fix(deps): update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
grafana/grafana		minor	12.3.2 → 12.4.9
prom/prometheus		minor	v3.9.1 → v3.14.0
org.sonatype.central:central-publishing-maven-plugin (source)	build	minor	0.10.0 → 0.11.0
org.jacoco:jacoco-maven-plugin (source)	build	patch	0.8.14 → 0.8.15
org.apache.maven.plugins:maven-surefire-plugin (source)	build	patch	3.5.4 → 3.5.6
org.apache.maven.plugins:maven-failsafe-plugin (source)	build	patch	3.5.4 → 3.5.6
org.projectlombok:lombok (source)		patch	1.18.42 → 1.18.46
com.github.spotbugs:spotbugs (source)	build	minor	4.9.8 → 4.10.4
com.github.spotbugs:spotbugs-maven-plugin (source)	build	minor	4.9.8.2 → 4.10.4.0
org.testcontainers:testcontainers (source)	compile	patch	2.0.3 → 2.0.5
org.slf4j:jcl-over-slf4j (source, changelog)	compile	patch	2.0.17 → 2.0.18
org.slf4j:slf4j-simple (source, changelog)	test	patch	2.0.17 → 2.0.18
org.slf4j:slf4j-api (source, changelog)	compile	patch	2.0.17 → 2.0.18
org.projectlombok:lombok (source)	compile	patch	1.18.42 → 1.18.46
org.mockito:mockito-core	test	minor	5.21.0 → 5.23.0
org.junit.jupiter:junit-jupiter (source)	test	minor	6.0.2 → 6.1.3
org.apache.commons:commons-fileupload2-jakarta-servlet6 (source)	compile	patch	2.0.0-M4 → 2.0.0-M5
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	compile	minor	2.8.15 → 2.9.0
org.jdbi:jdbi3-bom (source)	import	minor	3.51.0 → 3.54.0
com.google.guava:guava	compile	minor	33.5.0-jre → 33.7.1-jre
com.github.spotbugs:spotbugs-annotations (source)	optional	minor	4.9.8 → 4.10.4
org.wikidata.wdtk:wdtk-datamodel (source)	compile	minor	0.17.0 → 0.18.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	compile	minor	2.21.0 → 2.22.2
com.fasterxml.jackson.core:jackson-annotations (source)	compile	minor	2.21 → 2.22
io.swagger.core.v3:swagger-annotations	compile	patch	2.2.42 → 2.2.55
commons-io:commons-io (source)	compile	minor	2.21.0 → 2.22.0
com.ibm.icu:icu4j (source)	compile	minor	78.2 → 78.3
org.geotools:gt-main	compile	minor	34.2 → 34.5
org.springframework.boot:spring-boot-starter-parent (source)	parent	patch	3.5.10 → 3.5.16

---

Release Notes

grafana/grafana (grafana/grafana)

v12.4.9

Security

• CVE-2026-17183

Features and enhancements

• Dashboard Import: Labels in v2 schema #​130428, @​harisrozajac

Bug fixes

• Azure Monitor: fix migration for dimension filters #​130521, @​olivierlemasle

v12.4.8

v12.4.7

Features and enhancements

• Dashboards: Get annotations and dashboard endpoint performance improvements #​129780, @​filewalkwithme

Bug fixes

• DashboardDS: Fix Mixed panels with a time override stuck in permanent loading #​129289, @​oscarkilhed

v12.4.6

Features and enhancements

• Alerting: Add protected fields authorization check to provisioning API #​127940, @​grafana-writer[bot]
• Alerting: Return 403 instead of 500 on contact point provenance mismatch #​127814, @​rwwiv
• Go: Update version to 1.26.5 #​128017, @​macabu

Bug fixes

• Jaeger: Handle gzip, deflate, and brotli compressed API responses #​128062, @​zoltanbedi
• alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL #​128753, @​dhananjay6561

v12.4.5

Features and enhancements

• Docker: Bump Alpine-based images to 3.24.1 #​126538, @​macabu

Bug fixes

• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid #​125769, @​papagian

v12.4.4

Features and enhancements

• Browse dashboards: Make elements visible and flow better when zoomed #​120678, @​aocenas
• Docker: Bump Alpine-based images to 3.23.4 #​123027, @​Proximyst
• Go: Update version to 1.26.3 #​124456, @​macabu
• Graphite: Strip tagged path from tags.name when aliasSub wrapping is detected #​122619, @​adamyeats
• LibraryPanels: Return 403 instead of 500 for insufficient permissions #​123470, @​MissingRoberto
• Plugins: Sanitise header values to printable ASCII for gRPC compatibility #​122474, @​adamyeats

Bug fixes

• Alerting: Fix AlertManagerPicker visibility to check Alertmanager datasources #​124073, @​konrad147
• Alerting: Treat not found error when fetching plugins as not installed #​122989, @​rodrigopk
• DashboardDS: Fix Mixed panels not updating on time-range change with stale upstreams #​124893, @​ivanortegaalba
• Jaeger: Fix log event timestamp unit conversion in trace view #​123711, @​ktw4071
• PostgreSQL: Allow sql_engine to return results for EXPLAIN queries #​123245, @​sdague

v12.4.3

Bug fixes

• Security: CVE-2026-28374
• Security: CVE-2026-28376
• Security: CVE-2026-28383
• Security: CVE-2026-28380
• Security: CVE-2026-33376
• Security: CVE-2026-28379
• Security: CVE-2026-33377
• Security: CVE-2026-33378
• Security: CVE-2026-33381
• Security: CVE-2026-33380

v12.4.2

Features and enhancements

• Analytics tab: Improve voice over accessibility (Enterprise)
• Dashboards a11y: Do not open time zonemenu on focus #​120388, @​idastambuk
• Dashboards: Resolve display names by identity in version history #​120273, @​ivanortegaalba
• Plugins: Forward AWS SDK credential chain env vars to external AWS plugins #​120209, @​kevinwcyu
• Public Dashboards: Prevent unintended CRUD operations from different orgs #​120457, @​mmandrus

Bug fixes

• IAM: Handle NULL team_member.external column to fix dashboard loading #​120179, @​difro
• Plugins: Fix installer IsDisabled condition #​120568, @​andresmgot
• Plugins: Forward PLUGIN_UNIX_SOCKET_DIR to plugin processes to fix tmp dir in restricted environments #​120275, @​HarshadaGawas05
• Security: Fix CVE-2026-27876
• Security: Fix CVE-2026-27877
• Security: Fix CVE-2026-28375
• Security: Fix CVE-2026-27879
• Security: Fix CVE-2026-27880
• Security: Fix CVE-2026-27876
• Security: Fix CVE-2026-27876
• Security: Fix CVE-2026-33375

v12.4.1

Features and enhancements

• AccessControl: Invalidate scope resolver cache on datasource deletion #​118741, @​mihai-turdean
• Go: Update to 1.25.8 #​119693, @​macabu
• Rendering: Add support for custom CA certs in Image Renderer #​118859, @​mrevutskyi

Bug fixes

• AccessControl: Fix test utility for datasource deletion permissions cleanup (Enterprise)
• Alerting: Change scope for testing new receivers to use supported resource type. #​118495, @​yuri-tceretian
• Alerting: Fix CollateAlertRuleGroup migration for MariaDB compatibility #​119028, @​alexander-akhmetov

v12.4.0

Features and enhancements

• API: Add missing scope check on dashboards #​116885, @​Proximyst
• Alerting Enrichment: Add new RBAC permissions for reading and writing enrichments (Enterprise)
• Alerting: Add Alert Rules tabs navigation with feature toggle #​116253, @​aifraenkel
• Alerting: Add Alert activity card to alerting home page #​115822, @​dhalachliyski
• Alerting: Add Cursor frontmatter to CLAUDE.md for auto-loading #​115613, @​soniaAguilarPeiron
• Alerting: Add Edit/Export actions to group rows, clickable folders, and square icon for recording rules #​117763, @​konrad147
• Alerting: Add RBAC for enrichment #​113296, @​soniaAguilarPeiron
• Alerting: Add RBAC to enrichments (Enterprise)
• Alerting: Add UI for imported time intervals #​116249, @​soniaAguilarPeiron
• Alerting: Add alert labels as tags on annotations (#​28610) #​116244, @​msvechla
• Alerting: Add alertingSyncNotifiersApiMigration feature flag #​117946, @​rodrigopk
• Alerting: Add compressed periodic save for alert instances #​111803, @​softho0n
• Alerting: Add counts for firing and pending alert rules #​113309, @​laurenashleigh
• Alerting: Add empty state to triage page WIP #​113390, @​laurenashleigh
• Alerting: Add expression type information to webhook valueString #​112312, @​softho0n
• Alerting: Add feature toggle to disable DMA creation in UI #​116830, @​soniaAguilarPeiron
• Alerting: Add first CLAUDE.md in the frontend alerting folder #​114308, @​soniaAguilarPeiron
• Alerting: Add folder_uid label to the grafana_alerting_rule_group_rules metric #​115129, @​alexander-akhmetov
• Alerting: Add gh in CLAUDE.md #​114992, @​soniaAguilarPeiron
• Alerting: Add limits for the size of expanded notification templates #​115242, @​yuri-tceretian
• Alerting: Add managed folder validation frontend #​115203, @​laurenashleigh
• Alerting: Add policy selector in the alert rule form #​117464, @​soniaAguilarPeiron
• Alerting: Add saved searches feature for alert rules page #​115001, @​dhalachliyski
• Alerting: Add viz wrapper for run queries in enrichment (Enterprise)
• Alerting: Alerts page performance improvements #​113391, @​konrad147
• Alerting: Analyze an alert rule with Grafana Assistant #​114420, @​soniaAguilarPeiron
• Alerting: Apply pending period to NoData and Error alerts #​117024, @​santihernandezc
• Alerting: Change group filtering to search-based using lightweight BE endpoint #​114347, @​laurenashleigh
• Alerting: Collate alert_rule.namespace_uid column as binary #​115152, @​alexander-akhmetov
• Alerting: Collate rule_group column as binary #​114365, @​rwwiv
• Alerting: Config option to set default datasource in Prometheus rule import #​115665, @​alexander-akhmetov
• Alerting: Correct relative paths in CLAUDE.md Required Reading links #​114709, @​dhalachliyski
• Alerting: Dedicated permission for Template testing API #​115032, @​yuri-tceretian
• Alerting: Deprecate OpsGenie integration #​117085, @​yuri-tceretian
• Alerting: Filter out imported contact points from simplified routing dropdown #​116408, @​soniaAguilarPeiron
• Alerting: Hide DMA options when no manageAlerts datasources exist #​115952, @​soniaAguilarPeiron
• Alerting: Import to Grafana Alerting Wizard - first iteration #​116924, @​soniaAguilarPeiron
• Alerting: Improve ASH Loki query efficiency by including folderUID #​113322, @​JacobsonMT
• Alerting: Improve instance count display #​114997, @​laurenashleigh
• Alerting: Make AI Helper in triage to use only assistant (Enterprise)
• Alerting: Make default notification configuration use empty receiver #​116368, @​yuri-tceretian
• Alerting: Make saved search name clickable to apply search #​116832, @​dhalachliyski
• Alerting: Migrate to K8s style receiver testing API #​116847, @​rodrigopk
• Alerting: Notification configuration tabs #​116749, @​aifraenkel
• Alerting: Prevent routing preview from auto-triggering on mount #​113749, @​laurenashleigh
• Alerting: Prevent users from saving rules to git-synced folders #​114944, @​rwwiv
• Alerting: Protected fields for Contact points #​115442, @​yuri-tceretian
• Alerting: Receiver testing via app platform APIs #​111338, @​yuri-tceretian
• Alerting: Refactor error for duplicate names on notificationPolicy creation #​117797, @​rodrigopk
• Alerting: Replace the static radio button list for notification routing with a dropdown #​117414, @​soniaAguilarPeiron
• Alerting: Resize created_by and updated_by columns in alert rules tables #​113870, @​yuri-tceretian
• Alerting: Restrict import UI to admin users only #​117441, @​rodrigopk
• Alerting: Show alert rule scoping in the UI to enrichments list and form (Enterprise)
• Alerting: Single alertmanager contact points versions #​116076, @​soniaAguilarPeiron
• Alerting: Update GOPS labels API calls to v2alpha1 #​116327, @​soniaAguilarPeiron
• Alerting: Update RuleGroupConfig definitions with missing fields #​115850, @​JacobsonMT
• Alerting: Update UI of instance counts on triage page #​113660, @​laurenashleigh
• Alerting: Update createdBy field when silence is being Recreated #​115543, @​paulojmdias
• Alerting: Update docs for ash AI helper button #​114229, @​soniaAguilarPeiron
• Alerting: Update import wizard to use policyTreeName as config identifier #​117382, @​soniaAguilarPeiron
• Alerting: Update logic handling canCreate in integrations version, and handle the new deprecated field in the schema #​116672, @​soniaAguilarPeiron
• Alerting: Update origin for openAssistant in ash (Enterprise)
• Alerting: Update prompt for Analyze rule AI button #​115341, @​soniaAguilarPeiron
• Alerting: Update prompt for the button 'Analyze rule with assistant' button #​114593, @​konrad147
• Alerting: Update tooltip message when routing preview is disabled #​113962, @​laurenashleigh
• Alerting: Update translations (Enterprise)
• Alerting: Use assistant inline hook instead of llm for template ai button (Enterprise)
• Alerting: Use canUse instead of provenance to filter out time intervals #​117036, @​rodrigopk
• Alerting: Use data source headers when remote writing #​114528, @​santihernandezc
• AppChrome: Add proper menu icon for menu, logo icon becomes home #​114713, @​torkelo
• Auditing: Allow configuring Loki retries and timeout (Enterprise)
• Auditing: Track uid endpoints for dashboards, not id (Enterprise)
• Auth: Add SSO settings PATCH endpoint #​117346, @​colin-stuart
• Auth: Add support for validating OAuth ID token signatures #​116442, @​DanCech
• Auth: Promote SCIM to GA #​116963, @​linoman
• Authz: Implement Query operation for Zanzana with folder parent retrieval #​113483, @​mihai-turdean
• Avatar: Require sign-in, remove queue, respect timeout #​116891, @​macabu
• Azure Monitor: Clear filter options in logs builder when key changes #​116329, @​aangelisc
• Azure: Improved column handling in logs query builder #​114667, @​aangelisc
• Azure: Include aggregate columns in logs builder #​114684, @​aangelisc
• CandleStick: Add timeRangePan #​113888, @​drew08t
• Chore: API: add query params to the spec #​117217, @​yudintsevegor
• Chore: Access API: add missing query params (Enterprise)
• Chore: Deprecate experimental restore dashboard API #​116256, @​ryantxu
• Chore: Deprecate the localeFormatPreference feature toggle #​116621, @​joshhunt
• Chore: Improve packaging/docker/run.sh #​114012, @​dmotte
• Chore: RBAC: Migrate role picker to rtkq #​116571, @​yudintsevegor
• Chore: Remove Drilldown Investigations #​115471, @​joey-grafana
• Chore: Remove logRequestsInstrumentedAsUnknown feature flag #​116417, @​undef1nd
• Chore: Remove pinNavItems feature toggle #​113855, @​tomratcliffe
• Chore: Remove unifiedHistory feature toggle and associated code #​113857, @​tomratcliffe
• Chore: Remove deprecated language_provider methods in prometheus package #​114361, @​itsmylife
• Chore: Remove experimental feature individualCookiePreferences #​116374, @​hairyhenderson
• Chore: Remove unused+experimental /dashboards/calculate-diff API support #​114151, @​ryantxu
• Chore: Rudderstack upgrade to SDK v3 behind flag #​114126, @​samsch
• Chore: Upgrade Grafana Faro to v2, removing web_vitals_attribution_enabled #​117516, @​tskarhed
• Cleanup: Remove CSV drag-and-drop snapshot query feature #​113645, @​fastfrwrd
• Cloud Monitoring: Add support for Google Cloud universe_domain #​115931, @​aangelisc
• CloudMigrations: Remove feature toggle and introduce config setting to disable it #​114223, @​macabu
• CloudWatch Logs: Hide internal logs field #​114121, @​kevinwcyu
• CloudWatch Logs: Limit CloudWatch logs queries to use logGroupIdentifiers only for monitoring accounts #​113137, @​kevinwcyu
• CloudWatch Logs: Select log groups with the log group selector and $__logGroups macro for OpenSearch Structured Query Language queries #​116222, @​kevinwcyu
• CloudWatch: Add anomaly command to language support, add documentation for anomaly queries #​113311, @​idastambuk
• CloudWatch: Add links to data source docs in the config editor #​113795, @​kevinwcyu
• CloudWatch: Make match exact toggle false by default #​113314, @​idastambuk
• Cloudwatch: Make cloudwatchBatchQueries GA #​117448, @​iwysiu
• Cloudwatch: Mark missing default region error downstream #​117551, @​iwysiu
• Cloudwatch: Update grafana-aws-sdk to 1.4.2 #​115855, @​iwysiu
• Config: Set skip migrations in defaults.ini + override when running frontend service locally #​114007, @​ashharrison90
• Correlations: Remove support for org_id=0 #​116877, @​gelicia
• Dashboard : Allow applying variable regex to display text #​114426, @​kristinademeshchik
• Dashboard Controls: Add UI for displaying under menu #​113517, @​leventebalogh
• Dashboard provisioning: Add support for v2 schema #​113620, @​stephaniehingtgen
• Dashboard: Do not select element always #​116986, @​torkelo
• Dashboard: Hide sidebar in kiosk mode #​115387, @​torkelo
• Dashboard: Hide sidebar on mobile when in view mode #​117369, @​torkelo
• Dashboard: Hide sidebar when playlist is playing #​115414, @​torkelo
• Dashboard: New experimental time range zoom shortcuts #​114190, @​jesdavpet
• Dashboard: Round x/y/w/h when importing a dashboard with floats #​117072, @​bfmatei
• Dashboards: Avoid using internal id from the frontend #​117398, @​ryantxu
• Dashboards: Do not show alert rules button for new dashboads #​115571, @​torkelo
• Dashboards: Make clear all of variable dropdown accessible by keyboard navigation #​117462, @​oscarkilhed
• Dashboards: Per panel filtering for timeseries #​114499, @​mdvictor
• Dashboards: Prevent memory leak in CUE validation by reusing context only for 100 validations #​114818, @​MissingRoberto
• Dashboards: Remove deprecated dashboard id endpoints #​117227, @​stephaniehingtgen
• DashboardsAPI: Deprecate /api/dashboards/home #​115333, @​ryantxu
• DataSources: Deprecate api routes with name and internal IDs #​116391, @​ryantxu
• DataSources: Update SDKs in support of auth service #​112101, @​njvrzm
• Datagrid: Deprecate panel #​116071, @​natellium
• Datasources: Experimental API group names use full plugin IDs #​112961, @​dafydd-t
• Datasources: Support new temp creds AWS datasources in auth service (Enterprise)
• Dependencies: Bump Go to v1.25.5 #​114749, @​macabu
• Docs: Add Knowledge Graph trace & profile configuration section #​117155, @​github-actions[bot]
• Docs: Add a "DO NOT MODIFY" warning to the public/img/* source code directory #​115502, @​jesdavpet
• Docs: Clarify section title for repeating rows and tabs #​115170, @​imatwawana
• Docs: Cleanup enterprise tag usage #​114694, @​Hipska
• Docs: Cleanup enterprise tag usage (Enterprise)
• Dynamic Dashboards: Add new panel button with drag & drop #​116276, @​idastambuk
• Dynamic Dashboards: Disallow adding empty row and tab titles #​113941, @​idastambuk
• Dynamic Dashboards: Make outline open by default #​114146, @​idastambuk
• Dynamic Dashboards: Show hidden variables greyed out #​115723, @​idastambuk
• EchoSrv: Enable auto route tracking for Azure App Insights #​113354, @​joshhunt
• ElasticSearch: Update annotation time-range properties #​115500, @​aangelisc
• Elasticsearch: Add default query mode config setting #​112540, @​cauemarcondes
• Elasticsearch: Add support for serverless connections #​114855, @​cauemarcondes
• Elasticsearch: Clear code editor query when switching query types #​116318, @​Milad93R
• Elasticsearch: Handle keyed filters buckets and emit frames #​113478, @​adamyeats
• Elasticsearch: Raw query editor for DSL #​114066, @​bossinc
• Explore: Add keyboard shortcut to run queries (#​111675) #​115811, @​naimeshpatel5295
• Explore: Ensure data source is part of query object in internal data links #​112949, @​ifrost
• Explore: Remove use of AppChrome navbar #​114680, @​torkelo
• Explore: Reset legend when a new query is run #​116323, @​ifrost
• Explore: Traces query that will work with either logs drilldown or explore #​115837, @​gtk-grafana
• Explore: Use new Table component #​111463, @​SamarthBagga
• ExternalPlugins: Restore backward compatability for util function #​113735, @​torkelo
• Feat: Datasources Auth Service (Enterprise)
• Feat: Experimental sandbox mode for community & PPT plugins (Enterprise)
• Feat: Experimental sandbox mode for community plugins #​115936, @​njvrzm
• Feat: Remove experimental permissionsFilterRemoveSubquery feature #​116405, @​papagian
• FeatureToggle: Create experimental timeRangePan flag #​112988, @​jesdavpet
• FeatureToggle: Enable time range pan zoom flags by default as generally available #​116970, @​jesdavpet
• FieldColor: Add accessible color palettes #​114424, @​ashharrison90
• Folders: Deprecate getFolderByUID method #​113173, @​tomratcliffe
• Folders: Improve wording for actions and move/delete #​114090, @​tomratcliffe
• Folders: Manage folder owner reference #​117426, @​tomratcliffe
• Folders: Send permissions query param with app platform for folder picker #​114158, @​tomratcliffe
• Folders: Show owner references on folder details pages #​116843, @​tomratcliffe
• Gauge: Delete radialbar plugin to avoid migrations #​116722, @​fastfrwrd
• Gauge: Mark grafana/ui export as deprecated #​116436, @​fastfrwrd
• Geomap: Min/Max Zoom options for XYZ Tile Layer #​114947, @​WoozyMasta
• Geomap: Variable support in the XYZ Tile layer #​116654, @​WoozyMasta
• Go: Update to 1.25.6 #​116394, @​macabu
• Go: Update to 1.25.7 #​117470, @​macabu
• Grafana Cli: Add admin flush-rbac-seed-assignment command #​116716, @​stephaniehingtgen
• Grafana Monitoring: Enable native HTTP histograms by default, make classic histograms configurable #​116534, @​undef1nd
• GrafanaBootData: Deprecate config.apps #​115610, @​hugohaggmark
• GrafanaBootData: Deprecate config.panels #​116918, @​hugohaggmark
• Graphite: Revert naming convention changes #​117158, @​aangelisc
• Heatmap: Add timeRangePan #​113889, @​drew08t
• Heatmap: Support for linear y axis #​113337, @​leeoniya
• I18n: Ignore dist folder in packages when extracting translations #​116532, @​aocenas
• IAM: Optionally make refresh tokens required if use_refresh_token is enabled #​114174, @​cinaglia
• InteractiveTable: Extend sort options with disableSortRemove and sortDescFirst [#​115352](https://redirect.github.com/grafana/grafana/pull/115

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.