14293 Commits
Author SHA1 Message Date
github-actions[bot] 0ba0b99665 apply security patch: release-11.3.7/security-patch-202505051005.patch 2025-05-21 20:58:22 +00:00
github-actions[bot] 655d22cf8a apply security patch: release-11.3.7/404-202504151210.patch 2025-05-21 20:58:22 +00:00
Matheus Macabu e2b1120bdb [release-11.3.7] Dependencies: Bump packages in modules with incorrect dependencies or outside of workspace (#105467)
Dependencies: Bump golang.org/x to latest
2025-05-15 14:52:57 +02:00
Matheus Macabu 63e8ce5b89 [release-11.3.7] Dependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0 (#105447)
Dependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
2025-05-15 12:05:37 +02:00
Matheus Macabu d34b905c73 [release-11.3.7] Dependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12 (#105376)
Dependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
2025-05-14 14:19:08 +02:00
William Wernert cb857f7675 [release-11.3.7] Alerting: Ensure field validators return the proper type (#105286)
Alerting: Ensure field validators return the proper type (#104050)

* Ensure field validators return the proper type

This ensures correct error propagation through services up to
the API layer.

* Move error wrapping up to call site

(cherry picked from commit 820c338414)
2025-05-13 08:49:34 -04:00
Matheus Macabu d8b2f416c7 [release-11.3.7] Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0 (#105254)
Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
2025-05-12 14:52:16 +02:00
Matheus Macabu 9434a6b6d5 [release-11.3.7] Chore: Bump Go version to 1.24.3 (#105112)
Chore: Bump Go version to 1.24.3
2025-05-08 16:08:43 +02:00
Kevin Minehart 912f090eb1 [release-11.3.7] Backport workflow fixes (#104697)
* Copy workflows and actions from main

* add zizmor.yml
2025-04-29 11:47:18 -05:00
github-actions[bot] 8c38ecaaa3 apply security patch: release-11.3.6/367-202504020734.patch
commit 53a77731e21532e0b6289424476906b55463c71a
Author: Andres Martinez Gotor <andres.martinez@grafana.com>
Date:   Mon Mar 31 12:15:52 2025 +0200

    Sanitize paths before evaluating access to route
2025-04-22 13:37:38 +00:00
xavi b97060a465 [release-11.3.6] [IAM] Prepend AppSubURL to redirectURI before validating it (#104092)
[IAM] Prepend AppSubURL to redirectURI before validating it (#103475)

(cherry picked from commit 5053aa576d)
2025-04-17 09:39:30 +02:00
Mariell Hoversholm 27d1c63107 [release-11.3.6] Go: Bump to 1.24.2 (#103528)
* Go: Bump to 1.24.2

It is not likely we are actually affected by the CVEs, but updating proactively is not a bad idea nonetheless.

Fixes: CVE-2025-22871
Fixes: https://github.com/grafana/grafana-operator-experience-squad/issues/1311

* CI: Update golangci-lint

(cherry picked from commit 1c4284a8b4)
2025-04-09 08:44:16 +02:00
Misiandxavi 3f60ef5146 [release-11.3.6] Auth: Fix SAML user IsExternallySynced not being set correctly (#103101)
Auth: Fix SAML user IsExternallySynced not being set correctly (#98487)

(cherry picked from commit 345757c3ae)

Co-authored-by: xavi <114113189+volcanonoodle@users.noreply.github.com>
2025-03-31 15:29:33 +02:00
Misi 34e755d9f1 [release-11.3.6] Auth: Introduce authn.SSOClientConfig to get client config from SSOSettings service (#103001)
Auth: Introduce authn.SSOClientConfig to get client config from SSOSettings service (#94618)

* wip

* possible solution

* Separate interface for SSO settings clients

* Rename interface

* Fix tests

* Rename

* Change GetClientConfig to comma ok idiom

(cherry picked from commit 50a635bc7e)
2025-03-27 16:52:53 +01:00
Karl Persson d3c332171b [release-11.3.6] AuthN: Refetch user on "ErrUserAlreadyExists" (#102983)
* AuthN: Refetch user on "ErrUserAlreadyExists" (#100346)

* AuthN: Refetch user on "ErrUserAlreadyExists"

(cherry picked from commit 0b4c622df8)
2025-03-27 15:07:23 +01:00
Denis Vodopianov 22d7a474b3 Chore: Update libs with CVE in dependencies (#102710)
Chore: Update CVE-affected golang-gwt dependencies
2025-03-24 16:23:14 +01:00
Denis VodopianovandSerge Zaitsev 22604c198c [release-11.3.5] Chore: Revert golangci PR + bump golangic version (#102239)
Chore: Revert golangci PR + bump golangic version (#96326)

* Chore: Clean up some excludes and fix makefile (#96052)

clean up some excludes and fix makefile

* Chore: Enable cache on golangci linter (#95471)

* try to enable cache on golangci linter

* bump version

* exclude G115

* reduce timeout

* remove deprecated linter

* bump linter version in bingo

* try a different syntax for workspace modules

* try another command

* add apps to linter path

* try disabling cue codegen

* skip some linting in devenv

* exclude dirs and try again

* try workaround for pkg

* try path instead of dir

* make it one line

* replace package prefix

* exclude xorm

* exclude wire

* file-based aproach to nolint in workspaces

* missing quote

* simplify command line

* change ownership

* upgrade linter

* revert bingo readme

* revert devenv changes

* upgrade golint

* use dashes to stay consistent with other workflows

* also change name in its own workflow file

* rename in codeowners

(cherry picked from commit 3dbd3a7a81)

Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
2025-03-18 14:59:57 +01:00
Jack BaldryandRobby Milo bb19e14a97 [v11.3] Remove relref shortcodes (#101715) (#101993)
* manually replce all shared relrefs

* relref replace - previous grafana versions

* update test

* prettier

(cherry picked from commit 3f07134896)
Signed-off-by: Jack Baldry <jack.baldry@grafana.com>

Co-authored-by: Robby Milo <robbymilo@fastmail.com>
2025-03-12 13:18:16 +02:00
Matthew Jacobson 0e1acbaf3e [release-11.3.5] Alerting: Re-encrypt existing contact points before get and patch in legacy config API (#101840)
* Alerting: Re-encrypt existing contact points before get and patch in legacy config API (#101263)

* Test covering Get+Save interaction for newly secret fields

* Alerting: Re-encrypt existing contact points before get and patch

(cherry picked from commit b73c59547c)

* googlechat url test fix

(cherry picked from commit 0f4af56177)
2025-03-08 01:05:10 +02:00
Ieva 9f1e8e66be [release-11.3.5] Service Accounts: Do not show error pop-ups for Service Account and Renderer UI flows (#101791)
* Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows (#101679)

don't show error pop-ups for SAs and renderer

(cherry picked from commit f0d260ba5b)

* Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows (#101776)

* don't show error pop-ups for SAs and renderer

* only hide non 4xx error pop'ups

* linting

(cherry picked from commit 392124de00)
2025-03-07 21:27:00 +00:00
Matheus MacabuandKarl Persson 534a96a72c [release-11.3.5] Chore: Bump dependencies to address security issues (#101641)
* Chore: Bump golang.org/x/net to v0.36.0

* Chore: Bump filippo.io/age to v1.2.1

* Chore: Bump github.com/ua-parser/uap-go to v0.0.0-20250213224047-9c035f085b90

* Chore: Bump github.com/go-jose/go-jose/v3 to v3.0.4

* Chore: Bump github.com/moby/moby to v27.5.1

* Zanzana: bump openfga version (#94485)

* Bump openfga

* Remove internall sqlite implementation for openfga

* Use sqlite implementation from openfga

(cherry picked from commit 9ece88d585)

* Chore: Bump github.com/openfga/openfga to v1.8.5

* Chore: Bump github.com/elazarl/goproxy to v1.7.1

* Chore: Pin Prometheus to v1.20.3 for ngalert

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2025-03-07 10:14:12 +01:00
Matheus Macabu 4d5714a61f [release-11.3.5] Chore: Bump Go to 1.23.7 (#101583)
Chore: Bump Go to 1.23.7
2025-03-05 09:57:06 +01:00
Matheus Macabu 9a2ab39cf0 [release-11.3.5] Chore: Update golang.org/x/crypto and golang.org/x/oauth2 to address security issues (#101283)
Chore: Update golang.org/x/crypto and golang.org/x/oauth2 to address security issues (#101268)

- CVE-2025-22869 and Go issue https://go.dev/issue/71931.
- CVE-2025-22868 and Go issue https://go.dev/issue/71490.

(cherry picked from commit 3aedb9159e)
2025-02-26 08:42:10 +01:00
Witek BedykandMatheus Macabu 8f47143c97 [release-11.3.5] Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#100818)
* [release-11.4.2] Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1

Backport from #95807

(cherry picked from commit ec33c739a8)

* Run make update-workspace

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
2025-02-24 11:07:16 +01:00
Kevin Minehart dd15c5dc95 [release-11.3.5] CI: Remove unused release_publisher scripts (#101156)
CI: Remove unused release_publisher scripts (#101019)

* Remove the unused `release_publisher` script.
* Remove the "whats new check" in Drone.
* Automatically set the What's New URL in releases based on the tagged version.

(cherry picked from commit 49e5f77dd1)
2025-02-21 09:28:03 -07:00
xavi 739ac52c3e [release-11.3.5] IAM: fix grafana_com OAuth connector config overriding (#101075) 2025-02-20 20:05:56 +01:00
Jev Forsberg c05dcecd2c Chore: Fix linting error in release branch [11.3.5] (#101092)
balm0mma/ run goimports -w pkg/services/dashboards/service/dashboard_service.go
2025-02-20 11:51:49 -07:00
github-actions[bot] f2a29f6695 apply security patch: release-11.3.4/319-202502130515.patch
commit 346da67ed7656d39514959a64d84ee24f29fd454
Author: AgnesToulet <35176601+AgnesToulet@users.noreply.github.com>
Date:   Tue Feb 11 10:57:05 2025 +0100

    Dashboards: Prevent title longer than 5 000 characters

    (cherry picked from commit f9e0789210004b0bd7902255644ef348ae7b3aa8)
2025-02-18 21:05:30 +00:00
Todd Treece ec913bf706 [release-11.3.4] Metrics: Use correct gatherer in graphite bridge (#100676)
Metrics: Use correct gatherer in graphite bridge (#100624)

(cherry picked from commit 5a74a1a0f6)
2025-02-13 23:32:06 +02:00
Misiandxavi 5d30a16617 [release-11.3.4] IAM: log error when malformed json arrays are found in SSO configs (#100652)
IAM: Log error when malformed json arrays are found in SSO configs (#99896)

(cherry picked from commit eeadb7e771)

Co-authored-by: xavi <114113189+volcanonoodle@users.noreply.github.com>
2025-02-13 18:36:34 +01:00
grafana-delivery-bot[bot]andChristopher Lord f99b152dc1 [v11.3.x] Plugin Metrics: Eliminate data race in plugin metrics middleware (#100076)
Plugin Metrics: Eliminate data race in plugin metrics middleware (#99396)

fix: eliminate data race in plugin metrics middleware

A data race was detected when multiple goroutines accessed the `MetricsMiddleware`
simultaneously. The race occurred because a single `MetricsMiddleware` instance
was being shared across goroutines while its `BaseHandler` field was being
modified during middleware chain setup.

Fix by creating a new `MetricsMiddleware` instance for each middleware chain,
while safely sharing the thread-safe Prometheus metrics and plugin registry.
This maintains proper metrics collection while eliminating the mutable shared
state that caused the race condition.

Original error was detected here:

```
WARNING: DATA RACE
Read at 0x00c0039c0790 by goroutine 4486:
  github.com/grafana/grafana-plugin-sdk-go/backend.(*ErrorSourceMiddleware).CallResource()
      /Users/clord/src/grafana/irm-devstack/.devenv/state/go/pkg/mod/github.com/grafana/grafana-plugin-sdk-go@v0.261.0/backend/error_source_middleware.go:93 +0x40
  github.com/grafana/grafana-plugin-sdk-go/backend.BaseHandler.CallResource()
  ...

```

(cherry picked from commit e74cf72d99)

Co-authored-by: Christopher Lord <christopher.lord@grafana.com>
2025-02-04 17:48:39 +00:00
Yuri Tseretyanandgithub-actions[bot] 120d198e42 [v11.3.x] Alerting: k8s receivers api encrypt existing unencrypted secureFields on update (#99849)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-01-30 16:44:03 -07:00
grafana-delivery-bot[bot]andAndreas Christou 2b9acf6346 [v11.3.x] Azure: Correctly set application insights resource values (#99597)
* Azure: Correctly set application insights resource values (#99214)

Correctly set resource values

(cherry picked from commit 30ee8b9813)

* Fix test

---------

Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
2025-01-27 21:17:50 +02:00
grafana-delivery-bot[bot]andAndreas Christou e042c90214 [v11.3.x] MSSQL: Correctly type UDPConnectionLimit (#99582)
MSSQL: Correctly type `UDPConnectionLimit` (#99011)

* Correctly type UDPConnectionLimit

* Update tests

* Handle legacy case

(cherry picked from commit cc09f38421)

Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
2025-01-27 18:15:25 +02:00
Mariell Hoversholm 4605a8e751 Security: Update to Go 1.23.5 - Backport to v11.3.x (#99124)
* feat: update to Go 1.23.5

* chore: make drone

* chore: make update-workspace

* CI: Force re-build

* build: update mariadb connection

The new Alpine base that the Golang images are built on no longer trust the CA of MySQL.

This is a backport of: https://github.com/grafana/grafana/pull/98857

(cherry picked from commit e1bb8ccb79)
2025-01-17 09:33:25 +01:00
grafana-delivery-bot[bot]andDaniel-Davies 578f49a7f6 [v11.3.x] OAuth: Return SocialError on membership check failure (#98860)
OAuth: Return SocialError on membership check failure (#98330)

use socialerror

(cherry picked from commit ddca09fb02)

Co-authored-by: Daniel-Davies <33356828+Daniel-Davies@users.noreply.github.com>
2025-01-13 12:05:54 +02:00
grafana-delivery-bot[bot]andSelene 8c94782840 [v11.3.x] ContactPoints: Remove blank lines prefixes in contact point types (#98765)
ContactPoints: Remove blank lines prefixes in contact point types (#98590)

Remove blank lines prefixes in contact point types

(cherry picked from commit 7cad430ca7)

Co-authored-by: Selene <selenepinillos@gmail.com>
2025-01-10 11:37:17 +01:00
Mariell Hoversholm d0a31e48d9 Backport 0a390cc069 from #97823 (#97860) 2024-12-12 16:10:38 +01:00
Andreas ChristouandAdam Yeats cc30b2fbb1 [v11.3.x] Azure Monitor: Add a feature flag to toggle user auth for Azure Monitor only (#97576)
* Azure Monitor: Add a feature flag to toggle user auth for Azure Monitor only (#96858)

* Azure Monitor: Add a feature flag to toggle user auth for Azure Monitor only

* Fix condition for userIdentityEnabled

* Re-add removed test

* Remove unused prop

* Refactor onAuthTypeChange in AzureCredentialsForm

* Add frontend unit tests

* Lint

(cherry picked from commit b898a4540d)

# Conflicts:
#	docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
#	packages/grafana-data/src/types/featureToggles.gen.ts
#	pkg/services/featuremgmt/registry.go
#	pkg/services/featuremgmt/toggles_gen.csv
#	pkg/services/featuremgmt/toggles_gen.go
#	pkg/services/featuremgmt/toggles_gen.json

* Update test

* Fix lint

---------

Co-authored-by: Adam Yeats <16296989+adamyeats@users.noreply.github.com>
2024-12-10 11:20:17 +00:00
grafana-delivery-bot[bot]andAndreas Christou 0709fad9e6 [v11.3.x] Azure/GCM: Improve error display (#97593)
* Azure/GCM: Improve error display (#96921)

Improve handling of errors

(cherry picked from commit 9f75a448d4)

* Update import and var name

---------

Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
2024-12-06 22:03:03 +02:00
grafana-delivery-bot[bot]andowensmallwood 4a8b4d2496 [v11.3.x] Unified Storage: Use tls preferred when grafana db using ssl (#97379)
Unified Storage: Use tls preferred when grafana db using ssl (#97378)

When unified storage is using the grafana db (default case for on-prem), if the db is using ssl then set tls=preferred. This fixes an on-prem bug in 11.3.1.

(cherry picked from commit 9642eedce6)

Co-authored-by: owensmallwood <owen.smallwood@grafana.com>
2024-12-04 10:16:52 -06:00
grafana-delivery-bot[bot]andMatthew Jacobson 4428bf7025 [v11.3.x] Alerting: Fix incorrect 500 code on missing alert rule dashboardUID / panelID (#96775)
Alerting: Fix incorrect 500 code on missing alert rule dashboardUID / panelID (#96491)

(cherry picked from commit 64c93217ff)

Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
2024-12-02 09:15:40 -05:00
Alexander AkhmetovandYuri Tseretyan 98be4ac047 [v11.3.x] Alerting: Update state manager to have immutable state in cache (#96843)
* Alerting: Update state manager to have immutable state in cache (#95985)

* create a new state and set at the end
* propagate labels datasource_uid and ref_id from current state if it's error
* copy the state when apply to all

(cherry picked from commit 420db99d16)

* Remove unused states variables

---------

Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
2024-11-25 15:22:40 +01:00
grafana-delivery-bot[bot]andMatthew Jacobson a09dcda92d [v11.3.x] Alerting: Fix per-receiver RBAC for receivers with long names (#95165)
Alerting: Fix per-receiver RBAC for receivers with long names (#95084)

* Implement uidToResourceID

* add middleware

* Move uidToResourceID to alerting package

* Only hash uid if it's too long

* Use hashed uid in access control

* Move ReceiverUidToResourceId to ScopeProvider

* resolve uid in middleware only if param exists

* Tests

* Linting

---------

Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
(cherry picked from commit 4aad44e848)

Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
2024-11-14 13:01:31 -05:00
lean.dev 9241bc5f5c [v11.3.x] MigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user (#96345)
apply security patch: v11.3.x/194-202410181505.patch
2024-11-12 16:33:00 -03:00
Fayzal Ghantiwala 8bc0014845 [v11.3.x] Alerting: Make context deadline on AlertNG service startup configurable (#96135)
Alerting: Make context deadline on AlertNG service startup configurable (#96053)

* Make alerting context deadline configurable

* Remove debug logs

* Change default timeout

* Update tests

(cherry picked from commit 1fdc48faba)
2024-11-08 16:46:50 +00:00
grafana-delivery-bot[bot]andAlexander Akhmetov 0e0a2c0371 [v11.3.x] Alerting: Fix saving advanced mode toggle state in the alert rule editor (#95981)
Alerting: Fix saving advanced mode toggle state in the alert rule editor (#95924)

(cherry picked from commit 4ce1abc6f9)

Co-authored-by: Alexander Akhmetov <me@alx.cx>
2024-11-06 19:04:59 +01:00
grafana-delivery-bot[bot]andMisi 16411b1b4a [v11.3.x] ServerLock: Fix pg concurrency/locking issue (#95935)
ServerLock: Fix pg concurrency/locking issue (#95916)

Fix pg unique constraint validation in serverlock

(cherry picked from commit ab974ddf14)

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
2024-11-06 11:09:20 +02:00
grafana-delivery-bot[bot]andGeorges Chaudy 4f80c4c55c [v11.3.x] Unified Storage: Use ssl_mode instead of sslmode (#95662)
Unified Storage: Use ssl_mode instead of sslmode (#95658)

change unistore to use ssl_mode instead of sslmode

(cherry picked from commit 76b43267c8)

Co-authored-by: Georges Chaudy <chaudyg@gmail.com>
2024-10-31 15:30:34 +00:00
grafana-delivery-bot[bot]andKarl Persson 855dcd7b7b [v11.3.x] Migration: Remove table aliasing in delete statement to make it work for mariadb (#95232)
Migration: Remove table aliasing in delete statement to make it work for mariadb (#95226)

Migration: remove table aliasing in delete statement to make it work in mariadb
(cherry picked from commit 6f7528f896)

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-10-31 07:51:27 +00:00