Bump protobufjs, @grafana/runtime and @grafana/ui #9

Closed

dependabot[bot] wants to merge 1 commits from dependabot/npm_and_yarn/multi-e58eefe952 into master

pull from: dependabot/npm_and_yarn/multi-e58eefe952

merge into: :master

:master

:gh-pages

:dependabot/npm_and_yarn/multi-b7ca2403b9

:dependabot/npm_and_yarn/websocket-driver-0.7.5

:dependabot/npm_and_yarn/form-data-4.0.6

:dependabot/npm_and_yarn/qs-6.15.2

:dependabot/npm_and_yarn/tootallnate/once-2.0.1

:dependabot/npm_and_yarn/brace-expansion-5.0.6

:dependabot/npm_and_yarn/protobufjs/utf8-1.1.1

:dependabot/npm_and_yarn/fast-uri-3.1.2

:dependabot/npm_and_yarn/multi-f89ca03f7f

Conversation 1 Commits 1 Files Changed 2

+261 -391

dependabot[bot] commented 2026-06-19 06:47:24 +02:00 (Migrated from github.com)

Copy Link

Copy Source

Removes protobufjs. It's no longer used after updating ancestor dependencies protobufjs, @grafana/runtime and @grafana/ui. These dependencies need to be updated together.

Removes protobufjs

Updates @grafana/runtime from 12.4.2 to 12.4.4

Release notes

Sourced from @​grafana/runtime's releases.

12.4.4

Download page What's new highlights

Features and enhancements

• Browse dashboards: Make elements visible and flow better when zoomed #120678, @​aocenas
• Docker: Bump Alpine-based images to 3.23.4 #123027, @​Proximyst
• Go: Update version to 1.26.3 #124456, @​macabu
• Graphite: Strip tagged path from tags.name when aliasSub wrapping is detected #122619, @​adamyeats
• LibraryPanels: Return 403 instead of 500 for insufficient permissions #123470, @​MissingRoberto
• Plugins: Sanitise header values to printable ASCII for gRPC compatibility #122474, @​adamyeats

Bug fixes

• Alerting: Fix AlertManagerPicker visibility to check Alertmanager datasources #124073, @​konrad147
• Alerting: Treat not found error when fetching plugins as not installed #122989, @​rodrigopk
• DashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams #124893, @​ivanortegaalba
• Jaeger: Fix log event timestamp unit conversion in trace view #123711, @​ktw4071
• PostgreSQL: Allow sql_engine to return results for EXPLAIN queries #123245, @​sdague
• Security: CVE-2026-9029
• Security: CVE-2026-33382
• Security: CVE-2026-42127
• Security: CVE-2026-42129
• Security: CVE-2026-10601
• Security: CVE-2026-8609
• Security: CVE-2026-8595

12.4.3

Download page What's new highlights

Features and enhancements

• Analytics: Keep internal dashboard id #121417, @​ryantxu
• Go: Update to 1.25.9 #122095, @​macabu
• Reporting: Correctly apply appSubURL to report settings requests (Enterprise)

Bug fixes

• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4 #121481, @​alexander-akhmetov

12.4.3+security-02

Download page What's new highlights

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380

... (truncated)

Changelog

Sourced from @​grafana/runtime's changelog.

12.3.6+security-04 (2026-05-12)

Bug fixes

• Alerting: Fix error when updating Alertmanager config with autogenerated receivers #113712, @​moustafab
• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377
• Security: CVE-2026-33378
• Security: CVE-2026-33381
• Security: CVE-2026-33380

13.0.1+security-01 (2026-05-12)

Bug fixes

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377
• Security: CVE-2026-33378
• Security: CVE-2026-33381
• Security: CVE-2026-33380

12.4.3+security-02 (2026-05-12)

Bug fixes

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377

... (truncated)

Commits

• 1ffa3da [release-12.4.4] Chore: Bump and align faro packages (#123466)
• 2ce243e [release-12.4.4] Chore(deps): Upgrade rollup to >= 4.59.0 (#122765)
• 458e423 [release-12.4.4] Chore(deps): Upgrade lodash to >= 4.18.1 (#122686)
• 32e9be7 Release: 12.4.3 (#122537)
• 86c8324 [release-12.4.3] Chore(deps): Upgrade serialize-javascript to >= 7.0.3 (#122510)
• 84ddda2 [release-12.4.3] Analytics: Keep internal dashboard id (#121417)
• a095a3a Release: 12.4.2 (#121092)
• See full diff in compare view

Updates @grafana/ui from 12.4.2 to 12.4.4

Release notes

Sourced from @​grafana/ui's releases.

12.4.4

Download page What's new highlights

Features and enhancements

• Browse dashboards: Make elements visible and flow better when zoomed #120678, @​aocenas
• Docker: Bump Alpine-based images to 3.23.4 #123027, @​Proximyst
• Go: Update version to 1.26.3 #124456, @​macabu
• Graphite: Strip tagged path from tags.name when aliasSub wrapping is detected #122619, @​adamyeats
• LibraryPanels: Return 403 instead of 500 for insufficient permissions #123470, @​MissingRoberto
• Plugins: Sanitise header values to printable ASCII for gRPC compatibility #122474, @​adamyeats

Bug fixes

• Alerting: Fix AlertManagerPicker visibility to check Alertmanager datasources #124073, @​konrad147
• Alerting: Treat not found error when fetching plugins as not installed #122989, @​rodrigopk
• DashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams #124893, @​ivanortegaalba
• Jaeger: Fix log event timestamp unit conversion in trace view #123711, @​ktw4071
• PostgreSQL: Allow sql_engine to return results for EXPLAIN queries #123245, @​sdague
• Security: CVE-2026-9029
• Security: CVE-2026-33382
• Security: CVE-2026-42127
• Security: CVE-2026-42129
• Security: CVE-2026-10601
• Security: CVE-2026-8609
• Security: CVE-2026-8595

12.4.3

Download page What's new highlights

Features and enhancements

• Analytics: Keep internal dashboard id #121417, @​ryantxu
• Go: Update to 1.25.9 #122095, @​macabu
• Reporting: Correctly apply appSubURL to report settings requests (Enterprise)

Bug fixes

• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4 #121481, @​alexander-akhmetov

12.4.3+security-02

Download page What's new highlights

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380

... (truncated)

Changelog

Sourced from @​grafana/ui's changelog.

12.3.6+security-04 (2026-05-12)

Bug fixes

• Alerting: Fix error when updating Alertmanager config with autogenerated receivers #113712, @​moustafab
• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377
• Security: CVE-2026-33378
• Security: CVE-2026-33381
• Security: CVE-2026-33380

13.0.1+security-01 (2026-05-12)

Bug fixes

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377
• Security: CVE-2026-33378
• Security: CVE-2026-33381
• Security: CVE-2026-33380

12.4.3+security-02 (2026-05-12)

Bug fixes

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377

... (truncated)

Commits

• 42cdc39 [release-12.4.4] patch: apply patches for June 2nd release (#125791)
• 511a398 [release-12.4.4] Table: Use npm-published grafana fork of react-data-grid (#1...
• 1ffa3da [release-12.4.4] Chore: Bump and align faro packages (#123466)
• 2ce243e [release-12.4.4] Chore(deps): Upgrade rollup to >= 4.59.0 (#122765)
• 458e423 [release-12.4.4] Chore(deps): Upgrade lodash to >= 4.18.1 (#122686)
• 32e9be7 Release: 12.4.3 (#122537)
• 72d266a [release-12.4.3] Chore(deps): Upgrade storybook to >= 8.6.17 (#122442)
• a095a3a Release: 12.4.2 (#121092)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Removes [protobufjs](https://github.com/protobufjs/protobuf.js). It's no longer used after updating ancestor dependencies [protobufjs](https://github.com/protobufjs/protobuf.js), [@grafana/runtime](https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime) and [@grafana/ui](https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui). These dependencies need to be updated together. Removes `protobufjs` Updates `@grafana/runtime` from 12.4.2 to 12.4.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grafana/grafana/releases">@​grafana/runtime's releases</a>.</em></p> <blockquote> <h2>12.4.4</h2> <p><a href="https://grafana.com/grafana/download/12.4.4">Download page</a> <a href="https://grafana.com/docs/grafana/latest/whatsnew/">What's new highlights</a></p> <h3>Features and enhancements</h3> <ul> <li><strong>Browse dashboards:</strong> Make elements visible and flow better when zoomed <a href="https://redirect.github.com/grafana/grafana/pull/120678">#120678</a>, <a href="https://github.com/aocenas"><code>@​aocenas</code></a></li> <li><strong>Docker:</strong> Bump Alpine-based images to 3.23.4 <a href="https://redirect.github.com/grafana/grafana/pull/123027">#123027</a>, <a href="https://github.com/Proximyst"><code>@​Proximyst</code></a></li> <li><strong>Go:</strong> Update version to 1.26.3 <a href="https://redirect.github.com/grafana/grafana/pull/124456">#124456</a>, <a href="https://github.com/macabu"><code>@​macabu</code></a></li> <li><strong>Graphite:</strong> Strip tagged path from <code>tags.name</code> when <code>aliasSub</code> wrapping is detected <a href="https://redirect.github.com/grafana/grafana/pull/122619">#122619</a>, <a href="https://github.com/adamyeats"><code>@​adamyeats</code></a></li> <li><strong>LibraryPanels:</strong> Return 403 instead of 500 for insufficient permissions <a href="https://redirect.github.com/grafana/grafana/pull/123470">#123470</a>, <a href="https://github.com/MissingRoberto"><code>@​MissingRoberto</code></a></li> <li><strong>Plugins:</strong> Sanitise header values to printable ASCII for gRPC compatibility <a href="https://redirect.github.com/grafana/grafana/pull/122474">#122474</a>, <a href="https://github.com/adamyeats"><code>@​adamyeats</code></a></li> </ul> <h3>Bug fixes</h3> <ul> <li><strong>Alerting:</strong> Fix AlertManagerPicker visibility to check Alertmanager datasources <a href="https://redirect.github.com/grafana/grafana/pull/124073">#124073</a>, <a href="https://github.com/konrad147"><code>@​konrad147</code></a></li> <li><strong>Alerting:</strong> Treat not found error when fetching plugins as not installed <a href="https://redirect.github.com/grafana/grafana/pull/122989">#122989</a>, <a href="https://github.com/rodrigopk"><code>@​rodrigopk</code></a></li> <li><strong>DashboardDS:</strong> Fix Mixed panels not updating on time-range change with stale upstreams <a href="https://redirect.github.com/grafana/grafana/pull/124893">#124893</a>, <a href="https://github.com/ivanortegaalba"><code>@​ivanortegaalba</code></a></li> <li><strong>Jaeger:</strong> Fix log event timestamp unit conversion in trace view <a href="https://redirect.github.com/grafana/grafana/pull/123711">#123711</a>, <a href="https://github.com/ktw4071"><code>@​ktw4071</code></a></li> <li><strong>PostgreSQL:</strong> Allow sql_engine to return results for EXPLAIN queries <a href="https://redirect.github.com/grafana/grafana/pull/123245">#123245</a>, <a href="https://github.com/sdague"><code>@​sdague</code></a></li> <li><strong>Security</strong>: CVE-2026-9029</li> <li><strong>Security</strong>: CVE-2026-33382</li> <li><strong>Security</strong>: CVE-2026-42127</li> <li><strong>Security</strong>: CVE-2026-42129</li> <li><strong>Security</strong>: CVE-2026-10601</li> <li><strong>Security</strong>: CVE-2026-8609</li> <li><strong>Security</strong>: CVE-2026-8595</li> </ul> <h2>12.4.3</h2> <p><a href="https://grafana.com/grafana/download/12.4.3">Download page</a> <a href="https://grafana.com/docs/grafana/latest/whatsnew/">What's new highlights</a></p> <h3>Features and enhancements</h3> <ul> <li><strong>Analytics:</strong> Keep internal dashboard id <a href="https://redirect.github.com/grafana/grafana/pull/121417">#121417</a>, <a href="https://github.com/ryantxu"><code>@​ryantxu</code></a></li> <li><strong>Go:</strong> Update to 1.25.9 <a href="https://redirect.github.com/grafana/grafana/pull/122095">#122095</a>, <a href="https://github.com/macabu"><code>@​macabu</code></a></li> <li><strong>Reporting:</strong> Correctly apply appSubURL to report settings requests (Enterprise)</li> </ul> <h3>Bug fixes</h3> <ul> <li><strong>Alerting:</strong> Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4 <a href="https://redirect.github.com/grafana/grafana/pull/121481">#121481</a>, <a href="https://github.com/alexander-akhmetov"><code>@​alexander-akhmetov</code></a></li> </ul> <h2>12.4.3+security-02</h2> <p><a href="https://grafana.com/grafana/download/12.4.3+security-02">Download page</a> <a href="https://grafana.com/docs/grafana/latest/whatsnew/">What's new highlights</a></p> <ul> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/grafana/grafana/blob/main/CHANGELOG.md">@​grafana/runtime's changelog</a>.</em></p> <blockquote> <!-- raw HTML omitted --> <h1>12.3.6+security-04 (2026-05-12)</h1> <h3>Bug fixes</h3> <ul> <li><strong>Alerting:</strong> Fix error when updating Alertmanager config with autogenerated receivers <a href="https://redirect.github.com/grafana/grafana/pull/113712">#113712</a>, <a href="https://github.com/moustafab"><code>@​moustafab</code></a></li> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> <li><strong>Security</strong>: CVE-2026-33376</li> <li><strong>Security</strong>: CVE-2026-28379</li> <li><strong>Security</strong>: CVE-2026-33377</li> <li><strong>Security</strong>: CVE-2026-33378</li> <li><strong>Security</strong>: CVE-2026-33381</li> <li><strong>Security</strong>: CVE-2026-33380</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <h1>13.0.1+security-01 (2026-05-12)</h1> <h3>Bug fixes</h3> <ul> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> <li><strong>Security</strong>: CVE-2026-33376</li> <li><strong>Security</strong>: CVE-2026-28379</li> <li><strong>Security</strong>: CVE-2026-33377</li> <li><strong>Security</strong>: CVE-2026-33378</li> <li><strong>Security</strong>: CVE-2026-33381</li> <li><strong>Security</strong>: CVE-2026-33380</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <h1>12.4.3+security-02 (2026-05-12)</h1> <h3>Bug fixes</h3> <ul> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> <li><strong>Security</strong>: CVE-2026-33376</li> <li><strong>Security</strong>: CVE-2026-28379</li> <li><strong>Security</strong>: CVE-2026-33377</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grafana/grafana/commit/1ffa3daa27a1f83dd5a06cb058183393aaf5fcc1"><code>1ffa3da</code></a> [release-12.4.4] Chore: Bump and align faro packages (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/123466">#123466</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/2ce243ef5ce4096769ea617904c24f45f5f5d892"><code>2ce243e</code></a> [release-12.4.4] Chore(deps): Upgrade rollup to &gt;= 4.59.0 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/122765">#122765</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/458e423bf91a12b078a08bcb9e88b24562f7334c"><code>458e423</code></a> [release-12.4.4] Chore(deps): Upgrade lodash to &gt;= 4.18.1 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/122686">#122686</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/32e9be78218a895625fc920cfae43d0b7f43456f"><code>32e9be7</code></a> Release: 12.4.3 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/122537">#122537</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/86c83248f8739fbc178c0e5c451b44bdba7b5ed7"><code>86c8324</code></a> [release-12.4.3] Chore(deps): Upgrade serialize-javascript to &gt;= 7.0.3 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/122510">#122510</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/84ddda2c0535f88cc704f8c5d2d6e12282cdb0c3"><code>84ddda2</code></a> [release-12.4.3] Analytics: Keep internal dashboard id (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/121417">#121417</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/a095a3a7c75d63ba90090217aac7d66b8f2dd960"><code>a095a3a</code></a> Release: 12.4.2 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-runtime/issues/121092">#121092</a>)</li> <li>See full diff in <a href="https://github.com/grafana/grafana/commits/v12.4.4/packages/grafana-runtime">compare view</a></li> </ul> </details> <br /> Updates `@grafana/ui` from 12.4.2 to 12.4.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grafana/grafana/releases">@​grafana/ui's releases</a>.</em></p> <blockquote> <h2>12.4.4</h2> <p><a href="https://grafana.com/grafana/download/12.4.4">Download page</a> <a href="https://grafana.com/docs/grafana/latest/whatsnew/">What's new highlights</a></p> <h3>Features and enhancements</h3> <ul> <li><strong>Browse dashboards:</strong> Make elements visible and flow better when zoomed <a href="https://redirect.github.com/grafana/grafana/pull/120678">#120678</a>, <a href="https://github.com/aocenas"><code>@​aocenas</code></a></li> <li><strong>Docker:</strong> Bump Alpine-based images to 3.23.4 <a href="https://redirect.github.com/grafana/grafana/pull/123027">#123027</a>, <a href="https://github.com/Proximyst"><code>@​Proximyst</code></a></li> <li><strong>Go:</strong> Update version to 1.26.3 <a href="https://redirect.github.com/grafana/grafana/pull/124456">#124456</a>, <a href="https://github.com/macabu"><code>@​macabu</code></a></li> <li><strong>Graphite:</strong> Strip tagged path from <code>tags.name</code> when <code>aliasSub</code> wrapping is detected <a href="https://redirect.github.com/grafana/grafana/pull/122619">#122619</a>, <a href="https://github.com/adamyeats"><code>@​adamyeats</code></a></li> <li><strong>LibraryPanels:</strong> Return 403 instead of 500 for insufficient permissions <a href="https://redirect.github.com/grafana/grafana/pull/123470">#123470</a>, <a href="https://github.com/MissingRoberto"><code>@​MissingRoberto</code></a></li> <li><strong>Plugins:</strong> Sanitise header values to printable ASCII for gRPC compatibility <a href="https://redirect.github.com/grafana/grafana/pull/122474">#122474</a>, <a href="https://github.com/adamyeats"><code>@​adamyeats</code></a></li> </ul> <h3>Bug fixes</h3> <ul> <li><strong>Alerting:</strong> Fix AlertManagerPicker visibility to check Alertmanager datasources <a href="https://redirect.github.com/grafana/grafana/pull/124073">#124073</a>, <a href="https://github.com/konrad147"><code>@​konrad147</code></a></li> <li><strong>Alerting:</strong> Treat not found error when fetching plugins as not installed <a href="https://redirect.github.com/grafana/grafana/pull/122989">#122989</a>, <a href="https://github.com/rodrigopk"><code>@​rodrigopk</code></a></li> <li><strong>DashboardDS:</strong> Fix Mixed panels not updating on time-range change with stale upstreams <a href="https://redirect.github.com/grafana/grafana/pull/124893">#124893</a>, <a href="https://github.com/ivanortegaalba"><code>@​ivanortegaalba</code></a></li> <li><strong>Jaeger:</strong> Fix log event timestamp unit conversion in trace view <a href="https://redirect.github.com/grafana/grafana/pull/123711">#123711</a>, <a href="https://github.com/ktw4071"><code>@​ktw4071</code></a></li> <li><strong>PostgreSQL:</strong> Allow sql_engine to return results for EXPLAIN queries <a href="https://redirect.github.com/grafana/grafana/pull/123245">#123245</a>, <a href="https://github.com/sdague"><code>@​sdague</code></a></li> <li><strong>Security</strong>: CVE-2026-9029</li> <li><strong>Security</strong>: CVE-2026-33382</li> <li><strong>Security</strong>: CVE-2026-42127</li> <li><strong>Security</strong>: CVE-2026-42129</li> <li><strong>Security</strong>: CVE-2026-10601</li> <li><strong>Security</strong>: CVE-2026-8609</li> <li><strong>Security</strong>: CVE-2026-8595</li> </ul> <h2>12.4.3</h2> <p><a href="https://grafana.com/grafana/download/12.4.3">Download page</a> <a href="https://grafana.com/docs/grafana/latest/whatsnew/">What's new highlights</a></p> <h3>Features and enhancements</h3> <ul> <li><strong>Analytics:</strong> Keep internal dashboard id <a href="https://redirect.github.com/grafana/grafana/pull/121417">#121417</a>, <a href="https://github.com/ryantxu"><code>@​ryantxu</code></a></li> <li><strong>Go:</strong> Update to 1.25.9 <a href="https://redirect.github.com/grafana/grafana/pull/122095">#122095</a>, <a href="https://github.com/macabu"><code>@​macabu</code></a></li> <li><strong>Reporting:</strong> Correctly apply appSubURL to report settings requests (Enterprise)</li> </ul> <h3>Bug fixes</h3> <ul> <li><strong>Alerting:</strong> Document Grafana HA Alertmanager cluster metrics prefix change in Grafana 12.4 <a href="https://redirect.github.com/grafana/grafana/pull/121481">#121481</a>, <a href="https://github.com/alexander-akhmetov"><code>@​alexander-akhmetov</code></a></li> </ul> <h2>12.4.3+security-02</h2> <p><a href="https://grafana.com/grafana/download/12.4.3+security-02">Download page</a> <a href="https://grafana.com/docs/grafana/latest/whatsnew/">What's new highlights</a></p> <ul> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/grafana/grafana/blob/main/CHANGELOG.md">@​grafana/ui's changelog</a>.</em></p> <blockquote> <!-- raw HTML omitted --> <h1>12.3.6+security-04 (2026-05-12)</h1> <h3>Bug fixes</h3> <ul> <li><strong>Alerting:</strong> Fix error when updating Alertmanager config with autogenerated receivers <a href="https://redirect.github.com/grafana/grafana/pull/113712">#113712</a>, <a href="https://github.com/moustafab"><code>@​moustafab</code></a></li> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> <li><strong>Security</strong>: CVE-2026-33376</li> <li><strong>Security</strong>: CVE-2026-28379</li> <li><strong>Security</strong>: CVE-2026-33377</li> <li><strong>Security</strong>: CVE-2026-33378</li> <li><strong>Security</strong>: CVE-2026-33381</li> <li><strong>Security</strong>: CVE-2026-33380</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <h1>13.0.1+security-01 (2026-05-12)</h1> <h3>Bug fixes</h3> <ul> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> <li><strong>Security</strong>: CVE-2026-33376</li> <li><strong>Security</strong>: CVE-2026-28379</li> <li><strong>Security</strong>: CVE-2026-33377</li> <li><strong>Security</strong>: CVE-2026-33378</li> <li><strong>Security</strong>: CVE-2026-33381</li> <li><strong>Security</strong>: CVE-2026-33380</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <h1>12.4.3+security-02 (2026-05-12)</h1> <h3>Bug fixes</h3> <ul> <li><strong>Security</strong>: CVE-2026-28374</li> <li><strong>Security</strong>: CVE-2026-28376</li> <li><strong>Security</strong>: CVE-2026-28383</li> <li><strong>Security</strong>: CVE-2026-28380</li> <li><strong>Security</strong>: CVE-2026-33376</li> <li><strong>Security</strong>: CVE-2026-28379</li> <li><strong>Security</strong>: CVE-2026-33377</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29"><code>42cdc39</code></a> [release-12.4.4] patch: apply patches for June 2nd release (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/125791">#125791</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/511a3980428eaa3981ef6965b0152bf2eeee783e"><code>511a398</code></a> [release-12.4.4] Table: Use npm-published grafana fork of react-data-grid (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/1">#1</a>...</li> <li><a href="https://github.com/grafana/grafana/commit/1ffa3daa27a1f83dd5a06cb058183393aaf5fcc1"><code>1ffa3da</code></a> [release-12.4.4] Chore: Bump and align faro packages (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/123466">#123466</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/2ce243ef5ce4096769ea617904c24f45f5f5d892"><code>2ce243e</code></a> [release-12.4.4] Chore(deps): Upgrade rollup to &gt;= 4.59.0 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/122765">#122765</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/458e423bf91a12b078a08bcb9e88b24562f7334c"><code>458e423</code></a> [release-12.4.4] Chore(deps): Upgrade lodash to &gt;= 4.18.1 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/122686">#122686</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/32e9be78218a895625fc920cfae43d0b7f43456f"><code>32e9be7</code></a> Release: 12.4.3 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/122537">#122537</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/72d266a0142bcb5d2a4e963529ba285a52ffdee6"><code>72d266a</code></a> [release-12.4.3] Chore(deps): Upgrade storybook to &gt;= 8.6.17 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/122442">#122442</a>)</li> <li><a href="https://github.com/grafana/grafana/commit/a095a3a7c75d63ba90090217aac7d66b8f2dd960"><code>a095a3a</code></a> Release: 12.4.2 (<a href="https://github.com/grafana/grafana/tree/HEAD/packages/grafana-ui/issues/121092">#121092</a>)</li> <li>See full diff in <a href="https://github.com/grafana/grafana/commits/v12.4.4/packages/grafana-ui">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/andydixon/grafana-battery-visualisation/network/alerts). </details>

dependabot[bot] commented 2026-07-21 10:49:37 +02:00 (Migrated from github.com)

Copy Link

Copy Source

Superseded by #12.

Superseded by #12.

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

Pull requests that update a dependency file

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

javascript

Pull requests that update javascript code

question

Further information is requested

wontfix

This will not be worked on

No labels dependencies javascript

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

andy (Andy Dixon)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: andy/grafana-battery-visualisation#9