Grafana 13.3.0 release notes, 27 Oct 2026

Download page What's new highlights

Security

Security: Fix CVE-2026-100105
Security: Fix CVE-2026-13719
Security: Fix CVE-2026-13720
Security: Fix CVE-2026-15577
Security: Fix CVE-2026-33374
Security: Fix CVE-2026-81841
Security: Fix CVE-2026-88858
Security: Fix CVE-2026-88967
Security: Fix CVE-2026-93294
Security: Fix CVE-2026-95502

Features and enhancements

Access control: reject global role creation in single-org mode (Enterprise)
Alerting: Add AccessControlAction entries for inhibition rules #130977, @rodrigopk
Alerting: Add notifications API boundary module #134537, @rodrigopk
Alerting: Add the Config API data layer for external Alertmanager auto-sync #129478, @rodrigopk
Alerting: Allow drag and drop for yaml file as import source for import wizard #132705, @rodrigopk
Alerting: Cleanup promote staged config code #130974, @rodrigopk
Alerting: Disable datasource picker while an import is staged #133181, @rodrigopk
Alerting: Make stage default import method in GMA import wizard #130634, @rodrigopk
Alerting: Make the Import wizard review step preview look clickable #132711, @rodrigopk
Alerting: Migrate the Import-to-GMA wizard's auto-sync integration #131523, @rodrigopk
Alerting: Migrate the auto-sync settings hook and panel onto the Config API #131521, @rodrigopk
Alerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1 #134883, @moustafab
Alerting: Promote a staged import configuration #130327, @rodrigopk
Alerting: Read staged config origin from the managed_by field #130787, @rodrigopk
Alerting: Redact secrets from the Import-to-GMA preview modal #132827, @rodrigopk
Alerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers #131520, @rodrigopk
Alerting: Remove import method from import to GMA wizard #130609, @rodrigopk
Alerting: Retire the legacy admin_config auto-sync path #131524, @rodrigopk
Alerting: Show Auto-sync support in the import wizard picker #131084, @rodrigopk
Alerting: Support Mimir alertmanager_config files in Import to GMA wizard #135637, @rodrigopk
Alerting: Surface external Alertmanager sync health in the settings UI #131527, @rodrigopk
Alerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard #131072, @rodrigopk
Auth: Bound OAuth token refresh lock waits by time instead of attempts #133929, @cinaglia
Canvas: Load the standalone plugin by default #134873, @gtk-grafana
Chore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0) #132571, @stevesg
Dashboard: Adds new a subtitle option for panel descriptions #129164, @torkelo
Dashboard: Fall back when collection deletion is unsupported #128259, @bestend
Dashboards: Add $__namespace global variable #132167, @ivanortegaalba
Dashboards: Allow Add variable + btn to add filters, links and annos as well #130841, @mdvictor
Dashboards: Hide links to deleted folders in Recently Deleted #134469, @Clarity-89
Dashboards: Improve Recently Deleted performance with server-side search #134126, @pstibrany
Dashboards: Make the auto grid to be default #130749, @bfmatei
Dashboards: Show Git Sync badges in folder search #132790, @Clarity-89
Faro: add support for trackResources #130792, @ashharrison90
FieldOverrides: Add ShowIfOverride to field config options #132419, @gtk-grafana
Frontend: add subresource integrity #131596, @jackw
Git Sync: Clarify repository links for pure Git #134238, @ferruvich
Git Sync: Ignore hidden paths in repository scans and diffs #134731, @ferruvich
GrafanaBootData: Restrict config.datasources usage via lint rule #130661, @mckn
Heatmap: Keep exemplar marker size consistent across displays #134072, @fastfrwrd
Home: Send the traces setup CTA to the OpenTelemetry onboarding guide #135135, @Clarity-89
Homepage: Add an On call schedules tab with your shifts and who's on call #134747, @Clarity-89
Homepage: Let the Synthetic Monitoring card ignore checks, targets, and probes #134217, @Clarity-89
Homepage: Let the metrics card exclude hosts and filesystems from its disk alert #133472, @Clarity-89
Homepage: Move card filters to a footer dropdown and show page kinds as icons #135851, @Clarity-89
Homepage: Replace the Recent tab with Recent activity #134633, @Clarity-89
Homepage: Stop the homepage from jumping while it loads #135321, @Clarity-89
Log Details Sidebar: Change default action to replace the current log instead of opening a new tab #133129, @matyax
Log Details: Surface errors in logs and update links styles #134427, @matyax
Logs Table: Disable hover overflow by default #132882, @matyax
Logs: Invert the orientation of the arrow in the Logs Table and Logs Panel #131156, @matyax
Packaging: Remove bash dependency from alpine Docker image #132643, @TheoBrigitte
PanelEdit: Conditional field config display & edit context #132398, @gtk-grafana
PanelOptions: Add context options to overrides #132414, @gtk-grafana
Plugins: Avoid to delete RBAC roles when upgrading #134143, @andresmgot
Plugins: Expose OpenFeature provider discovery to backend plugins #129735, @adamyeats
Plugins: Forward SSL certificate environment variables #131848, @osmocomet
Plugins: Show the correct warning when grafana.com is unreachable #132028, @lazerg
Provisioning: Add generic git OAuth app connections #134186, @amalavet
Provisioning: Add link back to the original dashboard in preview banner #129037, @MissingRoberto
Provisioning: Allow permission updates on provisioned folders #134725, @ferruvich
Provisioning: Allow resource previews in unsynced folders #133250, @ferruvich
Provisioning: Always interpret folder metadata in resources and sync #134726, @ferruvich
Provisioning: Always protect folder metadata from direct file writes #135038, @ferruvich
Provisioning: Always use folder metadata in Git Sync #134355, @Clarity-89
Provisioning: Default save from a branch preview to the previewed branch #135136, @Clarity-89
Provisioning: GitHub-style doc tabs for folder README #129073, @MissingRoberto
Provisioning: Handle repository build timeouts and branch outages #135072, @ferruvich
Provisioning: Keep folder when removing _folder.json leaves its UID unchanged #135574, @ferruvich
Provisioning: Link README items to Grafana pages when viewed in Grafana #128455, @MissingRoberto
Provisioning: Make backend user attribution unconditional #134709, @ferruvich
Provisioning: Never replace the repository root folder during incremental sync #135397, @ferruvich
Provisioning: Reject invalid resource names before API calls #133666, @ferruvich
Provisioning: Respect Git Sync polling intervals after unchanged refs #134380, @ferruvich
Provisioning: Show last checked time in Pull status #134476, @ferruvich
Provisioning: Skip previews for pull requests from forks #132522, @ferruvich
Provisioning: Stop PR previews when refs disappear #132547, @ferruvich
Provisioning: Style branch/target-branch as GitHub-like pills in preview banner #131133, @MissingRoberto
Provisioning: Support generic git OAuth connections in the UI #134187, @amalavet
Provisioning: Support legacy paths and diagnose missing source annotations #133225, @ferruvich
Provisioning: Surface the finalizer blocking a stuck repository deletion #133241, @MissingRoberto
Provisioning: Treat manager-kind conflicts as warnings #132364, @ferruvich
Provisioning: Use resource.action for preview banner title accuracy #131134, @MissingRoberto
Provisioning: recover from a deleted PR branch (pre-flight + save to new branch) #128977, @MissingRoberto
Provisioning: render mermaid diagrams in folder README #129096, @MissingRoberto
Provisioning: tolerate quota lookup failures for existing repositories #131703, @ferruvich
QueryEditor: Add extension point to the top toolbar #132289, @aocenas
RBAC: Allow removing unowned permissions through access-control APIs (Enterprise)
RBAC: Document APIs allow removing unowned permissions through access-control APIs #132518, @gamab
Replace subtitle switch UI string #132965, @imatwawana
Reports: say in the report when a variable value no longer exists (Enterprise)
Sandbox: Config flag deprecation message #135329, @jesdavpet
Sandbox: Show deprecation warning in UI tooltip (Enterprise)
Standard options: Add Ordinal unit. #130091, @simonprickett
Table: Calculate column widths independently of scrollbar visibility #134337, @fastfrwrd
Table: Prevent initial column width jump with vertical scrollbars #133615, @fastfrwrd
TimeRangePicker: Default isOnCanvas to true #135833, @torkelo
TopNav: Logo should not shrink #131170, @torkelo
Trace View: Open Logs link in a new tab (Drilldown) or in split view (Explore) #132987, @matyax
TraceView: Add Go to span on the header error banner #132550, @joey-grafana
TraceView: Add a trace banner for error and warning spans #132250, @joey-grafana
TraceView: Expand attribute plugin cross-sell promos #131472, @joey-grafana
TraceView: Open the banner span from Go to span and surface exception #133122, @joey-grafana
TraceView: Use design system tokens in the header, minimap and timeline #133339, @joey-grafana
TraceView: Use design system tokens in waterfall rows and span details #133434, @joey-grafana
Traces to logs: Extend support, and discover trace and span related logs from #130515, @matyax
Transformations: Allow setting static refIDs per transformation #131458, @Develer
Transformations: Resolve variables in the classic transformation editor #135569, @Develer
UI: Luxon on by default #134865, @fastfrwrd
Unified storage: Enable automatic cleanup of deleted resources by default #133330, @pstibrany
alerting: Remove method step from import to GMA wizard #130616, @rodrigopk

Bug fixes

Alerting: Fix alerts going to the built-in Alertmanager after startup for external-only orgs #134481, @gillesdemey
Alerting: Fix instance rows vanishing at coarse query steps in Triage #133516, @rodrigopk
Alerting: Fix notification policy drop and query drift in rule saves #131645, @rodrigopk
Alerting: Fix rule groups missing from a folder until "Show more" is clicked #131078, @JacobsonMT
Alerting: Fix stale dry-run validation and YAML errors in the Import wizard #132707, @rodrigopk
Alerting: Fix useAutoSyncConfiguration's queries behind Org Admin + feature toggle #130627, @rodrigopk
Alerting: fix GetManagedRoute returning imported route for unrelated names #132563, @JacobsonMT
Alerting: reject managed route names with leading/trailing whitespace #132566, @JacobsonMT
Dashboard: Preserve panel subtitle in V2 save model #133723, @adi-IL
Dashboards: Fix Classic model returning v2 JSON when saving a provisioned dashboard #131718, @ivanortegaalba
Dashboards: Fix adhoc and groupby variable datasource on UI import #131817, @ivanortegaalba
Dashboards: Fix browse crash and hangs when a dashboard shares its folder's UID #132634, @Clarity-89
Dashboards: Fix edit state props when swapping dashboard state in place #132001, @ifrost
Dashboards: Fix missing deletion dates in Recently Deleted #133734, @pstibrany
Dashboards: Fix query variable refresh reset to onDashboardLoad on v2 UI import #131837, @ivanortegaalba
Dashboards: Keep tags set on a new dashboard when saving it #131459, @ivanortegaalba
Dashboards: Keep variable values and time settings set by an applied spec instead of reverting them to the URL #134200, @ivanortegaalba
Dashboards: Preserve query variable refresh setting on v2 dashboard import #132007, @Sergej-Vlasov
Dashboards: Show values preview for data source variables in the edit pane #131736, @ivanortegaalba
Library panels: Fix skeleton alignment #133965, @ashharrison90
Navigation: Hide NetworkError when switching organization #131955, @AshrithaSB
Packaging: Fix issue with bundled plugins not being moved properly #131033, @kminehart
PanelEditor: Fix options pane not resizable beyond the preview's content width #131581, @ivanortegaalba
Plugins: Don't report loaded plugins as not registered when a request times out #135591, @leventebalogh
Provisioning: Fix PR dashboard previews when served from a sub-path #132569, @gustaff-weldon
Provisioning: Fix folder cleanup and hidden directory scans #135050, @ferruvich
Provisioning: Fix folder rename UID collision during full sync #130401, @ferruvich
Provisioning: Fix sync step flicker in Git Sync wizard #134108, @Clarity-89
Reporting: Fix race condition with repeat panels on the /d-render/ page #128536, @mmandrus
SQL Expressions: Read enum fields as their text #135225, @nicwestvold
SQL Expressions: Rename label columns that clash with generated column names #134869, @nicwestvold
Security: Fix CVE-2026-17183 #131061, @github-actions[bot]
Table: Fix nested apply-to-row coloring to use the nested frame's own fields #129426, @fastfrwrd
Table: Fix the height a wrapped header row reserves #132230, @fastfrwrd
Table: fix JSON cell indentation, styling, and hover reveal #130452, @fastfrwrd

Breaking changes

Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace #132172, @xnyo

Plugin development fixes & changes

ConfirmModal: Ensure focus correctly traps when invoked from a dropdown menu #132764, @ashharrison90
Datasources: Remove deprecated isDefault from DataSourceInstanceListItem #133886, @leventebalogh
GrafanaUI: Fix focus ring appearance #132808, @ashharrison90
MultiCombobox: Ensure height is consistent between empty/filled states #131255, @ashharrison90
Runtime: Stabilize async data source APIs #134390, @leventebalogh
Runtime: Stabilize plugin settings APIs #134723, @leventebalogh