features and enhancements:
    Alerting: Make context deadline on AlertNG service startup
    configurable.
    MigrationAssistant: Restrict dashboards, folders and
    datasources by the org id of the signed in
    user.
    User: Check SignedInUser OrgID in RevokeInvite.
  * Bug fixes:
    Alerting: Fix escaping of silence matchers in utf8 mode.
    Alerting: Fix overflow for long receiver names.
    Alerting: Fix saving advanced mode toggle state in the alert
    rule editor.
    Alerting: Fix setting datasource uid, when datasource is string
    in old version.
    Alerting: Force refetch prom rules when refreshing panel.
    Anonymous User: Adds validator service for anonymous users.
    Azure Monitor: Support metric namespaces fallback.
    Azure: Fix duplicated traces in multi-resource trace query.
    Azure: Handle namespace request rejection.
    CloudWatch: Interpolate region in log context query.
    Dashboard datasource: Return annotations as series when query
    topic is "annotations".
    Dashboard: Append orgId to URL.
    Dashboards: Fixes performance issue expanding a row.
    Flame Graph: Fix crash when it receives empty data.
    Folders: Add admin permissions upon creation of a folder w. SA.
    Folders: Don't show error pop-up if the user can't fetch the
    root folder.
    Migration: Remove table aliasing in delete statement to make it
    work for mariadb.
    ServerLock: Fix pg concurrency/locking issue.
    Service Accounts: Run service account creation in transaction.
    Table: Fix text wrapping applying to wrong field.
    Unified Storage: Use ssl_mode instead of sslmode.
- Update to version 11.3.0+security-01:
  * Security:
    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
- Upgrade to version 11.3.0:
  * Features and enhancements:
    View mode and Edit mode are generally available.
    Template variables and the time range picker remain visible
    when scrolling.
    Added timezone parameter in Grafana URL.
    Kiosk mode displays dashboard controls.
    Auto-formatted table cell values in Cell Inspect.
    Allow adding actions to canvas elements.
    Legend support in bar gauge visualizations.
    Apply the same binary transformation to all the number fields
    in a given table at once.
    Add support for data links and actions in several
    visualizations.
    The Explore Logs plugin is installed by default.
    Added correlations to external URLs in Explore.
    Simplified query section for alert rule creation.
    Introduced recording rules for Grafana-managed alerts.
    GitHub App authentication for the GitHub data source.
    Improved subfolder creation flow.
    Redesigned plugin details page.
    Added UI for LDAP configuration.
    Added RBAC support in Plugins.
- Update to version 11.2.2+security-01:
  * Bug fix:
    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)
- Update to version 11.2.2:
  * Features and enhancements:
    Data sources: Hide the datasource redirection banner for users
    who can't interact with data sources.
  * Bug fixes:
    Alerting: Fix preview of silences when label name contains
    spaces.
    Alerting: Make query wrapper match up datasource UIDs if
    necessary.
    AzureMonitor: Improve resource picker efficiency.
    AzureMonitor: Remove Basic Logs retention warning.
    CloudWatch: Fix segfault when migrating legacy queries.
    DashboardScene: Fix broken error handling and error rendering.
    Plugins: Avoid returning 404 for AutoEnabled apps.
- Update to version 11.2.1:
  * Features and enhancements:
    Alerting: Support for optimistic concurrency in priovisioning
    Tempate API.
    Logs panel: Enable displayedFields in dashboards and apps.
    State timeline: Add pagination support.
  * Bug fixes:
    Authn: No longer hash service account token twice during
    authentication.
    CloudMigrations: Fix snapshot creation on Windows systems.
    DashGPT: Fixes issue with generation on Safari.
    Dashboard: Fix Annotation runtime error when a data source does
    not support annotations.
    Grafana SQL: Fix broken import in NumberInput component.
    Logs: Show older logs button when infinite scroll is enabled
    and sort order is descending.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Templating: Fix searching non-latin template variables.
- Upgrade to version 11.2.0:
  * Features and enhancements:
    Grafana Cloud Migration Assistant is in public preview.
    Added navigation bookmarks.
    Added template variables support in some transformations.
    Introduced Transpose transformation.
    Group to nested tables is now generally available.
    Format string transformation is now generally available.
    New cumulative and window calculations available in Add field
    from calculation.
    Canvas: Standardized tooltips.
    Canvas: Allow adding data links without using an override.
    Canvas: Allow opening data links with a single click.
    Canvas: Add the ability to control the order in which data
    links are displayed.
    Added pagination support for state timeline.
    Centralized alert history page.
    Grafana Explore now allows for logs filtering and pinning in
    content outline.
    Added forward direction search for Loki.
    Added Cloudwatch Metric Insights cross account observability
    support.
    Added Yugabyte data source.
    Map org-specific user roles from your OAuth provider.
    Better SAML integration for Azure AD.
    API support for LDAP configuration (experimental).
    OpenID Connect Discovery URL for Generic OAuth.
- Update to version 11.1.5:
  * Bug fixes:
    Alerting: Fix permissions for prometheus rule endpoints.
    Alerting: Fix persisting result fingerprint that is used by
    recovery threshold.
    RBAC: Fix an issue with server admins not being able to manage
    users in orgs that they don't belong to.
    Snapshots: Fix panic when snapshot_remove_expired is true.
    VizTooltip: Fix positioning at bottom and right edges on
    mobile.
    Plugins: Fix QueryField typeahead missing background color.
- Update to version 11.1.3:
  * Bug fix:
    RBAC: Allow plugins to use scoped actions.
- Update to version 11.1.1:
  * Bug fixes:
    Alerting: Skip fetching alerts for unsaved dashboards.
    Alerting: Support utf8_strict_mode: false in Mimir.
    Scenes: Fixes issue with panel repeat height calculation.
    Table Panel: Fix Image hover without datalinks.
    Tempo: Fix grpc streaming support over pdc-agent.
    RBAC: Allow plugins to use scoped actions.
- Upgrade to version 11.1.0:
  * Security:
    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  * Features and improvements:
    Allow table cell text wrapping.
    Added stat visualization percent change color mode options.
    XA chart is generally available.
    Redesigned settings page for Alerting.
    Added alerting template selector.
    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.
    Improved paused alert visibility.
    Rule-specific silences with permissions.
    Support for AWS SNS integration in Grafana-managed alerts.
    Added GeoMap and panel shortcut keyboard support.
    Accessability headings improvements.
    Added reduced motion support.
- Update to version 11.0.1:
  * Breaking changes:
    If you had selected your language as "Português Brasileiro"
    previously, this will be reset. You have to select it again in
    your Preferences for the fix to be applied and the translations
    will then be shown.
  * Bug fixes:
    Echo: Suppress errors from frontend-metrics API call failing.
    Analytics: Fix ApplicationInsights integration.
    DashboardScene: Fixes issue removing override rule.
    BrowseDashboards: Prepend subpath to New Browse Dashboard
    actions.
    Alerting: Fix rule storage to filter by group names using
    case-sensitive comparison.
    RBAC: List only the folders that the user has access to.
    DashboardScene: Fixes lack of re-render when updating field
    override properties.
    DashboardScene: Fixes inspect with transforms issue.
    AzureMonitor: Fix bug detecting app insights queries.
    Access Control: Clean up permissions for deprovisioned data
    sources.
    Loki: Fix editor history in wrong order.
    SSE: Fix threshold unmarshal to avoid panic.
    LibraryPanels/RBAC: Ignore old folder permission check when
    deleting/patching lib panel.
    Dashboards: Correctly display Admin access to dashboards in the
    UI.
    LogsTable: Fix default sort by time.
    Alerting: Fix rules deleting when reordering whilst filtered.
    Alerting: Fix typo in JSON response for rule export.
    CloudMonitoring: Fix query type selection issue.
    Alerting: Fix scheduler to sort rules before evaluation.
    DashboardScene: Skip panel repeats when values are the same.
    Alerting: Do not store series values from past evaluations in
    state manager for no reason.
    DashboardScene: Fixing major row repeat issues.
    DashboardScene: Fixes checkbox orienation in save forms.
- Upgrade to version 11.0.0:
  * Breaking changes:
    AngularJS support is turned off by default.
    Legacy alerting is entirely removed.
    Subfolders cause very rare issues with folders which have
    slashes in their names.
    The input data source is removed.
    Data sources: Responses which are associated with hidden
    queries will be removed (filtered) by Grafana.
    The URL which is generated when viewing an individual repeated
    panel has changed.
    React Router is deprecated.
    The grafana/e2e testing tool is deprecated.
  * Features and enhancements:
    Introduced Explore Metrics (public preview) and Explore Logs
    (experimental).
    Introduced edit mode to provide an easier way to discover and
    interact with the dashboard edit exprerience.
    Fixed positioning of template variables and time picker.
    Introduced dashboard subfolders.
    Use AI to generate titles and descriptions for panels and
    dashboards.
    Canvas: Enhanced flowcharting functionality.
    Canvas: Universal data link support.
    Canvas: Added infinite panning editor option.
    Added colored table rows with conditional formatting.
    Set threshold colors in the Config from query transformation.
    Substring matcher added to the Filter by value transformation.
    Keep Last State for Grafana Managed Alerting.
    Redesigned alert detail view.
    The Alerting Provisioning HTTP API has been updated to enforce
    RBAC.
    Removed old Tempo Search and Loki Search.
    MSSQL: Windows Active Directory (Kerberos) authentication.
    New strong password policy.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1748606400">- Drop patches:
  * 0002-Fix-msagl-and-remove-esfx.patch
  * 0004-Bump-glog.patch
  * 0005-Bump-jwt.patch
  * 0006-Bump-go-jose.patch
- Add patch:
  * 0002-Add-grafana-authlib-types.patch
- Require Go 1.24 or newer for building
- Update to version 11.5.5 (jsc#PED-12918):
  * Security:
    CVE-2025-4123: Fix cross-site scripting vulnerability
    (bsc#1243714).
    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    CVE-2025-3580: Prevent unauthorized server admin deletion
    (bsc#1243672).
- Update to version 11.5.4:
  * Security:
    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    CVE-2025-3454: Sanitize paths before evaluating access to route
    (bsc#1241683).
    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  * Features and enhancements:
    Azure Monitor: Filter namespaces by resource group.
    Azure: Add support for custom namespace and custom metrics
    variable queries.
    Azure: Resource picker improvements.
    Azure: Support more complex variable interpolation.
    Azure: Variable editor and resource picker improvements.
    DashboardScenePage: Correct slug in self referencing data
    links.
    Prometheus: Add support for cloud partners Prometheus data
    sources.
  * Bug fixes:
    InfluxDB: Fix nested variable interpolation.
    LDAP test: Fix page crash.
- Update to version 11.5.3:
  * Security:
    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  * Bug fixes:
    Alerting: Fix token-based Slack image upload to work with
    channel names.
    Auth: Fix AzureAD config UI's ClientAuthentication dropdown.
    Dashboard: Fix the unintentional time range and variables
    updates on saving.
    Dashboards: Fix missing v/e/i keybindings to return back to
    dashboard.
    InfluxDB: Improve handling of template variables contained in
    regular expressions (InfluxQL).
    Org redirection: Fix linking between orgs.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1749211200">- Exclude ix86 architectures. They are not supported and fail to
  build.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1752235200">- Update to version 11.5.6:
  * Security:
    CVE-2025-3415: Fix exposure of DingDing alerting integration
    URL to Viewer level users (bsc#1245302)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1753358400">- Update to version 11.5.7:
  * Security:
    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards
    (bsc#1246735)
    CVE-2025-6197: Fix open redirect in organization switching
    (bsc#1246736)
  * Bug fixes:
    Azure: Fix legend formatting.
    Azure: Fix resource name determination in template variable
    queries.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1759924800">- Drop 0002-Add-grafana-authlib-types.patch
- Update to version 11.5.9:
  * Security:
    CVE-2025-11065: Fix sensitive information leak in logs
    (bsc#1250616)
  * Features and enhancements:
    Auditing: Document new options for recording datasource query
    request/response body.
  * Bug fixes:
    Login: Fix redirection after login when Grafana is served from
    subpath.
- Update to version 11.5.8:
  * No relevant changes</changelog>
  <changelog author="witold.bedyk@suse.com" date="1761566400">- Use forked wire from Grafana repository instead of external
  package (jsc#PED-14178).
- Update to version 11.5.10:
  Security:
  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
  Features and enhancements:
  * Update to Go 1.25
  * Update to golang.org/x/net v0.45.0
  Bug fixes:
  * Auth: Fix render user OAuth passthrough.
  * LDAP Authentication: Fix URL to propagate username context as
    parameter.
  * Plugins: Dependencies do not inherit parent URL for preinstall.</changelog>
  <changelog author="witold.bedyk@suse.com" date="1763985600">- Fix CVE-2025-64751: Drop experimental implementation of
  authorization Zanzana server/client (bsc#1254113)
- Add 0002-Drop-zanzana.patch
- Require gcc7-c++ for building</changelog>
  <changelog author="witold.bedyk@suse.com" date="1765281600">- Require gcc11-c++ for building with SLE 12 SP5</changelog>
  <changelog author="witold.bedyk@suse.com" date="1768564800">- CVE-2025-68156: Fix potential DoS via unbounded recursion in
  builtin functions (bsc#1255340)
- Add 0004-Bump-expr-lang.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1769688000">- CVE-2026-21721: Fix access control by the dashboard permissions
  API (bsc#1257337)
- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)
- Add patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Build only for SUSE distributions</changelog>
  <changelog author="witold.bedyk@suse.com" date="1771588800">- Update patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
- Drop patches:
  * 0005-Add-dashboards-scope-check.patch
  * 0006-Fix-avatar.patch
- Update to version 11.6.11:
  Features and enhancements:
  * Alerting: Add limits for the size of expanded notification
    templates
  * Correlations: Remove support for org_id=0
  Security:
  * CVE-2026-21722: Public dashboards annotations: use dashboard
    timerange if time selection disabled (bsc#1258136)
- Update to version 11.6.10:
  Features and enhancements:
  * API: Add missing scope check on dashboards
  * Avatar: Require sign-in, remove queue, respect timeout
  Bug fixes:
  * Alerting: Fix a race condition panic in ResetStateByRuleUID
  Security:
  * CVE-2025-30153: Fix Improper Handling of Highly Compressed Data
    (Data Amplification) in
    github.com/getkin/kin-openapi/openapi3filter
    (bsc#1264764)
- Update to version 11.6.9:
  Features and enhancements:
  * Plugins: Add PluginContext to plugins when scenes is disabled
  Bug fixes:
  * Alerting: Fix contacts point issues
- Update to version 11.6.8:
  Bug fixes:
  * Alerting: Fix unmarshalling of GettableStatus to include time
    intervals
- Update to version 11.6.7:
  Bug fixes:
  * Auth: Fix render user OAuth passthrough
  * LDAP Authentication: Fix URL to propagate username context as
    parameter
  * Plugins: Dependencies do not inherit parent URL for preinstall
  * URLParams: Stringify true values as key=true always (fixes
    issues with variables with true value)
- Update to version 11.6.6:
  Bug fixes:
  * Alerting: Fix copying of recording rule fields
  * Fix redirection after login when Grafana is served from subpath
- Update to version 11.6.5:
  Features and enhancements:
  * Alerting: Bump alerting package to include change to
    NewTLSClient
- Update to version 11.6.4:
  Features and enhancements:
  * StateTimeline: Add endTime to tooltip
  * Unified storage: Respect GF_DATABASE_URL override
  Bug fixes:
  * Alerting: Fix group interval override when adding new rules
  * Azure: Fix legend formatting
  * Azure: Fix resource name determination in template variable
    queries
  * Graphite: Fix annotation queries
  * Graphite: Fix date mutation
  * Graphite: Fix nested variable interpolation for repeated rows
- Update to version 11.6.3:
  Security:
  * Fixes CVE-2025-3415
- Update to version 11.6.2:
  Bug fixes:
  * Dashboard: Fixes issue with row repeats and first row
  * Graphite: Ensure template variables are interpolated correctly
  * Graphite: Fix Graphite series interpolation
  * Prometheus: Fix semver import path
- Update to version 11.6.1:
  Features and enhancements:
  * DashboardScenePage: Correct slug in self referencing data links
  * GrafanaUI: Use safePolygon close handler for interactive
    tooltips instead of a delay
  * Prometheus: Add support for cloud partners Prometheus data
    sources
  Bug fixes:
  * Alertmanager: Add Role-Based Access Control via reqAction Field
  * GrafanaUI: Remove blurred background from overlay backdrops to
    improve performance
  * InfluxDB: Fix nested variable interpolation
  * LDAP test: Fix page crash
  * Org redirection: Fix linking between orgs
  Security:
  * CVE-2025-29923: Fix potential out of order responses when
    `CLIENT SETINFO` times out during connection establishment
    (bsc#1259999)
- Upgrade to version 11.6.0:
  Features and enhancements:
  * Visualisations: One click links and actions
  * Annotations: Add cron syntax support
  * WebGL-powered geomaps for better performance
  * Alerting: Add alert rule version history
  Security:
  * API keys: Migrate API keys to service accounts at startup</changelog>
  <changelog author="witold.bedyk@suse.com" date="1772193600">- Drop support for SLE 12 (jsc#PED-15474)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1774958400">- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1
  (bsc#1258595)
  * Add 0005-Bump-edwards25519.patch
- CVE-2026-21725: Fix missing UID when deleting datasource by name
  (bsc#1258873)
  * Add 0006-Fix-CVE-2026-21725.patch
- Rebase 0002-Drop-zanzana.patch
- Update to version 11.6.14+security-01:
  Security:
  * CVE-2026-33375: Fix denial of Service via out-of-memory
    exhaustion in MSSQL data source plugin (bsc#1260881)
- Update to version 11.6.14:
  Security:
  * CVE-2026-27876: Fix remote arbitrary code execution via chained
    SQL Expressions (bsc#1261025)
  * CVE-2026-27877: Fix information disclosure of data-source
    passwords via public dashboards (bsc#1261026)
  * CVE-2026-28375: Fix denial of service via testdata data-source
    (bsc#1261029)
  * CVE-2026-27879: Fix denial of service via resample query
    (bsc#1261027)
  * CVE-2026-33186: Fix authorization bypass due to improper
    validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  * CVE-2026-21724: Fix authorization bypass allows modification of
    protected webhook URLs (bsc#1260878)
- Update to version 11.6.13:
  Enhancement:
  * Wire the public dashboard service to the HTTP server
- Update to version 11.6.12:
  Enhancement:
  * Update authentication redirect logic
  Bug fix:
  * Fix single panel render with variable references</changelog>
  <changelog author="witold.bedyk@suse.com" date="1777896000">- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
  * Add 0007-Bump-github.com-go-jose-go-jose.patch
- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability
  in Apache Thrift (bsc#1263501)
  * Add 0008-Bump-github.com-apache-thrift.patch
- CVE-2026-41607: Fix potential information disclosure in Apache
  Thrift (bsc#1263272)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780401600">- Update to version 11.6.14+security-04:
  Security:
  * CVE-2026-28374: Fix insecure direct object reference in
    Annotations API (bsc#1265290)
  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live
    push endpoint (bsc#1265289)
  * CVE-2026-28383: Fix unbounded memory allocation in Grafana
    plugin resources (bsc#1265286)
  * CVE-2026-28380: Fix broken access control in Snapshot API
    (bsc#1265287)
  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass
    (bsc#1265285)
  * CVE-2026-28379: Fix viewer-triggered race condition in
    Grafana Live (bsc#1265288)
  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation
    (bsc#1265284)
  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin
    (bsc#1265283)
  * CVE-2026-33381: Prevent users from generating Service Account
    tokens after permissions removal (bsc#1265281)
  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing
    an authenticated attacker to read arbitrary files from the
    Grafana server’s filesystem (bsc#1265282)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1780660800">- CVE-2026-39821: Fix validation bypass and privilege escalation by
  updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  * Fix multiple issues when parsing HTML files (bsc#1267153):
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681,
    CVE-2026-42506
  * Added 0009-Bump-golang.org-x-net.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1783598400">- Require Go &gt;= 1.26 for building
- Add UI web assets as additional source tarball
- Update to version 12.4.5 (jsc#PED-16512):
  * Datasources: return 400 when payload UID does not match URL UID
    in PUT /api/datasources/uid/:uid
- Update to version 12.4.4:
  * Security and quality updates:
    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
    OTLP HTTP exporters by updating to v1.43.0.
    (bsc#1274217)
    CVE-2026-33382: Limit the size of the request body before
    processing it at several Grafana API endpoints
    (bsc#1271331)
    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
    CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
    public dashboard query endpoint (bsc#1268868)
    CVE-2026-9029: Fix arbitrary code execution and information
    disclosure via XSS in geomap panel (bsc#1272328)
    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
    updating golang.org/x/net (bsc#1265763)
    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
    route (bsc#1271330)
  * Various bug fixes and enhancements.
- Update to version 12.4.3:
  * Analytics: Keep internal dashboard id.
  * Go: Update to 1.25.9.
  * Reporting: Correctly apply appSubURL to report settings
    requests.
  * Alerting: Document Grafana HA Alertmanager cluster metrics
    prefix change.
- Update to version 12.4.2:
  * Various bug fixes and performance improvements.
  * Dependency updates to core plugins and UI libraries.
  * CVE-2026-1229: Update github.com/cloudflare/circl to fix
    producing incorect output for specific inputs
    (bsc#1265525)
- Update to version 12.4.1:
  * Bug fixes and minor quality-of-life enhancements.
  * Updates to data source provisioning and dashboard schemas.
- Update to version 12.4.0:
  * Introduced dynamic dashboards in public preview.
  * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
  * Added the ability to create dashboards from templates using
    sample data.
  * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
  * Added support to map one variable to multiple values.
  * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)
  * CVE-2026-21723: Fix DoS vulnerability in Templates Test
    endpoint (bsc#1272427)
- Update to version 12.3.0:
  * Released a completely redesigned logs visualization.
  * Added the ability to export dashboards directly as PNG images.
  * Introduced an interactive learning experience within the
    Grafana UI.
  * Added a Switch template variable type to quickly toggle between
    values in queries.
  * Added functionality to style table cells using CSS properties
    via the field cell option.
- Update to version 12.2.0:
  * Routine feature enhancements, minor bug fixes, and security
    patches.
- Update to version 12.1.0:
  * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
  * Redesigned the alert rule list page.
  * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
  * Added support for Service Account Impersonation in the BigQuery
    data source.
  * Introduced the Grafana Advisor in public preview.
- Update to version 12.0.0:
  * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
  * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
  * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
  * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
  * Introduced a new dashboard schema to replace the original
    single grid layout.
- Removed patches:
  * 0002-Drop-zanzana.patch
  * 0004-Bump-expr-lang.patch
  * 0006-Fix-CVE-2026-21725.patch
  * 0007-Bump-github.com-go-jose-go-jose.patch
  * 0008-Bump-github.com-apache-thrift.patch
  * 0009-Bump-golang.org-x-net.patch
- Rebased 0005-Bump-edwards25519.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1784030400">- Add Legal-Review-Notice (bsc#1271327)</changelog>
</package>
</otherdata>