Release: 11.3.8 (#106808 )

* Update changelog * Update version to 11.3.8 * Update CHANGELOG.md add cve fix to changelog --------- Co-authored-by: grafana-delivery-bot[bot] <grafana-delivery-bot[bot]@users.noreply.github.com> Co-authored-by: Jev Forsberg <46619047+baldm0mma@users.noreply.github.com>
apply security patch: release-11.3.8/434-202505231801.patch
2025-06-17 19:56:17 +00:00 · 2025-06-13 13:56:19 +00:00 · 2025-06-12 17:30:22 +01:00 · 2025-06-11 18:04:57 +02:00 · 2025-06-10 17:04:43 -06:00 · 2025-06-10 15:21:38 +01:00
3229 changed files with 135108 additions and 56625 deletions
--- a/.betterer.results
+++ b/.betterer.results
--- a/.betterer.ts
+++ b/.betterer.ts
@@ -7,9 +7,11 @@ import { glob } from 'glob';
 // Why are we ignoring these?
 // They're all deprecated/being removed so doesn't make sense to fix types
 const eslintPathsToIgnore = [
-  'public/app/angular', // will be removed in Grafana 11
-  'public/app/plugins/panel/graph', // will be removed alongside angular
-  'public/app/plugins/panel/table-old', // will be removed alongside angular
+  'packages/grafana-ui/src/graveyard', // will be removed alongside angular in Grafana 12
+  'public/app/angular', // will be removed in Grafana 12
+  'public/app/plugins/panel/graph', // will be removed alongside angular in Grafana 12
+  'public/app/plugins/panel/table-old', // will be removed alongside angular in Grafana 12
+  'e2e/test-plugins',
 ];

 // Avoid using functions that report the position of the issues, as this causes a lot of merge conflicts
@@ -20,10 +22,9 @@ export default {
      .exclude(new RegExp(eslintPathsToIgnore.join('|'))),
  'no undocumented stories': () => countUndocumentedStories().include('**/!(*.internal).story.tsx'),
  'no gf-form usage': () =>
-    regexp(
-      /gf-form/gm,
-      'gf-form usage has been deprecated. Use a component from @grafana/ui or custom CSS instead.'
-    ).include('**/*.{ts,tsx,html}'),
+    regexp(/gf-form/gm, 'gf-form usage has been deprecated. Use a component from @grafana/ui or custom CSS instead.')
+      .include('**/*.{ts,tsx,html}')
+      .exclude(new RegExp('packages/grafana-ui/src/themes/GlobalStyles')),
 };

 function countUndocumentedStories() {
--- a/.bingo/golangci-lint.mod
+++ b/.bingo/golangci-lint.mod
@@ -1,5 +1,5 @@
 module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT

-go 1.24.3
+go 1.24.4

 require github.com/golangci/golangci-lint v1.64.2 // cmd/golangci-lint
--- a/.bra.toml
+++ b/.bra.toml
@@ -2,7 +2,7 @@
 init_cmds = [
  ["GO_BUILD_DEV=1", "make", "build-go"],
  ["make", "gen-jsonnet"],
-  ["./bin/grafana", "server", "-profile", "-profile-addr=0.0.0.0", "-profile-port=6000", "-profile-block-rate=1", "-profile-mutex-rate=5", "-packaging=dev", "cfg:app_mode=development"]
+  ["./bin/grafana", "server", "-profile", "-profile-addr=127.0.0.1", "-profile-port=6000", "-profile-block-rate=1", "-profile-mutex-rate=5", "-packaging=dev", "cfg:app_mode=development"]
 ]
 watch_all = true
 follow_symlinks = true
@@ -18,5 +18,5 @@ build_delay = 1500
 cmds = [
  ["GO_BUILD_DEV=1", "make", "build-go"],
  ["make", "gen-jsonnet"],
-  ["./bin/grafana", "server", "-profile", "-profile-addr=0.0.0.0", "-profile-port=6000", "-profile-block-rate=1", "-profile-mutex-rate=5", "-packaging=dev", "cfg:app_mode=development"]
+  ["./bin/grafana", "server", "-profile", "-profile-addr=127.0.0.1", "-profile-port=6000", "-profile-block-rate=1", "-profile-mutex-rate=5", "-packaging=dev", "cfg:app_mode=development"]
 ]
--- a/.drone.yml
+++ b/.drone.yml
--- a/.eslintignore
+++ b/.eslintignore
@@ -13,7 +13,7 @@ node_modules
 /public/lib/monaco
 /scripts/grafana-server/tmp
 vendor
-e2e/custom-plugins
+e2e/test-plugins
 playwright-report

 # TS generate from cue by cuetsy
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -772,6 +772,7 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/release-comms.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/migrate-prs.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/create-next-release-branch.yml @grafana/grafana-developer-enablement-squad
+/.github/workflows/create-security-branch.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/codeowners-validator.yml @tolzhabayev
 /.github/workflows/codeql-analysis.yml @DanCech
 /.github/workflows/commands.yml @torkelo
@@ -799,6 +800,7 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/storybook-verification.yml @grafana/grafana-frontend-platform
 /.github/workflows/update-make-docs.yml @grafana/docs-tooling
 /.github/workflows/scripts/kinds/verify-kinds.go @grafana/platform-monitoring
+/.github/workflows/scripts/create-security-branch/create-security-branch.sh @grafana/grafana-developer-enablement-squad
 /.github/workflows/publish-kinds-next.yml @grafana/platform-monitoring
 /.github/workflows/publish-kinds-release.yml @grafana/platform-monitoring
 /.github/workflows/verify-kinds.yml @grafana/platform-monitoring
@@ -826,7 +828,6 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/pr-e2e-tests.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/run-e2e-suite.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/skye-add-to-project.yml @grafana/grafana-frontend-platform
-/.github/workflows/zizmor.yml @grafana/grafana-developer-enablement-squad
 /.github/zizmor.yml @grafana/grafana-developer-enablement-squad

 # Generated files not requiring owner approval
--- a/.github/commands.json
+++ b/.github/commands.json
@@ -458,5 +458,749 @@
    "addToProject": {
      "url": "https://github.com/orgs/grafana/projects/471"
    }
+  },
+  {
+    "type": "label",
+    "name": "area/alerting",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/52"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/backend",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/665"
+    }
+  },
+  {
+    "type": "label",
+    "name": "type/build-packaging",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/509"
+    }
+  },
+  {
+    "type": "label",
+    "name": "type/accessibility",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/78"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/transformations",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/56"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/auth",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/plugins",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/76"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/annotations",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/56"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/annotations",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/provisioning",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/599"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/scenes",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Postgres",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/logs",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/203"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/public-dashboards",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/482"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/exploremetrics",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/112"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/auth/oauth",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/traceview",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/221"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/auth/rbac",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/expressions",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/112"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/backend/api",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/319"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/security",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/470"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/admin/user",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/node-graph",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/221"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/configuration",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/96"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/frontend/library-panels",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/auth/ldap",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/MSSQL",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Jaeger",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/navigation",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/78"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/search",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/78"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/search",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/flame-graph",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/221"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/auth/serviceaccount",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/field/overrides",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/backend/db/sql",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/image-rendering",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/482"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/backend/db/postgres",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/96"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/permissions",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/660"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/import",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/links",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/templating",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/variables",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboards/panel",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/data-links",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/rows",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/edit",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/edit",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/scenes",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/snapshot",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/folders",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/timerange",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/repeating",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/annotations",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/library-panel",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/kiosk",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/tv",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/import",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/field-override",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/repeat",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/dashboard/settings",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/backend/db/sqlite",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/599"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/backend/db/mysql",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/45"
+    }
+  },
+  {
+    "type": "label",
+    "name": "type/browser-compatibility",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/78"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/text",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/78"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Zipkin",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/streaming",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/319"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/frontend/login",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/78"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Parca",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/CSV",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/datagrid",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/56"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/dashboard-list",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "team/grafana-aws-datasources",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/97"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Zabbix",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/TestDataDB",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/76"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Splunk",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/55"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/SiteWIse",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/97"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Phlare",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/221"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/JSON",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/BigQuery",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Alertmanager",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/52"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/recorded-queries",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/112"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/singlestat",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/56"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/panel/annotation-list",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/202"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/editor",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/grafana/grafana/projects/21"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/data/export",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/56"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/azure-cosmosdb",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/X-Ray",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/97"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/Timestream",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/97"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/OpenSearch",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/97"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/GoogleSheets",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/GitHub",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "datasource/MySQL",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/457"
+    }
+  },
+  {
+    "type": "label",
+    "name": "area/query-library",
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/736"
+    }
  }
-]
+]
--- a/.github/issue-opened.json
+++ b/.github/issue-opened.json
@@ -6,6 +6,6 @@
    },
    "noLabels": true,
    "addLabel": "internal",
-    "comment": " please add one or more appropriate labels. Here are some tips:\r\n\r\n- if you are making an issue, TODO, or reminder for yourself or your team, please add one label that best describes the product or feature area. Please also add the issue to your project board. :rocket:\r\n\r\n- if you are making an issue for any other reason (docs typo, you found a bug, etc), please add at least one label that best describes the product or feature that you are discussing (e.g. `area/alerting`, `datasource/loki`, `type/docs`, `type/bug`, etc). [Our issue triage](https://github.com/grafana/grafana/blob/main/ISSUE_TRIAGE.md#3-categorizing-an-issue) doc also provides additional guidance on labeling. :rocket:\r\n\r\n Thank you! :heart:"
+    "comment": " please add one or more appropriate labels. Here are some tips:\r\n\r\n- if you are making an issue, TODO, or reminder for yourself or your team, please add one label that best describes the product or feature area. Please also add the issue to your project board. :rocket:\r\n\r\n- if you are making an issue for any other reason (docs typo, you found a bug, etc), please add at least one label that best describes the product or feature that you are discussing (e.g. `area/alerting`, `datasource/loki`, `type/docs`, `type/bug`, etc). [Our issue triage](https://github.com/grafana/grafana/blob/main/contribute/ISSUE_TRIAGE.md#3-categorize-an-issue) doc also provides additional guidance on labeling. :rocket:\r\n\r\n Thank you! :heart:"
  }
 ]
--- a/.github/pr-commands.json
+++ b/.github/pr-commands.json
@@ -436,5 +436,71 @@
    ],
    "action": "updateLabel",
    "addLabel": "area/panel/table"
+  },
+  {
+    "type": "changedfiles",
+    "matches": [
+      "public/app/plugins/datasource/azuremonitor/**/*",
+      "pkg/tsdb/azuremonitor/**/*"
+    ],
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "changedfiles",
+    "matches": [
+      "public/app/plugins/datasource/graphite/**/*",
+      "pkg/tsdb/graphite/**/*"
+    ],
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "changedfiles",
+    "matches": [
+      "public/app/plugins/datasource/influxdb/**/*",
+      "pkg/tsdb/influx/**/*"
+    ],
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "changedfiles",
+    "matches": [
+      "public/app/plugins/datasource/elasticsearch/**/*",
+      "pkg/tsdb/elasticsearch/**/*"
+    ],
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "changedfiles",
+    "matches": [
+      "public/app/plugins/datasource/cloud-monitoring/**/*",
+      "pkg/tsdb/cloud-monitoring/**/*"
+    ],
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
+  },
+  {
+    "type": "changedfiles",
+    "matches": [
+      "public/app/plugins/datasource/opentsdb/**/*",
+      "pkg/tsdb/opentsdb/**/*"
+    ],
+    "action": "addToProject",
+    "addToProject": {
+      "url": "https://github.com/orgs/grafana/projects/190"
+    }
  }
 ]
--- a/.github/workflows/create-security-branch.yml
+++ b/.github/workflows/create-security-branch.yml
@@ -0,0 +1,79 @@
+name: Create security branch
+on:
+  workflow_call:
+    inputs:
+      release_branch:
+        type: string
+        description: The release branch to increment (eg providing `release-11.2.3` will result in `release-11.2.3+security-01` being created)
+        required: true
+      security_branch_number:
+        type: string
+        description: 'The security branch number (e.g., 01)'
+        required: false
+        default: '01'
+      repository:
+        type: string
+        description: 'The repository to create the security branch in (e.g., grafana/grafana-security-mirror)'
+        required: true
+    outputs:
+      branch:
+        description: The new security branch that was created
+        value: ${{ jobs.main.outputs.branch }}
+  workflow_dispatch:
+    inputs:
+      release_branch:
+        type: string
+        description: The release branch to increment (eg providing `release-11.2.3` will result in `release-11.2.3+security-01` being created)
+        required: true
+      security_branch_number:
+        type: string
+        description: 'The security branch number (e.g., 01)'
+        required: false
+        default: '01'
+      repository:
+        type: string
+        description: 'The repository to create the security branch in (e.g., grafana/grafana-security-mirror)'
+        required: true
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    outputs:
+      branch: ${{ steps.branch.outputs.branch }}
+    steps:
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        with:
+          # Secrets placed in the ci/data/repo/grafana/grafana/delivery-bot-app path in Vault
+          repo_secrets: |
+            GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY
+
+      - name: "Generate token"
+        id: generate_token
+        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
+        with:
+          app_id: ${{ vars.DELIVERY_BOT_APP_ID }}
+          private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }}
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.release_branch }}
+
+      - name: Create security branch
+        id: branch
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          INPUT_RELEASE_BRANCH: ${{ inputs.release_branch }}
+          INPUT_SECURITY_BRANCH_NUMBER: ${{ inputs.security_branch_number }}
+          INPUT_REPOSITORY: ${{ inputs.repository }}
+        run: |
+          chmod +x .github/workflows/scripts/create-security-branch/create-security-branch.sh
+          .github/workflows/scripts/create-security-branch/create-security-branch.sh
--- a/.github/workflows/release-comms.yml
+++ b/.github/workflows/release-comms.yml
@@ -72,6 +72,22 @@ jobs:
    with:
      ownerRepo: 'grafana/grafana-enterprise'
      source: ${{ needs.setup.outputs.release_branch }}
+  create_security_branch_grafana:
+    name: Create security branch (Grafana Security Mirror)
+    needs: setup
+    uses: ./.github/workflows/create-security-branch.yml
+    with:
+      release_branch: ${{ needs.setup.outputs.release_branch }}
+      security_branch_number: "01"
+      repository: grafana/grafana-security-mirror
+  create_security_branch_enterprise:
+    name: Create security branch (Enterprise)
+    needs: setup
+    uses: ./.github/workflows/create-security-branch.yml
+    with:
+      release_branch: ${{ needs.setup.outputs.release_branch }}
+      security_branch_number: "01"
+      repository: grafana/grafana-enterprise
  migrate_prs_grafana:
    needs:
      - setup
--- a/.github/workflows/scripts/create-security-branch/create-security-branch.sh
+++ b/.github/workflows/scripts/create-security-branch/create-security-branch.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Construct the security branch name
+SECURITY_BRANCH="${INPUT_RELEASE_BRANCH}+security-${INPUT_SECURITY_BRANCH_NUMBER}"
+
+# Check if branch already exists
+if git show-ref --verify --quiet "refs/heads/${SECURITY_BRANCH}"; then
+    echo "::error::Security branch ${SECURITY_BRANCH} already exists"
+    exit 1
+fi
+
+# Create and push the new branch from the release branch
+git checkout "${INPUT_RELEASE_BRANCH}"
+git checkout -b "${SECURITY_BRANCH}"
+git push origin "${SECURITY_BRANCH}"
+
+# Output the branch name for the workflow
+echo "branch=${SECURITY_BRANCH}" >> "${GITHUB_OUTPUT}" 
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,23 +0,0 @@
-name: Zizmor GitHub Actions static analysis
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  zizmor:
-    name: Analyse with Zizmor
-
-    permissions:
-      actions: read
-      contents: read
-      # required to comment on pull requests with the results of the check
-      pull-requests: write
-      # required to upload the results to GitHub's code scanning service
-      security-events: write
-
-    uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@main  # zizmor: ignore[unpinned-uses]
-    with:
-      fail-severity: high
-      min-severity: high
--- a/.gitignore
+++ b/.gitignore
@@ -220,3 +220,6 @@ public/app/plugins/**/dist/

 # Locally enabling the Go race detector until we can globally do so
 .go-race-enabled-locally
+
+# Mock service worker used for fake API responses in frontend development
+public/mockServiceWorker.js
--- a/.nxignore
+++ b/.nxignore
@@ -0,0 +1 @@
+!conf/custom.ini
--- a/.prettierignore
+++ b/.prettierignore
@@ -28,5 +28,8 @@ public/api-merged.json
 public/api-enterprise-spec.json
 public/openapi3.json

+# Generated mock service worker
+public/mockServiceWorker.js
+
 # Crowdin files
 public/locales/**/*.json
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,5 +1 @@
 # See https://aquasecurity.github.io/trivy/v0.48/docs/configuration/filtering/#trivyignore
-
-# Adding CVE in grafana-plugin-sdk-go to exclusions as it does not have direct impact on the product
-# and updating library version requires complex changes in the codebase
-CVE-2024-8986
--- a/.yarn/releases/yarn-4.5.0.cjs
+++ b/.yarn/releases/yarn-4.5.0.cjs
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -26,7 +26,7 @@ plugins:
  - path: .yarn/plugins/@yarnpkg/plugin-outdated.cjs
    spec: 'https://mskelton.dev/yarn-outdated/v2'

-yarnPath: .yarn/releases/yarn-4.4.0.cjs
+yarnPath: .yarn/releases/yarn-4.5.0.cjs
 # Uncomment the following lines if you want to use Verdaccio local npm registry. Read more at packages/README.md
 #npmScopes:
 # grafana:
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,132 +1,208 @@
-<!-- 11.2.9 START -->
+<!-- 11.3.8 START -->

-# 11.2.9 (2025-04-22)
+# 11.3.8 (2025-06-17)

 ### Features and enhancements

- **Chore:** Update libs with CVE in dependencies [#102712](https://github.com/grafana/grafana/pull/102712), [@grambbledook](https://github.com/grambbledook)
- **Go:** Bump to 1.24.2 [#103529](https://github.com/grafana/grafana/pull/103529), [@Proximyst](https://github.com/Proximyst)
+- **Dependencies:** Bump Go to v1.24.4 [#106571](https://github.com/grafana/grafana/pull/106571), [@macabu](https://github.com/macabu)
+- **Dependencies:** Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 [#106120](https://github.com/grafana/grafana/pull/106120), [@macabu](https://github.com/macabu)
+
+### Bug fixes
+
+- **Security:** Fixes CVE-2025-3415
+
+<!-- 11.3.8 END -->
+<!-- 11.3.7 START -->
+
+# 11.3.7 (2025-05-22)
+
+### Features and enhancements
+
+- **Chore:** Bump Go version to 1.24.3 [#105112](https://github.com/grafana/grafana/pull/105112), [@macabu](https://github.com/macabu)
+- **Dependencies:** Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0 [#105447](https://github.com/grafana/grafana/pull/105447), [@macabu](https://github.com/macabu)
+- **Dependencies:** Bump github.com/openfga/openfga from v1.8.5 to v1.8.12 [#105376](https://github.com/grafana/grafana/pull/105376), [@macabu](https://github.com/macabu)
+- **Dependencies:** Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0 [#105254](https://github.com/grafana/grafana/pull/105254), [@macabu](https://github.com/macabu)
+
+### Bug fixes
+
+- **Security:** Fix CVE-2025-3454
+- **Security:** Fix CVE-2025-2703
+
+<!-- 11.3.7 END -->
+<!-- 11.3.6 START -->
+
+# 11.3.6 (2025-04-22)
+
+### Features and enhancements
+
+- **Chore:** Update libs with CVE in dependencies [#102710](https://github.com/grafana/grafana/pull/102710), [@grambbledook](https://github.com/grambbledook)
+- **Go:** Bump to 1.24.2 [#103528](https://github.com/grafana/grafana/pull/103528), [@Proximyst](https://github.com/Proximyst)
 - **Go:** Bump to 1.24.2 (Enterprise)

 ### Bug fixes

- **Auth:** Fix SAML user IsExternallySynced not being set correctly [#103102](https://github.com/grafana/grafana/pull/103102), [@volcanonoodle](https://github.com/volcanonoodle)
- **AuthN:** Refetch user on "ErrUserAlreadyExists" [#102982](https://github.com/grafana/grafana/pull/102982), [@kalleep](https://github.com/kalleep)
+- **Auth:** Fix SAML user IsExternallySynced not being set correctly [#103101](https://github.com/grafana/grafana/pull/103101), [@volcanonoodle](https://github.com/volcanonoodle)
+- **AuthN:** Refetch user on "ErrUserAlreadyExists" [#102983](https://github.com/grafana/grafana/pull/102983), [@kalleep](https://github.com/kalleep)
 - **Security:** Fix CVE-2025-3454
 - **Security:** Fix CVE-2025-2703

-<!-- 11.2.9 END -->
-<!-- 11.2.8 START -->
+<!-- 11.3.6 END -->
+<!-- 11.3.5 START -->

-# 11.2.8 (2025-03-25)
+# 11.3.5 (2025-03-25)

 ### Features and enhancements

- **Chore:** Bump Go version to 1.23.7 [#101294](https://github.com/grafana/grafana/pull/101294), [@macabu](https://github.com/macabu)
- **Chore:** Bump Go version to 1.23.7 (Enterprise)
+- **Chore:** Bump Go to 1.23.7 [#101583](https://github.com/grafana/grafana/pull/101583), [@macabu](https://github.com/macabu)
+- **Chore:** Bump Go to 1.23.7 (Enterprise)

 ### Bug fixes

- **Alerting:** Update slack image upload to use new API [#101487](https://github.com/grafana/grafana/pull/101487), [@moustafab](https://github.com/moustafab)
- **CloudMigrations:** Fix OrderBy clause in GetSnapshotList sql handler [#102351](https://github.com/grafana/grafana/pull/102351), [@mmandrus](https://github.com/mmandrus)
- **Service Accounts:** Do not show error pop-ups for Service Account and Renderer UI flows [#101795](https://github.com/grafana/grafana/pull/101795), [@IevaVasiljeva](https://github.com/IevaVasiljeva)
+- **Alerting:** Fix token-based Slack image upload to work with channel names [#101488](https://github.com/grafana/grafana/pull/101488), [@moustafab](https://github.com/moustafab)
+- **Service Accounts:** Do not show error pop-ups for Service Account and Renderer UI flows [#101791](https://github.com/grafana/grafana/pull/101791), [@IevaVasiljeva](https://github.com/IevaVasiljeva)

-<!-- 11.2.8 END -->
-<!-- 11.2.7 START -->
+<!-- 11.3.5 END -->
+<!-- 11.3.4 START -->

-# 11.2.7 (2025-02-18)
+# 11.3.4 (2025-02-18)

 ### Features and enhancements

- **Docker:** Use our own glibc 2.40 binaries [#99922](https://github.com/grafana/grafana/pull/99922), [@DanCech](https://github.com/DanCech)
+- **Docker:** Use our own glibc 2.40 binaries [#99923](https://github.com/grafana/grafana/pull/99923), [@DanCech](https://github.com/DanCech)

 ### Bug fixes

- **Azure:** Correctly set application insights resource values [#99596](https://github.com/grafana/grafana/pull/99596), [@aangelisc](https://github.com/aangelisc)
+- **Auth:** Fix redirect with JWT auth URL login [#100495](https://github.com/grafana/grafana/pull/100495), [@mgyongyosi](https://github.com/mgyongyosi)
+- **Azure:** Correctly set application insights resource values [#99597](https://github.com/grafana/grafana/pull/99597), [@aangelisc](https://github.com/aangelisc)
+- **Dashboards:** Bring back scripted dashboards [#100627](https://github.com/grafana/grafana/pull/100627), [@dprokop](https://github.com/dprokop)
+- **Plugin Metrics:** Eliminate data race in plugin metrics middleware [#100076](https://github.com/grafana/grafana/pull/100076), [@clord](https://github.com/clord)

-<!-- 11.2.7 END -->
-<!-- 11.2.6 START -->
+<!-- 11.3.4 END -->
+<!-- 11.3.3 START -->

-# 11.2.6 (2025-01-28)
+# 11.3.3 (2025-01-28)

 ### Features and enhancements

- **Azure Monitor:** Add a feature flag to toggle user auth for Azure Monitor only [#97565](https://github.com/grafana/grafana/pull/97565), [@adamyeats](https://github.com/adamyeats)
- **Security:** Update to Go 1.22.11 - Backport to v11.2.x [#99125](https://github.com/grafana/grafana/pull/99125), [@Proximyst](https://github.com/Proximyst)
- **Security:** Update to Go 1.22.11 - Backport to v11.2.x (Enterprise)
+- **Azure Monitor:** Add a feature flag to toggle user auth for Azure Monitor only [#97576](https://github.com/grafana/grafana/pull/97576), [@adamyeats](https://github.com/adamyeats)
+- **Security:** Update to Go 1.23.5 - Backport to v11.3.x [#99124](https://github.com/grafana/grafana/pull/99124), [@Proximyst](https://github.com/Proximyst)
+- **Security:** Update to Go 1.23.5 - Backport to v11.3.x (Enterprise)

 ### Bug fixes

- **Azure/GCM:** Improve error display [#97591](https://github.com/grafana/grafana/pull/97591), [@aangelisc](https://github.com/aangelisc)
+- **Alerting:** AlertingQueryRunner should skip descendant nodes of invalid queries [#97829](https://github.com/grafana/grafana/pull/97829), [@gillesdemey](https://github.com/gillesdemey)
+- **Azure/GCM:** Improve error display [#97593](https://github.com/grafana/grafana/pull/97593), [@aangelisc](https://github.com/aangelisc)
+- **Dashboard:** Fixes issue with compatability of old DashboardModel.annotations [#97467](https://github.com/grafana/grafana/pull/97467), [@torkelo](https://github.com/torkelo)
+- **Dashboards:** Fix issue where filtered panels would not react to variable changes [#98733](https://github.com/grafana/grafana/pull/98733), [@oscarkilhed](https://github.com/oscarkilhed)
+- **Dashboards:** Fixes issue with panel header showing even when hide time override was enabled [#97389](https://github.com/grafana/grafana/pull/97389), [@torkelo](https://github.com/torkelo)
+- **Dashboards:** Fixes week relative time ranges when weekStart was changed [#98268](https://github.com/grafana/grafana/pull/98268), [@torkelo](https://github.com/torkelo)
+- **DateTimePicker:** Fixes issue with date picker showing invalid date [#97970](https://github.com/grafana/grafana/pull/97970), [@torkelo](https://github.com/torkelo)
+- **Fix:** Add support for datasource variable queries [#98118](https://github.com/grafana/grafana/pull/98118), [@sunker](https://github.com/sunker)
+- **InfluxDB:** Adhoc filters can use template vars as values [#98785](https://github.com/grafana/grafana/pull/98785), [@bossinc](https://github.com/bossinc)
+- **Unified Storage:** Use tls preferred when grafana db using ssl [#97379](https://github.com/grafana/grafana/pull/97379), [@owensmallwood](https://github.com/owensmallwood)

-<!-- 11.2.6 END -->
-<!-- 11.2.5 START -->
+### Plugin development fixes & changes

-# 11.2.5 (2024-12-04)
+- **Grafana UI:** Re-add react-router-dom as a dependency [#98421](https://github.com/grafana/grafana/pull/98421), [@leventebalogh](https://github.com/leventebalogh)

-### Bug fixes
+<!-- 11.3.3 END -->
+<!-- 11.3.2 START -->

- **Fix:** Do not fetch Orgs if the user is authenticated by apikey/sa or render key [#97264](https://github.com/grafana/grafana/pull/97264), [@mgyongyosi](https://github.com/mgyongyosi)
-
-<!-- 11.2.5 END -->
-<!-- 11.2.4 START -->
-
-# 11.2.4 (2024-11-19)
+# 11.3.2 (2024-12-04)

 ### Features and enhancements

- **Alerting:** Make context deadline on AlertNG service startup configurable [#96133](https://github.com/grafana/grafana/pull/96133), [@fayzal-g](https://github.com/fayzal-g)
- **MigrationAssistant:** Restrict dashboards, folders and datasources by the org id of the signed in user [#96344](https://github.com/grafana/grafana/pull/96344), [@leandro-deveikis](https://github.com/leandro-deveikis)
- **Transformations:** Add 'transpose' transform [#95076](https://github.com/grafana/grafana/pull/95076), [@jmdane](https://github.com/jmdane)
- **User:** Check SignedInUser OrgID in RevokeInvite [#95489](https://github.com/grafana/grafana/pull/95489), [@mgyongyosi](https://github.com/mgyongyosi)
+- **Backport:** Announcement Banners: Enable feature for all cloud tiers (Enterprise)

 ### Bug fixes

- **Alerting:** Force refetch prom rules when refreshing panel [#96124](https://github.com/grafana/grafana/pull/96124), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
- **Anonymous User:** Adds validator service for anonymous users [#94993](https://github.com/grafana/grafana/pull/94993), [@leandro-deveikis](https://github.com/leandro-deveikis)
+- **Fix:** Do not fetch Orgs if the user is authenticated by apikey/sa or render key [#97262](https://github.com/grafana/grafana/pull/97262), [@mgyongyosi](https://github.com/mgyongyosi)
+
+<!-- 11.3.2 END -->
+<!-- 11.3.1 START -->
+
+# 11.3.1 (2024-11-19)
+
+### Features and enhancements
+
+- **Alerting:** Make context deadline on AlertNG service startup configurable [#96135](https://github.com/grafana/grafana/pull/96135), [@fayzal-g](https://github.com/fayzal-g)
+- **MigrationAssistant:** Restrict dashboards, folders and datasources by the org id of the signed in user [#96345](https://github.com/grafana/grafana/pull/96345), [@leandro-deveikis](https://github.com/leandro-deveikis)
+- **User:** Check SignedInUser OrgID in RevokeInvite [#95490](https://github.com/grafana/grafana/pull/95490), [@mgyongyosi](https://github.com/mgyongyosi)
+
+### Bug fixes
+
+- **Alerting:** Fix escaping of silence matchers in utf8 mode [#95347](https://github.com/grafana/grafana/pull/95347), [@tomratcliffe](https://github.com/tomratcliffe)
+- **Alerting:** Fix overflow for long receiver names [#95133](https://github.com/grafana/grafana/pull/95133), [@gillesdemey](https://github.com/gillesdemey)
+- **Alerting:** Fix saving advanced mode toggle state in the alert rule editor [#95981](https://github.com/grafana/grafana/pull/95981), [@alexander-akhmetov](https://github.com/alexander-akhmetov)
+- **Alerting:** Fix setting datasource uid, when datasource is string in old version [#96273](https://github.com/grafana/grafana/pull/96273), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
+- **Alerting:** Force refetch prom rules when refreshing panel [#96125](https://github.com/grafana/grafana/pull/96125), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
+- **Anonymous User:** Adds validator service for anonymous users [#94994](https://github.com/grafana/grafana/pull/94994), [@leandro-deveikis](https://github.com/leandro-deveikis)
 - **Anonymous User:** Adds validator service for anonymous users (Enterprise)
- **Azure Monitor:** Support metric namespaces fallback [#95154](https://github.com/grafana/grafana/pull/95154), [@aangelisc](https://github.com/aangelisc)
- **Azure:** Fix duplicated traces in multi-resource trace query [#95246](https://github.com/grafana/grafana/pull/95246), [@aangelisc](https://github.com/aangelisc)
- **Azure:** Handle namespace request rejection [#95908](https://github.com/grafana/grafana/pull/95908), [@aangelisc](https://github.com/aangelisc)
- **Folders:** Add admin permissions upon creation of a folder w. SA [#95416](https://github.com/grafana/grafana/pull/95416), [@eleijonmarck](https://github.com/eleijonmarck)
- **Migration:** Remove table aliasing in delete statement to make it work for mariadb [#95231](https://github.com/grafana/grafana/pull/95231), [@kalleep](https://github.com/kalleep)
- **ServerLock:** Fix pg concurrency/locking issue [#95934](https://github.com/grafana/grafana/pull/95934), [@mgyongyosi](https://github.com/mgyongyosi)
- **ServerSideExpressions:** Disable SQL Expressions to prevent RCE and LFI vulnerability [#94959](https://github.com/grafana/grafana/pull/94959), [@samjewell](https://github.com/samjewell)
+- **Azure Monitor:** Support metric namespaces fallback [#95155](https://github.com/grafana/grafana/pull/95155), [@aangelisc](https://github.com/aangelisc)
+- **Azure:** Fix duplicated traces in multi-resource trace query [#95247](https://github.com/grafana/grafana/pull/95247), [@aangelisc](https://github.com/aangelisc)
+- **Azure:** Handle namespace request rejection [#95909](https://github.com/grafana/grafana/pull/95909), [@aangelisc](https://github.com/aangelisc)
+- **CloudWatch:** Interpolate region in log context query [#94990](https://github.com/grafana/grafana/pull/94990), [@iwysiu](https://github.com/iwysiu)
+- **Dashboard datasource:** Return annotations as series when query topic is "annotations" [#95971](https://github.com/grafana/grafana/pull/95971), [@kaydelaney](https://github.com/kaydelaney)
+- **Dashboard:** Append orgId to URL [#95963](https://github.com/grafana/grafana/pull/95963), [@bfmatei](https://github.com/bfmatei)
+- **Dashboards:** Fixes performance issue expanding a row [#95321](https://github.com/grafana/grafana/pull/95321), [@torkelo](https://github.com/torkelo)
+- **Flame Graph:** Fix crash when it receives empty data [#96211](https://github.com/grafana/grafana/pull/96211), [@yincongcyincong](https://github.com/yincongcyincong)
+- **Folders:** Add admin permissions upon creation of a folder w. SA [#95365](https://github.com/grafana/grafana/pull/95365), [@eleijonmarck](https://github.com/eleijonmarck)
+- **Folders:** Don't show error pop-up if the user can't fetch the root folder [#95600](https://github.com/grafana/grafana/pull/95600), [@IevaVasiljeva](https://github.com/IevaVasiljeva)
+- **Migration:** Remove table aliasing in delete statement to make it work for mariadb [#95232](https://github.com/grafana/grafana/pull/95232), [@kalleep](https://github.com/kalleep)
+- **ServerLock:** Fix pg concurrency/locking issue [#95935](https://github.com/grafana/grafana/pull/95935), [@mgyongyosi](https://github.com/mgyongyosi)
+- **Service Accounts:** Run service account creation in transaction [#94803](https://github.com/grafana/grafana/pull/94803), [@IevaVasiljeva](https://github.com/IevaVasiljeva)
+- **Table:** Fix text wrapping applying to wrong field [#95425](https://github.com/grafana/grafana/pull/95425), [@codeincarnate](https://github.com/codeincarnate)
+- **Unified Storage:** Use ssl_mode instead of sslmode [#95662](https://github.com/grafana/grafana/pull/95662), [@chaudyg](https://github.com/chaudyg)

-<!-- 11.2.4 END -->
-<!-- 11.2.3+security-01 START -->
+<!-- 11.3.1 END -->
+<!-- 11.3.0+security-01 START -->

-# 11.2.3+security-01 (2024-11-12)
+# 11.3.0+security-01 (2024-11-12)

 ### Bug fixes

 - **MigrationAssistant:** Fix Migration Assistant issue [CVE-2024-9476]

-<!-- 11.2.3+security-01 END -->
-<!-- 11.2.3 START -->
+<!-- 11.3.0+security-01 END -->
+<!-- 11.3.0 START -->

-# 11.2.3 (2024-10-22)
+# 11.3.0 (2024-10-22)
+
+### Features and enhancements
+
+- **Alerting:** Add manage permissions UI logic for Contact Points [#92885](https://github.com/grafana/grafana/pull/92885), [@tomratcliffe](https://github.com/tomratcliffe)
+- **Alerting:** Allow linking to silence form with `__alert_rule_uid__` value preset [#93526](https://github.com/grafana/grafana/pull/93526), [@tomratcliffe](https://github.com/tomratcliffe)
+- **Alerting:** Hide query name when using simplified mode in the alert rule [#93779](https://github.com/grafana/grafana/pull/93779), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
+- **Alerting:** Limit and clean up old alert rules versions [#89754](https://github.com/grafana/grafana/pull/89754), [@igloo12](https://github.com/igloo12)
+- **Alerting:** Style nits for the simple query mode [#93930](https://github.com/grafana/grafana/pull/93930), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
+- **Alerting:** Update texts in annotations step [#93977](https://github.com/grafana/grafana/pull/93977), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
+- **Alerting:** Use useProduceNewAlertmanagerConfiguration for contact points [#88456](https://github.com/grafana/grafana/pull/88456), [@gillesdemey](https://github.com/gillesdemey)
+- **Auth:** Attach external session info to Grafana session [#93849](https://github.com/grafana/grafana/pull/93849), [@mgyongyosi](https://github.com/mgyongyosi)
+- **Auth:** Replace jmespath/go-jmespath with jmespath-community/go-jmespath [#94203](https://github.com/grafana/grafana/pull/94203), [@mgyongyosi](https://github.com/mgyongyosi)
+- **CloudMigrations:** Add support for migration of Library Elements (Panels) resources [#93898](https://github.com/grafana/grafana/pull/93898), [@macabu](https://github.com/macabu)
+- **Cloudwatch:** Update grafana-aws-sdk [#94155](https://github.com/grafana/grafana/pull/94155), [@iwysiu](https://github.com/iwysiu)
+- **Explore Logs:** Preinstall for onprem Grafana instances [#94221](https://github.com/grafana/grafana/pull/94221), [@svennergr](https://github.com/svennergr)
+- **ExploreMetrics:** Ensure compatibility with Incremental Querying [#94355](https://github.com/grafana/grafana/pull/94355), [@NWRichmond](https://github.com/NWRichmond)
+- **FieldConfig:** Add support for Actions [#92874](https://github.com/grafana/grafana/pull/92874), [@adela-almasan](https://github.com/adela-almasan)
+- **Plugin Extensions:** Require meta-data to be defined in `plugin.json` during development mode [#93429](https://github.com/grafana/grafana/pull/93429), [@leventebalogh](https://github.com/leventebalogh)
+- **Reporting:** Display template variables in the PDF (Enterprise)
+- **Tempo:** Add deprecation notice for Aggregate By [#94050](https://github.com/grafana/grafana/pull/94050), [@joey-grafana](https://github.com/joey-grafana)

 ### Bug fixes

- **Alerting:** Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] [#93947](https://github.com/grafana/grafana/pull/93947), [@alexweav](https://github.com/alexweav)
- **AzureMonitor:** Fix App Insights portal URL for multi-resource trace queries [#94475](https://github.com/grafana/grafana/pull/94475), [@aangelisc](https://github.com/aangelisc)
- **Canvas:** Allow API calls to grafana origin [#94129](https://github.com/grafana/grafana/pull/94129), [@adela-almasan](https://github.com/adela-almasan)
- **Folders:** Correctly show new folder button under root folder [#94712](https://github.com/grafana/grafana/pull/94712), [@IevaVasiljeva](https://github.com/IevaVasiljeva)
- **OrgSync:** Do not set default Organization for a user to a non-existent Organization [#94549](https://github.com/grafana/grafana/pull/94549), [@mgyongyosi](https://github.com/mgyongyosi)
- **Plugins:** Skip install errors if dependency plugin already exists [#94717](https://github.com/grafana/grafana/pull/94717), [@wbrowne](https://github.com/wbrowne)
- **ServerSideExpressions:** Disable SQL Expressions to prevent RCE and LFI vulnerability [#94959](https://github.com/grafana/grafana/pull/94959), [@samjewell](https://github.com/samjewell)
+- **Alerting/Chore:** Fix TimeRangeInput not working across multiple months [#93622](https://github.com/grafana/grafana/pull/93622), [@tomratcliffe](https://github.com/tomratcliffe)
+- **Alerting:** Fix default value for input in simple condition [#94248](https://github.com/grafana/grafana/pull/94248), [@soniaAguilarPeiron](https://github.com/soniaAguilarPeiron)
+- **Alerting:** Fix eval interval not being saved when creating a new group [#93821](https://github.com/grafana/grafana/pull/93821), [@tomratcliffe](https://github.com/tomratcliffe)
+- **Alerting:** Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] [#93940](https://github.com/grafana/grafana/pull/93940), [@alexweav](https://github.com/alexweav)
+- **Alerting:** Fix panics when attempting to create an Alertmanager after failing [#94023](https://github.com/grafana/grafana/pull/94023), [@santihernandezc](https://github.com/santihernandezc)
+- **DashboardScene:** Fixes url issue with subpath when exiting edit mode [#93962](https://github.com/grafana/grafana/pull/93962), [@torkelo](https://github.com/torkelo)
+- **Dashboards:** Enable scenes by default [#93818](https://github.com/grafana/grafana/pull/93818), [@ivanortegaalba](https://github.com/ivanortegaalba)
+- **Dashboards:** Fixes view & edit keyboard shortcuts when grafana is behind a subpath [#93955](https://github.com/grafana/grafana/pull/93955), [@torkelo](https://github.com/torkelo)
+- **ElasticSearch:** Fix errorsource in newInstanceSettings [#93859](https://github.com/grafana/grafana/pull/93859), [@iwysiu](https://github.com/iwysiu)
+- **Reporting:** Fix reports on multi-org instance (Enterprise)
+- **SubMenu:** Fix expanding sub menu items on touch devices [#93208](https://github.com/grafana/grafana/pull/93208), [@yincongcyincong](https://github.com/yincongcyincong)

-<!-- 11.2.3 END -->
-<!-- 11.2.2+security-01 START -->
-
-# 11.2.2+security-01 (2024-10-17)
-
-### Bug fixes
-
- **SQL Expressions**: Fixes CVE-2024-9264
-
-<!-- 11.2.2+security-01 END -->
+<!-- 11.3.0 END -->
 <!-- 11.2.2 START -->

 # 11.2.2 (2024-10-01)
@@ -150,15 +226,72 @@
 - **Plugins:** Avoid returning 404 for `AutoEnabled` apps [#93488](https://github.com/grafana/grafana/pull/93488), [@wbrowne](https://github.com/wbrowne)

 <!-- 11.2.2 END -->
-<!-- 11.2.1+security-01 START -->
+<!-- 11.1.7 START -->

-# 11.2.1+security-01 (2024-10-17)
+# 11.1.7 (2024-10-01)
+
+### Features and enhancements
+
+- **Chore:** Bump Go to 1.22.7 [#93355](https://github.com/grafana/grafana/pull/93355), [@hairyhenderson](https://github.com/hairyhenderson)
+- **Chore:** Bump Go to 1.22.7 (Enterprise)

 ### Bug fixes

- **SQL Expressions**: Fixes CVE-2024-9264
+- **Alerting:** Fix preview of silences when label name contains spaces [#93050](https://github.com/grafana/grafana/pull/93050), [@tomratcliffe](https://github.com/tomratcliffe)
+- **Alerting:** Make query wrapper match up datasource UIDs if necessary [#93115](https://github.com/grafana/grafana/pull/93115), [@tomratcliffe](https://github.com/tomratcliffe)
+- **AzureMonitor:** Deduplicate resource picker rows [#93704](https://github.com/grafana/grafana/pull/93704), [@aangelisc](https://github.com/aangelisc)
+- **AzureMonitor:** Improve resource picker efficiency [#93439](https://github.com/grafana/grafana/pull/93439), [@aangelisc](https://github.com/aangelisc)
+- **AzureMonitor:** Remove Basic Logs retention warning [#93122](https://github.com/grafana/grafana/pull/93122), [@aangelisc](https://github.com/aangelisc)
+- **Correlations:** Limit access to correlations page to users who can access Explore [#93675](https://github.com/grafana/grafana/pull/93675), [@ifrost](https://github.com/ifrost)
+- **Plugins:** Avoid returning 404 for `AutoEnabled` apps [#93487](https://github.com/grafana/grafana/pull/93487), [@wbrowne](https://github.com/wbrowne)

-<!-- 11.2.1+security-01 END -->
+<!-- 11.1.7 END -->
+<!-- 11.0.6 START -->
+
+# 11.0.6 (2024-10-01)
+
+### Features and enhancements
+
+- **Chore:** Bump Go to 1.22.7 [#93358](https://github.com/grafana/grafana/pull/93358), [@hairyhenderson](https://github.com/hairyhenderson)
+- **Chore:** Bump Go to 1.22.7 (Enterprise)
+
+### Bug fixes
+
+- **AzureMonitor:** Deduplicate resource picker rows [#93703](https://github.com/grafana/grafana/pull/93703), [@aangelisc](https://github.com/aangelisc)
+- **AzureMonitor:** Improve resource picker efficiency [#93438](https://github.com/grafana/grafana/pull/93438), [@aangelisc](https://github.com/aangelisc)
+- **Correlations:** Limit access to correlations page to users who can access Explore [#93674](https://github.com/grafana/grafana/pull/93674), [@ifrost](https://github.com/ifrost)
+- **Plugins:** Avoid returning 404 for `AutoEnabled` apps [#93486](https://github.com/grafana/grafana/pull/93486), [@wbrowne](https://github.com/wbrowne)
+
+<!-- 11.0.6 END -->
+<!-- 10.4.10 START -->
+
+# 10.4.10 (2024-10-01)
+
+### Features and enhancements
+
+- **Chore:** Bump Go to 1.22.7 [#93359](https://github.com/grafana/grafana/pull/93359), [@hairyhenderson](https://github.com/hairyhenderson)
+- **Chore:** Bump Go to 1.22.7 (Enterprise)
+
+### Bug fixes
+
+- **AzureMonitor:** Deduplicate resource picker rows [#93702](https://github.com/grafana/grafana/pull/93702), [@aangelisc](https://github.com/aangelisc)
+- **Correlations:** Limit access to correlations page to users who can access Explore [#93673](https://github.com/grafana/grafana/pull/93673), [@ifrost](https://github.com/ifrost)
+
+<!-- 10.4.10 END -->
+<!-- 10.3.11 START -->
+
+# 10.3.11 (2024-10-01)
+
+### Features and enhancements
+
+- **Chore:** Bump Go to 1.22.7 [#93360](https://github.com/grafana/grafana/pull/93360), [@hairyhenderson](https://github.com/hairyhenderson)
+- **Chore:** Bump Go to 1.22.7 (Enterprise)
+
+### Bug fixes
+
+- **Correlations:** Limit access to correlations page to users who can access Explore [#93672](https://github.com/grafana/grafana/pull/93672), [@ifrost](https://github.com/ifrost)
+
+<!-- 10.3.11 END -->
 <!-- 11.2.1 START -->

 # 11.2.1 (2024-09-26)
@@ -189,6 +322,63 @@
 - **AutoSizeInput:** Allow to be controlled by value [#92999](https://github.com/grafana/grafana/pull/92999), [@ivanortegaalba](https://github.com/ivanortegaalba)

 <!-- 11.2.1 END -->
+<!-- 11.1.6 START -->
+
+# 11.1.6 (2024-09-26)
+
+### Features and enhancements
+
+- **Chore:** Update swagger ui (4.3.0 to 5.17.14) [#92341](https://github.com/grafana/grafana/pull/92341), [@ryantxu](https://github.com/ryantxu)
+
+### Bug fixes
+
+- **Templating:** Fix searching non-latin template variables [#92892](https://github.com/grafana/grafana/pull/92892), [@leeoniya](https://github.com/leeoniya)
+- **TutorialCard:** Fix link to tutorial not opening [#92646](https://github.com/grafana/grafana/pull/92646), [@eledobleefe](https://github.com/eledobleefe)
+
+### Plugin development fixes & changes
+
+- **Bugfix:** QueryField typeahead missing background color [#92316](https://github.com/grafana/grafana/pull/92316), [@mckn](https://github.com/mckn)
+- **Alerting:** Fixed CVE-2024-8118.
+
+<!-- 11.1.6 END -->
+<!-- 11.0.5 START -->
+
+# 11.0.5 (2024-09-26)
+
+### Features and enhancements
+
+- **Chore:** Update swagger ui (4.3.0 to 5.17.14) [#92345](https://github.com/grafana/grafana/pull/92345), [@ryantxu](https://github.com/ryantxu)
+
+### Bug fixes
+
+- **Provisioning:** Prevent provisioning folder errors from failing startup [#92588](https://github.com/grafana/grafana/pull/92588), [@suntala](https://github.com/suntala)
+- **TutorialCard:** Fix link to tutorial not opening [#92645](https://github.com/grafana/grafana/pull/92645), [@eledobleefe](https://github.com/eledobleefe)
+- **Alerting:** Fixed CVE-2024-8118.
+
+<!-- 11.0.5 END -->
+<!-- 10.4.9 START -->
+
+# 10.4.9 (2024-09-26)
+
+### Features and enhancements
+
+- **Chore:** Update swagger ui (4.3.0 to 5.17.14) [#92344](https://github.com/grafana/grafana/pull/92344), [@ryantxu](https://github.com/ryantxu)
+
+### Bug fixes
+
+- **Provisioning:** Prevent provisioning folder errors from failing startup [#92591](https://github.com/grafana/grafana/pull/92591), [@suntala](https://github.com/suntala)
+- **Alerting:** Fixed CVE-2024-8118.
+
+<!-- 10.4.9 END -->
+<!-- 10.3.10 START -->
+
+# 10.3.10 (2024-09-26)
+
+### Bug fixes
+
+- **Alerting:** Fixed CVE-2024-8118.
+
+<!-- 10.3.10 END -->
 <!-- 11.2.0 START -->

 # 11.2.0 (2024-08-27)
@@ -388,6 +578,82 @@
 - **Runtime:** Add provider and access hook for location service [#90759](https://github.com/grafana/grafana/pull/90759), [@aocenas](https://github.com/aocenas)

 <!-- 11.2.0 END -->
+<!-- 11.1.5 START -->
+
+# 11.1.5 (2024-08-27)
+
+### Bug fixes
+
+- **Alerting:** Fix permissions for prometheus rule endpoints [#91414](https://github.com/grafana/grafana/pull/91414), [@yuri-tceretian](https://github.com/yuri-tceretian)
+- **Alerting:** Fix persisting result fingerprint that is used by recovery threshold [#91290](https://github.com/grafana/grafana/pull/91290), [@yuri-tceretian](https://github.com/yuri-tceretian)
+- **Auditing:** Fix a possible crash when audit logger parses responses for failed requests (Enterprise)
+- **RBAC:** Fix an issue with server admins not being able to manage users in orgs that they don't belong to [#92273](https://github.com/grafana/grafana/pull/92273), [@IevaVasiljeva](https://github.com/IevaVasiljeva)
+- **RBAC:** Fix an issue with server admins not being able to manage users in orgs that they dont belong to (Enterprise)
+- **RBAC:** Fix seeder failures when inserting duplicated permissions (Enterprise)
+- **Snapshots:** Fix panic when snapshot_remove_expired is true [#91232](https://github.com/grafana/grafana/pull/91232), [@ryantxu](https://github.com/ryantxu)
+- **VizTooltip:** Fix positioning at bottom and right edges on mobile [#92137](https://github.com/grafana/grafana/pull/92137), [@leeoniya](https://github.com/leeoniya)
+
+### Plugin development fixes & changes
+
+- **Bugfix:** QueryField typeahead missing background color [#92316](https://github.com/grafana/grafana/pull/92316), [@mckn](https://github.com/mckn)
+
+<!-- 11.1.5 END -->
+<!-- 11.0.4 START -->
+
+# 11.0.4 (2024-08-27)
+
+### Bug fixes
+
+- **Alerting:** Fix persisting result fingerprint that is used by recovery threshold [#91328](https://github.com/grafana/grafana/pull/91328), [@yuri-tceretian](https://github.com/yuri-tceretian)
+- **Auditing:** Fix a possible crash when audit logger parses responses for failed requests (Enterprise)
+- **RBAC:** Fix seeder failures when inserting duplicated permissions (Enterprise)
+- **Snapshots:** Fix panic when snapshot_remove_expired is true [#91330](https://github.com/grafana/grafana/pull/91330), [@ryantxu](https://github.com/ryantxu)
+
+<!-- 11.0.4 END -->
+<!-- 10.4.8 START -->
+
+# 10.4.8 (2024-08-27)
+
+### Bug fixes
+
+- **Alerting:** Fix persisting result fingerprint that is used by recovery threshold [#91331](https://github.com/grafana/grafana/pull/91331), [@yuri-tceretian](https://github.com/yuri-tceretian)
+- **Auditing:** Fix a possible crash when audit logger parses responses for failed requests (Enterprise)
+- **RBAC:** Fix seeder failures when inserting duplicated permissions (Enterprise)
+- **Snapshots:** Fix panic when snapshot_remove_expired is true [#91329](https://github.com/grafana/grafana/pull/91329), [@ryantxu](https://github.com/ryantxu)
+
+<!-- 10.4.8 END -->
+<!-- 10.3.9 START -->
+
+# 10.3.9 (2024-08-27)
+
+<!-- 10.3.9 END -->
+<!-- 11.1.4 START -->
+
+# 11.1.4 (2024-08-14)
+
+### Bug fixes
+
+- **Swagger:** Fixed CVE-2024-6837.
+
+<!-- 11.1.4 END -->
+<!-- 11.0.3 START -->
+
+# 11.0.3 (2024-08-14)
+
+### Bug fixes
+
+- **Swagger:** Fixed CVE-2024-6837.
+
+<!-- 11.0.3 END -->
+<!-- 10.4.7 START -->
+
+# 10.4.7 (2024-08-14)
+
+### Bug fixes
+
+- **Swagger:** Fixed CVE-2024-6837.
+
+<!-- 10.4.7 END -->
 <!-- 11.1.3 START -->

 # 11.1.3 (2024-07-26)
--- a/7
+++ b/7
@@ -6,7 +6,7 @@
 ARG BASE_IMAGE=alpine:3.21
 ARG JS_IMAGE=node:20-alpine
 ARG JS_PLATFORM=linux/amd64
-ARG GO_IMAGE=golang:1.24.3-alpine
+ARG GO_IMAGE=golang:1.24.4-alpine

 # Default to building locally
 ARG GO_SRC=go-builder
@@ -25,6 +25,7 @@ COPY packages packages
 COPY plugins-bundled plugins-bundled
 COPY public public
 COPY LICENSE ./
+COPY conf/defaults.ini ./conf/defaults.ini

 RUN apk add --no-cache make build-base python3

@@ -50,6 +51,7 @@ RUN if grep -i -q alpine /etc/issue; then \
      apk add --no-cache \
          # This is required to allow building on arm64 due to https://github.com/golang/go/issues/22040
          binutils-gold \
+          bash \
          # Install build dependencies
          gcc g++ make git; \
    fi
@@ -67,7 +69,10 @@ COPY pkg/build/go.* pkg/build/
 COPY pkg/build/wire/go.* pkg/build/wire/
 COPY pkg/promlib/go.* pkg/promlib/
 COPY pkg/storage/unified/resource/go.* pkg/storage/unified/resource/
+COPY pkg/storage/unified/apistore/go.* pkg/storage/unified/apistore/
 COPY pkg/semconv/go.* pkg/semconv/
+COPY pkg/aggregator/go.* pkg/aggregator/
+COPY apps/playlist/go.* apps/playlist/

 RUN go mod download
 RUN if [[ "$BINGO" = "true" ]]; then \
--- a/45
+++ b/45
@@ -8,7 +8,7 @@ WIRE_TAGS = "oss"
 include .bingo/Variables.mk

 GO = go
-GO_VERSION = 1.24.3
+GO_VERSION = 1.24.4
 GO_LINT_FILES ?= $(shell ./scripts/go-workspace/golangci-lint-includes.sh)
 GO_TEST_FILES ?= $(shell ./scripts/go-workspace/test-includes.sh)
 SH_FILES ?= $(shell find ./scripts -name *.sh)
@@ -18,6 +18,9 @@ GO_BUILD_FLAGS += $(if $(GO_BUILD_DEV),-dev)
 GO_BUILD_FLAGS += $(if $(GO_BUILD_TAGS),-build-tags=$(GO_BUILD_TAGS))
 GO_BUILD_FLAGS += $(GO_RACE_FLAG)

+# GNU xargs has flag -r, and BSD xargs (e.g. MacOS) has that behaviour by default
+XARGSR = $(shell xargs --version 2>&1 | grep -q GNU && echo xargs -r || echo xargs)
+
 targets := $(shell echo '$(sources)' | tr "," " ")

 GO_INTEGRATION_TESTS := $(shell find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' | grep -o '\(.*\)/' | sort -u)
@@ -239,6 +242,14 @@ test-go-unit: ## Run unit tests for backend with flags.
 	printf '$(GO_TEST_FILES)' | xargs \
 	$(GO) test $(GO_RACE_FLAG) -short -covermode=atomic -timeout=30m

+.PHONY: test-go-unit-pretty
+test-go-unit-pretty: check-tparse
+	@if [ -z "$(FILES)" ]; then \
+		echo "Notice: FILES variable is not set. Try \"make test-go-unit-pretty FILES=./pkg/services/mysvc\""; \
+		exit 1; \
+	fi
+	$(GO) test $(GO_RACE_FLAG) -timeout=10s $(FILES) -json | tparse -all
+
 .PHONY: test-go-integration
 test-go-integration: ## Run integration tests for backend with flags.
 	@echo "test backend integration tests"
@@ -295,6 +306,15 @@ golangci-lint: $(GOLANGCI_LINT)
 .PHONY: lint-go
 lint-go: golangci-lint ## Run all code checks for backend. You can use GO_LINT_FILES to specify exact files to check

+.PHONY: lint-go-diff
+lint-go-diff: $(GOLANGCI_LINT)
+	git diff --name-only remotes/origin/main | \
+		grep '\.go$$' | \
+		$(XARGSR) dirname | \
+		sort -u | \
+		sed 's,^,./,' | \
+		$(XARGSR) $(GOLANGCI_LINT) run --config .golangci.toml
+
 # with disabled SC1071 we are ignored some TCL,Expect `/usr/bin/env expect` scripts
 .PHONY: shellcheck
 shellcheck: $(SH_FILES) ## Run checks for shell scripts.
@@ -338,27 +358,32 @@ build-docker-full-ubuntu: ## Build Docker image based on Ubuntu for development.

 ##@ Services

-# create docker-compose file with provided sources and start them
-# example: make devenv sources=postgres,auth/openldap
+COMPOSE := $(shell if docker compose --help >/dev/null 2>&1; then echo docker compose; else echo docker-compose; fi)
+ifeq ($(COMPOSE),docker-compose)
+$(warning From July 2023 Compose V1 (docker-compose) stopped receiving updates. Migrate to Compose V2 (docker compose). https://docs.docker.com/compose/migrate/)
+endif
+
+# Create a Docker Compose file with provided sources and start them.
+# For example, `make devenv sources=postgres,auth/openldap`
 .PHONY: devenv
 ifeq ($(sources),)
 devenv:
-	@printf 'You have to define sources for this command \nexample: make devenv sources=postgres,openldap\n'
+	@printf 'You have to define sources for this command \nexample: make devenv sources=postgres,auth/openldap\n'
 else
-devenv: devenv-down ## Start optional services, e.g. postgres, prometheus, and elasticsearch.
+devenv: devenv-down ## Start optional services like Postgresql, Prometheus, or Elasticsearch.
 	@cd devenv; \
 	./create_docker_compose.sh $(targets) || \
 	(rm -rf {docker-compose.yaml,conf.tmp,.env}; exit 1)

 	@cd devenv; \
-	docker-compose up -d --build
+	$(COMPOSE) up -d --build
 endif

 .PHONY: devenv-down
 devenv-down: ## Stop optional services.
 	@cd devenv; \
 	test -f docker-compose.yaml && \
-	docker-compose down || exit 0;
+	$(COMPOSE) down || exit 0;

 .PHONY: devenv-postgres
 devenv-postgres:
@@ -431,6 +456,12 @@ go-race-is-enabled:
 enable-go-race:
 	@touch .go-race-enabled-locally

+check-tparse:
+	@command -v tparse >/dev/null 2>&1 || { \
+		echo >&2 "Error: tparse is not installed. Refer to https://github.com/mfridman/tparse"; \
+		exit 1; \
+	}
+
 .PHONY: help
 help: ## Display this help.
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
--- a/apps/alerting/notifications/template.cue
+++ b/apps/alerting/notifications/template.cue
@@ -0,0 +1,25 @@
+package core
+
+templateGroup: {
+	kind:  "TemplateGroup"
+	group: "notifications"
+	apiResource: {
+		groupOverride: "notifications.alerting.grafana.app"
+	}
+	codegen: {
+		frontend: false
+		backend:  true
+	}
+	pluralName: "TemplatesGroups"
+	current:    "v0alpha1"
+	versions: {
+		"v0alpha1": {
+			schema: {
+				spec: {
+					title: string
+					content: string
+				}
+			}
+		}
+	}
+}
--- a/apps/playlist/Makefile
+++ b/apps/playlist/Makefile
@@ -0,0 +1,3 @@
+.PHONY: generate
+generate:
+	@grafana-app-sdk generate -g ./apis --kindgrouping=group --postprocess
--- a/apps/playlist/apis/playlist/v0alpha1/playlist_codec_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/playlist_codec_gen.go
@@ -0,0 +1,28 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"encoding/json"
+	"io"
+
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// PlaylistJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
+type PlaylistJSONCodec struct{}
+
+// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
+func (*PlaylistJSONCodec) Read(reader io.Reader, into resource.Object) error {
+	return json.NewDecoder(reader).Decode(into)
+}
+
+// Write writes JSON-encoded bytes into `writer` marshaled from `from`
+func (*PlaylistJSONCodec) Write(writer io.Writer, from resource.Object) error {
+	return json.NewEncoder(writer).Encode(from)
+}
+
+// Interface compliance checks
+var _ resource.Codec = &PlaylistJSONCodec{}
--- a/apps/playlist/apis/playlist/v0alpha1/playlist_metadata_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/playlist_metadata_gen.go
@@ -0,0 +1,32 @@
+package v0alpha1
+
+import (
+	"time"
+)
+
+// PlaylistMetadata defines model for PlaylistMetadata.
+type PlaylistMetadata struct {
+	CreatedBy         string            `json:"createdBy"`
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	Generation        int64             `json:"generation"`
+	Labels            map[string]string `json:"labels"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Uid               string            `json:"uid"`
+	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
+	UpdatedBy         string            `json:"updatedBy"`
+}
+
+// _kubeObjectMetadata is metadata found in a kubernetes object's metadata field.
+// It is not exhaustive and only includes fields which may be relevant to a kind's implementation,
+// As it is also intended to be generic enough to function with any API Server.
+type PlaylistKubeObjectMetadata struct {
+	CreationTimestamp time.Time         `json:"creationTimestamp"`
+	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
+	Finalizers        []string          `json:"finalizers"`
+	Generation        int64             `json:"generation"`
+	Labels            map[string]string `json:"labels"`
+	ResourceVersion   string            `json:"resourceVersion"`
+	Uid               string            `json:"uid"`
+}
--- a/apps/playlist/apis/playlist/v0alpha1/playlist_object_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/playlist_object_gen.go
@@ -0,0 +1,265 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"fmt"
+	"github.com/grafana/grafana-app-sdk/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"time"
+)
+
+// +k8s:openapi-gen=true
+type Playlist struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata"`
+	Spec              PlaylistSpec   `json:"spec"`
+	PlaylistStatus    PlaylistStatus `json:"status"`
+}
+
+func (o *Playlist) GetSpec() any {
+	return o.Spec
+}
+
+func (o *Playlist) SetSpec(spec any) error {
+	cast, ok := spec.(PlaylistSpec)
+	if !ok {
+		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
+	}
+	o.Spec = cast
+	return nil
+}
+
+func (o *Playlist) GetSubresources() map[string]any {
+	return map[string]any{
+		"status": o.PlaylistStatus,
+	}
+}
+
+func (o *Playlist) GetSubresource(name string) (any, bool) {
+	switch name {
+	case "status":
+		return o.PlaylistStatus, true
+	default:
+		return nil, false
+	}
+}
+
+func (o *Playlist) SetSubresource(name string, value any) error {
+	switch name {
+	case "status":
+		cast, ok := value.(PlaylistStatus)
+		if !ok {
+			return fmt.Errorf("cannot set status type %#v, not of type PlaylistStatus", value)
+		}
+		o.PlaylistStatus = cast
+		return nil
+	default:
+		return fmt.Errorf("subresource '%s' does not exist", name)
+	}
+}
+
+func (o *Playlist) GetStaticMetadata() resource.StaticMetadata {
+	return resource.StaticMetadata{
+		Name:      o.ObjectMeta.Name,
+		Namespace: o.ObjectMeta.Namespace,
+		Group:     o.GroupVersionKind().Group,
+		Version:   o.GroupVersionKind().Version,
+		Kind:      o.GroupVersionKind().Kind,
+	}
+}
+
+func (o *Playlist) SetStaticMetadata(metadata resource.StaticMetadata) {
+	o.Name = metadata.Name
+	o.Namespace = metadata.Namespace
+	o.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   metadata.Group,
+		Version: metadata.Version,
+		Kind:    metadata.Kind,
+	})
+}
+
+func (o *Playlist) GetCommonMetadata() resource.CommonMetadata {
+	dt := o.DeletionTimestamp
+	var deletionTimestamp *time.Time
+	if dt != nil {
+		deletionTimestamp = &dt.Time
+	}
+	// Legacy ExtraFields support
+	extraFields := make(map[string]any)
+	if o.Annotations != nil {
+		extraFields["annotations"] = o.Annotations
+	}
+	if o.ManagedFields != nil {
+		extraFields["managedFields"] = o.ManagedFields
+	}
+	if o.OwnerReferences != nil {
+		extraFields["ownerReferences"] = o.OwnerReferences
+	}
+	return resource.CommonMetadata{
+		UID:               string(o.UID),
+		ResourceVersion:   o.ResourceVersion,
+		Generation:        o.Generation,
+		Labels:            o.Labels,
+		CreationTimestamp: o.CreationTimestamp.Time,
+		DeletionTimestamp: deletionTimestamp,
+		Finalizers:        o.Finalizers,
+		UpdateTimestamp:   o.GetUpdateTimestamp(),
+		CreatedBy:         o.GetCreatedBy(),
+		UpdatedBy:         o.GetUpdatedBy(),
+		ExtraFields:       extraFields,
+	}
+}
+
+func (o *Playlist) SetCommonMetadata(metadata resource.CommonMetadata) {
+	o.UID = types.UID(metadata.UID)
+	o.ResourceVersion = metadata.ResourceVersion
+	o.Generation = metadata.Generation
+	o.Labels = metadata.Labels
+	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
+	if metadata.DeletionTimestamp != nil {
+		dt := metav1.NewTime(*metadata.DeletionTimestamp)
+		o.DeletionTimestamp = &dt
+	} else {
+		o.DeletionTimestamp = nil
+	}
+	o.Finalizers = metadata.Finalizers
+	if o.Annotations == nil {
+		o.Annotations = make(map[string]string)
+	}
+	if !metadata.UpdateTimestamp.IsZero() {
+		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
+	}
+	if metadata.CreatedBy != "" {
+		o.SetCreatedBy(metadata.CreatedBy)
+	}
+	if metadata.UpdatedBy != "" {
+		o.SetUpdatedBy(metadata.UpdatedBy)
+	}
+	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
+	if metadata.ExtraFields != nil {
+		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
+			if cast, ok := annotations.(map[string]string); ok {
+				o.Annotations = cast
+			}
+		}
+		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
+			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
+				o.ManagedFields = cast
+			}
+		}
+		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
+			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
+				o.OwnerReferences = cast
+			}
+		}
+	}
+}
+
+func (o *Playlist) GetCreatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
+}
+
+func (o *Playlist) SetCreatedBy(createdBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
+}
+
+func (o *Playlist) GetUpdateTimestamp() time.Time {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
+	return parsed
+}
+
+func (o *Playlist) SetUpdateTimestamp(updateTimestamp time.Time) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
+}
+
+func (o *Playlist) GetUpdatedBy() string {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
+}
+
+func (o *Playlist) SetUpdatedBy(updatedBy string) {
+	if o.ObjectMeta.Annotations == nil {
+		o.ObjectMeta.Annotations = make(map[string]string)
+	}
+
+	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
+}
+
+func (o *Playlist) Copy() resource.Object {
+	return resource.CopyObject(o)
+}
+
+func (o *Playlist) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+// Interface compliance compile-time check
+var _ resource.Object = &Playlist{}
+
+// +k8s:openapi-gen=true
+type PlaylistList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+	Items           []Playlist `json:"items"`
+}
+
+func (o *PlaylistList) DeepCopyObject() runtime.Object {
+	return o.Copy()
+}
+
+func (o *PlaylistList) Copy() resource.ListObject {
+	cpy := &PlaylistList{
+		TypeMeta: o.TypeMeta,
+		Items:    make([]Playlist, len(o.Items)),
+	}
+	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
+	for i := 0; i < len(o.Items); i++ {
+		if item, ok := o.Items[i].Copy().(*Playlist); ok {
+			cpy.Items[i] = *item
+		}
+	}
+	return cpy
+}
+
+func (o *PlaylistList) GetItems() []resource.Object {
+	items := make([]resource.Object, len(o.Items))
+	for i := 0; i < len(o.Items); i++ {
+		items[i] = &o.Items[i]
+	}
+	return items
+}
+
+func (o *PlaylistList) SetItems(items []resource.Object) {
+	o.Items = make([]Playlist, len(items))
+	for i := 0; i < len(items); i++ {
+		o.Items[i] = *items[i].(*Playlist)
+	}
+}
+
+// Interface compliance compile-time check
+var _ resource.ListObject = &PlaylistList{}
--- a/apps/playlist/apis/playlist/v0alpha1/playlist_schema_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/playlist_schema_gen.go
@@ -0,0 +1,34 @@
+//
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+//
+
+package v0alpha1
+
+import (
+	"github.com/grafana/grafana-app-sdk/resource"
+)
+
+// schema is unexported to prevent accidental overwrites
+var (
+	schemaPlaylist = resource.NewSimpleSchema("playlist.grafana.app", "v0alpha1", &Playlist{}, &PlaylistList{}, resource.WithKind("Playlist"),
+		resource.WithPlural("playlists"), resource.WithScope(resource.NamespacedScope))
+	kindPlaylist = resource.Kind{
+		Schema: schemaPlaylist,
+		Codecs: map[resource.KindEncoding]resource.Codec{
+			resource.KindEncodingJSON: &PlaylistJSONCodec{},
+		},
+	}
+)
+
+// Kind returns a resource.Kind for this Schema with a JSON codec
+func PlaylistKind() resource.Kind {
+	return kindPlaylist
+}
+
+// Schema returns a resource.SimpleSchema representation of Playlist
+func PlaylistSchema() *resource.SimpleSchema {
+	return schemaPlaylist
+}
+
+// Interface compliance checks
+var _ resource.Schema = kindPlaylist
--- a/apps/playlist/apis/playlist/v0alpha1/playlist_spec_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/playlist_spec_gen.go
@@ -0,0 +1,36 @@
+package v0alpha1
+
+// Defines values for PlaylistItemType.
+const (
+	PlaylistItemTypeDashboardById  PlaylistItemType = "dashboard_by_id"
+	PlaylistItemTypeDashboardByTag PlaylistItemType = "dashboard_by_tag"
+	PlaylistItemTypeDashboardByUid PlaylistItemType = "dashboard_by_uid"
+)
+
+// PlaylistItem defines model for PlaylistItem.
+// +k8s:openapi-gen=true
+type PlaylistItem struct {
+	// type of the item.
+	Type PlaylistItemType `json:"type"`
+
+	// Value depends on type and describes the playlist item.
+	//  - dashboard_by_id: The value is an internal numerical identifier set by Grafana. This
+	//  is not portable as the numerical identifier is non-deterministic between different instances.
+	//  Will be replaced by dashboard_by_uid in the future. (deprecated)
+	//  - dashboard_by_tag: The value is a tag which is set on any number of dashboards. All
+	//  dashboards behind the tag will be added to the playlist.
+	//  - dashboard_by_uid: The value is the dashboard UID
+	Value string `json:"value"`
+}
+
+// PlaylistItemType type of the item.
+// +k8s:openapi-gen=true
+type PlaylistItemType string
+
+// PlaylistSpec defines model for PlaylistSpec.
+// +k8s:openapi-gen=true
+type PlaylistSpec struct {
+	Interval string         `json:"interval"`
+	Items    []PlaylistItem `json:"items"`
+	Title    string         `json:"title"`
+}
--- a/apps/playlist/apis/playlist/v0alpha1/playlist_status_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/playlist_status_gen.go
@@ -0,0 +1,70 @@
+package v0alpha1
+
+// Defines values for PlaylistOperatorStateState.
+const (
+	PlaylistOperatorStateStateFailed     PlaylistOperatorStateState = "failed"
+	PlaylistOperatorStateStateInProgress PlaylistOperatorStateState = "in_progress"
+	PlaylistOperatorStateStateSuccess    PlaylistOperatorStateState = "success"
+)
+
+// Defines values for PlayliststatusOperatorStateState.
+const (
+	PlayliststatusOperatorStateStateFailed     PlayliststatusOperatorStateState = "failed"
+	PlayliststatusOperatorStateStateInProgress PlayliststatusOperatorStateState = "in_progress"
+	PlayliststatusOperatorStateStateSuccess    PlayliststatusOperatorStateState = "success"
+)
+
+// PlaylistOperatorState defines model for PlaylistOperatorState.
+// +k8s:openapi-gen=true
+type PlaylistOperatorState struct {
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State PlaylistOperatorStateState `json:"state"`
+}
+
+// PlaylistOperatorStateState state describes the state of the lastEvaluation.
+// It is limited to three possible states for machine evaluation.
+// +k8s:openapi-gen=true
+type PlaylistOperatorStateState string
+
+// PlaylistStatus defines model for PlaylistStatus.
+// +k8s:openapi-gen=true
+type PlaylistStatus struct {
+	// additionalFields is reserved for future use
+	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
+
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]PlayliststatusOperatorState `json:"operatorStates,omitempty"`
+}
+
+// PlayliststatusOperatorState defines model for Playliststatus.#OperatorState.
+// +k8s:openapi-gen=true
+type PlayliststatusOperatorState struct {
+	// descriptiveState is an optional more descriptive state field which has no requirements on format
+	DescriptiveState *string `json:"descriptiveState,omitempty"`
+
+	// details contains any extra information that is operator-specific
+	Details map[string]interface{} `json:"details,omitempty"`
+
+	// lastEvaluation is the ResourceVersion last evaluated
+	LastEvaluation string `json:"lastEvaluation"`
+
+	// state describes the state of the lastEvaluation.
+	// It is limited to three possible states for machine evaluation.
+	State PlayliststatusOperatorStateState `json:"state"`
+}
+
+// PlayliststatusOperatorStateState state describes the state of the lastEvaluation.
+// It is limited to three possible states for machine evaluation.
+// +k8s:openapi-gen=true
+type PlayliststatusOperatorStateState string
--- a/apps/playlist/apis/playlist/v0alpha1/zz_openapi_gen.go
+++ b/apps/playlist/apis/playlist/v0alpha1/zz_openapi_gen.go
@@ -0,0 +1,340 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by grafana-app-sdk. DO NOT EDIT.
+
+package v0alpha1
+
+import (
+	common "k8s.io/kube-openapi/pkg/common"
+	spec "k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
+	return map[string]common.OpenAPIDefinition{
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.Playlist":                    schema_playlist_apis_playlist_v0alpha1_Playlist(ref),
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistItem":                schema_playlist_apis_playlist_v0alpha1_PlaylistItem(ref),
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistList":                schema_playlist_apis_playlist_v0alpha1_PlaylistList(ref),
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistOperatorState":       schema_playlist_apis_playlist_v0alpha1_PlaylistOperatorState(ref),
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistSpec":                schema_playlist_apis_playlist_v0alpha1_PlaylistSpec(ref),
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistStatus":              schema_playlist_apis_playlist_v0alpha1_PlaylistStatus(ref),
+		"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlayliststatusOperatorState": schema_playlist_apis_playlist_v0alpha1_PlayliststatusOperatorState(ref),
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_Playlist(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistStatus"),
+						},
+					},
+				},
+				Required: []string{"metadata", "spec", "status"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistSpec", "github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_PlaylistItem(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PlaylistItem defines model for PlaylistItem.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "type of the item.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"value": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Value depends on type and describes the playlist item.\n - dashboard_by_id: The value is an internal numerical identifier set by Grafana. This\n is not portable as the numerical identifier is non-deterministic between different instances.\n Will be replaced by dashboard_by_uid in the future. (deprecated)\n - dashboard_by_tag: The value is a tag which is set on any number of dashboards. All\n dashboards behind the tag will be added to the playlist.\n - dashboard_by_uid: The value is the dashboard UID",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type", "value"},
+			},
+		},
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_PlaylistList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.Playlist"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"metadata", "items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.Playlist", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_PlaylistOperatorState(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PlaylistOperatorState defines model for PlaylistOperatorState.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"descriptiveState": {
+						SchemaProps: spec.SchemaProps{
+							Description: "descriptiveState is an optional more descriptive state field which has no requirements on format",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "details contains any extra information that is operator-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"lastEvaluation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastEvaluation is the ResourceVersion last evaluated",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"state": {
+						SchemaProps: spec.SchemaProps{
+							Description: "state describes the state of the lastEvaluation. It is limited to three possible states for machine evaluation.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"lastEvaluation", "state"},
+			},
+		},
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_PlaylistSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PlaylistSpec defines model for PlaylistSpec.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"interval": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistItem"),
+									},
+								},
+							},
+						},
+					},
+					"title": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"interval", "items", "title"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlaylistItem"},
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_PlaylistStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PlaylistStatus defines model for PlaylistStatus.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"additionalFields": {
+						SchemaProps: spec.SchemaProps{
+							Description: "additionalFields is reserved for future use",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"operatorStates": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operatorStates is a map of operator ID to operator state evaluations. Any operator which consumes this kind SHOULD add its state evaluation information to this field.",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlayliststatusOperatorState"),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/grafana/grafana/apps/playlist/apis/playlist/v0alpha1.PlayliststatusOperatorState"},
+	}
+}
+
+func schema_playlist_apis_playlist_v0alpha1_PlayliststatusOperatorState(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PlayliststatusOperatorState defines model for Playliststatus.#OperatorState.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"descriptiveState": {
+						SchemaProps: spec.SchemaProps{
+							Description: "descriptiveState is an optional more descriptive state field which has no requirements on format",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "details contains any extra information that is operator-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"lastEvaluation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastEvaluation is the ResourceVersion last evaluated",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"state": {
+						SchemaProps: spec.SchemaProps{
+							Description: "state describes the state of the lastEvaluation. It is limited to three possible states for machine evaluation.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"lastEvaluation", "state"},
+			},
+		},
+	}
+}
--- a/apps/playlist/go.mod
+++ b/apps/playlist/go.mod
@@ -0,0 +1,42 @@
+module github.com/grafana/grafana/apps/playlist
+
+go 1.24.4
+
+require (
+	github.com/grafana/grafana-app-sdk v0.19.0
+	k8s.io/apimachinery v0.32.1
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
+)
+
+require (
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/stretchr/testify v1.10.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)
--- a/apps/playlist/go.sum
+++ b/apps/playlist/go.sum
@@ -0,0 +1,114 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/grafana/grafana-app-sdk v0.19.0 h1:RY9HvCFR+4WUy81n53wejZnof9qE6++pd6r24d6+JYs=
+github.com/grafana/grafana-app-sdk v0.19.0/go.mod h1:y0BgzYxc+a7CwOqkwUhN9zXd5cgZJjd2zAbgHEd/xzo=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.32.1 h1:683ENpaCBjma4CYqsmZyhEzrGz6cjn1MY/X2jB2hkZs=
+k8s.io/apimachinery v0.32.1/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
--- a/apps/playlist/kinds/cue.mod/module.cue
+++ b/apps/playlist/kinds/cue.mod/module.cue
@@ -0,0 +1 @@
+module: "github.com/grafana/grafana/apps/playlist/kinds"
--- a/apps/playlist/kinds/playlist.cue
+++ b/apps/playlist/kinds/playlist.cue
@@ -0,0 +1,39 @@
+package core
+
+externalName: {
+	kind: "Playlist"
+	group: "playlist"
+	apiResource: {
+		groupOverride: "playlist.grafana.app"
+	}
+	codegen: {
+		frontend: false
+		backend: true
+	}
+	pluralName: "Playlists"
+	current: "v0alpha1"
+	versions: {
+		"v0alpha1": {
+			schema: {
+				#Item: {
+					// type of the item.
+					type: "dashboard_by_tag" | "dashboard_by_uid" | "dashboard_by_id" @cuetsy(kind="enum")
+					// Value depends on type and describes the playlist item.
+					//  - dashboard_by_id: The value is an internal numerical identifier set by Grafana. This
+					//  is not portable as the numerical identifier is non-deterministic between different instances.
+					//  Will be replaced by dashboard_by_uid in the future. (deprecated)
+					//  - dashboard_by_tag: The value is a tag which is set on any number of dashboards. All
+					//  dashboards behind the tag will be added to the playlist.
+					//  - dashboard_by_uid: The value is the dashboard UID
+					value: string
+				}
+								
+				spec: {
+					title: string
+					interval: string
+					items: [...#Item]
+				}
+			}
+		}
+	}
+}
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -582,6 +582,16 @@ oauth_auto_login = false
 # OAuth state max age cookie duration in seconds. Defaults to 600 seconds.
 oauth_state_cookie_max_age = 600

+# Sets a custom oAuth error message. This is useful if you need to point the users to a specific location for support.
+oauth_login_error_message = oauth.login.error
+
+# Minimum wait time in milliseconds for the server lock retry mechanism.
+# The server lock retry mechanism is used to prevent multiple Grafana instances from
+# simultaneously refreshing OAuth tokens. This mechanism waits at least this amount
+# of time before retrying to acquire the server lock. There are 5 retries in total.
+# The wait time between retries is calculated as random(n, n + 500)
+oauth_refresh_token_server_lock_min_wait_ms = 1000
+
 # limit of api_key seconds to live before expiration
 api_key_max_seconds_to_live = -1

@@ -608,6 +618,10 @@ id_response_header_prefix = X-Grafana
 # The header value will encode the namespace ("user:<id>", "api-key:<id>", "service-account:<id>")
 id_response_header_namespaces = user api-key service-account

+# Enables the use of managed service accounts for plugin authentication
+# This feature currently **only supports single-organization deployments**
+managed_service_accounts_enabled = false
+
 #################################### SSO Settings ###########################
 [sso_settings]
 # interval for reloading the SSO Settings from the database
@@ -1335,6 +1349,11 @@ notification_log_retention = 5d
 # Duration for which a resolved alert state transition will continue to be sent to the Alertmanager.
 resolved_alert_retention = 15m

+# Defines the limit of how many alert rule versions
+# should be stored in the database for each alert rule in an organization including the current one.
+# 0 value means no limit
+rule_version_record_limit = 0
+
 [unified_alerting.screenshots]
 # Enable screenshots in notifications. You must have either installed the Grafana image rendering
 # plugin, or set up Grafana to use a remote rendering service.
@@ -1437,6 +1456,9 @@ max_age =
 max_annotations_to_keep =

 [recording_rules]
+# Enable recording rules. You must provide write credentials below.
+enabled = false
+
 # Target URL (including write path) for recording rules.
 url =

@@ -1546,8 +1568,8 @@ expire_time = 7
 #################################### Internal Grafana Metrics ############
 # Metrics available at HTTP URL /metrics and /metrics/plugins/:pluginId
 [metrics]
-enabled              = true
-interval_seconds     = 10
+enabled = true
+interval_seconds = 10
 # Disable total stats (stat_totals_*) metrics to be generated
 disable_total_stats = false
 # The interval at which the total stats collector will update the stats. Default is 1800 seconds.
@@ -1725,6 +1747,12 @@ install_token =
 hide_angular_deprecation =
 # Comma separated list of plugin ids for which environment variables should be forwarded. Used only when feature flag pluginsSkipHostEnvVars is enabled.
 forward_host_env_vars =
+# Comma separated list of plugin ids to install as part of the startup process.
+preinstall = grafana-lokiexplore-app
+# Controls whether preinstall plugins asynchronously (in the background) or synchronously (blocking). Useful when preinstalled plugins are used with provisioning.
+preinstall_async = true
+# Disables preinstall feature. It has the same effect as setting preinstall to an empty list.
+preinstall_disabled = false

 #################################### Grafana Live ##########################################
 [live]
@@ -1982,3 +2010,13 @@ feedback_url = https://docs.google.com/forms/d/e/1FAIpQLSeEE33vhbSpR8A8S1A1ocZ1B
 # How frequently should the frontend UI poll for changes while resources are migrating
 frontend_poll_interval = 2s

+################################## Frontend development configuration ###################################
+# Warning! Any settings placed in this section will be available on `process.env.frontend_dev_{foo}` within frontend code
+# Any values placed here may be accessible to the UI. Do not place sensitive information here.
+[frontend_dev]
+# Should UI tests fail when console log/warn/erroring?
+# Does not affect the result when running on CI - only for allowing devs to choose this behaviour locally
+fail_tests_on_console = true
+# Whether or not to enable the MSW mock API, which intercepts requests and returns mock data
+# Should only be used for local development or demo purposes
+mock_api = false
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -583,9 +583,19 @@
 # Deprecated, use auto_login option for specific provider instead.
 ;oauth_auto_login = false

+# Sets a custom oAuth error message. This is useful if you need to point the users to a specific location for support.
+;oauth_login_error_message = oauth.login.error
+
 # OAuth state max age cookie duration in seconds. Defaults to 600 seconds.
 ;oauth_state_cookie_max_age = 600

+# Minimum wait time in milliseconds for the server lock retry mechanism.
+# The server lock retry mechanism is used to prevent multiple Grafana instances from
+# simultaneously refreshing OAuth tokens. This mechanism waits at least this amount
+# of time before retrying to acquire the server lock. There are 5 retries in total.
+# The wait time between retries is calculated as random(n, n + 500)
+; oauth_refresh_token_server_lock_min_wait_ms = 1000
+
 # limit of api_key seconds to live before expiration
 ;api_key_max_seconds_to_live = -1

@@ -612,6 +622,10 @@
 # The header value will encode the namespace ("user:<id>", "api-key:<id>", "service-account:<id>")
 ;id_response_header_namespaces = user api-key service-account

+# Enables the use of managed service accounts for plugin authentication
+# This feature currently **only supports single-organization deployments**
+; managed_service_accounts_enabled = false
+
 #################################### Anonymous Auth ######################
 [auth.anonymous]
 # enable anonymous access
@@ -1324,6 +1338,11 @@
 # Duration for which a resolved alert state transition will continue to be sent to the Alertmanager.
 ;resolved_alert_retention = 15m

+# Defines the limit of how many alert rule versions
+# should be stored in the database for each alert rule in an organization including the current one.
+# 0 value means no limit
+;rule_version_record_limit= 0
+
 [unified_alerting.screenshots]
 # Enable screenshots in notifications. You must have either installed the Grafana image rendering
 # plugin, or set up Grafana to use a remote rendering service.
@@ -1431,6 +1450,9 @@ max_annotations_to_keep =

 #################################### Recording Rules #####################
 [recording_rules]
+# Enable recording rules. You must provide write credentials below.
+enabled = false
+
 # Target URL (including write path) for recording rules.
 url =

@@ -1914,3 +1936,11 @@ timeout = 30s
 ;feedback_url = ""
 # How frequently should the frontend UI poll for changes while resources are migrating
 ;frontend_poll_interval = 2s
+
+################################## Frontend development configuration ###################################
+# Warning! Any settings placed in this section will be available on `process.env.frontend_dev_{foo}` within frontend code
+# Any values placed here may be accessible to the UI. Do not place sensitive information here.
+[frontend_dev]
+# Should UI tests fail when console log/warn/erroring?
+# Does not affect the result when running on CI - only for allowing devs to choose this behaviour locally
+; fail_tests_on_console = true
--- a/contribute/ISSUE_TRIAGE.md
+++ b/contribute/ISSUE_TRIAGE.md
@@ -270,17 +270,17 @@ In case there is an uncertainty around the prioritization of an issue, please as
 1. If applicable, label the issue `priority/support-subscription`.
 1. Add the issue to the next upcoming patch or major/minor stable release milestone. Ask maintainers for help if unsure if it's a patch or not. Create a new milestone if there are none.
 1. Make sure to add the issue to a suitable backlog of a GitHub project and prioritize it or assign someone to work on it now or very soon.
-1. Consider requesting [help from the community](#5-requesting-help-from-the-community), even though it may be problematic given a short amount of time until it should be released.
+1. Consider requesting [help from the community](#5-request-help-from-the-community), even though it may be problematic given a short amount of time until it should be released.

 **Important long-term**

 1. Label the issue `priority/important-longterm`.
-1. Consider requesting [help from the community](#5-requesting-help-from-the-community).
+1. Consider requesting [help from the community](#5-request-help-from-the-community).

 **Nice to have**

 1. Label the issue `priority/nice-to-have`.
-1. Consider requesting [help from the community](#5-requesting-help-from-the-community).
+1. Consider requesting [help from the community](#5-request-help-from-the-community).

 **Not critical, but unsure?**

--- a/contribute/backend/README.md
+++ b/contribute/backend/README.md
@@ -25,4 +25,4 @@ If you want to make or review large changes to the backend, be sure to habituall

 ## Guidelines for dependency management

-If you work with a dependency that requires an upgrade, refer to [Upgrading dependencies](/contribute/backend/upgrading-dependencies.md).
+If you work with a dependency that requires an upgrade, refer to [Upgrade dependencies](/contribute/backend/upgrade-dependencies.md).
--- a/contribute/backend/database.md
+++ b/contribute/backend/database.md
@@ -18,7 +18,7 @@ Grafana uses the [XORM](https://xorm.io) framework for persisting objects to the

 > **Deprecated:** We are deprecating `sqlstore` handlers in favor of using the `SQLStore` object directly in each service. Since most services still use the `sqlstore` handlers, we still want to explain how they work.

-The `sqlstore` package allows you to register [command handlers](communication.md#handle-commands) that either store or retrieve objects from the database. The `sqlstore` handlers are similar to services:
+The `sqlstore` package allows you to register [command handlers](communication.md#commands-and-queries) that either store or retrieve objects from the database. The `sqlstore` handlers are similar to services:

 - [Services](services.md) are command handlers that _contain business logic_.
 - `sqlstore` handlers are command handlers that _access the database_.
@@ -30,7 +30,7 @@ The `sqlstore` package allows you to register [command handlers](communication.m
 To register a handler:

 - Create a new file, `myrepo.go`, in the `sqlstore` package.
- Create a [command handler](communication.md#handle-commands).
+- Create a [command handler](communication.md#commands-and-queries).
 - Register the handler in the `init` function:

 ```go
@@ -60,7 +60,7 @@ type MyService struct {
 }
 ```

-You can now make SQL queries in any of your [command handlers](communication.md#handle-commands) or [event listeners](communication.md#subscribe-to-an-event):
+You can now make SQL queries in any of your [command handlers](communication.md#commands-and-queries) or [event listeners](communication.md#subscribe-to-an-event):

 ```go
 func (s *MyService) DeleteDashboard(ctx context.Context, cmd *models.DeleteDashboardCommand) error {
@@ -107,7 +107,7 @@ To add a migration:

 ### Implement `DatabaseMigrator`

-During initialization, SQL store queries the service registry, and runs migrations for every service that implements the [DatabaseMigrator](https://github.com/grafana/grafana/blob/44c2007498c76c2dbb48e8366b4af410f1ee1b98/pkg/registry/registry.go#L101-L106) interface.
+During initialization, SQL store queries the service registry, and runs migrations for every service that implements the [DatabaseMigrator](https://github.com/grafana/grafana/blob/d27c3822f28e5f26199b4817892d6d24a7a26567/pkg/registry/registry.go#L46-L50) interface.

 To add a migration:

--- a/contribute/backend/instrumentation.md
+++ b/contribute/backend/instrumentation.md
@@ -55,7 +55,7 @@ When should you use each log level?

 Use a contextual logger to include additional key/value pairs attached to `context.Context`. For example, a `traceID`, used to allow correlating logs with traces, correlate logs with a common identifier, either or both.

-You must [Enable tracing in Grafana](#2-enable-tracing-in-grafana) to get a `traceID`.
+You must [Enable tracing in Grafana](#enable-tracing-in-grafana) to get a `traceID`.

 For example:

@@ -156,7 +156,7 @@ A distributed trace is data that tracks an application request as it flows throu

 ### Usage

-Grafana uses [OpenTelemetry](https://opentelemetry.io/) for distributed tracing. There's an interface `Tracer` in the `pkg/infra/tracing` package that implements the [OpenTelemetry Tracer interface](go.opentelemetry.io/otel/trace), which you can use to create traces and spans. To access `Tracer` you need to get it injected as a dependency of your service. Refer to [Services](services.md) for more details. For more information, you may also refer to [The OpenTelemetry documentation](https://opentelemetry.io/docs/instrumentation/go/manual/).
+Grafana uses [OpenTelemetry](https://opentelemetry.io/) for distributed tracing. There's an interface `Tracer` in the `pkg/infra/tracing` package that implements the [OpenTelemetry Tracer interface](https://pkg.go.dev/go.opentelemetry.io/otel/trace), which you can use to create traces and spans. To access `Tracer` you need to get it injected as a dependency of your service. Refer to [Services](services.md) for more details. For more information, you may also refer to [The OpenTelemetry documentation](https://opentelemetry.io/docs/instrumentation/go/manual/).

 For example:

@@ -269,7 +269,7 @@ attribute.Key("org_id").Int64(proxy.ctx.SignedInUser.OrgID)
   make devenv sources=jaeger
   ```

-1. Enable tracing in Grafana
+1. Enable tracing in Grafana<a name="enable-tracing-in-grafana"></a>

   To enable tracing in Grafana, you must set the address in your `config.ini` file:

--- a/contribute/backend/services.md
+++ b/contribute/backend/services.md
@@ -121,7 +121,7 @@ For an example of the `IsDisabled` method and custom initialization code when th

 ## Run Wire (generate code)

-Running `make run` calls `make gen-go` on the first run. The `gen-go` in turn calls the Wire binary and generates the code in [`wire_gen.go`](/pkg/server/wire_gen.go) and [`wire_gen.go`](/pkg/cmd/grafana-cli/runner/wire_gen.go). The Wire binary is installed using [`bingo`](https://github.com/bwplotka/bingo) which downloads and installs all the tools needed, including the Wire binary at the specified version.
+Running `make run` calls `make gen-go` on the first run. The `gen-go` in turn calls the Wire binary and generates the code in [`wire_gen.go`](/pkg/server/wire_gen.go). The Wire binary is installed using [`bingo`](https://github.com/bwplotka/bingo) which downloads and installs all the tools needed, including the Wire binary at the specified version.

 ## OSS vs. Enterprise

--- a/contribute/engineering/terminology.md
+++ b/contribute/engineering/terminology.md
@@ -2,16 +2,14 @@

 <!-- Keep terms in alphabetical order: -->

-This document defines technical terms used in Grafana.
+This glossary defines technical terms used in Grafana.

 ## TLS/SSL

 The acronyms [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) (Transport Layer Security) and
-[SSL](https://en.wikipedia.org/wiki/SSL) (Secure Socket Layer) are both used to describe the HTTPS security layer,
-and are in practice synonymous. However, TLS is considered the current name for the technology, and SSL is considered
+[SSL](https://en.wikipedia.org/wiki/SSL) (Secure Socket Layer) are both used to describe the HTTPS security layer.
+In practice, they are synonymous. However, TLS is considered the current name for the technology, and SSL is considered
 [deprecated](https://tools.ietf.org/html/rfc7568).

-As such, while both terms are in use (also in our codebase) and are indeed interchangeable, TLS is the preferred term.
-That said however, we have at Grafana Labs decided to use both acronyms in combination when referring to this type of
-technology, i.e. _TLS/SSL_. This is in order to not confuse those who may not be aware of them being synonymous,
-and SSL still being so prevalent in common discourse.
+As such, while we use both terms in our codebase and documentation, we generally prefer TLS.
+However, we use both acronyms in combination when referring to this type of technology, that is, _TLS/SSL_. We do this because we don't want to confuse readers who may not be aware of them being synonymous, and SSL is still prevalent in common discourse.
--- a/contribute/merge-pull-request.md
+++ b/contribute/merge-pull-request.md
@@ -30,7 +30,7 @@ The pull request title should be formatted according to `<Area>: <Summary>` (Bot

 Keep the summary short and understandable for the community as a whole.

-All commits in a pull request are squashed when merged and the pull request title will be the default subject line of the squashed commit message. It's also used for the [changelog](#include-in-changelog-and-release-notes).
+All commits in a pull request are squashed when merged and the pull request title will be the default subject line of the squashed commit message. It's also used for the [changelog](#what-to-include-in-changelog-and-release-notes).

 **Example:**

@@ -40,7 +40,7 @@ See [formatting guidelines](create-pull-request.md#formatting-guidelines) for mo

 ### Assign a milestone (automated)

-The Grafana release process uses a bot to automatically assign pull requests to a milestone to make it easier for release managers to track changes. For example, [generating changelog (release note)](#include-in-changelog-and-release-notes) must be in a milestone.
+The Grafana release process uses a bot to automatically assign pull requests to a milestone to make it easier for release managers to track changes. For example, [generating changelog (release note)](#what-to-include-in-changelog-and-release-notes) must be in a milestone.

 That being said, _you don't have to assign a milestone manually_ to a pull request. Instead, when it is merged and closed, a bot will then look for the most appropriate milestone and assign it to the pull request.

@@ -104,7 +104,7 @@ In case the pull request introduces a deprecation you should document this. Labe
 <Deprecation description>
 ```

-**Breaking changes:**
+**Breaking changes:**<a name="breaking-changes"></a>

 In case the pull request introduces a breaking change you should document this. Label the pull request with `add to changelog` and `breaking change` and use the following template at the end of the pull request description describing the breaking change:

--- a/contribute/style-guides/e2e-plugins.md
+++ b/contribute/style-guides/e2e-plugins.md
@@ -1,16 +1,18 @@
-# end-to-end tests for plugins
+# End-to-end tests for plugins

-When end-to-end testing Grafana plugins, it's recommended to use the [`@grafana/plugin-e2e`](https://www.npmjs.com/package/@grafana/plugin-e2e?activeTab=readme) testing tool. `@grafana/plugin-e2e` extends [`@playwright/test`](https://playwright.dev/) capabilities with relevant fixtures, models, and expect matchers; enabling comprehensive end-to-end testing of Grafana plugins across multiple versions of Grafana. For information on how to get started with Plugin end-to-end testing and Playwright, checkout the [Get started](https://grafana.com/developers/plugin-tools/e2e-test-a-plugin/get-started) guide.
+When end-to-end testing Grafana plugins, a best practice is to use the [`@grafana/plugin-e2e`](https://www.npmjs.com/package/@grafana/plugin-e2e?activeTab=readme) testing tool. The `@grafana/plugin-e2e` tool extends [`@playwright/test`](https://playwright.dev/) capabilities with relevant fixtures, models, and expect matchers. Use it to enable comprehensive end-to-end testing of Grafana plugins across multiple versions of Grafana.

-## Adding end-to-end tests for a core plugin
+> **Note:** To learn more, refer to our documentation on [plugin development](https://grafana.com/developers/plugin-tools/) and [end-to-end plugin testing](https://grafana.com/developers/plugin-tools/e2e-test-a-plugin/get-started).

-Playwright end-to-end tests for plugins should be added to the [`e2e/plugin-e2e`](https://github.com/grafana/grafana/tree/main/e2e/plugin-e2e) directory.
+## Add end-to-end tests for a core plugin

-1. Add a new directory that has the name as your plugin [`here`](https://github.com/grafana/grafana/tree/main/e2e/plugin-e2e). This is where your plugin tests will be kept.
+You can add Playwright end-to-end tests for plugins to the [`e2e/plugin-e2e`](https://github.com/grafana/grafana/tree/main/e2e/plugin-e2e) directory.

-2. Playwright uses [projects](https://playwright.dev/docs/test-projects) to logically group tests together. All tests in a project share the same configuration.
-   In the [Playwright config file](https://github.com/grafana/grafana/blob/main/playwright.config.ts), add a new project item. Make sure the `name` and the `testDir` sub directory matches the name of the directory that contains your plugin tests.
-   Adding `'authenticate'` to the list of dependencies and specifying `'playwright/.auth/admin.json'` as storage state will ensure all tests in your project will start already authenticated as an admin user. If you wish to use a different role for and perhaps test RBAC for some of your tests, please refer to the plugin-e2e [documentation](https://grafana.com/developers/plugin-tools/e2e-test-a-plugin/use-authentication).
+1. Add a new directory that has the name as your plugin [`here`](https://github.com/grafana/grafana/tree/main/e2e/plugin-e2e). This is the directory where your plugin tests will be kept.
+
+1. Playwright uses [projects](https://playwright.dev/docs/test-projects) to logically group tests together. All tests in a project share the same configuration.
+   In the [Playwright config file](https://github.com/grafana/grafana/blob/main/playwright.config.ts), add a new project item. Make sure the `name` and the `testDir` subdirectory match the name of the directory that contains your plugin tests.
+   Add `'authenticate'` to the list of dependencies and specify `'playwright/.auth/admin.json'` as the storage state to ensure that all tests in your project will start already authenticated as an admin user. If you want to use a different role for and perhaps test RBAC for some of your tests, refer to our [documentation](https://grafana.com/developers/plugin-tools/e2e-test-a-plugin/use-authentication).

   ```ts
   {
@@ -24,14 +26,16 @@ Playwright end-to-end tests for plugins should be added to the [`e2e/plugin-e2e`
    },
   ```

-3. Update the [CODEOWNERS](https://github.com/grafana/grafana/blob/main/.github/CODEOWNERS/#L315) file so that your team is owner of the tests in the directory you added in step 1.
+1. Update the [CODEOWNERS](https://github.com/grafana/grafana/blob/main/.github/CODEOWNERS/#L315) file so that your team is owner of the tests in the directory you added in step 1.

 ## Commands

- `yarn e2e:playwright` will run all Playwright tests. Optionally, you can provide the `--project mysql` argument to run tests in a certain project.
+- `yarn e2e:playwright` runs all Playwright tests. Optionally, you can provide the `--project mysql` argument to run tests in a specific project.

-The script above assumes you have Grafana running on `localhost:3000`. You may change this by providing environment variables.
+  The `yarn e2e:playwright` script assumes you have Grafana running on `localhost:3000`. You may change this with an environment variable:

-`HOST=127.0.0.1 PORT=3001 yarn e2e:playwright`
+  `HOST=127.0.0.1 PORT=3001 yarn e2e:playwright`

- `yarn e2e:playwright:server` will start a Grafana [development server](https://github.com/grafana/grafana/blob/main/scripts/grafana-server/start-server) on port 3001 and run the Playwright tests. The development server is provisioned with the [devenv](https://github.com/grafana/grafana/blob/main/contribute/developer-guide.md#add-data-sources) dashboards, data sources and apps.
+  The `yarn e2e:playwright:server` starts a Grafana [development server](https://github.com/grafana/grafana/blob/main/scripts/grafana-server/start-server) on port 3001 and runs the Playwright tests.
+
+- You can provision the development server with the [devenv](https://github.com/grafana/grafana/blob/main/contribute/developer-guide.md#add-data-sources) dashboards, data sources, and apps.
--- a/contribute/style-guides/e2e.md
+++ b/contribute/style-guides/e2e.md
@@ -1,4 +1,4 @@
-# End-to-End tests
+# End-to-end tests

 Grafana Labs uses a minimal [homegrown solution](../../e2e/utils/index.ts) built on top of [Cypress](https://cypress.io) for its end-to-end (E2E) tests.

@@ -6,17 +6,17 @@ Important notes:

 - We generally store all element identifiers ([CSS selectors](https://mdn.io/docs/Web/CSS/CSS_Selectors)) within the framework for reuse and maintainability.
 - We generally do not use stubs or mocks as to fully simulate a real user.
- Cypress' promises [do not behave as you'd expect](https://docs.cypress.io/guides/core-concepts/introduction-to-cypress.html#Mixing-Async-and-Sync-code).
- [Testing core Grafana](e2e-core.md) is different than [testing plugins](e2e-plugins.md) - core Grafana uses Cypress whereas plugins use [Playwright test](https://playwright.dev/).
+- Cypress' promises [don't behave as you might expect](https://docs.cypress.io/guides/core-concepts/introduction-to-cypress.html#Mixing-Async-and-Sync-code).
+- [Testing core Grafana](e2e-core.md) is different than [testing plugins](e2e-plugins.md)—core Grafana uses Cypress whereas plugins use [Playwright test](https://playwright.dev/).

 ## Framework structure

-Inspired by https://martinfowler.com/bliki/PageObject.html
+Our framework structure is inspired by [Martin Fowler's Page Object](https://martinfowler.com/bliki/PageObject.html).

- `Selector`: A unique identifier that is used from the E2E framework to retrieve an element from the Browser
- `Page`: An abstraction for an object that contains one or more `Selectors` with `visit` function to navigate to the page.
- `Component`: An abstraction for an object that contains one or more `Selectors` but without `visit` function
- `Flow`: An abstraction that contains a sequence of actions on one or more `Pages` that can be reused and shared between tests
+- **`Selector`**: A unique identifier that is used from the E2E framework to retrieve an element from the browser
+- **`Page`**: An abstraction for an object that contains one or more `Selector` identifiers with the `visit` function to go to the page.
+- **`Component`**: An abstraction for an object that contains one or more `Selector` identifiers but without the `visit` function
+- **`Flow`**: An abstraction that contains a sequence of actions on one or more `Page` abstractions that can be reused and shared between tests

 ## Basic example

@@ -26,13 +26,15 @@ Let's start with a simple [JSX](https://reactjs.org/docs/introducing-jsx.html) e
 <input className="gf-form-input login-form-input" type="text" />
 ```

-We _could_ target the field with a CSS selector like `.gf-form-input.login-form-input` but that would be brittle as style changes occur frequently. Furthermore there is nothing that signals to future developers that this input is part of an E2E test. At Grafana, we use `data-testid` attributes as our preferred way of defining selectors. See [Aria-Labels vs data-testid](#aria-labels-vs-data-testid) for more details.
+It is possible to target the field with a CSS selector like `.gf-form-input.login-form-input`. However, doing so is a brittle solution because style changes occur frequently.
+
+Furthermore, there is nothing that signals to future developers that this input is part of an E2E test. At Grafana, we use `data-testid` attributes as our preferred way of defining selectors. See [Aria-Labels vs data-testid](#aria-labels-vs-data-testid) for more details.

 ```jsx
 <input data-testid="Username input field" className="gf-form-input login-form-input" type="text" />
 ```

-The next step is to create a `Page` representation in our E2E framework to glue the test with the real implementation using the `pageFactory` function. For that function we can supply a `url` and `selectors` like in the example below:
+The next step is to create a `Page` representation in our E2E framework. Doing so glues the test with the real implementation using the `pageFactory` function. For that function we can supply a `url` and selector like in the following example:

 ```typescript
 export const Login = {
@@ -43,9 +45,9 @@ export const Login = {
 };
 ```

-Note that the selector is prefixed with `data-testid` - this is a signal to the framework to look for the selector in the `data-testid` attribute.
+In this example, the selector is prefixed with `data-testid`. The prefix is a signal to the framework to look for the selector in the `data-testid` attribute.

-The next step is to add the `Login` page to the `Pages` export within [_\<repo-root>/packages/grafana-e2e-selectors/src/selectors/pages.ts_](../../packages/grafana-e2e-selectors/src/selectors/pages.ts) so that it appears when we type `e2e.pages` in our IDE.
+The next step is to add the `Login` page to the `Pages` export within [_\<repo-root>/packages/grafana-e2e-selectors/src/selectors/pages.ts_](../../packages/grafana-e2e-selectors/src/selectors/pages.ts) so that it appears when we type `e2e.pages` in your IDE.

 ```typescript
 export const Pages = {
@@ -56,7 +58,9 @@ export const Pages = {
 };
 ```

-Now that we have a `Page` called `Login` in our `Pages` const we can use that to add a selector in our html like shown below and now this really signals to future developers that it is part of an E2E test.
+Now that we have a page called `Login` in our `Pages` const, use it to add a selector in our HTML as shown in the following example. This page really signals to future developers that it is part of an E2E test.
+
+Example:

 ```jsx
 import { selectors } from '@grafana/e2e-selectors';
@@ -66,9 +70,8 @@ import { selectors } from '@grafana/e2e-selectors';

 The last step in our example is to use our `Login` page as part of a test.

- The `url` property is used whenever we call the `visit` function and is equivalent to the Cypress' [`cy.visit()`](https://docs.cypress.io/api/commands/visit.html#Syntax).
-
- Any defined selector can be accessed from the `Login` page by invoking it. This is equivalent to the result of the Cypress function [`cy.get(…)`](https://docs.cypress.io/api/commands/get.html#Syntax).
+- Use the `url` property whenever you call the `visit` function. It is equivalent to the [`cy.visit()`](https://docs.cypress.io/api/commands/visit.html#Syntax) in Cypress.
+- Access any defined selector from the `Login` page by invoking it. This is equivalent to the result of the Cypress function [`cy.get(…)`](https://docs.cypress.io/api/commands/get.html#Syntax).

 ```typescript
 describe('Login test', () => {
@@ -83,7 +86,7 @@ describe('Login test', () => {

 ## Advanced example

-Let's take a look at an example that uses the same `selector` for multiple items in a list for instance. In this example app we have a list of data sources that we want to click on during an E2E test.
+Let's take a look at an example that uses the same selector for multiple items in a list for instance. In this example app, there's a list of data sources that we want to click on during an E2E test.

 ```jsx
 <ul>
@@ -97,7 +100,7 @@ Let's take a look at an example that uses the same `selector` for multiple items
 </ul>
 ```

-Just as before in the basic example we'll start by creating a page abstraction using the `pageFactory` function:
+Like in the basic example, start by creating a page abstraction using the `pageFactory` function:

 ```typescript
 export const DataSources = {
@@ -106,11 +109,11 @@ export const DataSources = {
 };
 ```

-You might have noticed that instead of a simple `string` as the `selector`, we're using a `function` that takes a string parameter as an argument and returns a formatted string using the argument.
+You might have noticed that instead of a simple string as the selector, there's a function that takes a string parameter as an argument and returns a formatted string using the argument.

-Just as before we need to add the `DataSources` page to the exported const `Pages` in `packages/grafana-e2e-selectors/src/selectors/pages.ts`.
+Just as before, you need to add the `DataSources` page to the exported const `Pages` in `packages/grafana-e2e-selectors/src/selectors/pages.ts`.

-The next step is to use the `dataSources` selector function as in our example below:
+The next step is to use the `dataSources` selector function as in the following example:

 ```jsx
 <ul>
@@ -126,7 +129,7 @@ The next step is to use the `dataSources` selector function as in our example be
 </ul>
 ```

-When this list is rendered with the data sources with names `A`, `B` and `C` ,the resulting HTML would look like:
+When this list is rendered with the data sources with names `A`, `B` and `C` ,the resulting HTML looks like this:

 ```html
 <div class="card-item-name" data-testid="data-testid Data source list item A">A</div>
@@ -134,7 +137,7 @@ When this list is rendered with the data sources with names `A`, `B` and `C` ,th
 <div class="card-item-name" data-testid="data-testid Data source list item C">C</div>
 ```

-Now we can write our test. The one thing that differs from the [basic example](#basic-example) above is that we pass in which data source we want to click on as an argument to the selector function:
+Now we can write our test. The one thing that differs from the previous [basic example](#basic-example) is that we pass in which data source we want to click as an argument to the selector function:

 ```typescript
 describe('List test', () => {
@@ -147,17 +150,17 @@ describe('List test', () => {
 });
 ```

-## Aria-Labels vs data-testid
+## aria-label versus data-testid

-Our selectors are set up to work with both aria-labels and data-testid attributes. Aria-labels help assistive technologies such as screenreaders identify interactive elements of a page for our users.
+Our selectors are set up to work with both `aria-label` attributes and `data-testid` attributes. The `aria-label` attributes help assistive technologies such as screen readers identify interactive elements of a page for our users.

-A good example of a time to use an aria-label might be if you have a button with an X to close:
+A good example of a time to use an aria-label might be if you have a button with an **X** to close:

 ```
 <button aria-label="close">X<button>
 ```

-It might be clear visually that the X closes the modal, but audibly it would not be clear for example.
+It might be clear visually that the **X** closes the modal, but audibly it would not be clear, for example.

 ```
 <button aria-label="close">Close<button>
@@ -165,28 +168,26 @@ It might be clear visually that the X closes the modal, but audibly it would not

 The example might read aloud to a user as "Close, Close" or something similar.

-However adding aria-labels to elements that are already clearly labeled or not interactive can be confusing and redundant for users with assistive technologies.
+However, adding an aria-label to an element that is already clearly labeled or not interactive can be confusing and redundant for users with assistive technologies.

-In such cases rather than adding unnecessary aria-labels to components so as to make them selectable for testing, it is preferable to use a data attribute that would not be read aloud with an assistive technology for example:
+In such cases, don't add an unnecessary aria-label to a component so as to make them selectable for testing. Instead, use a data attribute that will not be read aloud with an assistive technology. For example:

 ```
 <button data-testid="modal-close-button">Close<button>
 ```

-We have added support for this in our selectors, to use:
-
-Prefix your selector string with "data-testid":
+We have added support for data attributes in our selectors Prefix your selector string with `data-testid`:

 ```typescript
 export const Components = {
  Login: {
-    openButton: 'open-button', // this would look for an aria-label
-    closeButton: 'data-testid modal-close-button', // this would look for a data-testid
+    openButton: 'open-button', // this looks for an aria-label
+    closeButton: 'data-testid modal-close-button', // this  looks for a data-testid
  },
 };
 ```

-and in your component, import the selectors and add the data test id:
+and in your component, import the selectors and add the `data-testid`:

 ```
 <button data-testid={Selectors.Components.Login.closeButton}>
--- a/contribute/style-guides/frontend.md
+++ b/contribute/style-guides/frontend.md
@@ -1,41 +1,6 @@
-# Frontend Style Guide
+# Frontend style guide

-Generally we follow the Airbnb [React Style Guide](https://github.com/airbnb/javascript/tree/master/react).
-
-## Table of Contents
-
- [Frontend Style Guide](#frontend-style-guide)
-
-  - [Table of Contents](#table-of-contents)
-  - [Basic rules](#basic-rules)
-    - [Naming conventions](#naming-conventions)
-      - [Use `PascalCase` for:](#use-pascalcase-for)
-        - [Typescript class names](#typescript-class-names)
-        - [Types and interfaces](#types-and-interfaces)
-        - [Enums](#enums)
-      - [Use `camelCase` for:](#use-camelcase-for)
-        - [Functions](#functions)
-        - [Methods](#methods)
-        - [Variables](#variables)
-        - [React state and properties](#react-state-and-properties)
-        - [Emotion class names](#emotion-class-names)
-      - [Use `ALL_CAPS` for constants.](#use-all_caps-for-constants)
-      - [Use BEM convention for SASS styles.](#use-bem-convention-for-sass-styles)
-    - [Typing](#typing)
-    - [File and directory naming conventions](#file-and-directory-naming-conventions)
-    - [Code organization](#code-organization)
-      - [Exports](#exports)
-    - [Comments](#comments)
-    - [Linting](#linting)
-  - [React](#react)
-    - [Props](#props)
-      - [Name callback props and handlers with an "on" prefix.](#name-callback-props-and-handlers-with-an-on-prefix)
-      - [React Component definitions](#react-component-definitions)
-      - [React Component constructor](#react-component-constructor)
-      - [React Component defaultProps](#react-component-defaultprops)
-  - [State management](#state-management)
-
-  - [Proposal for removing or replacing Angular dependencies](https://github.com/grafana/grafana/pull/23048)
+Grafana Labs follows the [Airbnb React/JSX Style Guide](https://github.com/airbnb/javascript/tree/master/react) in matters pertaining to React. This guide provides highlights of the style rules we follow.

 ## Basic rules

@@ -43,11 +8,13 @@ Generally we follow the Airbnb [React Style Guide](https://github.com/airbnb/jav
 - Break large components up into sub-components.
 - Use spaces for indentation.

-### Naming conventions
+## Naming conventions

-#### Use `PascalCase` for:
+Follow these guidelines when naming elements of your code.

-##### Typescript class names
+### Class names
+
+Use PascalCase. For example:

 ```typescript
 // bad
@@ -61,7 +28,94 @@ class DataLink {
 }
 ```

-##### Types and interfaces
+### Constants
+
+Use ALL CAPS for constants. For example:
+
+```typescript
+// bad
+const constantValue = "This string won't change";
+// bad
+const constant_value = "This string won't change";
+
+// good
+const CONSTANT_VALUE = "This string won't change";
+```
+
+### Emotion class names
+
+Use camelCase. For example:
+
+```typescript
+const getStyles = (theme: GrafanaTheme2) => ({
+  // bad
+  ElementWrapper: css`...`,
+  // bad
+  ['element-wrapper']: css`...`,
+
+  // good
+  elementWrapper: css({
+    padding: theme.spacing(1, 2),
+    background: theme.colors.background.secondary,
+  }),
+});
+```
+
+Use hook useStyles2(getStyles) to memoize the styles generation and try to avoid passing props to the getStyles function and instead compose classes using Emotion CX function.
+
+### Enums
+
+Use PascalCase. For example:
+
+```
+// bad
+enum buttonVariant {
+ //...
+}
+
+// good
+enum ButtonVariant {
+ //...
+}
+```
+
+### Files and directories
+
+Name files according to the primary export:
+
+- When the primary export is a class or React component, use PascalCase.
+- When the primary export is a function, use camelCase.
+
+For files that export multiple utility functions, use the name that describes the responsibility of grouped utilities. For example, a file that exports math utilities should be named `math.ts`.
+
+- Use `constants.ts` for files that export constants.
+- Use `actions.ts` for files that export Redux actions.
+- Use `reducers.ts` for Redux reducers.
+- Use `*.test.ts(x)` for test files.
+
+For directory names, use dash-case (sometimes called kebab-case).
+
+- Use `features/new-important-feature/utils.ts`
+
+### Functions
+
+Use PascalCase. For example:
+
+Use camelCase.
+
+```typescript
+// bad
+const CalculatePercentage = () => { ... }
+// bad
+const calculate_percentage = () => { ... }
+
+// good
+const calculatePercentage = () => { ... }
+```
+
+### Interfaces
+
+Use PascalCase. For example:

 ```
 // bad
@@ -91,35 +145,11 @@ type request_info = ...
 type RequestInfo = ...
 ```

-##### Enums
+### Methods

-```
-// bad
-enum buttonVariant {
- //...
-}
+Use PascalCase. For example:

-// good
-enum ButtonVariant {
- //...
-}
-```
-
-#### Use `camelCase` for:
-
-##### Functions
-
-```typescript
-// bad
-const CalculatePercentage = () => { ... }
-// bad
-const calculate_percentage = () => { ... }
-
-// good
-const calculatePercentage = () => { ... }
-```
-
-##### Methods
+Use camelCase.

 ```typescript
 class DateCalculator {
@@ -137,164 +167,13 @@ class DateCalculator {
 }
 ```

-##### Variables
+### React components

-```typescript
-// bad
-const QueryTargets = [];
-// bad
-const query_targets = [];
+Follow these guidelines for naming React components.

-// good
-const queryTargets = [];
-```
+#### React callback props and handlers

-##### React state and properties
-
-```typescript
-interface ModalState {
-  // bad
-  IsActive: boolean;
-  // bad
-  is_active: boolean;
-
-  // good
-  isActive: boolean;
-}
-```
-
-##### Emotion class names
-
-```typescript
-const getStyles = (theme: GrafanaTheme2) => ({
-  // bad
-  ElementWrapper: css`...`,
-  // bad
-  ['element-wrapper']: css`...`,
-
-  // good
-  elementWrapper: css({
-    padding: theme.spacing(1, 2),
-    background: theme.colors.background.secondary,
-  }),
-});
-```
-
-Use hook useStyles2(getStyles) to memoize the styles generation and try to avoid passing props to the getStyles function and instead compose classes using emotion cx function.
-
-#### Use `ALL_CAPS` for constants.
-
-```typescript
-// bad
-const constantValue = "This string won't change";
-// bad
-const constant_value = "This string won't change";
-
-// good
-const CONSTANT_VALUE = "This string won't change";
-```
-
-#### Use [BEM](http://getbem.com/) convention for SASS styles.
-
-_SASS styles are deprecated. Please migrate to Emotion whenever you need to modify SASS styles._
-
-### Typing
-
-In general, you should let Typescript infer the types so that there's no need to explicitly define type for each variable.
-
-There are some exceptions to this:
-
-```typescript
-// Typescript needs to know type of arrays or objects otherwise it would infer it as array of any
-
-// bad
-const stringArray = [];
-
-// good
-const stringArray: string[] = [];
-```
-
-Specify function return types explicitly in new code. This improves readability by being able to tell what a function returns just by looking at the signature. It also prevents errors when a function's return type is broader than expected by the author.
-
-> **Note:** We don't have linting for this enabled because of lots of old code that needs to be fixed first.
-
-```typescript
-// bad
-function transform(value?: string) {
-  if (!value) {
-    return undefined;
-  }
-  return applyTransform(value);
-}
-
-// good
-function transform(value?: string): TransformedValue | undefined {
-  if (!value) {
-    return undefined;
-  }
-  return applyTransform(value);
-}
-```
-
-### File and directory naming conventions
-
-Name files according to the primary export:
-
- When the primary export is a class or React component, use PascalCase.
- When the primary export is a function, use camelCase.
-
-For files exporting multiple utility functions, use the name that describes the responsibility of grouped utilities. For example, a file exporting math utilities should be named `math.ts`.
-
- Use `constants.ts` for files exporting constants.
- Use `actions.ts` for files exporting Redux actions.
- Use `reducers.ts` Redux reducers.
- Use `*.test.ts(x)` for test files.
-
- Use kebab case for directory names: lowercase, words delimited by hyphen ( `-` ). For example, `features/new-important-feature/utils.ts`.
-
-### Code organization
-
-Organize your code in a directory that encloses feature code:
-
- Put Redux state and domain logic code in `state` directory (i.e. `features/my-feature/state/actions.ts`).
- Put React components in `components` directory (i.e. `features/my-feature/components/ButtonPeopleDreamOf.tsx`).
- Put test files next to the test subject.
- Put containers (pages) in feature root (i.e. `features/my-feature/DashboardPage.tsx`).
- Put API function calls that isn't a redux thunk in an `api.ts` file within the same directory.
- Subcomponents can live in the component folders. Small component do not need their own folder.
- Component SASS styles should live in the same folder as component code.
-
-For code that needs to be used by external plugin:
-
- Put components and types in `@grafana/ui`.
- Put data models and data utilities in `@grafana/data`.
- Put runtime services interfaces in `@grafana/runtime`.
-
-#### Exports
-
- Use named exports for all code you want to export from a file.
- Use declaration exports (i.e. `export const foo = ...`).
- Avoid using default exports (for example, `export default foo`).
- Export only the code that is meant to be used outside the module.
-
-### Comments
-
- Use [TSDoc](https://github.com/microsoft/tsdoc) comments to document your code.
- Use [react-docgen](https://github.com/reactjs/react-docgen) comments (`/** ... */`) for props documentation.
- Use inline comments for comments inside functions, classes etc.
- Please try to follow the [code comment guidelines](./code-comments.md) when adding comments.
-
-### Linting
-
-Linting is performed using [@grafana/eslint-config](https://github.com/grafana/eslint-config-grafana).
-
-## React
-
-Use the following conventions when implementing React components:
-
-### Props
-
-##### Name callback props and handlers with an "on" prefix.
+Name callback props and handlers with an _on_ prefix. For example:

 ```tsx
 // bad
@@ -321,17 +200,9 @@ render() {

 ```

-##### React Component definitions
+#### React component constructor

-```jsx
-// bad
-export class YourClass extends PureComponent { ... }
-
-// good
-export class YourClass extends PureComponent<{},{}> { ... }
-```
-
-##### React Component constructor
+Use the following convention when implementing these React components:

 ```typescript
 // bad
@@ -341,7 +212,9 @@ constructor(props) {...}
 constructor(props: Props) {...}
 ```

-##### React Component defaultProps
+#### React component defaultProps
+
+Use the following convention when implementing these React components:

 ```typescript
 // bad
@@ -351,9 +224,131 @@ static defaultProps = { ... }
 static defaultProps: Partial<Props> = { ... }
 ```

-### How to declare functional components
+#### React component definitions

-We prefer using function declarations over function expressions when creating a new react functional component.
+Use the following convention when implementing these React components:
+
+```jsx
+// bad
+export class YourClass extends PureComponent { ... }
+
+// good
+export class YourClass extends PureComponent<{},{}> { ... }
+```
+
+#### React state and properties
+
+Use camelCase. For example:
+
+```typescript
+interface ModalState {
+  // bad
+  IsActive: boolean;
+  // bad
+  is_active: boolean;
+
+  // good
+  isActive: boolean;
+}
+```
+
+### SASS
+
+SASS styles are deprecated. You should migrate to Emotion whenever you need to modify SASS styles.
+
+### Types
+
+In general, you should let TypeScript infer the types so that there's no need to explicitly define the type for each variable.
+
+There are some exceptions to this:
+
+```typescript
+// TypeScript needs to know the type of arrays or objects; otherwise, it infers type as an array of any
+
+// bad
+const stringArray = [];
+
+// good
+const stringArray: string[] = [];
+```
+
+Specify function return types explicitly in new code. This improves readability by being able to tell what a function returns just by looking at the signature. It also prevents errors when a function's return type is broader than expected by the author.
+
+> **Note:** Linting is not enabled for this issue because there is old code that needs to be fixed first.
+
+```typescript
+// bad
+function transform(value?: string) {
+  if (!value) {
+    return undefined;
+  }
+  return applyTransform(value);
+}
+
+// good
+function transform(value?: string): TransformedValue | undefined {
+  if (!value) {
+    return undefined;
+  }
+  return applyTransform(value);
+}
+```
+
+### Variables
+
+Use PascalCase. For example:
+
+Use camelCase.
+
+```typescript
+// bad
+const QueryTargets = [];
+// bad
+const query_targets = [];
+
+// good
+const queryTargets = [];
+```
+
+## Code organization
+
+Organize your code in a directory that encloses feature code:
+
+- Put Redux state and domain logic code in the `state` directory (for example, `features/my-feature/state/actions.ts`).
+- Put React components in the `components` directory (for example, `features/my-feature/components/ButtonPeopleDreamOf.tsx`).
+- Put test files next to the test subject.
+- Put containers (pages) in the feature root (for example, `features/my-feature/DashboardPage.tsx`).
+- Put API function calls that aren't a Redux thunk in an `api.ts` file within the same directory.
+- Subcomponents should live in the component folders. Small components don't need their own folder.
+- Component SASS styles should live in the same folder as component code.
+
+For code that needs to be used by an external plugin:
+
+- Put components and types in `@grafana/ui`.
+- Put data models and data utilities in `@grafana/data`.
+- Put runtime services interfaces in `@grafana/runtime`.
+
+### Exports
+
+- Use named exports for all code you want to export from a file.
+- Use declaration exports (that is, `export const foo = ...`).
+- Avoid using default exports (for example, `export default foo`).
+- Export only the code that is meant to be used outside the module.
+
+### Code comments
+
+- Use [TSDoc](https://github.com/microsoft/tsdoc) comments to document your code.
+- Use [react-docgen](https://github.com/reactjs/react-docgen) comments (`/** ... */`) for props documentation.
+- Use inline comments for comments inside functions, classes, etc.
+- Please try to follow the [code comment guidelines](./code-comments.md) when adding comments.
+
+## Linting
+
+Linting is performed using [@grafana/eslint-config](https://github.com/grafana/eslint-config-grafana).
+
+## Functional components
+
+Use function declarations instead of function expressions when creating a new React functional component. For example:

 ```typescript
 // bad
@@ -366,13 +361,6 @@ export const Component: React.FC<Props> = (props) => { ... }
 export function Component(props: Props) { ... }
 ```

-Some interesting readings on the topic:
-
- [Create React App: Remove React.FC from typescript template](https://github.com/facebook/create-react-app/pull/8177)
- [Kent C. Dodds: How to write a React Component in Typescript](https://kentcdodds.com/blog/how-to-write-a-react-component-in-typescript)
- [Kent C. Dodds: Function forms](https://kentcdodds.com/blog/function-forms)
- [Sam Hendrickx: Why you probably shouldn't use React.FC?](https://medium.com/raccoons-group/why-you-probably-shouldnt-use-react-fc-to-type-your-react-components-37ca1243dd13)
-
 ## State management

 - Don't mutate state in reducers or thunks.
--- a/contribute/style-guides/redux.md
+++ b/contribute/style-guides/redux.md
@@ -2,16 +2,20 @@

 Grafana uses [Redux Toolkit](https://redux-toolkit.js.org/) to handle Redux boilerplate code.

-> Some of our Reducers are used by Angular and therefore state is to be considered as mutable for those reducers.
+> **Note:** Some of our reducers are used by Angular; therefore, consider state to be mutable for those reducers.

 ## Test functionality

+Here's how to test the functioning of your Redux reducers.
+
 ### reducerTester

-Fluent API that simplifies the testing of reducers
+Use the Fluent API framework to simplify the testing of reducers.

 #### Usage

+Example of `reducerTester` in use:
+
 ```typescript
 reducerTester()
  .givenReducer(someReducer, initialState)
@@ -21,9 +25,9 @@ reducerTester()

 #### Complex usage

-Sometimes you encounter a `resulting state` that contains properties that are hard to compare, such as `Dates`, but you still want to compare that other props in state are correct.
+Sometimes you encounter a _resulting state_ that contains properties that are hard to compare, such as `Dates`, but you still want to evaluate whether other props in state are correct.

-Then you can use `thenStatePredicateShouldEqual` function on `reducerTester` that will return the `resulting state` so that you can expect upon individual properties..
+In these cases, you can evaluate individual properties by using `thenStatePredicateShouldEqual` function on `reducerTester` that will return the resulting state. For example:

 ```typescript
 reducerTester()
@@ -37,10 +41,12 @@ reducerTester()

 ### thunkTester

-Fluent API that simplifies the testing of thunks.
+Here's a Fluent API function that simplifies the testing of thunks.

 #### Usage

+Example of `thunkTester` in use:
+
 ```typescript
 const dispatchedActions = await thunkTester(initialState).givenThunk(someThunk).whenThunkIsDispatched(arg1, arg2, arg3);

@@ -49,7 +55,7 @@ expect(dispatchedActions).toEqual([someAction('reducer tests')]);

 ## Typing of connected props

-It is possible to infer connected props automatically from `mapStateToProps` and `mapDispatchToProps` using a helper type `ConnectedProps` from Redux. For this to work the `connect` call has to be split into two parts.
+It is possible to infer connected props automatically from `mapStateToProps` and `mapDispatchToProps` using a helper type `ConnectedProps` from Redux. For this to work properly, split the `connect` call into two parts like so:

 ```typescript
 import { connect, ConnectedProps } from 'react-redux';
@@ -80,4 +86,4 @@ class PanelEditorUnconnected extends PureComponent<Props> {}
 export const PanelEditor = connector(PanelEditorUnconnected);
 ```

-For more examples, refer to the [Redux docs](https://react-redux.js.org/using-react-redux/static-typing#inferring-the-connected-props-automatically).
+For more examples, refer to the [Redux documentation](https://react-redux.js.org/using-react-redux/static-typing#inferring-the-connected-props-automatically).
--- a/contribute/style-guides/storybook.md
+++ b/contribute/style-guides/storybook.md
@@ -1,6 +1,8 @@
 # Storybook

-[Storybook](https://storybook.js.org/) is a tool which we use to manage our design system and the components which are a part of it. Storybook consists of _stories:_ each story represents a component and a case in which it is used. To show a wide variety of use cases is good both documentation wise and for troubleshooting -- it might be possible to reproduce a bug for an edge case in a story.
+[Storybook](https://storybook.js.org/) is a tool which Grafana uses to manage our design system and its components. Storybook consists of _stories_. Each story represents a component and the case in which it is used.
+
+To show a wide variety of use cases is good both documentation wise and for troubleshooting—it might be possible to reproduce a bug for an edge case in a story.

 Storybook is:

@@ -10,16 +12,22 @@ Storybook is:

 ## How to create stories

-Stories for a component should be placed next to the component file. The Storybook file requires the same name as the component file. For example, a story for `SomeComponent.tsx` will have the file name `SomeComponent.story.tsx`. If a story should be internal, not visible in production, name the file `SomeComponent.story.internal.tsx`.
+Stories for a component should be placed next to the component file. The Storybook file requires the same name as the component file. For example, a story for `SomeComponent.tsx` has the file name `SomeComponent.story.tsx`.
+
+If a story should be internal—not visible in production—name the file `SomeComponent.story.internal.tsx`.

 ### Writing stories

-When writing stories, we use the [CSF format](https://storybook.js.org/docs/formats/component-story-format/). For more in-depth information on writing stories, see [Storybook’s documentation on writing stories](https://storybook.js.org/docs/basics/writing-stories/).
+When writing stories, we use the [CSF format](https://storybook.js.org/docs/formats/component-story-format/).
+
+> **Note:** For more in-depth information on writing stories, see [Storybook’s documentation](https://storybook.js.org/docs/basics/writing-stories/).

 With the CSF format, the default export defines some general information about the stories in the file:

- `title`: Where the component is going to live in the hierarchy
- `decorators`: A list which can contain wrappers or provide context, such as theming
+- **`title`**: Where the component is going to live in the hierarchy
+- **`decorators`**: A list which can contain wrappers or provide context, such as theming
+
+Example:

 ```jsx
 // In MyComponent.story.tsx
@@ -34,18 +42,18 @@ export default {

 ```

-When it comes to writing the actual stories, you continue in the same file with named exports. The exports are turned into the story name.
+When it comes to writing the actual stories, you should continue in the same file with named exports. The exports are turned into the story name like so:

 ```jsx
 // Will produce a story name “some story”
 export const someStory = () => <MyComponent />;
 ```

-If you want to write cover cases with different values for props, then using knobs is usually enough. You don’t need to create a new story. This will be covered further down.
+If you want to write cover cases with different values for props, then using knobs is usually enough. You don’t need to create a new story. This topic will be covered further down.

 ### Categorization

-We currently have these categories:
+We have these categories of components:

 - **Docs Overview** - Guidelines and information regarding the design system
 - **Forms** - Components commonly used in forms such as different kind of inputs
@@ -55,7 +63,7 @@ We currently have these categories:

 ## Writing MDX documentation

-An MDX file is basically a markdown file with the possibility to add jsx. These files are used by Storybook to create a “docs” tab.
+An MDX file is a markdown file with the possibility to add JSX. These files are used by Storybook to create a “docs” tab.

 ### Link the MDX file to a component’s stories

@@ -83,7 +91,7 @@ export default {

 ### MDX file structure

-There are some things that the MDX file should contain:
+The MDX file should contain the following items:

 - When and why the component should be used
 - Best practices - dos and don’ts for the component
@@ -101,7 +109,9 @@ import { MyComponent } from './MyComponent';

 ### MDX file without a relationship to a component

-An MDX file can exist by itself without any connection to a story. This can be good for writing things such as a general guidelines page. Two things are required for this to work:
+An MDX file can exist by itself without any connection to a story. This can be good for writing things such as a general guidelines page.
+
+Two conditions must be met for this to work:

 - The file needs to be named `*.story.mdx`
 - A `Meta` tag must exist that says where in the hierarchy the component lives. It can look like this:
@@ -115,7 +125,7 @@ An MDX file can exist by itself without any connection to a story. This can be g

 ```

-You can add parameters to the Meta tag. This example shows how to hide the tools:
+You can add parameters to the `Meta` tag. This example shows how to hide the tools:

 ```jsx
 <Meta title="Docs Overview/Color Palettes" parameters={{ options: { isToolshown: false }}}/>
@@ -128,11 +138,11 @@ You can add parameters to the Meta tag. This example shows how to hide the tools

 ## Documenting component properties

-A quick way to get an overview of what a component does is by looking at its properties. That's why it is important that we document these in a good way.
+A quick way to get an overview of what a component does is by looking at its properties. That's why it is important that you document these in a good way.

 ### Comments

-When writing the props interface for a component, it is possible to add a comment to that specific property, which will end up in the Props table in the MDX file. The comments are generated by [react-docgen](https://github.com/reactjs/react-docgen) and are formatted by writing `/** */`.
+When writing the props interface for a component, it's possible to add a comment to that specific property. When you do so, the comment will appear in the Props table in the MDX file. The comments are generated by [react-docgen](https://github.com/reactjs/react-docgen) and are formatted by writing `/** */`.

 ```jsx
 interface MyProps {
@@ -143,25 +153,28 @@ interface MyProps {

 ### Controls

-The [controls addon](https://storybook.js.org/docs/react/essentials/controls) provides a way to interact with a component's properties dynamically and requires much less code than knobs. We're deprecating knobs in favor of using controls.
+The [controls addon](https://storybook.js.org/docs/react/essentials/controls) provides a way to interact with a component's properties dynamically. It also requires much less code than knobs.
+
+Knobs are deprecated in favor of using controls.

 #### Migrating a story from Knobs to Controls

-As a test, we migrated the [button story](https://github.com/grafana/grafana/blob/main/packages/grafana-ui/src/components/Button/Button.story.tsx). Here's the guide on how to migrate a story to controls.
+As a test, we migrated the [button story](https://github.com/grafana/grafana/blob/main/packages/grafana-ui/src/components/Button/Button.story.tsx).
+
+Here's the guide on how to migrate a story to controls.

 1.  Remove the `@storybook/addon-knobs` dependency.
-2.  Import the Story type from `@storybook/react`
+2.  Import the `Story` type from `@storybook/react`

    `import { Story } from @storybook/react`

-3.  Import the props interface from the component you're working on (these must be exported in the component).
+3.  Import the props interface from the component you're working on (these must be exported in the component):

    `import { Props } from './Component'`

-4.  Add the Story type to all stories in the file, then replace the props sent to the component
-    and remove any knobs.
+4.  Add the `Story` type to all stories in the file, then replace the props sent to the component and remove any knobs:

-    Before
+    Before:

    ```tsx
    export const Simple = () => {
@@ -172,7 +185,7 @@ As a test, we migrated the [button story](https://github.com/grafana/grafana/blo
    };
    ```

-    After
+    After:

    ```tsx
    export const Simple: Story<Props> = ({ prop1, prop2 }) => {
@@ -180,7 +193,7 @@ As a test, we migrated the [button story](https://github.com/grafana/grafana/blo
    };
    ```

-5.  Add default props (or args in Storybook language).
+5.  Add default props (or `args` in Storybook language):

    ```tsx
    Simple.args = {
@@ -189,8 +202,7 @@ As a test, we migrated the [button story](https://github.com/grafana/grafana/blo
    };
    ```

-6.  If the component has advanced props type (ie. other than string, number, boolean), you need to
-    specify these in an `argTypes`. This is done in the default export of the story.
+6.  If the component has advanced props type (that is, other than string, number, or Boolean), you need to specify these in an `argTypes`. Do this in the default export of the story:

    ```tsx
    export default {
@@ -204,6 +216,6 @@ As a test, we migrated the [button story](https://github.com/grafana/grafana/blo

 ## Best practices

- When creating a new component or writing documentation for an existing one, always cover the basic use case it was intended for with a code example.
+- When creating a new component or writing documentation for an existing one, add a code example. The example should always cover the basic use case it was intended for.
 - Use stories and knobs to create edge cases. If you are trying to solve a bug, try to reproduce it with a story.
- Do not create stories in the MDX, always create them in the `*.story.tsx` file.
+- Do not create stories in the MDX. Instead, create them in the `*.story.tsx` file.
--- a/contribute/style-guides/styling.md
+++ b/contribute/style-guides/styling.md
@@ -1,16 +1,16 @@
 # Styling Grafana

-[Emotion](https://emotion.sh/docs/introduction) is our default-to-be approach to styling React components. It provides a way for styles to be a consequence of properties and state of a component.
+[Emotion](https://emotion.sh/docs/introduction) is Grafana's default-to-be approach to styling React components. It provides a way for styles to be a consequence of properties and state of a component.

 ## Usage

-For styling components, use [Emotion's `css` function](https://emotion.sh/docs/emotion#css).
+For styling components, use [Emotion's `css` function](https://emotion.sh/docs/@emotion/css#css).

 ### Basic styling

-To access the theme in your styles, use the `useStyles` hook. It provides basic memoization and access to the theme object.
+To access the Emotion theme in your styles, use the `useStyles` hook. This hook provides basic memoization and access to the theme object.

-> Please remember to put `getStyles` function at the end of the file!
+> **Note:** Please remember to put `getStyles` function at the end of the file!

 ```tsx
 import { GrafanaTheme2 } from '@grafana/data';
@@ -30,12 +30,17 @@ const getStyles = (theme: GrafanaTheme2) =>
  });
 ```

-### Styling complex components
+### Style complex components

-In more complex cases, especially when you need to style multiple DOM elements in one component, or when using styles that depend on properties and/or state you
-can have your getStyles function return an object with many class names and use [Emotion's `cx` function](https://emotion.sh/docs/@emotion/css#cx) to compose them.
+In more complex cases, you can have the `getStyles` function return an object with many class names and use [Emotion's `cx` function](https://emotion.sh/docs/@emotion/css#cx) to compose them.

-Let's say you need to style a component that has a different background depending on the `isActive` property :
+This feature can be especially useful in certain use cases:
+
+- when you need to style multiple DOM elements in one component
+- when using styles that depend on properties
+- when using styles that depend on state
+
+Let's say you need to style a component that has a different background depending on the `isActive` property. For example:

 ```tsx
 import { css, cx } from '@emotion/css';
@@ -75,4 +80,4 @@ const getStyles = (theme: GrafanaTheme2) => {
 };
 ```

-For more information about themes at Grafana please see the [themes guide](./themes.md).
+For more information about themes at Grafana, refer to the [themes guide](./themes.md).
--- a/contribute/style-guides/testing.md
+++ b/contribute/style-guides/testing.md
@@ -1,10 +1,11 @@
-# Testing Guidelines
+# Testing guidelines

 The goal of this document is to address the most frequently asked "How to" questions related to unit testing.

-## Best practices
+## Some recommended practices for testing

- Default to the `*ByRole` queries when testing components as it encourages testing with accessibility concerns in mind. It's also possible to use `*ByLabelText` queries. However, the `*ByRole` queries are [more robust](https://testing-library.com/docs/queries/bylabeltext/#name) and are generally recommended over the former.
+- Default to the `*ByRole` queries when testing components because it encourages testing with accessibility concerns in mind.
+- Alternatively, you could use `*ByLabelText` queries for testing components. However, we recommend the `*ByRole` queries because they are [more robust](https://testing-library.com/docs/queries/bylabeltext/#name).

 ## Testing User Interactions

@@ -13,7 +14,7 @@ We use the [user-event](https://testing-library.com/docs/user-event/intro) libra
 There are two important considerations when working with `userEvent`:

 1. All methods in `userEvent` are asynchronous, and thus require the use of `await` when called.
-2. Directly calling methods from `userEvent` may not be supported in future versions. As such, it's necessary to first call `userEvent.setup()` prior to the tests. This method returns a `userEvent` instance, complete with all its methods. This setup process can be simplified using a utility function:
+1. Directly calling methods from `userEvent` may not be supported in future versions. As such, it's necessary to first call `userEvent.setup()` prior to the tests. This method returns a `userEvent` instance, complete with all its methods. This setup process can be simplified using a utility function:

 ```tsx
 import { render, screen } from '@testing-library/react';
@@ -32,15 +33,15 @@ it('should render', async () => {
 });
 ```

-## Debugging Tests
+## Debug tests

 There are a few utilities that can be useful for debugging tests:

- [screen.debug()](https://testing-library.com/docs/queries/about/#screendebug) - This function prints a human-readable representation of the document's DOM tree when called without arguments, or the DOM tree of specific node(s) when provided with arguments. It is internally using `console.log` to log the output to terminal.
- [Testing Playground](https://testing-playground.com/) - An interactive sandbox that allows testing which queries work with specific HTML elements.
- [logRoles](https://testing-library.com/docs/dom-testing-library/api-debugging/#prettydom) - A utility function that prints out all the implicit ARIA roles for a given DOM tree.
+- [screen.debug()](https://testing-library.com/docs/queries/about/#screendebug) - This function prints a human-readable representation of the document's DOM tree when called without arguments, or the DOM tree of specific node or nodes when provided with arguments. It is internally using `console.log` to log the output to terminal.
+- [Testing Playground](https://testing-playground.com/) - An interactive sandbox that allows testing of which queries work with specific HTML elements.
+- [prettyDOM logRoles](https://testing-library.com/docs/dom-testing-library/api-debugging/#prettydom) - A utility function that prints out all the implicit ARIA roles for a given DOM tree.

-## Testing Select Components
+## Testing select components

 Here, the [OrgRolePicker](https://github.com/grafana/grafana/blob/38863844e7ac72c7756038a1097f89632f9985ff/public/app/features/admin/OrgRolePicker.tsx) component is used as an example. This component essentially serves as a wrapper for the `Select` component, complete with its own set of options.

@@ -78,7 +79,7 @@ export function OrgRolePicker({ value, onChange, 'aria-label': ariaLabel, inputI

 ### Querying the Select Component

-The recommended way to query `Select` components is by using a label. Add a `label` element and provide the `htmlFor` prop with a matching `inputId`. Alternatively, `aria-label` can be specified on the `Select`.
+It is a recommended practice to query `Select` components by using a label. Add a `label` element and provide the `htmlFor` prop with a matching `inputId`. Alternatively, you can specify `aria-label` on the `Select` statement.

 ```tsx
 describe('OrgRolePicker', () => {
@@ -94,7 +95,7 @@ describe('OrgRolePicker', () => {
 });
 ```

-### Testing the Display of Correct Options
+### Test the display of correct options

 At times, it might be necessary to verify that the `Select` component is displaying the correct options. In such instances, the best solution is to click the `Select` component and match the desired option using the `*ByText` query.

@@ -129,11 +130,11 @@ it('should select an option', async () => {
 });
 ```

-## Mocking Objects and Functions
+## Mock objects and functions

-### Mocking the `window` Object and Its Methods
+### Mock the `window` object and its methods

-The recommended approach for mocking the `window` object is to use Jest spies. Jest's spy functions provide a built-in mechanism for restoring mocks. This feature eliminates the need to manually save a reference to the `window` object.
+The recommended approach for mocking the `window` object is to use [Jest spies](https://jestjs.io/docs/jest-object). Jest's spy functions provide a built-in mechanism for restoring mocks. This feature eliminates the need to manually save a reference to the `window` object.

 ```tsx
 let windowSpy: jest.SpyInstance;
@@ -156,7 +157,7 @@ it('should test with window', function () {

 ### Mocking getBackendSrv()

-The `getBackendSrv()` function is used to make HTTP requests to the Grafana backend. It is possible to mock this function using the `jest.mock` method.
+Use the `getBackendSrv()` function to make HTTP requests to the Grafana backend. It is possible to mock this function using the `jest.mock` method.

 ```tsx
 jest.mock('@grafana/runtime', () => ({
@@ -169,9 +170,9 @@ jest.mock('@grafana/runtime', () => ({

 #### Mocking getBackendSrv for AsyncSelect

-The `AsyncSelect` component is used to asynchronously load options. As such, it often relies on the `getBackendSrv` for loading the options.
+Use the `AsyncSelect` component to asynchronously load options. This component often relies on the `getBackendSrv` for loading the options.

-Here's how the test would look like for this [OrgPicker](https://github.com/grafana/grafana/blob/38863844e7ac72c7756038a1097f89632f9985ff/public/app/core/components/Select/OrgPicker.tsx) component, which uses `AsyncSelect` under the hood.
+Here's what the test looks like for this [OrgPicker](https://github.com/grafana/grafana/blob/38863844e7ac72c7756038a1097f89632f9985ff/public/app/core/components/Select/OrgPicker.tsx) component, which uses `AsyncSelect` under the hood:

 ```tsx
 import { screen, render } from '@testing-library/react';
--- a/contribute/triage-issues.md
+++ b/contribute/triage-issues.md
@@ -7,7 +7,7 @@ Triage helps ensure that GitHub issues resolve quickly by:
 - Lowering the issue count by preventing duplicate issues.
 - Streamlining the development process by preventing duplicate discussions.

-This document gives you some ideas on what you can do to help. For more information, read more about [how the core Grafana team triage issues](/ISSUE_TRIAGE.md).
+This document gives you some ideas on what you can do to help. For more information, read more about [how the core Grafana team triage issues](/contribute/ISSUE_TRIAGE.md).

 ## Improve issues

@@ -23,9 +23,9 @@ Investigate issues that we haven't been able to reproduce yet. In some cases, th

 ## Vote on issues

-Use [GitHub reactions](https://help.github.com/en/articles/about-conversations-on-github#reacting-to-ideas-in-comments) to let us know what's important to you. Vote on bugs if you've experienced the same problem. **Don't vote, or react, by commenting on the issue.**
+Use [GitHub reactions](https://github.blog/news-insights/product-news/add-reactions-to-pull-requests-issues-and-comments/) to let us know what's important to you. Vote on bugs if you've experienced the same problem. **Don't vote, or react, by commenting on the issue.**

-Read more about [how we prioritize issues](/ISSUE_TRIAGE.md#4-prioritization-of-issues).
+Read more about [how we prioritize issues](/contribute/ISSUE_TRIAGE.md#4-prioritization-of-issues).

 ## Report duplicates

--- a/devenv/dev-dashboards/migrations/migrations.json
+++ b/devenv/dev-dashboards/migrations/migrations.json
@@ -389,9 +389,9 @@
            "type": "testdata",
            "uid": "PD8C576611E62080A"
          },
+          "rawFrameContent": "[\n  {\n    \"schema\": {\n      \"refId\": \"A\",\n      \"meta\": {\n        \"typeVersion\": [\n          0,\n          0\n        ],\n        \"custom\": {\n          \"customStat\": 10\n        }\n      },\n      \"fields\": [\n        {\n          \"name\": \"time\",\n          \"type\": \"time\",\n          \"typeInfo\": {\n            \"frame\": \"time.Time\",\n            \"nullable\": true\n          },\n          \"config\": {\n            \"interval\": 3600000\n          }\n        },\n        {\n          \"name\": \"Value\",\n          \"type\": \"number\",\n          \"typeInfo\": {\n            \"frame\": \"float64\",\n            \"nullable\": true\n          },\n          \"labels\": {\n            \"pod\": \"A-pod\"\n          },\n          \"config\": {}\n        }\n      ]\n    },\n    \"data\": {\n      \"values\": [\n        [\n          1727107111901,\n          1727110711901,\n          1727114311901,\n          1727117911901,\n          1727121511901,\n          1727125111901\n        ],\n        [\n          1.907286825122581,\n          2.260951647569786,\n          1.887442338051216,\n          2.1526144400893514,\n          1.7287721375237766,\n          1.7262902137793208\n        ]\n      ]\n    }\n  },\n  {\n    \"schema\": {\n      \"refId\": \"A\",\n      \"meta\": {\n        \"typeVersion\": [\n          0,\n          0\n        ],\n        \"custom\": {\n          \"customStat\": 10\n        }\n      },\n      \"fields\": [\n        {\n          \"name\": \"time\",\n          \"type\": \"time\",\n          \"typeInfo\": {\n            \"frame\": \"time.Time\",\n            \"nullable\": true\n          },\n          \"config\": {\n            \"interval\": 3600000\n          }\n        },\n        {\n          \"name\": \"Value\",\n          \"type\": \"number\",\n          \"typeInfo\": {\n            \"frame\": \"float64\",\n            \"nullable\": true\n          },\n          \"labels\": {\n            \"pod\": \"A-pod1\"\n          },\n          \"config\": {}\n        }\n      ]\n    },\n    \"data\": {\n      \"values\": [\n        [\n          1727107111901,\n          1727110711901,\n          1727114311901,\n          1727117911901,\n          1727121511901,\n          1727125111901\n        ],\n        [\n          1.907286825122581,\n          1.589539045095202,\n          1.5914283506847613,\n          1.8976990616650726,\n          1.758223085999124,\n          2.2294649594813816\n        ]\n      ]\n    }\n  },\n  {\n    \"schema\": {\n      \"refId\": \"A\",\n      \"meta\": {\n        \"typeVersion\": [\n          0,\n          0\n        ],\n        \"custom\": {\n          \"customStat\": 10\n        }\n      },\n      \"fields\": [\n        {\n          \"name\": \"time\",\n          \"type\": \"time\",\n          \"typeInfo\": {\n            \"frame\": \"time.Time\",\n            \"nullable\": true\n          },\n          \"config\": {\n            \"interval\": 3600000\n          }\n        },\n        {\n          \"name\": \"Value\",\n          \"type\": \"number\",\n          \"typeInfo\": {\n            \"frame\": \"float64\",\n            \"nullable\": true\n          },\n          \"labels\": {\n            \"pod\": \"A-pod2\"\n          },\n          \"config\": {}\n        }\n      ]\n    },\n    \"data\": {\n      \"values\": [\n        [\n          1727107111901,\n          1727110711901,\n          1727114311901,\n          1727117911901,\n          1727121511901,\n          1727125111901\n        ],\n        [\n          1.907286825122581,\n          2.0914263380328766,\n          1.8164545521094575,\n          1.621111084665713,\n          1.3902653996444705,\n          1.482803315949775\n        ]\n      ]\n    }\n  }\n]",
          "refId": "A",
-          "scenarioId": "random_walk",
-          "seriesCount": 3
+          "scenarioId": "raw_frame"
        }
      ],
      "thresholds": [],
@@ -462,6 +462,145 @@
      "title": "Status + Notes",
      "type": "text"
    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": {
+        "default": false,
+        "type": "datasource",
+        "uid": "-- Dashboard --"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 11,
+        "w": 16,
+        "x": 0,
+        "y": 22
+      },
+      "hiddenSeries": false,
+      "id": 32,
+      "legend": {
+        "alignAsTable": true,
+        "avg": true,
+        "current": true,
+        "max": true,
+        "min": false,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "nullPointMode": "null",
+      "options": {
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "percentage": false,
+      "pluginVersion": "11.3.0-pre",
+      "pointradius": 2,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "datasource": {
+            "type": "datasource",
+            "uid": "-- Dashboard --"
+          },
+          "panelId": 28,
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeRegions": [],
+      "title": "Flot graph - x axis series mode (with legend calcs)",
+      "tooltip": {
+        "shared": false,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "mode": "series",
+        "show": true,
+        "values": [
+          "total"
+        ]
+      },
+      "yaxes": [
+        {
+          "$$hashKey": "object:88",
+          "format": "short",
+          "logBase": 1,
+          "show": true
+        },
+        {
+          "$$hashKey": "object:89",
+          "format": "short",
+          "logBase": 1,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false
+      }
+    },
+    {
+      "datasource": {
+        "type": "testdata",
+        "uid": "PD8C576611E62080A"
+      },
+      "gridPos": {
+        "h": 11,
+        "w": 8,
+        "x": 16,
+        "y": 22
+      },
+      "id": 33,
+      "options": {
+        "code": {
+          "language": "plaintext",
+          "showLineNumbers": false,
+          "showMiniMap": false
+        },
+        "content": "# Graph panel >> Bar gauge panel\n",
+        "mode": "markdown"
+      },
+      "pluginVersion": "11.3.0-pre",
+      "targets": [
+        {
+          "datasource": {
+            "type": "testdata",
+            "uid": "PD8C576611E62080A"
+          },
+          "refId": "A"
+        }
+      ],
+      "title": "Status + Notes",
+      "type": "text"
+    },
    {
      "aliasColors": {},
      "bars": true,
@@ -1183,4 +1322,4 @@
  "uid": "cdd412c4",
  "version": 68,
  "weekStart": ""
-}
+}
--- a/devenv/docker/blocks/auth/authentik/ldap_authentik.toml
+++ b/devenv/docker/blocks/auth/authentik/ldap_authentik.toml
@@ -18,7 +18,7 @@ name = "displayName"
 surname = "sn"
 username = "cn"
 member_of = "memberOf"
-email =  "mail"
+email = "mail"

 # Map ldap groups to grafana org roles
 [[servers.group_mappings]]
--- a/devenv/docker/blocks/auth/jwt_proxy/docker-compose.yaml
+++ b/devenv/docker/blocks/auth/jwt_proxy/docker-compose.yaml
@@ -51,7 +51,7 @@
    depends_on:
      - oauthkeycloak
    extra_hosts:
-      - "env.grafana.local:host.containers.internal"
+      - "env.grafana.local:host-gateway"
    ports:
      - 8088:8088
    restart: unless-stopped
--- a/devenv/docker/blocks/auth/nginx_proxy/nginx_serve_from_sub_path.conf
+++ b/devenv/docker/blocks/auth/nginx_proxy/nginx_serve_from_sub_path.conf
@@ -0,0 +1,39 @@
+events { worker_connections 1024; }
+
+http {
+  # This is required to proxy Grafana Live WebSocket connections.
+  map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+  }
+
+  upstream grafana {
+    server host.docker.internal:3000;
+  }
+
+  server {
+    listen 8090;
+
+    location / {
+      root /var/www/html;
+    }
+
+    # Set the followings in grafana.ini:
+    # [server]
+    # root_url = http://localhost:8090/grafana/
+    # serve_from_sub_path = true
+    location /grafana/ {
+      proxy_set_header Host $host;
+      proxy_pass http://grafana;
+    }
+
+    # Proxy Grafana Live WebSocket connections.
+    location /grafana/api/live/ {
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_set_header Host $host;
+      proxy_pass http://grafana;
+    }
+  }
+}
--- a/devenv/docker/blocks/collectd/README.md
+++ b/devenv/docker/blocks/collectd/README.md
@@ -30,7 +30,7 @@ Environment variables
  - Graphite prefix
  - Optional, defaults to collectd.
 - `REPORT_BY_CPU`
-  - Report per-CPU metrics if true, global sum of CPU metrics if false (details: [collectd.conf man page](https://collectd.org/documentation/manpages/collectd.conf.5.shtml#plugin_cpu))
+  - Report per-CPU metrics if true, global sum of CPU metrics if false (details: [collectd.conf man page](https://www.collectd.org/documentation/manpages/collectd.conf.html))
  - Optional, defaults to false.
 - `COLLECT_INTERVAL`
  - Collection interval and thus resolution of metrics
--- a/devenv/docker/blocks/mimir_backend/docker-compose.yaml
+++ b/devenv/docker/blocks/mimir_backend/docker-compose.yaml
@@ -1,5 +1,5 @@
  mimir_backend:
-    image: grafana/mimir-alpine:r295-a23e559
+    image: grafana/mimir-alpine:r304-3872ccb
    container_name: mimir_backend
    command:
      - -target=backend
@@ -14,4 +14,4 @@
      - 8080:8080
    volumes:
      - "./docker/blocks/mimir_backend/nginx/nginx.conf.template:/etc/nginx/templates/nginx.conf.template"
-      - "./docker/blocks/mimir_backend/nginx/.htpasswd:/etc/nginx/.htpasswd"
+      - "./docker/blocks/mimir_backend/nginx/.htpasswd:/etc/nginx/.htpasswd"
--- a/devenv/docker/blocks/mqtt/README.md
+++ b/devenv/docker/blocks/mqtt/README.md
@@ -0,0 +1,31 @@
+# NanoMQ MQTT broker
+
+Starts a [NanoMQ MQTT broker](https://nanomq.io/docs/en/latest/).
+
+## Authentication
+
+The broker is configured to use a simple username/password authentication.
+See [./nanomq_pwd.conf](./nanomq_pwd.conf) for the default credentials. 
+
+## TLS Certificates
+
+If you want to configure an MQTT contact point in Grafana Alerting with TLS, you need to provide a certificate and key.
+
+You can find them in `/etc/certs` directory in the container:
+
+``` shell
+docker exec devenv-mqtt-1 ls /etc/certs/
+```
+
+### CA Certificate
+
+``` shell
+docker exec devenv-mqtt-1 cat /etc/certs/ca.pem
+```
+
+### Client certificates
+
+``` shell
+docker exec devenv-mqtt-1 cat /etc/certs/client.pem
+docker exec devenv-mqtt-1 cat /etc/certs/client.key
+```
--- a/devenv/docker/blocks/mqtt/build/Dockerfile
+++ b/devenv/docker/blocks/mqtt/build/Dockerfile
@@ -0,0 +1,9 @@
+FROM emqx/nanomq:0.21.11-full
+
+RUN apt-get update && apt-get install -y \
+  openssl \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY ./san.cnf /etc/certs/san.cnf
+COPY ./gen_certs.sh /etc/certs/gen_certs.sh
+RUN /etc/certs/gen_certs.sh
--- a/devenv/docker/blocks/mqtt/build/gen_certs.sh
+++ b/devenv/docker/blocks/mqtt/build/gen_certs.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+DAYS_VALID=3650
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Create CA certificate
+openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/ca.key"
+openssl req -new -x509 -days $DAYS_VALID -key "$SCRIPT_DIR/ca.key" -out "$SCRIPT_DIR/ca.pem" -subj "/CN=My CA"
+
+# Create server certificate
+openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/server.key"
+openssl req -new -key "$SCRIPT_DIR/server.key" -out "$SCRIPT_DIR/server.csr" -subj "/CN=localhost"
+openssl x509 -req -days $DAYS_VALID -in "$SCRIPT_DIR/server.csr" -CA "$SCRIPT_DIR/ca.pem" -CAkey "$SCRIPT_DIR/ca.key" -CAcreateserial -out "$SCRIPT_DIR/server.pem" -extfile "$SCRIPT_DIR/san.cnf" -extensions v3_req
+
+# Create client key and certificate
+openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/client.key"
+openssl req -new -key "$SCRIPT_DIR/client.key" -out "$SCRIPT_DIR/client.csr" -subj "/CN=Client"
+openssl x509 -req -days $DAYS_VALID -in "$SCRIPT_DIR/client.csr" -CA "$SCRIPT_DIR/ca.pem" -CAkey "$SCRIPT_DIR/ca.key" -CAcreateserial -out "$SCRIPT_DIR/client.pem" -extfile "$SCRIPT_DIR/san.cnf" -extensions v3_req
--- a/devenv/docker/blocks/mqtt/build/san.cnf
+++ b/devenv/docker/blocks/mqtt/build/san.cnf
@@ -0,0 +1,7 @@
+[ v3_req ]
+subjectAltName = @alt_names
+
+[ alt_names ]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1
--- a/devenv/docker/blocks/mqtt/docker-compose.yaml
+++ b/devenv/docker/blocks/mqtt/docker-compose.yaml
@@ -0,0 +1,12 @@
+  mqtt:
+    build:
+      context: docker/blocks/mqtt/build
+    ports:
+      - "127.0.0.1:1883:1883" # MQTT
+      - "127.0.0.1:8883:8883" # MQTT over TLS
+      - "127.0.0.1:8083:8083" # MQTT over WS
+      - "127.0.0.1:8443:8443" # MQTT over WSS
+    volumes:
+      - ${PWD}/docker/blocks/mqtt/nanomq.conf:/etc/nanomq.conf
+      - ${PWD}/docker/blocks/mqtt/nanomq_pwd.conf:/etc/nanomq_pwd.conf
+      - ${PWD}/docker/blocks/mqtt/nanomq_acl.conf:/etc/nanomq_acl.conf
--- a/devenv/docker/blocks/mqtt/nanomq.conf
+++ b/devenv/docker/blocks/mqtt/nanomq.conf
@@ -0,0 +1,40 @@
+log {
+    to=console
+    level=info
+}
+
+listeners.tcp {
+  bind = "0.0.0.0:1883"
+}
+
+
+listeners.ssl {
+  bind = "0.0.0.0:8883"
+
+  keyfile = "/etc/certs/server.key"
+  certfile = "/etc/certs/server.pem"
+  cacertfile = "/etc/certs/ca.pem"
+
+  # Change these settings to true if you want to deny
+  # access for clients that don't have a certificate.
+  verify_peer = false
+  fail_if_no_peer_cert = false
+}
+
+listeners.ws {
+  bind = "0.0.0.0:8083"
+}
+
+listeners.wss {
+  bind = "0.0.0.0:8443"
+}
+
+auth {
+  allow_anonymous = false
+  no_match = deny
+  deny_action = disconnect
+  password = {include "/etc/nanomq_pwd.conf"}
+  acl = {
+    include "/etc/nanomq_acl.conf"
+  }
+}
--- a/devenv/docker/blocks/mqtt/nanomq_acl.conf
+++ b/devenv/docker/blocks/mqtt/nanomq_acl.conf
@@ -0,0 +1,7 @@
+rules = [
+  {"permit": "allow", "username": "grafana", "action": "subscribe", "topics": ["#"]}
+  {"permit": "allow", "username": "grafana", "action": "publish", "topics": ["#"]}
+  {"permit": "allow", "username": "admin", "action": "subscribe", "topics": ["#"]}
+  {"permit": "allow", "username": "admin", "action": "publish", "topics": ["#"]}
+  {"permit": "deny"}
+]
--- a/devenv/docker/blocks/mqtt/nanomq_pwd.conf
+++ b/devenv/docker/blocks/mqtt/nanomq_pwd.conf
@@ -0,0 +1,2 @@
+admin:admin
+grafana:grafana
--- a/devenv/docker/blocks/prometheus/docker-compose.yaml
+++ b/devenv/docker/blocks/prometheus/docker-compose.yaml
@@ -37,3 +37,8 @@
    build: docker/blocks/prometheus_random_data
    ports:
      - "8081:8080"
+
+  prometheus-high-card:
+    build: docker/blocks/prometheus_high_card
+    ports:
+      - "9111:9111"
--- a/devenv/docker/blocks/prometheus/prometheus.yml
+++ b/devenv/docker/blocks/prometheus/prometheus.yml
@@ -38,6 +38,10 @@ scrape_configs:
    static_configs:
      - targets: ['prometheus-random-data:8080']

+  - job_name: 'prometheus-high-card'
+    static_configs:
+      - targets: ['prometheus-high-card:9111']
+
  - job_name: 'mysql'
    static_configs:
      - targets: ['mysql-exporter:9104']
--- a/devenv/docker/blocks/prometheus_high_card/Dockerfile
+++ b/devenv/docker/blocks/prometheus_high_card/Dockerfile
@@ -0,0 +1,15 @@
+FROM golang:latest AS builder
+
+ADD main.go /
+ADD go.mod /
+ADD go.sum /
+WORKDIR /
+
+RUN go mod download
+RUN CGO_ENABLED=0 GOOS=linux go build -o main .
+
+FROM scratch
+WORKDIR /
+EXPOSE 9111
+COPY --from=builder /main /main
+ENTRYPOINT ["/main"]
--- a/devenv/docker/blocks/prometheus_high_card/docker-compose.yaml
+++ b/devenv/docker/blocks/prometheus_high_card/docker-compose.yaml
@@ -0,0 +1,6 @@
+  prometheus_high_card:
+    build: docker/blocks/prometheus_high_card
+    ports:
+      - "3012:3012"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
--- a/devenv/docker/blocks/prometheus_high_card/go.mod
+++ b/devenv/docker/blocks/prometheus_high_card/go.mod
@@ -0,0 +1,21 @@
+module high-card
+
+go 1.24.4
+
+require (
+	github.com/prometheus/client_golang v1.22.0
+	golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+)
--- a/devenv/docker/blocks/prometheus_high_card/go.sum
+++ b/devenv/docker/blocks/prometheus_high_card/go.sum
@@ -0,0 +1,34 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 h1:y5zboxd6LQAqYIhHnB48p0ByQ/GnQx2BE33L8BOHQkI=
+golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6/go.mod h1:U6Lno4MTRCDY+Ba7aCcauB9T60gsv5s4ralQzP72ZoQ=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/devenv/docker/blocks/prometheus_high_card/main.go
+++ b/devenv/docker/blocks/prometheus_high_card/main.go
@@ -0,0 +1,123 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"golang.org/x/exp/rand"
+)
+
+func randomValues(max int) func() (string, bool) {
+	i := 0
+	return func() (string, bool) {
+		i++
+		return strconv.Itoa(i), i < max+1
+	}
+}
+
+func staticList(input []string) func() string {
+	return func() string {
+		i := rand.Intn(len(input))
+
+		return input[i]
+	}
+}
+
+type dimension struct {
+	label        string
+	getNextValue func() string
+}
+
+func main() {
+
+	fakeMetrics := []dimension{
+		{
+			label:        "cluster",
+			getNextValue: staticList([]string{"prod-uk1", "prod-eu1", "prod-uk2", "prod-eu2", "prod-uk3", "prod-eu3", "prod-uk4", "prod-eu4", "prod-uk5", "prod-eu5"}),
+		},
+		{
+			label:        "namespace",
+			getNextValue: staticList([]string{"default", "kube-api", "kube-system", "kube-public", "kube-node-lease", "kube-ingress", "kube-logging", "kube-metrics", "kube-monitoring", "kube-network", "kube-storage"}),
+		},
+		{
+			label:        "pod",
+			getNextValue: staticList([]string{"default"}),
+		},
+		{
+			label:        "container",
+			getNextValue: staticList([]string{"container"}),
+		},
+		{
+			label:        "method",
+			getNextValue: staticList([]string{"GET", "POST", "DELETE", "PUT", "PATCH"}),
+		},
+		{
+			label:        "address",
+			getNextValue: staticList([]string{"/", "/api", "/api/dashboard", "/api/dashboard/:uid", "/api/dashboard/:uid/overview", "/api/dashboard/:uid/overview/:id", "/api/dashboard/:uid/overview/:id/summary", "/api/dashboard/:uid/overview/:id/summary/:type", "/api/dashboard/:uid/overview/:id/summary/:type/:subtype", "/api/dashboard/:uid/overview/:id/summary/:type/:subtype/:id"}),
+		},
+		{
+			label:        "extra_label_name1",
+			getNextValue: staticList([]string{"default"}),
+		},
+		{
+			label:        "extra_label_name2",
+			getNextValue: staticList([]string{"default"}),
+		},
+		{
+			label:        "extra_label_name3",
+			getNextValue: staticList([]string{"default"}),
+		},
+		{
+			label:        "extra_label_name4",
+			getNextValue: staticList([]string{"default"}),
+		},
+		{
+			label:        "extra_label_name5",
+			getNextValue: staticList([]string{"default"}),
+		},
+		{
+			label:        "extra_label_name6",
+			getNextValue: staticList([]string{"default"}),
+		},
+	}
+
+	dimensions := []string{}
+	for _, dim := range fakeMetrics {
+		dimensions = append(dimensions, dim.label)
+	}
+
+	opsProcessed := promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "fakedata_highcard_http_requests_total",
+		Help: "a high cardinality counter",
+	}, dimensions)
+
+	http.Handle("/metrics", promhttp.Handler())
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("Hello, is it me you're looking for?"))
+	})
+
+	go func() {
+		for {
+			labels := []string{}
+			for _, dim := range fakeMetrics {
+				value := dim.getNextValue()
+				labels = append(labels, value)
+			}
+
+			opsProcessed.WithLabelValues(labels...).Inc()
+
+			time.Sleep(time.Millisecond)
+		}
+	}()
+
+	fmt.Printf("Server started at :9111\n")
+
+	log.Fatal(http.ListenAndServe(":9111", nil))
+}
--- a/devenv/docker/blocks/webdav/README.md
+++ b/devenv/docker/blocks/webdav/README.md
@@ -1,6 +1,6 @@
 # README for the image storage WebDAV docker block

-This block is used for testing the [WebDAV](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#external_image_storagewebdav) option for external image storage which is used in [alert notifications](https://grafana.com/docs/grafana/latest/alerting/manage-notifications/images-in-notifications/). This uses the simplest WebDav server that is still being maintained, a project called [Dufs](https://github.com/sigoden/dufs).
+This block is used for testing the [WebDAV](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#external_image_storagewebdav) option for external image storage which is used in [alert notifications](https://grafana.com/docs/grafana/latest/alerting/configure-notifications/template-notifications/images-in-notifications/). This uses the simplest WebDav server that is still being maintained, a project called [Dufs](https://github.com/sigoden/dufs).

 ## Using Dufs

--- a/devenv/plugins.yaml
+++ b/devenv/plugins.yaml
@@ -1,19 +1,23 @@
 apiVersion: 1

 apps:
-  - type: myorg-extensions-app
+  - type: grafana-extensionstest-app
    org_id: 1
    org_name: Main Org.
    disabled: false
-  - type: myorg-a-app
+    jsonData:
+      apiUrl: http://default-url.com
+    secureJsonData:
+      apiKey: secret-key
+  - type: grafana-extensionexample1-app
    org_id: 1
    org_name: Main Org.
    disabled: false
-  - type: myorg-b-app
+  - type: grafana-extensionexample2-app
    org_id: 1
    org_name: Main Org.
    disabled: false
-  - type: myorg-extensionpoint-app
+  - type: grafana-extensionexample3-app
    org_id: 1
    org_name: Main Org.
    disabled: false
--- a/docs/sources/administration/announcement-banner/_index.md
+++ b/docs/sources/administration/announcement-banner/_index.md
@@ -1,5 +1,4 @@
 ---
-draft: true
 keywords:
  - grafana
  - announcement
@@ -52,9 +51,6 @@ To create or update an announcement banner, follow these steps:
 1. Select the banner's end date and time in the **Ends at** field.
   By default, the banner is displayed indefinitely.
   You can set a date and time for the banner to stop displaying.
-1. Select the banner's visibility.
-   **Everyone** - The banner is visible to all users, including on login page.
-   **Authenticated users** - The banner is visible to only authenticated users.
 1. Select the type of banner in the **Variant** field.
   This determines the color of the banner's background.
 1. Click **Save** to save the banner settings.
--- a/docs/sources/administration/correlations/_index.md
+++ b/docs/sources/administration/correlations/_index.md
@@ -12,16 +12,18 @@ weight: 900

 # Correlations

-You can create interactive links for Explore visualizations to run queries related to presented data by setting up Correlations.
+You can create interactive links for Explore visualizations by setting up Correlations. These links can either run queries or generate external URLs related to presented data.

-A correlation defines how data in one [data source](../../datasources/) is used to query data in another data source.
+A correlation defines how data in one [data source](../../datasources/) is used to query data in another data source or to generate an external URL.
 Some examples:

 - an application name returned in a logs data source can be used to query metrics related to that application in a metrics data source, or
 - a user name returned by an SQL data source can be used to query logs related to that particular user in a logs data source
+- a customer ID in a logs data source can link to a different platform that has a profile on that customer.

 [Explore](../../explore/) takes user-defined correlations to display links inside the visualizations.
-You can click on a link to run the related query and see results in [Explore Split View](../../explore/#split-and-compare).
+If a correlation links to a query, you can click on that link to run the related query and see results in [Explore Split View](../../explore/#split-and-compare).
+If a correlation links to an external URL, you can click on the link to open the URL in a new tab in your browser.

 Explore visualizations that currently support showing links based on correlations:

--- a/docs/sources/administration/data-source-management/teamlbac/_index.md
+++ b/docs/sources/administration/data-source-management/teamlbac/_index.md
@@ -8,67 +8,63 @@ labels:
  products:
    - enterprise
    - cloud
-title: Team LBAC
+title: Label Based Access Control (LBAC) for data sources
 weight: 100
 ---

-# Team LBAC
+# Label Based Access Control (LBAC) for data sources

-Team Label Based Access Control (LBAC) simplifies and streamlines data source access management based on team memberships.
+Label Based Access Control (LBAC) simplifies and streamlines data source access management based on team memberships.

 {{< admonition type="note" >}}
-Creating Team LBAC rules is available for preview for logs with Loki in Grafana Cloud.
+LBAC rules is available for preview for logs with Loki in Grafana Cloud.
 Report any unexpected behavior to the Grafana Support team.

-To use Team LBAC rules you must enable the `teamHttpHeaders` feature toggle because the feature uses HTTP headers for the LBAC rules requests.
-
- Be sure that you are running Grafana Enterprise.
-  {{< /admonition >}}
+To use LBAC rules you must enable the `teamHttpHeaders` feature toggle because the feature uses HTTP headers for the LBAC rules requests.
+{{< /admonition >}}

 You can configure user access based upon team memberships using LogQL.
-Team LBAC controls access to logs depending on the rules set for each team.
+LBAC for data sources controls access to logs depending on the rules set for each team.

 This feature addresses two common challenges faced by Grafana users:

 1. Having a high number of Grafana Cloud data sources.
-   Team LBAC lets Grafana administrators reduce the total number of data sources per instance from hundreds, to one.
+   LBAC for data sources lets Grafana administrators reduce the total number of data sources per instance from hundreds, to one.
 1. Using the same dashboard across multiple teams.
-   Team LBAC lets Grafana Teams use the same dashboard with different access control rules.
+   LBAC for data sources lets Grafana Teams use the same dashboard with different access control rules.

-To set up Team LBAC for a Loki data source, refer to [Configure Team LBAC](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/).
+To set up LBAC for data sources for a Loki data source, refer to [Configure LBAC for data sources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/).

 ## Limitations

- There is a set number of rules to be configured within a datasource, depending on the size of the rules.
+- There is a set number of rules to be configured within a data source, depending on the size of the rules.
  - Around ~500-600 rules is the upper limit.
- If there are no Team LBAC rules for a user's team, that user can query all logs.
- If an administrator is part of a team with Team LBAC rules, those rules are applied to the administrator requests.
- Cloud Access Policies (CAP) LBAC rules override Team LBAC rules.
-  Cloud Access Policies are the access controls from Grafana Cloud.
-  If there are any CAP LBAC rules configured for the same data source, then only the CAP LBAC rules are applied.
+- If there are no LBAC for data sources rules for a user's team, that user can query all logs.
+- If an administrator is part of a team with LBAC for data sources rules, those rules are applied to the administrator requests.
+- Cloud Access Policy (CAP) LBAC rules override LBAC for data sources rules.
+  CAP are the access controls from Grafana Cloud.

-  You must remove any label selectors from your Cloud Access Policies to use Team LBAC.
-  For more information about CAP label selectors, refer to [Use label-based access control (LBAC) with access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/label-access-policies/).
+You must remove any label selectors from your Cloud Access Policy that is configured for the Loki data source, otherwise the CAP label selectors override the LBAC for data sources rules. For more information about CAP label selectors, refer to [Use label-based access control (LBAC) with access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/label-access-policies/).

 ## Data source permissions

-Data source permissions allow the users access to query the data source.
-Administrators set the permissions at the data source level.
-All the teams and users that are part of the data source inherit those permissions.
+- Data source permissions allow the users access to query the data source.
+- Administrators set the permissions at the data source level.
+- All the teams and users that are part of the data source inherit those permissions.

 ## Recommended setup

-It's recommended that you create a single Loki data source for using Team LBAC rules so you have a clear separation of data sources using Team LBAC and those that aren't.
+It's recommended that you create a single Loki data source for using LBAC for data sources rules so you have a clear separation of data sources using LBAC for data sources and those that aren't.
 All teams should have with only teams having `query` permission.
-You should create another Loki data source configured without Team LBAC for full access to the logs.
+You should create another Loki data source configured without LBAC for data sources for full access to the logs.

-## Team LBAC rules
+## LBAC rules

-Grafana adds Team LBAC rules to the HTTP request via the Loki data source.
+Grafana adds LBAC for data sources rules to the HTTP request via the Loki data source.

 If you configure multiple rules for a team, each rule is evaluated separately.
 Query results include lines that match any of the rules.

-Only users with data source `Admin` permissions can edit Team LBAC rules in the **Data source permissions** tab because changing LBAC rules requires the same access level as editing data source permissions.
+Only users with data source `Admin` permissions can edit LBAC for data sources rules in the **Data source permissions** tab because changing LBAC rules requires the same access level as editing data source permissions.

-To set up Team LBAC for a Loki data source, refer to [Configure Team LBAC](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/).
+To set up LBAC for data sources for a Loki data source, refer to [Configure LBAC for data sources](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/).
--- a/docs/sources/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/index.md
+++ b/docs/sources/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/index.md
@@ -1,5 +1,5 @@
 ---
-description: Configure Team LBAC for Loki data source on Grafana Cloud
+description: Configure LBAC for data sources for Loki data source on Grafana Cloud
 keywords:
  - loki
  - datasource
@@ -7,42 +7,41 @@ keywords:
 labels:
  products:
    - cloud
-title: Configure Team LBAC for Loki
+title: Configure LBAC for data sources for Loki
 weight: 250
 ---

-# Configure Team LBAC for Loki data source on Grafana Cloud
+# Configure LBAC for data sources for Loki data source on Grafana Cloud

-Team LBAC is available in private preview on Grafana Cloud for Loki created with basic authentication. Loki datasources for Team LBAC can only be created, provisioning is currently not available.
+LBAC for data sources is available in private preview on Grafana Cloud for Loki created with basic authentication. Loki data sources for LBAC for data sources can only be created, provisioning is currently not available.

 You cannot configure LBAC rules for Grafana-provisioned data sources from the UI. Alternatively, you can replicate the setting of the provisioned data source in a new data source as described in [LBAC Configuration for New Loki Data Source](https://grafana.com/docs/grafana/latest/administration/data-source-management/teamlbac/configure-teamlbac-for-loki/#task-1-lbac-configuration-for-new-loki-data-source) and then add the LBAC configuration to the new data source.

 ## Before you begin

-To be able to use Team LBAC rules, you need to enable the feature toggle `teamHttpHeaders` on your Grafana instance. Contact support to enable the feature toggle for you.
+To be able to use LBAC for data sources rules, you need to enable the feature toggle `teamHttpHeaders` on your Grafana instance. Contact support to enable the feature toggle for you.

- Be sure that you are running Grafana Enterprise.
- Be sure that you have the permission setup to create a loki tenant in Grafana Cloud
+- Be sure that you have the permission setup to create a Loki tenant in Grafana Cloud
 - Be sure that you have admin data source permissions for Grafana.

 ### Permissions

-We recommend that you remove all permissions for roles and teams that are not required to access the data source. This will help to ensure that only the required teams have access to the data source. The recommended permissions are `Admin` permission and only add the teams `Query` permissions that you want to add Team LBAC rules for.
+We recommend that you remove all permissions for roles and teams that are not required to access the data source. This will help to ensure that only the required teams have access to the data source. The recommended permissions are `Admin` permission and only add the teams `Query` permissions that you want to add LBAC for data sources rules for.

-## Task 1: Configure Team LBAC for a new Loki data source
+## Task 1: LBAC Configuration for New Loki Data Source

 1. Access Loki data sources details for your stack through grafana.com
-1. Copy Loki Details and Create a CAP
+1. Copy Loki details and create a CAP
   - Copy the details of your Loki setup.
   - Create a Cloud Access Policy (CAP) for the Loki data source in grafana.com.
   - Ensure the CAP includes `logs:read` permissions.
   - Ensure the CAP does not include `labels` rules.
-1. Create a New Loki Data Source
+1. Create a new Loki data source
   - In Grafana, proceed to add a new data source and select Loki as the type.
 1. Navigate back to the Loki data source
   - Set up the Loki data source using basic authentication. Use the userID as the username. Use the generated CAP token as the password.
   - Save and connect.
-1. Navigate to Data Source Permissions
-   - Go to the permissions tab of the newly created Loki data source. Here, you'll find the Team LBAC rules section.
+1. Navigate to data source permissions
+   - Go to the permissions tab of the newly created Loki data source. Here, you'll find the LBAC for data sources rules section.

-For more information on how to setup Team LBAC rules for a Loki data source, refer to [Create Team LBAC rules for the Loki data source](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/create-teamlbac-rules/).
+For more information on how to setup LBAC for data sources rules for a Loki data source, refer to [Create LBAC for data sources rules for the Loki data source](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/create-teamlbac-rules/).
--- a/docs/sources/administration/data-source-management/teamlbac/create-teamlbac-rules/index.md
+++ b/docs/sources/administration/data-source-management/teamlbac/create-teamlbac-rules/index.md
@@ -1,42 +1,41 @@
 ---
-description: Learn how to create Team LBAC rules for the Loki data source.
+description: Learn how to create LBAC for data sources rules for the Loki data source.
 keywords:
  - loki
  - lbac
  - team
 labels:
  products:
-    - enterprise
    - cloud
-title: Create Team LBAC rules for the Loki data source
+title: Create LBAC for data sources rules for the Loki data source
 weight: 250
 ---

-# Create Team LBAC rules for the Loki data source
+# Create LBAC for data sources rules for the Loki data source

-Team LBAC is available on Cloud for data sources created with basic authentication. Any managed Loki data source can **NOT** be configured with Team LBAC rules.
+LBAC for data sources is available on Cloud for Loki data sources created with basic authentication. Managed/Provisioned Loki data source can **NOT** be configured with LBAC for data sources as of now.

 ## Before you begin

-To be able to use Team LBAC rules, you need to enable the feature toggle `teamHttpHeaders` on your Grafana instance. Contact support to enable the feature toggle for you.
+To be able to use LBAC for data sources rules, you need to enable the feature toggle `teamHttpHeaders` on your Grafana instance. Contact support to enable the feature toggle for you.

- Be sure that you are running Grafana Enterprise.
+- Be sure that you have the permission setup to create a Loki tenant in Grafana Cloud.
 - Be sure that you have admin data source permissions for Grafana.
 - Be sure that you have a team setup in Grafana.

-### Create a Team LBAC Rule for a team
+### Create a LBAC for data sources Rule for a team

-1. Navigate to your Loki datasource
+1. Navigate to your Loki data source
 1. Navigate to the permissions tab
-   - Here, you'll find the Team LBAC rules section.
-1. Add a Team LBAC Rule
-   - Add a new rule for the team in the Team LBAC rules section.
-1. Define Label Selector for the Rule
+   - Here, you'll find the LBAC for data sources rules section.
+1. Add a LBAC for data sources Rule
+   - Add a new rule for the team in the LBAC for data sources rules section.
+1. Define a label selector for the rule
   - Add a label selector to the rule. Refer to Loki query documentation for guidance on the types of log selections you can specify.

 ### LBAC rule

-A LBAC rule is a `logql` query that runs as a query to the loki instance for your logs. Each rule is it's own filtering operating independently from the other rules within a team. For example, you can create a label policy that includes all log lines with the label.
+A LBAC rule is a `logql` query that runs as a query to the Loki instance for your logs. Each rule operates independently as its own filter, separate from other rules within a team. For example, you can create a label policy that includes all log lines with a specific label.

 One rule `{namespace="dev", cluster="us-west-0"}` created with multiple namespaces will be seen as `namespace="dev"` **AND** `cluster="us-west-0"`.
 Two rules `{namespace="dev"}`, `{cluster="us-west-0"}` created for a team will be seen as `namespace="dev"` **OR** `cluster="us-west-0"`.
@@ -47,11 +46,11 @@ We recommend you only add `query` permissions for teams that should use the data

 We recommend for a first setup, setting up as few rules as possible for each team and make them additive for simplicity.

-For validating the rules, we recommend testing the rules in the Loki Explore view. This will allow you to see the logs that would be returned for the rule.
+To validate the rules, we recommend testing the rules in the Loki Explore view. This will allow you to see the logs that would be returned for the rule.

 #### Tasks

-### Task 1: One rule setup for each team
+### Task 1: One rule set up for each team

 One common use case for creating an LBAC policy is to have specific access to logs that have a specific label. For example, you can create a label policy that includes all log lines with the label.

@@ -67,9 +66,9 @@ A user that is part of Team B will have access to logs that match `namespace="pr

 A user that is part of Team A and Team B will have access to logs that match `namespace="dev"` OR `namespace="prod"`.

-### Task 2: One rule setup for a team Exclude a label
+### Task 2: Set up a rule to exclude a label for a team

-One common use case for creating an LBAC policy is to exclude logs that have a specific label. For example, you can create a label policy that excludes all log lines with the label secret=true by adding a selector with `secret!="true"` when you create an access policy:
+One common use case for creating an LBAC policy is to exclude logs that have a specific label. For example, you can create a label policy that excludes all log lines with the label `secret=true` by adding a selector with `secret!="true"` when you create an access policy:

 We have one team, Team A `Query` permissions. Loki access is setup with `Admin` roles to have `Admin` permission only.

@@ -77,7 +76,7 @@ We have one team, Team A `Query` permissions. Loki access is setup with `Admin`

 A user that is part of Team A will **NOT** have access to logs that match `secret!="true"`.

-### Task 3: Multiple rules setup for one team
+### Task 3: Set up multiple rules for a team

 We have two teams, Team A and Team B with `Query` permissions. Loki access is setup with `Admin` roles having `Admin` permission.

@@ -113,7 +112,7 @@ A user in Team B will have access to logs that match `namespace!="dev"`.

 > _NOTE:_ A user that is part of Team A and Team B will have access to all logs that match `namespace="dev"` `OR` `namespace!="dev"`.

-### Task 5: One rule setup for a Team
+### Task 5: Single rule setup for a team

 We have two teams, Team A and Team B. Loki access is setup with `Editor`, `Viewer` roles to have `Query` permission.

--- a/docs/sources/administration/enterprise-licensing/activate-aws-marketplace-license/activate-license-on-ecs/index.md
+++ b/docs/sources/administration/enterprise-licensing/activate-aws-marketplace-license/activate-license-on-ecs/index.md
@@ -35,9 +35,9 @@ To activate your license, complete the following tasks.

   For more information about deploying an application on Amazon ECS, refer to [Creating an Amazon ECS service](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-service.html).

-1. As you create the Amazon ECS service, use the Grafana Enterprise version 8.3.0 or later container image.
+1. As you create the Amazon ECS service, use the intended Grafana Enterprise container image version.

-   For example, enter `grafana/grafana-enterprise:8.3.3`.
+   For example, enter `grafana/grafana-enterprise:11.3.0`.

   > Only Grafana Enterprise versions 8.3.0 and later support licenses granted through AWS Marketplace.

--- a/docs/sources/administration/enterprise-licensing/activate-aws-marketplace-license/activate-license-on-eks/index.md
+++ b/docs/sources/administration/enterprise-licensing/activate-aws-marketplace-license/activate-license-on-eks/index.md
@@ -20,7 +20,7 @@ weight: 200

 # Activate a Grafana Enterprise license from AWS Marketplace on EKS

-If you have purchased a Grafana Enterprise subscription through AWS Marketplace, you must activate it in order to use Grafana Enterprise data source plugins and features in Grafana.
+If you have purchased a Grafana Enterprise subscription through AWS Marketplace, you must activate it to use Grafana Enterprise data source plugins and features in Grafana.

 ## Before you begin:

@@ -37,9 +37,9 @@ To activate your license, complete the following tasks:

   For more information about installing Grafana on Kubernetes using the Helm Chart, refer to the [Grafana Helm Chart](https://github.com/grafana/helm-charts/tree/main/charts/grafana#readme).

-1. Use `kubectl set image deployment/my-release grafana=grafana/grafana-enterprise:<version>` to update the container image to Grafana Enterprise version 8.3.0 or later.
+1. Use `kubectl set image deployment/my-release grafana=grafana/grafana-enterprise:<version>` to update the container image.

-   For example, enter `grafana/grafana-enterprise:8.3.3`.
+   For example, enter `grafana/grafana-enterprise:11.3.0`.

 > Only Grafana Enterprise versions 8.3.0 and later support licenses granted through AWS Marketplace.

--- a/docs/sources/administration/plugin-management/index.md
+++ b/docs/sources/administration/plugin-management/index.md
@@ -56,7 +56,7 @@ Use app plugins when you want an out-of-the-box monitoring experience.

 ### Managing access for app plugins

-Customize access to app plugins with [RBAC](../roles-and-permissions/access-control/#about-rbac).
+Customize access to app plugins with [RBAC](../roles-and-permissions/access-control/rbac-for-app-plugins/).

 By default, the Viewer, Editor and Admin roles have access to all app plugins that their Organization role allows them to access. Access is granted by the `fixed:plugins.app:reader` role.

@@ -103,53 +103,45 @@ To browse for available plugins:

 ### Install a plugin

-To install a plugin:
+The most common way to install a plugin is through the Grafana UI, but alternative methods are also available.

 1. In Grafana, click **Administration > Plugins and data > Plugins** in the side navigation menu to view all plugins.
 1. Browse and find a plugin.
 1. Click the plugin's logo.
 1. Click **Install**.

-When the update is complete, you'll see a confirmation message that the installation was successful.
+There are also additional ways to install plugins depending on your setup.

-### Update a plugin
+#### Install a plugin using Grafana CLI

-To update a plugin:
+Grafana CLI allows you to install, upgrade, and manage your Grafana plugins using a command line. For more information about Grafana CLI plugin commands, refer to [Plugin commands](../../cli/#plugins-commands).

-1. In Grafana, click **Administration > Plugins and data > Plugins** in the side navigation menu to view all plugins.
-1. Click the **Installed** filter to show only installed plugins.
-1. Click the plugin's logo.
-1. Click **Update**.
+#### Install a plugin from a ZIP file

-When the update is complete, you'll see a confirmation message that the update was successful.
+This method is typically used for plugins not available in the Plugin Catalog or in environments without internet access.

-### Uninstall a plugin
+Download the archive containing the plugin assets, and install it by extracting the archive into the plugin directory. For example:

-To uninstall a plugin:
+```bash
+unzip my-plugin-0.2.0.zip -d YOUR_PLUGIN_DIR/my-plugin
+```

-1. In Grafana, click **Administration > Plugins and data > Plugins** in the side navigation menu to view all plugins.
-1. Click the plugin's logo.
-1. Click the **Installed** filter to show only installed plugins.
-1. Click **Uninstall**.
+The path to the plugin directory is defined in the configuration file. For more information, refer to [Configuration](../../setup-grafana/configure-grafana/#plugins).

-When the update is complete, you'll see a confirmation message that the uninstall was successful.
+#### Install a plugin in air-gapped environment

-## Install Grafana plugins
+Plugin installation usually requires an internet connection. You can check which endpoints are used during the installation on your instance and add them to your instance’s allowlist.

-Grafana supports data source, panel, and app plugins.
+If this is not possible you can go via installing a plugin using [Grafana CLI](#install-a-plugin-using-grafana-cli) or as a [ZIP file](#install-a-plugin-from-a-zip-file).

-1. In a web browser, navigate to the [Grafana plugin catalog](https://grafana.com/plugins) and find a plugin that you want to install.
-1. Click the plugin, and then click the **Installation** tab.
+You can fetch any plugin from Grafana.com API following the download link referenced in the API.
+Here is an example based on `grafana-lokiexplore-app` plugins.

-### Install plugin on Grafana Cloud
+1. Open `https://grafana.com/api/plugins/grafana-lokiexplore-app` and look for `links` section
+1. Find a `download` url which looks something like `https://grafana.com/api/plugins/grafana-lokiexplore-app/versions/1.0.2/download`
+1. Use this URL to download the plugin ZIP file, which you can then install as described above.

-On the **Installation tab**, in the **For** field, click the name of the Grafana instance on which you want to install the plugin.
-
-Grafana Cloud handles the plugin installation automatically.
-
-If you're logged in to Grafana Cloud when you add a plugin, log out and then log back in again to use the new plugin.
-
-### Install plugins using the Grafana Helm chart
+#### Install plugins using the Grafana Helm chart

 With the Grafana Helm chart, add the plugins you want to install as a list using the `plugins` field in the your values file. For more information about the configuration, refer to [the Helm chart configuration reference](https://github.com/grafana/helm-charts/tree/main/charts/grafana#configuration).

@@ -162,21 +154,29 @@ plugins:
  - redis-datasource
 ```

-### Install plugin on local Grafana
+When the update is complete, a confirmation message will indicate the installation was successful.

-Follow the instructions on the **Install** tab. You can either install the plugin with a Grafana CLI command or by downloading and uncompressing a zip file into the Grafana plugins directory. We recommend using Grafana CLI in most instances. The zip option is available if your Grafana server doesn't have access to the internet.
+### Update a plugin

-For more information about Grafana CLI plugin commands, refer to [Plugin commands](../../cli/#plugins-commands).
+To update a plugin:

-#### Install a packaged plugin
+1. In Grafana, click **Administration > Plugins and data > Plugins** in the side navigation menu to view all plugins.
+1. Click the **Installed** filter to show only installed plugins.
+1. Click the plugin's logo.
+1. Click **Update**.

-After the user has downloaded the archive containing the plugin assets, they can install it by extracting the archive into their plugin directory. For example:
+When the update is complete, a confirmation message will indicate the installation was successful.

-```bash
-unzip my-plugin-0.2.0.zip -d YOUR_PLUGIN_DIR/my-plugin
-```
+### Uninstall a plugin

-The path to the plugin directory is defined in the configuration file. For more information, refer to [Configuration](../../setup-grafana/configure-grafana/#plugins).
+To uninstall a plugin:
+
+1. In Grafana, click **Administration > Plugins and data > Plugins** in the side navigation menu to view all plugins.
+1. Click the plugin's logo.
+1. Click the **Installed** filter to show only installed plugins.
+1. Click **Uninstall**.
+
+When the update is complete, a confirmation message will indicate the installation was successful.

 ## Plugin signatures

--- a/docs/sources/administration/provisioning/index.md
+++ b/docs/sources/administration/provisioning/index.md
@@ -257,17 +257,17 @@ All of these settings are optional.
 The _HTTP\*_ tag denotes data sources that communicate using the HTTP protocol, including all core data source plugins except MySQL, PostgreSQL, and MS SQL.
 {{< /admonition >}}

-| Name              | Type   | Data source                        | Description                                              |
-| ----------------- | ------ | ---------------------------------- | -------------------------------------------------------- |
-| tlsCACert         | string | _HTTP\*_, MySQL, PostgreSQL        | CA cert for out going requests                           |
-| tlsClientCert     | string | _HTTP\*_, MySQL, PostgreSQL        | TLS Client cert for outgoing requests                    |
-| tlsClientKey      | string | _HTTP\*_, MySQL, PostgreSQL        | TLS Client key for outgoing requests                     |
-| password          | string | _HTTP\*_, MySQL, PostgreSQL, MSSQL | password                                                 |
-| basicAuthPassword | string | _HTTP\*_                           | password for basic authentication                        |
-| accessKey         | string | Cloudwatch                         | Access key for connecting to Cloudwatch                  |
-| secretKey         | string | Cloudwatch                         | Secret key for connecting to Cloudwatch                  |
-| sigV4AccessKey    | string | Elasticsearch and Prometheus       | SigV4 access key. Required when using keys auth provider |
-| sigV4SecretKey    | string | Elasticsearch and Prometheus       | SigV4 secret key. Required when using keys auth provider |
+| Name              | Type   | Data source                        | Description                                                                                                                                                      |
+| ----------------- | ------ | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| tlsCACert         | string | _HTTP\*_, MySQL, PostgreSQL        | CA cert for out going requests. You can point directly to your stored cert by using an environment variable following the `$__file{path/to/ca}` format.          |
+| tlsClientCert     | string | _HTTP\*_, MySQL, PostgreSQL        | TLS Client cert for outgoing requests. You can point directly to your stored cert by using an environment variable following the `$__file{path/to/cert}` format. |
+| tlsClientKey      | string | _HTTP\*_, MySQL, PostgreSQL        | TLS Client key for outgoing requests. You can point directly to your stored key by using an environment variable following the `$__file{path/to/key}` format.    |
+| password          | string | _HTTP\*_, MySQL, PostgreSQL, MSSQL | password                                                                                                                                                         |
+| basicAuthPassword | string | _HTTP\*_                           | password for basic authentication                                                                                                                                |
+| accessKey         | string | Cloudwatch                         | Access key for connecting to Cloudwatch                                                                                                                          |
+| secretKey         | string | Cloudwatch                         | Secret key for connecting to Cloudwatch                                                                                                                          |
+| sigV4AccessKey    | string | Elasticsearch and Prometheus       | SigV4 access key. Required when using keys auth provider                                                                                                         |
+| sigV4SecretKey    | string | Elasticsearch and Prometheus       | SigV4 secret key. Required when using keys auth provider                                                                                                         |

 #### Custom HTTP headers for data sources

@@ -504,6 +504,29 @@ The following sections detail the supported settings and secure settings for eac
 | ----- | -------------- |
 | token | yes            |

+#### Alert notification `MQTT`
+
+| Name          | Secure setting |
+| ------------- | -------------- |
+| brokerUrl     |                |
+| clientId      |                |
+| topic         |                |
+| messageFormat |                |
+| username      |                |
+| password      | yes            |
+| retain        |                |
+| qos           |                |
+| tlsConfig     |                |
+
+##### TLS config
+
+| Name               | Secure setting |
+| ------------------ | -------------- |
+| insecureSkipVerify |                |
+| clientCertificate  | yes            |
+| clientKey          | yes            |
+| caCertificate      | yes            |
+
 #### Alert notification `pagerduty`

 | Name           | Secure setting |
--- a/docs/sources/administration/roles-and-permissions/_index.md
+++ b/docs/sources/administration/roles-and-permissions/_index.md
@@ -10,6 +10,7 @@ labels:
  products:
    - enterprise
    - oss
+    - cloud
 title: Roles and permissions
 weight: 300
 ---
--- a/docs/sources/administration/roles-and-permissions/access-control/_index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/_index.md
@@ -190,8 +190,8 @@ Assign fixed roles when the basic roles do not meet your permission requirements
 - [Provisioning](/docs/grafana/<GRAFANA_VERSION>/administration/provisioning/)
 - [Reports](ref:dashboards-create-reports)
 - [Roles](ref:roles-and-permissions)
- [Settings](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/settings-updates-at-runtime/)
 - [Service accounts](ref:service-accounts)
+- [Settings](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/settings-updates-at-runtime/)
 - [Teams](/docs/grafana/<GRAFANA_VERSION>/administration/team-management/)
 - [Users](/docs/grafana/<GRAFANA_VERSION>/administration/user-management/)

--- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
@@ -25,11 +25,11 @@ refs:

 # RBAC permissions, actions, and scopes

-{{% admonition type="note" %}}
-Available in [Grafana Enterprise](../../../../introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
-{{% /admonition %}}
+{{< admonition type="note" >}}
+Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud/).
+{{< /admonition >}}

-A permission is comprised of an action and a scope. When creating a custom role, consider the actions the user can perform and the resource(s) on which they can perform those actions.
+A permission is comprised of an action and a scope. When creating a custom role, consider the actions the user can perform and the resources on which they can perform those actions.

 To learn more about the Grafana resources to which you can apply RBAC, refer to [Resources with RBAC permissions](ref:rbac-fixed-roles).

@@ -40,198 +40,184 @@ To learn more about the Grafana resources to which you can apply RBAC, refer to

 The following list contains role-based access control actions.

-| Action                                | Applicable scope                                                                        | Description                                                                                                                                                                                                               |
-| ------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `alert.instances.external:read`       | `datasources:*`<br>`datasources:uid:*`                                                  | Read alerts and silences in data sources that support alerting.                                                                                                                                                           |
-| `alert.instances.external:write`      | `datasources:*`<br>`datasources:uid:*`                                                  | Manage alerts and silences in data sources that support alerting.                                                                                                                                                         |
-| `alert.instances:create`              | n/a                                                                                     | Create silences in the current organization.                                                                                                                                                                              |
-| `alert.instances:read`                | n/a                                                                                     | Read alerts and silences in the current organization.                                                                                                                                                                     |
-| `alert.instances:write`               | n/a                                                                                     | Update and expire silences in the current organization.                                                                                                                                                                   |
-| `alert.notifications.external:read`   | `datasources:*`<br>`datasources:uid:*`                                                  | Read templates, contact points, notification policies, and mute timings in data sources that support alerting.                                                                                                            |
-| `alert.notifications.external:write`  | `datasources:*`<br>`datasources:uid:*`                                                  | Manage templates, contact points, notification policies, and mute timings in data sources that support alerting.                                                                                                          |
-| `alert.notifications:write`           | n/a                                                                                     | Manage templates, contact points, notification policies, and mute timings in the current organization.                                                                                                                    |
-| `alert.notifications:read`            | n/a                                                                                     | Read all templates, contact points, notification policies, and mute timings in the current organization.                                                                                                                  |
-| `alert.rules.external:read`           | `datasources:*`<br>`datasources:uid:*`                                                  | Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki)                                                                                                                                      |
-| `alert.rules.external:write`          | `datasources:*`<br>`datasources:uid:*`                                                  | Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki).                                                                                                                            |
-| `alert.rules:create`                  | `folders:*`<br>`folders:uid:*`                                                          | Create Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.       |
-| `alert.rules:delete`                  | `folders:*`<br>`folders:uid:*`                                                          | Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.       |
-| `alert.rules:read`                    | `folders:*`<br>`folders:uid:*`                                                          | Read Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.         |
-| `alert.rules:write`                   | `folders:*`<br>`folders:uid:*`                                                          | Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.       |
-| `alert.silences:create`               | `folders:*`<br>`folders:uid:*`                                                          | Create rule-specific silences in a folder and its subfolders.                                                                                                                                                             |
-| `alert.silences:read`                 | `folders:*`<br>`folders:uid:*`                                                          | Read all general silences and rule-specific silences in a folder and its subfolders.                                                                                                                                      |
-| `alert.silences:write`                | `folders:*`<br>`folders:uid:*`                                                          | Update and expire rule-specific silences in a folder and its subfolders.                                                                                                                                                  |
-| `alert.provisioning:read`             | n/a                                                                                     | Read all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.                                                                                    |
-| `alert.provisioning.secrets:read`     | n/a                                                                                     | Same as `alert.provisioning:read` plus ability to export resources with decrypted secrets.                                                                                                                                |
-| `alert.provisioning:write`            | n/a                                                                                     | Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.                                                                                  |
-| `alert.provisioning.provenance:write` | n/a                                                                                     | Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources                                                                                               |
-| `annotations:create`                  | `annotations:*`<br>`annotations:type:*`                                                 | Create annotations.                                                                                                                                                                                                       |
-| `annotations:delete`                  | `annotations:*`<br>`annotations:type:*`                                                 | Delete annotations.                                                                                                                                                                                                       |
-| `annotations:read`                    | `annotations:*`<br>`annotations:type:*`                                                 | Read annotations and annotation tags.                                                                                                                                                                                     |
-| `annotations:write`                   | `annotations:*`<br>`annotations:type:*`                                                 | Update annotations.                                                                                                                                                                                                       |
-| `apikeys:create`                      | n/a                                                                                     | Create API keys.                                                                                                                                                                                                          |
-| `apikeys:read`                        | `apikeys:*`<br>`apikeys:id:*`                                                           | Read API keys.                                                                                                                                                                                                            |
-| `apikeys:delete`                      | `apikeys:*`<br>`apikeys:id:*`                                                           | Delete API keys.                                                                                                                                                                                                          |
-| `dashboards:create`                   | `folders:*`<br>`folders:uid:*`                                                          | Create dashboards in one or more folders and their subfolders.                                                                                                                                                            |
-| `dashboards:delete`                   | `dashboards:*`<br>`dashboards:uid:*`<br>`folders:*`<br>`folders:uid:*`                  | Delete one or more dashboards.                                                                                                                                                                                            |
-| `dashboards.insights:read`            | n/a                                                                                     | Read dashboard insights data and see presence indicators.                                                                                                                                                                 |
-| `dashboards.permissions:read`         | `dashboards:*`<br>`dashboards:uid:*`<br>`folders:*`<br>`folders:uid:*`                  | Read permissions for one or more dashboards.                                                                                                                                                                              |
-| `dashboards.permissions:write`        | `dashboards:*`<br>`dashboards:uid:*`<br>`folders:*`<br>`folders:uid:*`                  | Update permissions for one or more dashboards.                                                                                                                                                                            |
-| `dashboards:read`                     | `dashboards:*`<br>`dashboards:uid:*`<br>`folders:*`<br>`folders:uid:*`                  | Read one or more dashboards.                                                                                                                                                                                              |
-| `dashboards:write`                    | `dashboards:*`<br>`dashboards:uid:*`<br>`folders:*`<br>`folders:uid:*`                  | Update one or more dashboards.                                                                                                                                                                                            |
-| `dashboards.public:write`             | `dashboards:*`<br>`dashboards:uid:*`                                                    | Write public dashboard configuration.                                                                                                                                                                                     |
-| `datasources.caching:read`            | `datasources:*`<br>`datasources:uid:*`                                                  | Read data source query caching settings.                                                                                                                                                                                  |
-| `datasources.caching:write`           | `datasources:*`<br>`datasources:uid:*`                                                  | Update data source query caching settings.                                                                                                                                                                                |
-| `datasources:create`                  | n/a                                                                                     | Create data sources.                                                                                                                                                                                                      |
-| `datasources:delete`                  | `datasources:*`<br>`datasources:uid:*`                                                  | Delete data sources.                                                                                                                                                                                                      |
-| `datasources:explore`                 | n/a                                                                                     | Enable access to the **Explore** tab.                                                                                                                                                                                     |
-| `datasources.id:read`                 | `datasources:*`<br>`datasources:uid:*`                                                  | Read data source IDs.                                                                                                                                                                                                     |
-| `datasources.insights:read`           | n/a                                                                                     | Read data sources insights data.                                                                                                                                                                                          |
-| `datasources.permissions:read`        | `datasources:*`<br>`datasources:uid:*`                                                  | List data source permissions.                                                                                                                                                                                             |
-| `datasources.permissions:write`       | `datasources:*`<br>`datasources:uid:*`                                                  | Update data source permissions.                                                                                                                                                                                           |
-| `datasources:query`                   | `datasources:*`<br>`datasources:uid:*`                                                  | Query data sources.                                                                                                                                                                                                       |
-| `datasources:read`                    | `datasources:*`<br>`datasources:uid:*`                                                  | List data sources.                                                                                                                                                                                                        |
-| `datasources:write`                   | `datasources:*`<br>`datasources:uid:*`                                                  | Update data sources.                                                                                                                                                                                                      |
-| `featuremgmt.read`                    | n/a                                                                                     | Read feature toggles.                                                                                                                                                                                                     |
-| `featuremgmt.write`                   | n/a                                                                                     | Write feature toggles.                                                                                                                                                                                                    |
-| `folders.permissions:read`            | `folders:*`<br>`folders:uid:*`                                                          | Read permissions for one or more folders and their subfolders.                                                                                                                                                            |
-| `folders.permissions:write`           | `folders:*`<br>`folders:uid:*`                                                          | Update permissions for one or more folders and their subfolders.                                                                                                                                                          |
-| `folders:create`                      | n/a                                                                                     | Create folders in the root level. If granted together with `folders:write`, also allows creating subfolders under all folders that the user can update.                                                                   |
-| `folders:delete`                      | `folders:*`<br>`folders:uid:*`                                                          | Delete one or more folders and their subfolders.                                                                                                                                                                          |
-| `folders:read`                        | `folders:*`<br>`folders:uid:*`                                                          | Read one or more folders and their subfolders.                                                                                                                                                                            |
-| `folders:write`                       | `folders:*`<br>`folders:uid:*`                                                          | Update one or more folders and their subfolders. If granted together with `folders:create` permission, also allows creating subfolders under these folders.                                                               |
-| `ldap.config:reload`                  | n/a                                                                                     | Reload the LDAP configuration.                                                                                                                                                                                            |
-| `ldap.status:read`                    | n/a                                                                                     | Verify the availability of the LDAP server or servers.                                                                                                                                                                    |
-| `ldap.user:read`                      | n/a                                                                                     | Read users via LDAP.                                                                                                                                                                                                      |
-| `ldap.user:sync`                      | n/a                                                                                     | Sync users via LDAP.                                                                                                                                                                                                      |
-| `library.panels:create`               | `folders:*` <br> `folders:uid:*`                                                        | Create a library panel in one or more folders and their subfolders.                                                                                                                                                       |
-| `library.panels:read`                 | `folders:*` <br> `folders:uid:*` <br> `library.panels:*` <br> `library.panels:uid:*`    | Read one or more library panels.                                                                                                                                                                                          |
-| `library.panels:write`                | `folders:*` <br> `folders:uid:*` <br> `library.panels:*` <br> `library.panels:uid:*`    | Update one or more library panels.                                                                                                                                                                                        |
-| `library.panels:delete`               | `folders:*` <br> `folders:uid:*` <br> `library.panels:*` <br> `library.panels:uid:*`    | Delete one or more library panels.                                                                                                                                                                                        |
-| `licensing.reports:read`              | n/a                                                                                     | Get custom permission reports.                                                                                                                                                                                            |
-| `licensing:delete`                    | n/a                                                                                     | Delete the license token.                                                                                                                                                                                                 |
-| `licensing:read`                      | n/a                                                                                     | Read licensing information.                                                                                                                                                                                               |
-| `licensing:write`                     | n/a                                                                                     | Update the license token.                                                                                                                                                                                                 |
-| `org.users:write`                     | `users:*` <br> `users:id:*`                                                             | Update the organization role (`None`, `Viewer`, `Editor`, or `Admin`) of a user.                                                                                                                                          |
-| `org.users:add`                       | `users:*` <br> `users:id:*`                                                             | Add a user to an organization or invite a new user to an organization.                                                                                                                                                    |
-| `org.users:read`                      | `users:*` <br> `users:id:*`                                                             | Get user profiles within an organization.                                                                                                                                                                                 |
-| `org.users:remove`                    | `users:*` <br> `users:id:*`                                                             | Remove a user from an organization.                                                                                                                                                                                       |
-| `orgs.preferences:read`               | n/a                                                                                     | Read organization preferences.                                                                                                                                                                                            |
-| `orgs.preferences:write`              | n/a                                                                                     | Update organization preferences.                                                                                                                                                                                          |
-| `orgs.quotas:read`                    | n/a                                                                                     | Read organization quotas.                                                                                                                                                                                                 |
-| `orgs.quotas:write`                   | n/a                                                                                     | Update organization quotas.                                                                                                                                                                                               |
-| `orgs:create`                         | n/a                                                                                     | Create an organization.                                                                                                                                                                                                   |
-| `orgs:delete`                         | n/a                                                                                     | Delete one or more organizations.                                                                                                                                                                                         |
-| `orgs:read`                           | n/a                                                                                     | Read one or more organizations.                                                                                                                                                                                           |
-| `orgs:write`                          | n/a                                                                                     | Update one or more organizations.                                                                                                                                                                                         |
-| `plugins.app:access`                  | `plugins:*` <br> `plugins:id:*`                                                         | Access one or more application plugins (still enforcing the organization role)                                                                                                                                            |
-| `plugins:install`                     | n/a                                                                                     | Install and uninstall plugins.                                                                                                                                                                                            |
-| `plugins:write`                       | `plugins:*` <br> `plugins:id:*`                                                         | Edit settings for one or more plugins.                                                                                                                                                                                    |
-| `provisioning:reload`                 | `provisioners:*`                                                                        | Reload provisioning files. To find the exact scope for specific provisioner, see [Scope definitions](#scope-definitions).                                                                                                 |
-| `reports:create`                      | n/a                                                                                     | Create reports.                                                                                                                                                                                                           |
-| `reports:write`                       | `reports:*` <br> `reports:id:*`                                                         | Update reports.                                                                                                                                                                                                           |
-| `reports.settings:read`               | n/a                                                                                     | Read report settings.                                                                                                                                                                                                     |
-| `reports.settings:write`              | n/a                                                                                     | Update report settings.                                                                                                                                                                                                   |
-| `reports:delete`                      | `reports:*` <br> `reports:id:*`                                                         | Delete reports.                                                                                                                                                                                                           |
-| `reports:read`                        | `reports:*` <br> `reports:id:*`                                                         | List all available reports or get a specific report.                                                                                                                                                                      |
-| `reports:send`                        | `reports:*` <br> `reports:id:*`                                                         | Send a report email.                                                                                                                                                                                                      |
-| `roles:delete`                        | `permissions:type:delegate`                                                             | Delete a custom role.                                                                                                                                                                                                     |
-| `roles:read`                          | `roles:*` <br> `roles:uid:*`                                                            | List roles and read a specific role with its permissions.                                                                                                                                                                 |
-| `roles:write`                         | `permissions:type:delegate`                                                             | Create or update a custom role.                                                                                                                                                                                           |
-| `roles:write`                         | `permissions:type:escalate`                                                             | Reset basic roles to their default permissions.                                                                                                                                                                           |
-| `server.stats:read`                   | n/a                                                                                     | Read Grafana instance statistics.                                                                                                                                                                                         |
-| `server.usagestats.report:read`       | n/a                                                                                     | View usage statistics report.                                                                                                                                                                                             |
-| `serviceaccounts:write`               | `serviceaccounts:*`                                                                     | Create Grafana service accounts.                                                                                                                                                                                          |
-| `serviceaccounts:create`              | n/a                                                                                     | Update Grafana service accounts.                                                                                                                                                                                          |
-| `serviceaccounts:delete`              | `serviceaccounts:*` <br> `serviceaccounts:id:*`                                         | Delete Grafana service accounts.                                                                                                                                                                                          |
-| `serviceaccounts:read`                | `serviceaccounts:*` <br> `serviceaccounts:id:*`                                         | Read Grafana service accounts.                                                                                                                                                                                            |
-| `serviceaccounts.permissions:write`   | `serviceaccounts:*` <br> `serviceaccounts:id:*`                                         | Update Grafana service account permissions to control who can do what with the service account.                                                                                                                           |
-| `serviceaccounts.permissions:read`    | `serviceaccounts:*` <br> `serviceaccounts:id:*`                                         | Read Grafana service account permissions to see who can do what with the service account.                                                                                                                                 |
-| `settings:read`                       | `settings:*`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Read the [Grafana configuration settings](../../../../setup-grafana/configure-grafana/)                                                                                                                                   |
-| `settings:write`                      | `settings:*`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Update any Grafana configuration settings that can be [updated at runtime](../../../../setup-grafana/configure-grafana/settings-updates-at-runtime/).                                                                     |
-| `support.bundles:create`              | n/a                                                                                     | Create support bundles.                                                                                                                                                                                                   |
-| `support.bundles:delete`              | n/a                                                                                     | Delete support bundles.                                                                                                                                                                                                   |
-| `support.bundles:read`                | n/a                                                                                     | List and download support bundles.                                                                                                                                                                                        |
-| `status:accesscontrol`                | `services:accesscontrol`                                                                | Get access-control enabled status.                                                                                                                                                                                        |
-| `teams.permissions:read`              | `teams:*`<br>`teams:id:*`                                                               | Read members and Team Sync setup for teams.                                                                                                                                                                               |
-| `teams.permissions:write`             | `teams:*`<br>`teams:id:*`                                                               | Add, remove and update members and manage Team Sync setup for teams.                                                                                                                                                      |
-| `teams.roles:add`                     | `permissions:type:delegate`                                                             | Assign a role to a team.                                                                                                                                                                                                  |
-| `teams.roles:read`                    | `teams:*`<br>`teams:id:*`                                                               | List roles assigned directly to a team.                                                                                                                                                                                   |
-| `teams.roles:remove`                  | `permissions:type:delegate`                                                             | Unassign a role from a team.                                                                                                                                                                                              |
-| `teams:create`                        | n/a                                                                                     | Create teams.                                                                                                                                                                                                             |
-| `teams:delete`                        | `teams:*`<br>`teams:id:*`                                                               | Delete one or more teams.                                                                                                                                                                                                 |
-| `teams:read`                          | `teams:*`<br>`teams:id:*`                                                               | Read one or more teams and team preferences. To list teams through the UI one of the following permissions is required in addition to `teams:read`: `teams:write`, `teams.permissions:read` or `teams.permissions:write`. |
-| `teams:write`                         | `teams:*`<br>`teams:id:*`                                                               | Update one or more teams and team preferences.                                                                                                                                                                            |
-| `users.authtoken:read`                | `global.users:*` <br> `global.users:id:*`                                               | List authentication tokens that are assigned to a user.                                                                                                                                                                   |
-| `users.authtoken:write`               | `global.users:*` <br> `global.users:id:*`                                               | Update authentication tokens that are assigned to a user.                                                                                                                                                                 |
-| `users.password:write`                | `global.users:*` <br> `global.users:id:*`                                               | Update a user’s password.                                                                                                                                                                                                 |
-| `users.permissions:read`              | `users:*`                                                                               | List permissions of a user.                                                                                                                                                                                               |
-| `users.permissions:write`             | `global.users:*` <br> `global.users:id:*`                                               | Update a user’s organization-level permissions.                                                                                                                                                                           |
-| `users.quotas:read`                   | `global.users:*` <br> `global.users:id:*`                                               | List a user’s quotas.                                                                                                                                                                                                     |
-| `users.quotas:write`                  | `global.users:*` <br> `global.users:id:*`                                               | Update a user’s quotas.                                                                                                                                                                                                   |
-| `users.roles:add`                     | `permissions:type:delegate`                                                             | Assign a role to a user or a service account.                                                                                                                                                                             |
-| `users.roles:read`                    | `users:*`                                                                               | List roles assigned directly to a user or a service account.                                                                                                                                                              |
-| `users.roles:remove`                  | `permissions:type:delegate`                                                             | Unassign a role from a user or a service account.                                                                                                                                                                         |
-| `users:create`                        | n/a                                                                                     | Create a user.                                                                                                                                                                                                            |
-| `users:delete`                        | `global.users:*` <br> `global.users:id:*`                                               | Delete a user.                                                                                                                                                                                                            |
-| `users:disable`                       | `global.users:*` <br> `global.users:id:*`                                               | Disable a user.                                                                                                                                                                                                           |
-| `users:enable`                        | `global.users:*` <br> `global.users:id:*`                                               | Enable a user.                                                                                                                                                                                                            |
-| `users:logout`                        | `global.users:*` <br> `global.users:id:*`                                               | Sign out a user.                                                                                                                                                                                                          |
-| `users:read`                          | `global.users:*`                                                                        | Read or search user profiles.                                                                                                                                                                                             |
-| `users:write`                         | `global.users:*` <br> `global.users:id:*`                                               | Update a user’s profile.                                                                                                                                                                                                  |
-
-### Grafana OnCall action definitions (beta)
-
-> **Note:** Available from Grafana 9.4 in early access.
-
-> **Note:** This feature is behind the `accessControlOnCall` feature toggle.
-> You can enable feature toggles through configuration file or environment variables. See configuration [docs](../../../../setup-grafana/configure-grafana/#feature_toggles) for details.
-
-The following list contains role-based access control actions used by Grafana OnCall application plugin.
-
-| Action                                           | Applicable scope | Description                                       |
-| ------------------------------------------------ | ---------------- | ------------------------------------------------- |
-| `grafana-oncall-app.alert-groups:read`           | n/a              | Read OnCall alert groups.                         |
-| `grafana-oncall-app.alert-groups:write`          | n/a              | Create, edit and delete OnCall alert groups.      |
-| `grafana-oncall-app.integrations:read`           | n/a              | Read OnCall integrations.                         |
-| `grafana-oncall-app.integrations:write`          | n/a              | Create, edit and delete OnCall integrations.      |
-| `grafana-oncall-app.integrations:test`           | n/a              | Test OnCall integrations.                         |
-| `grafana-oncall-app.escalation-chains:read`      | n/a              | Read OnCall escalation chains.                    |
-| `grafana-oncall-app.escalation-chains:write`     | n/a              | Create, edit and delete OnCall escalation chains. |
-| `grafana-oncall-app.schedules:read`              | n/a              | Read OnCall schedules.                            |
-| `grafana-oncall-app.schedules:write`             | n/a              | Create, edit and delete OnCall schedules.         |
-| `grafana-oncall-app.schedules:export`            | n/a              | Export OnCall schedules.                          |
-| `grafana-oncall-app.chatops:read`                | n/a              | Read OnCall ChatOps.                              |
-| `grafana-oncall-app.chatops:write`               | n/a              | Edit OnCall ChatOps.                              |
-| `grafana-oncall-app.chatops:update-settings`     | n/a              | Edit OnCall ChatOps settings.                     |
-| `grafana-oncall-app.maintenance:read`            | n/a              | Read OnCall maintenance.                          |
-| `grafana-oncall-app.maintenance:write`           | n/a              | Edit OnCall maintenance.                          |
-| `grafana-oncall-app.api-keys:read`               | n/a              | Read OnCall API keys.                             |
-| `grafana-oncall-app.api-keys:write`              | n/a              | Create, edit and delete OnCall API keys.          |
-| `grafana-oncall-app.notifications:read`          | n/a              | Receive OnCall notifications.                     |
-| `grafana-oncall-app.notification-settings:read`  | n/a              | Read OnCall notification settings.                |
-| `grafana-oncall-app.notification-settings:write` | n/a              | Edit OnCall notification settings.                |
-| `grafana-oncall-app.user-settings:read`          | n/a              | Read user's own OnCall user settings.             |
-| `grafana-oncall-app.user-settings:write`         | n/a              | Edit user's own OnCall user settings.             |
-| `grafana-oncall-app.user-settings:admin`         | n/a              | Read and edit all users' OnCall user settings.    |
-| `grafana-oncall-app.other-settings:read`         | n/a              | Read OnCall settings.                             |
-| `grafana-oncall-app.other-settings:write`        | n/a              | Edit OnCall settings.                             |
+<!-- prettier-ignore-start -->
+| Action                                | Applicable scopes                                                                                                   | Description                                                                                                                                                                                                               |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `alert.instances.external:read`       | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Read alerts and silences in data sources that support alerting.                                                                                                                                                           |
+| `alert.instances.external:write`      | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Manage alerts and silences in data sources that support alerting.                                                                                                                                                         |
+| `alert.instances:create`              | None                                                                                                                | Create silences in the current organization.                                                                                                                                                                              |
+| `alert.instances:read`                | None                                                                                                                | Read alerts and silences in the current organization.                                                                                                                                                                     |
+| `alert.instances:write`               | None                                                                                                                | Update and expire silences in the current organization.                                                                                                                                                                   |
+| `alert.notifications.external:read`   | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Read templates, contact points, notification policies, and mute timings in data sources that support alerting.                                                                                                            |
+| `alert.notifications.external:write`  | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Manage templates, contact points, notification policies, and mute timings in data sources that support alerting.                                                                                                          |
+| `alert.notifications:write`           | None                                                                                                                | Manage templates, contact points, notification policies, and mute timings in the current organization.                                                                                                                    |
+| `alert.notifications:read`            | None                                                                                                                | Read all templates, contact points, notification policies, and mute timings in the current organization.                                                                                                                  |
+| `alert.rules.external:read`           | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki)                                                                                                                                      |
+| `alert.rules.external:write`          | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki).                                                                                                                            |
+| `alert.rules:create`                  | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Create Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.       |
+| `alert.rules:delete`                  | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.       |
+| `alert.rules:read`                    | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Read Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.         |
+| `alert.rules:write`                   | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query.       |
+| `alert.silences:create`               | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Create rule-specific silences in a folder and its subfolders.                                                                                                                                                             |
+| `alert.silences:read`                 | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Read all general silences and rule-specific silences in a folder and its subfolders.                                                                                                                                      |
+| `alert.silences:write`                | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Update and expire rule-specific silences in a folder and its subfolders.                                                                                                                                                  |
+| `alert.provisioning:read`             | None                                                                                                                | Read all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.                                                                                    |
+| `alert.provisioning.secrets:read`     | None                                                                                                                | Same as `alert.provisioning:read` plus ability to export resources with decrypted secrets.                                                                                                                                |
+| `alert.provisioning:write`            | None                                                                                                                | Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and datasource are not required.                                                                                  |
+| `alert.provisioning.provenance:write` | None                                                                                                                | Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources                                                                                               |
+| `annotations:create`                  | <ul><li>`annotations:*`</li><li>`annotations:type:*`</li><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                      | Create annotations.                                                                                                                                                                                                       |
+| `annotations:delete`                  | <ul><li>`annotations:*`</li><li>`annotations:type:*`</li><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                      | Delete annotations.                                                                                                                                                                                                       |
+| `annotations:read`                    | <ul><li>`annotations:*`</li><li>`annotations:type:*`</li><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                      | Read annotations and annotation tags.                                                                                                                                                                                     |
+| `annotations:write`                   | <ul><li>`annotations:*`</li><li>`annotations:type:*`</li><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                      | Update annotations.                                                                                                                                                                                                       |
+| `apikeys:read`                        | <ul><li>`apikeys:*`</li><li>`apikeys:id:*`</li></ul>                                                                | Read API keys.                                                                                                                                                                                                            |
+| `apikeys:delete`                      | <ul><li>`apikeys:*`</li><li>`apikeys:id:*`</li></ul>                                                                | Delete API keys.                                                                                                                                                                                                          |
+| `banners:write`              | None                                                                                                                | Create [announcement banners](/docs/grafana-cloud/whats-new/2024-09-10-announcement-banner/).                                                                                                                                                                              |
+| `dashboards:create`                   | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Create dashboards in one or more folders and their subfolders.                                                                                                                                                            |
+| `dashboards:delete`                   | <ul><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>             | Delete one or more dashboards.                                                                                                                                                                                            |
+| `dashboards.insights:read`            | None                                                                                                                | Read dashboard insights data and see presence indicators.                                                                                                                                                                 |
+| `dashboards.permissions:read`         | <ul><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>             | Read permissions for one or more dashboards.                                                                                                                                                                              |
+| `dashboards.permissions:write`        | <ul><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>             | Update permissions for one or more dashboards.                                                                                                                                                                            |
+| `dashboards:read`                     | <ul><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>             | Read one or more dashboards.                                                                                                                                                                                              |
+| `dashboards:write`                    | <ul><li>`dashboards:*`</li><li>`dashboards:uid:*`</li><li>`folders:*`</li><li>`folders:uid:*`</li></ul>             | Update one or more dashboards.                                                                                                                                                                                            |
+| `dashboards.public:write`             | <ul><li>`dashboards:*`</li><li>`dashboards:uid:*`</li></ul>                                                         | Write public dashboard configuration.                                                                                                                                                                                     |
+| `datasources.caching:read`            | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Read data source query caching settings.                                                                                                                                                                                  |
+| `datasources.caching:write`           | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Update data source query caching settings.                                                                                                                                                                                |
+| `datasources:create`                  | None                                                                                                                | Create data sources.                                                                                                                                                                                                      |
+| `datasources:delete`                  | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Delete data sources.                                                                                                                                                                                                      |
+| `datasources:explore`                 | None                                                                                                                | Enable access to the **Explore** tab.                                                                                                                                                                                     |
+| `datasources.id:read`                 | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Read data source IDs.                                                                                                                                                                                                     |
+| `datasources.insights:read`           | None                                                                                                                | Read data sources insights data.                                                                                                                                                                                          |
+| `datasources.permissions:read`        | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | List data source permissions.                                                                                                                                                                                             |
+| `datasources.permissions:write`       | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Update data source permissions.                                                                                                                                                                                           |
+| `datasources:query`                   | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Query data sources.                                                                                                                                                                                                       |
+| `datasources:read`                    | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | List data sources.                                                                                                                                                                                                        |
+| `datasources:write`                   | <ul><li>`datasources:*`</li><li>`datasources:uid:*`</li></ul>                                                       | Update data sources.                                                                                                                                                                                                      |
+| `featuremgmt.read`                    | None                                                                                                                | Read feature toggles.                                                                                                                                                                                                     |
+| `featuremgmt.write`                   | None                                                                                                                | Write feature toggles.                                                                                                                                                                                                    |
+| `folders.permissions:read`            | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Read permissions for one or more folders and their subfolders.                                                                                                                                                            |
+| `folders.permissions:write`           | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Update permissions for one or more folders and their subfolders.                                                                                                                                                          |
+| `folders:create`                      | <ul><li>`folders:*`</li><li>`folders:uid:*`</li><li>`folders:uid:general`</li></ul>                                 | Create folders or subfolders. If granted with scope `folders:uid:general`, it allows to create root level folders. Otherwise, it allows creating subfolders under the specified folders.                                  |
+| `folders:delete`                      | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Delete one or more folders and their subfolders.                                                                                                                                                                          |
+| `folders:read`                        | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Read one or more folders and their subfolders.                                                                                                                                                                            |
+| `folders:write`                       | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Update one or more folders and their subfolders.                                                                                                                                                                          |
+| `ldap.config:reload`                  | None                                                                                                                | Reload the LDAP configuration.                                                                                                                                                                                            |
+| `ldap.status:read`                    | None                                                                                                                | Verify the availability of the LDAP server or servers.                                                                                                                                                                    |
+| `ldap.user:read`                      | None                                                                                                                | Read users via LDAP.                                                                                                                                                                                                      |
+| `ldap.user:sync`                      | None                                                                                                                | Sync users via LDAP.                                                                                                                                                                                                      |
+| `library.panels:create`               | <ul><li>`folders:*`</li><li>`folders:uid:*`</li></ul>                                                               | Create a library panel in one or more folders and their subfolders.                                                                                                                                                       |
+| `library.panels:read`                 | <ul><li>`folders:*`</li><li>`folders:uid:*`</li><li>`library.panels:*`</li><li>`library.panels:uid:*`</li></ul>     | Read one or more library panels.                                                                                                                                                                                          |
+| `library.panels:write`                | <ul><li>`folders:*`</li><li>`folders:uid:*`</li><li>`library.panels:*`</li><li>`library.panels:uid:*`</li></ul>     | Update one or more library panels.                                                                                                                                                                                        |
+| `library.panels:delete`               | <ul><li>`folders:*`</li><li>`folders:uid:*`</li><li>`library.panels:*`</li><li>`library.panels:uid:*`</li></ul>     | Delete one or more library panels.                                                                                                                                                                                        |
+| `licensing.reports:read`              | None                                                                                                                | Get custom permission reports.                                                                                                                                                                                            |
+| `licensing:delete`                    | None                                                                                                                | Delete the license token.                                                                                                                                                                                                 |
+| `licensing:read`                      | None                                                                                                                | Read licensing information.                                                                                                                                                                                               |
+| `licensing:write`                     | None                                                                                                                | Update the license token.                                                                                                                                                                                                 |
+| `org.users:write`                     | <ul><li>`users:*`</li><li>`users:id:*`</li></ul>                                                                    | Update the organization role (`None`, `Viewer`, `Editor`, or `Admin`) of a user.                                                                                                                                          |
+| `org.users:add`                       | <ul><li>`users:*`</li><li>`users:id:*`</li></ul>                                                                    | Add a user to an organization or invite a new user to an organization.                                                                                                                                                    |
+| `org.users:read`                      | <ul><li>`users:*`</li><li>`users:id:*`</li></ul>                                                                    | Get user profiles within an organization.                                                                                                                                                                                 |
+| `org.users:remove`                    | <ul><li>`users:*`</li><li>`users:id:*`</li></ul>                                                                    | Remove a user from an organization.                                                                                                                                                                                       |
+| `orgs.preferences:read`               | None                                                                                                                | Read organization preferences.                                                                                                                                                                                            |
+| `orgs.preferences:write`              | None                                                                                                                | Update organization preferences.                                                                                                                                                                                          |
+| `orgs.quotas:read`                    | None                                                                                                                | Read organization quotas.                                                                                                                                                                                                 |
+| `orgs.quotas:write`                   | None                                                                                                                | Update organization quotas.                                                                                                                                                                                               |
+| `orgs:create`                         | None                                                                                                                | Create an organization.                                                                                                                                                                                                   |
+| `orgs:delete`                         | None                                                                                                                | Delete one or more organizations.                                                                                                                                                                                         |
+| `orgs:read`                           | None                                                                                                                | Read one or more organizations.                                                                                                                                                                                           |
+| `orgs:write`                          | None                                                                                                                | Update one or more organizations.                                                                                                                                                                                         |
+| `plugins.app:access`                  | <ul><li>`plugins:*`</li><li>`plugins:id:*`</li></ul>                                                                | Access one or more application plugins (still enforcing the organization role)                                                                                                                                            |
+| `plugins:install`                     | None                                                                                                                | Install and uninstall plugins.                                                                                                                                                                                            |
+| `plugins:write`                       | <ul><li>`plugins:*`</li><li>`plugins:id:*`</li></ul>                                                                | Edit settings for one or more plugins.                                                                                                                                                                                    |
+| `provisioning:reload`                 | `provisioners:*`                                                                                                    | Reload provisioning files. To find the exact scope for specific provisioner, refer to [Scope definitions](#scope-definitions).                                                                                            |
+| `reports:create`                      | None                                                                                                                | Create reports.                                                                                                                                                                                                           |
+| `reports:write`                       | <ul><li>`reports:*`</li><li>`reports:id:*`</li></ul>                                                                | Update reports.                                                                                                                                                                                                           |
+| `reports.settings:read`               | None                                                                                                                | Read report settings.                                                                                                                                                                                                     |
+| `reports.settings:write`              | None                                                                                                                | Update report settings.                                                                                                                                                                                                   |
+| `reports:delete`                      | <ul><li>`reports:*`</li><li>`reports:id:*`</li></ul>                                                                | Delete reports.                                                                                                                                                                                                           |
+| `reports:read`                        | <ul><li>`reports:*`</li><li>`reports:id:*`</li></ul>                                                                | List all available reports or get a specific report.                                                                                                                                                                      |
+| `reports:send`                        | <ul><li>`reports:*`</li><li>`reports:id:*`</li></ul>                                                                | Send a report email.                                                                                                                                                                                                      |
+| `roles:delete`                        | <ul><li>`permissions:type:delegate`</li><ul>                                                                        | Delete a custom role.                                                                                                                                                                                                     |
+| `roles:read`                          | <ul><li>`roles:*`</li><li>`roles:uid:*`</li></ul>                                                                   | List roles and read a specific role with its permissions.                                                                                                                                                                 |
+| `roles:write`                         | <ul><li>`permissions:type:delegate`</li><ul>                                                                        | Create or update a custom role.                                                                                                                                                                                           |
+| `roles:write`                         | <ul><li>`permissions:type:escalate`</li><ul>                                                                        | Reset basic roles to their default permissions.                                                                                                                                                                           |
+| `server.stats:read`                   | None                                                                                                                | Read Grafana instance statistics.                                                                                                                                                                                         |
+| `server.usagestats.report:read`       | None                                                                                                                | View usage statistics report.                                                                                                                                                                                             |
+| `serviceaccounts:write`               | <ul><li>`serviceaccounts:*`</li><ul>                                                                                | Create Grafana service accounts.                                                                                                                                                                                          |
+| `serviceaccounts:create`              | None                                                                                                                | Update Grafana service accounts.                                                                                                                                                                                          |
+| `serviceaccounts:delete`              | <ul><li>`serviceaccounts:*`</li><li>`serviceaccounts:id:*`</li></ul>                                                | Delete Grafana service accounts.                                                                                                                                                                                          |
+| `serviceaccounts:read`                | <ul><li>`serviceaccounts:*`</li><li>`serviceaccounts:id:*`</li></ul>                                                | Read Grafana service accounts.                                                                                                                                                                                            |
+| `serviceaccounts.permissions:write`   | <ul><li>`serviceaccounts:*`</li><li>`serviceaccounts:id:*`</li></ul>                                                | Update Grafana service account permissions to control who can do what with the service account.                                                                                                                           |
+| `serviceaccounts.permissions:read`    | <ul><li>`serviceaccounts:*`</li><li>`serviceaccounts:id:*`</li></ul>                                                | Read Grafana service account permissions to see who can do what with the service account.                                                                                                                                 |
+| `settings:read`                       | <ul><li>`settings:*`</li><li>`settings:auth.saml:*`</li><li>`settings:auth.saml:enabled`</li></ul> (property level) | Read the [Grafana configuration settings](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/)                                                                                                               |
+| `settings:write`                      | <ul><li>`settings:*`</li><li>`settings:auth.saml:*`</li><li>`settings:auth.saml:enabled`</li></ul> (property level) | Update any Grafana configuration settings that can be [updated at runtime](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/settings-updates-at-runtime/).                                                 |
+| `support.bundles:create`              | None                                                                                                                | Create support bundles.                                                                                                                                                                                                   |
+| `support.bundles:delete`              | None                                                                                                                | Delete support bundles.                                                                                                                                                                                                   |
+| `support.bundles:read`                | None                                                                                                                | List and download support bundles.                                                                                                                                                                                        |
+| `status:accesscontrol`                | <ul><li>`services:accesscontrol`</li><ul>                                                                           | Get access-control enabled status.                                                                                                                                                                                        |
+| `teams.permissions:read`              | <ul><li>`teams:*`</li><li>`teams:id:*`</li></ul>                                                                    | Read members and Team Sync setup for teams.                                                                                                                                                                               |
+| `teams.permissions:write`             | <ul><li>`teams:*`</li><li>`teams:id:*`</li></ul>                                                                    | Add, remove and update members and manage Team Sync setup for teams.                                                                                                                                                      |
+| `teams.roles:add`                     | <ul><li>`permissions:type:delegate`</li><ul>                                                                        | Assign a role to a team.                                                                                                                                                                                                  |
+| `teams.roles:read`                    | <ul><li>`teams:*`</li><li>`teams:id:*`</li></ul>                                                                    | List roles assigned directly to a team.                                                                                                                                                                                   |
+| `teams.roles:remove`                  | <ul><li>`permissions:type:delegate`</li><ul>                                                                        | Unassign a role from a team.                                                                                                                                                                                              |
+| `teams:create`                        | None                                                                                                                | Create teams.                                                                                                                                                                                                             |
+| `teams:delete`                        | <ul><li>`teams:*`</li><li>`teams:id:*`</li></ul>                                                                    | Delete one or more teams.                                                                                                                                                                                                 |
+| `teams:read`                          | <ul><li>`teams:*`</li><li>`teams:id:*`</li></ul>                                                                    | Read one or more teams and team preferences. To list teams through the UI one of the following permissions is required in addition to `teams:read`: `teams:write`, `teams.permissions:read` or `teams.permissions:write`. |
+| `teams:write`                         | <ul><li>`teams:*`</li><li>`teams:id:*`</li></ul>                                                                    | Update one or more teams and team preferences.                                                                                                                                                                            |
+| `users.authtoken:read`                | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | List authentication tokens that are assigned to a user.                                                                                                                                                                   |
+| `users.authtoken:write`               | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Update authentication tokens that are assigned to a user.                                                                                                                                                                 |
+| `users.password:write`                | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Update a user’s password.                                                                                                                                                                                                 |
+| `users.permissions:read`              | <ul><li>`users:*`</li><ul>                                                                                          | List permissions of a user.                                                                                                                                                                                               |
+| `users.permissions:write`             | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Update a user’s organization-level permissions.                                                                                                                                                                           |
+| `users.quotas:read`                   | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | List a user’s quotas.                                                                                                                                                                                                     |
+| `users.quotas:write`                  | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Update a user’s quotas.                                                                                                                                                                                                   |
+| `users.roles:add`                     | <ul><li>`permissions:type:delegate`</li><ul>                                                                        | Assign a role to a user or a service account.                                                                                                                                                                             |
+| `users.roles:read`                    | <ul><li>`users:*`</li><ul>                                                                                          | List roles assigned directly to a user or a service account.                                                                                                                                                              |
+| `users.roles:remove`                  | <ul><li>`permissions:type:delegate`</li><ul>                                                                        | Unassign a role from a user or a service account.                                                                                                                                                                         |
+| `users:create`                        | None                                                                                                                | Create a user.                                                                                                                                                                                                            |
+| `users:delete`                        | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Delete a user.                                                                                                                                                                                                            |
+| `users:disable`                       | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Disable a user.                                                                                                                                                                                                           |
+| `users:enable`                        | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Enable a user.                                                                                                                                                                                                            |
+| `users:logout`                        | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Sign out a user.                                                                                                                                                                                                          |
+| `users:read`                          | <ul><li>`global.users:*`</li><ul>                                                                                   | Read or search user profiles.                                                                                                                                                                                             |
+| `users:write`                         | <ul><li>`global.users:*`</li><li>`global.users:id:*`</li></ul>                                                      | Update a user’s profile.                                                                                                                                                                                                  |
+{ .no-spacing-list }
+<!-- prettier-ignore-end -->

 ### Grafana Adaptive Metrics action definitions

 The following list contains role-based access control actions used by Grafana Adaptive Metrics.

-| Action                                               | Applicable scope | Description                                           |
-| ---------------------------------------------------- | ---------------- | ----------------------------------------------------- |
-| `grafana‑adaptive‑metrics‑app.plugin:access`         | n/a              | Access the Adaptive Metrics plugin in Grafana Cloud.  |
-| `grafana‑adaptive‑metrics‑app.config:read`           | n/a              | Read the Adaptive Metrics app configuration.          |
-| `grafana‑adaptive‑metrics‑app.config:write`          | n/a              | Update the Adaptive Metrics app configuration.        |
-| `grafana‑adaptive‑metrics‑app.recommendations:read`  | n/a              | Read aggregation recommendations.                     |
-| `grafana‑adaptive‑metrics‑app.recommendations:apply` | n/a              | Apply aggregation recommendations.                    |
-| `grafana‑adaptive‑metrics‑app.rules:read`            | n/a              | Read aggregation rules.                               |
-| `grafana‑adaptive‑metrics‑app.rules:write`           | n/a              | Create aggregation rules.                             |
-| `grafana‑adaptive‑metrics‑app.rules:delete`          | n/a              | Delete aggregation rules.                             |
-| `grafana‑adaptive‑metrics‑app.exemptions:read`       | n/a              | Read recommendation exemptions.                       |
-| `grafana‑adaptive‑metrics‑app.exemptions:write`      | n/a              | Create, update, and delete recommendation exemptions. |
+| Action                                               | Applicable scopes | Description                                           |
+| ---------------------------------------------------- | ----------------- | ----------------------------------------------------- |
+| `grafana‑adaptive‑metrics‑app.plugin:access`         | None              | Access the Adaptive Metrics plugin in Grafana Cloud.  |
+| `grafana‑adaptive‑metrics‑app.config:read`           | None              | Read the Adaptive Metrics app configuration.          |
+| `grafana‑adaptive‑metrics‑app.config:write`          | None              | Update the Adaptive Metrics app configuration.        |
+| `grafana‑adaptive‑metrics‑app.recommendations:read`  | None              | Read aggregation recommendations.                     |
+| `grafana‑adaptive‑metrics‑app.recommendations:apply` | None              | Apply aggregation recommendations.                    |
+| `grafana‑adaptive‑metrics‑app.rules:read`            | None              | Read aggregation rules.                               |
+| `grafana‑adaptive‑metrics‑app.rules:write`           | None              | Create aggregation rules.                             |
+| `grafana‑adaptive‑metrics‑app.rules:delete`          | None              | Delete aggregation rules.                             |
+| `grafana‑adaptive‑metrics‑app.exemptions:read`       | None              | Read recommendation exemptions.                       |
+| `grafana‑adaptive‑metrics‑app.exemptions:write`      | None              | Create, update, and delete recommendation exemptions. |
+
+### Grafana Alerting Notification action definitions
+
+To enable these permissions, enable the `alertingApiServer` feature toggle.
+
+| Action                                       | Applicable scopes                  | Description                                                                                                     |
+| -------------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------- |
+| `alert.notifications.receivers:read`         | `receivers:*`<br>`receivers:uid:*` | Read contact points. None                                                                                       |
+| `alert.notifications.receivers.secrets:read` | `receivers:*`<br>`receivers:uid:*` | Export contact points with decrypted secrets.None                                                               |
+| `alert.notifications.receivers:create`       | None                               | Create a new contact points. The creator is automatically granted full access to the created contact point.None |
+| `alert.notifications.receivers:write`        | `receivers:*`<br>`receivers:uid:*` | Update existing contact points.None                                                                             |
+| `alert.notifications.receivers:delete`       | `receivers:*`<br>`receivers:uid:*` | Update and delete existing contact points.None                                                                  |
+| `receivers.permissions:read`                 | `receivers:*`<br>`receivers:uid:*` | Read permissions for contact points.None                                                                        |
+| `receivers.permissions:write`                | `receivers:*`<br>`receivers:uid:*` | Manage permissions for contact points.None                                                                      |
+| `alert.notifications.time-intervals:read`    | None                               | Read mute time intervals.None                                                                                   |
+| `alert.notifications.time-intervals:write`   | None                               | Create new or update existing mute time intervals.None                                                          |
+| `alert.notifications.time-intervals:delete`  | None                               | Delete existing time intervals.None                                                                             |
+| `alert.notifications.templates:read`         | None                               | Read templates.                                                                                                 |
+| `alert.notifications.templates:write`        | None                               | Create new or update existing templates.None                                                                    |
+| `alert.notifications.templates:delete`       | None                               | Delete existing templates.None                                                                                  |

 ## Scope definitions

--- a/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md
@@ -74,8 +74,6 @@ refs:
 Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
 {{% /admonition %}}

-{{< table-of-contents >}}
-
 This section includes instructions for how to view permissions associated with roles, create custom roles, and update and delete roles.

 The following example includes the base64 username:password Basic Authorization. You cannot use authorization tokens in the request.
--- a/docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
@@ -109,9 +109,9 @@ To learn how to use the roles API to determine the role UUIDs, refer to [Manage
 | `fixed:datasources.insights:reader`          | `fixed_EBZ3NwlfecNPp2p0XcZRC1nfEYk` | `datasources.insights:read`                                                                                                                                                                                                                                                 | Read data source insights data.                                                                                                                                                                                                                                                       |
 | `fixed:datasources.permissions:reader`       | `fixed_ErYA-cTN3yn4h4GxaVPcawRhiOY` | `datasources.permissions:read`                                                                                                                                                                                                                                              | Read data source permissions.                                                                                                                                                                                                                                                         |
 | `fixed:datasources.permissions:writer`       | `fixed_aiQh9YDfLOKjQhYasF9_SFUjQiw` | All permissions from `fixed:datasources.permissions:reader` and <br>`datasources.permissions:write`                                                                                                                                                                         | Create, read, or delete permissions of a data source.                                                                                                                                                                                                                                 |
-| `fixed:folders:creator`                      | `fixed_gGLRbZGAGB6n9uECqSh_W382RlQ` | `folders:create`                                                                                                                                                                                                                                                            | Create folders in the root level. If granted together with `folders:write` permission, also allows creating subfolders under all folders.                                                                                                                                             |
+| `fixed:folders:creator`                      | `fixed_gGLRbZGAGB6n9uECqSh_W382RlQ` | `folders:create`                                                                                                                                                                                                                                                            | Create folders in the root level.                                                                                                                                                                                                                                                     |
 | `fixed:folders:reader`                       | `fixed_yeW-5QPeo-i5PZUIUXMlAA97GnQ` | `folders:read`<br>`dashboards:read`                                                                                                                                                                                                                                         | Read all folders and dashboards.                                                                                                                                                                                                                                                      |
-| `fixed:folders:writer`                       | `fixed_wJXLoTzgE7jVuz90dryYoiogL0o` | All permissions from `fixed:dashboards:writer` and <br>`folders:read`<br>`folders:write`<br>`folders:create`<br>`folders:delete`<br>`folders.permissions:read`<br>`folders.permissions:write`                                                                               | Read, create, update, and delete all folders and dashboards. If granted together with `fixed:folders:creator`, allows creating subfolders under all folders.                                                                                                                          |
+| `fixed:folders:writer`                       | `fixed_wJXLoTzgE7jVuz90dryYoiogL0o` | All permissions from `fixed:dashboards:writer` and <br>`folders:read`<br>`folders:write`<br>`folders:create`<br>`folders:delete`<br>`folders.permissions:read`<br>`folders.permissions:write`                                                                               | Read, update, and delete all folders and dashboards. Create folders and subfolders.                                                                                                                                                                                                   |
 | `fixed:folders.permissions:reader`           | `fixed_E06l4cx0JFm47EeLBE4nmv3pnSo` | `folders.permissions:read`                                                                                                                                                                                                                                                  | Read all folder permissions.                                                                                                                                                                                                                                                          |
 | `fixed:folders.permissions:writer`           | `fixed_3GAgpQ_hWG8o7-lwNb86_VB37eI` | All permissions from `fixed:folders.permissions:reader` and <br>`folders.permissions:write`                                                                                                                                                                                 | Read and update all folder permissions.                                                                                                                                                                                                                                               |
 | `fixed:ldap:reader`                          | `fixed_lMcOPwSkxKY-qCK8NMJc5k6izLE` | `ldap.user:read`<br>`ldap.status:read`                                                                                                                                                                                                                                      | Read the LDAP configuration and LDAP status information.                                                                                                                                                                                                                              |
--- a/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md
@@ -0,0 +1,82 @@
+---
+aliases:
+  - ../../../enterprise/access-control/rbac-for-app-plugins/
+description: Learn about how to configure access to app plugins using RBAC
+labels:
+  products:
+    - cloud
+menuTitle: RBAC for app plugins
+title: RBAC for app plugins
+weight: 90
+refs:
+  manage-rbac-roles-update-basic-role-permissions:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/roles-and-permissions/access-control/manage-rbac-roles/#update-basic-role-permissions
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/manage-rbac-roles/#update-basic-role-permissions
+  restrict-access-to-app-plugin-example:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/#prevent-viewers-from-accessing-an-app-plugin
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/plan-rbac-rollout-strategy/#prevent-viewers-from-accessing-an-app-plugin
+  adaptive-metrics-permissions:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/roles-and-permissions/access-control/custom-role-actions-scopes/#grafana-adaptive-metrics-action-definitions
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/custom-role-actions-scopes/#grafana-adaptive-metrics-action-definitions
+  rbac-role-definitions:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+---
+
+# RBAC for app plugins
+
+{{% admonition type="note" %}}
+Available in [Grafana Cloud](/docs/grafana-cloud).
+{{% /admonition %}}
+
+RBAC can be used to manage access to [app plugins](https://grafana.com/docs/grafana/latest/administration/plugin-management/#app-plugins).
+Each app plugin grants the basic Viewer, Editor and Admin organization roles a default set of plugin permissions.
+You can use RBAC to restrict which app plugins a basic organization role has access to.
+Some app plugins have fine-grained RBAC support, which allows you to grant additional access to these app plugins to teams and users regardless of their basic organization roles.
+
+## Restricting access to app plugins
+
+By default, Viewers, Editors and Admins have access to all App Plugins that their organization role allows them to access.
+To change this default behavior and prevent a basic organization role from accessing an App plugin, you must [update the basic role's permissions](ref:manage-rbac-roles-update-basic-role-permissions).
+See an example of [preventing Viewers from accessing an app plugin](ref:restrict-access-to-app-plugin-example) to learn more.
+To grant access to a limited set of app plugins, you will need plugin IDs. You can find them in `plugin.json` files or in the URL when you open the app plugin in the Grafana Cloud UI.
+
+Note that unless an app plugin has fine-grained RBAC support, it is not possible to grant access to this app plugin for a user whose organization role does not have access to that app plugin.
+
+## Fine-grained access to app plugins
+
+Plugins with fine-grained RBAC support allow you to manage access to plugin features at a more granular level.
+For instance, you can grant admin access to an app plugin to a user with Viewer organization role. Or restrict the Editor organization role from being able to edit plugin resources.
+
+Please refer to plugin documentation to see what RBAC permissions the plugin has and what default access the plugin grants to Viewer, Editor and Admin organization roles.
+
+The following list contains app plugins that have fine-grained RBAC support.
+
+| App plugin                                                                                                                                                                            | App plugin ID                  | App plugin permission documentation                                                                                                                                        |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/)                                                          | `grafana-auth-app`             | n/a                                                                                                                                                                        |
+| [Adaptive metrics](https://grafana.com/docs/grafana-cloud/cost-management-and-billing/reduce-costs/metrics-costs/control-metrics-usage-via-adaptive-metrics/adaptive-metrics-plugin/) | `grafana-adaptive-metrics-app` | [RBAC actions for Adaptive Metrics](ref:adaptive-metrics-permissions)                                                                                                      |
+| [Incident](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/incident/)                                                                                                     | `grafana-incident-app`         | n/a                                                                                                                                                                        |
+| [OnCall](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/oncall/)                                                                                                         | `grafana-oncall-app`           | [Configure RBAC for OnCall](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/oncall/manage/user-and-team-management/#manage-users-and-teams-for-grafana-oncall) |
+| [Performance Testing (K6)](https://grafana.com/docs/grafana-cloud/testing/k6/)                                                                                                        | `k6-app`                       | [Configure RBAC for K6](https://grafana.com/docs/grafana-cloud/testing/k6/projects-and-users/configure-rbac/)                                                              |
+| [Private data source connect (PDC)](https://grafana.com/docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/)                                                    | `grafana-pdc-app`              | n/a                                                                                                                                                                        |
+| [Service Level Objective (SLO)](https://grafana.com/docs/grafana-cloud/alerting-and-irm/slo/)                                                                                         | `grafana-slo-app`              | [Configure RBAC for SLO](https://grafana.com/docs/grafana-cloud/alerting-and-irm/slo/set-up/rbac/)                                                                         |
+
+### Revoke fine-grained access from app plugins
+
+To list all the permissions granted to a basic role, use the [HTTP API endpoint to query for the role](https://grafana.com/docs/grafana/latest/developers/http_api/access_control/#get-a-role).
+Basic role UIDs are listed in [RBAC role definitions list](ref:rbac-role-definitions).
+To remove the undesired plugin permissions from a basic role, you must [update the basic role's permissions](ref:manage-rbac-roles-update-basic-role-permissions).
+
+### Grant additional access to app plugins
+
+To grant access to app plugins, you can use the predefined [fixed plugin roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/#fixed-roles) or create [custom roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/#custom-roles) with specific plugin permissions.
+To learn about how to assign an RBAC role, refer to [the documentation on assigning RBAC roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/assign-rbac-roles/#assign-rbac-roles).
--- a/docs/sources/administration/roles-and-permissions/access-control/troubleshooting/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/troubleshooting/index.md
@@ -8,7 +8,7 @@ labels:
    - enterprise
 menuTitle: Troubleshooting RBAC
 title: Troubleshooting RBAC
-weight: 80
+weight: 100
 ---

 # Troubleshooting RBAC
--- a/docs/sources/administration/service-accounts/_index.md
+++ b/docs/sources/administration/service-accounts/_index.md
@@ -12,6 +12,7 @@ labels:
  products:
    - enterprise
    - oss
+    - cloud
 menuTitle: Service accounts
 title: Service accounts
 weight: 800
--- a/docs/sources/alerting/_index.md
+++ b/docs/sources/alerting/_index.md
@@ -27,10 +27,6 @@ cards:
      href: ./fundamentals/
      description: Learn more about the fundamentals and available features that help you create, manage, and respond to alerts; and improve your team’s ability to resolve issues quickly.
      height: 24
-    - title: Set up
-      href: ./set-up/
-      description: Set up your implementation of Grafana Alerting.
-      height: 24
    - title: Configure alert rules
      href: ./alerting-rules/
      description: Create, manage, view, and adjust alert rules to alert on your metrics data or log entries from multiple data sources — no matter where your data is stored.
@@ -39,13 +35,13 @@ cards:
      href: ./configure-notifications/
      description: Choose how, when, and where to send your alert notifications.
      height: 24
-    - title: Detect and respond
+    - title: Monitor status
      href: ./manage-notifications/
      description: Monitor, respond to, and triage issues within your services.
      height: 24
-    - title: Monitor
-      href: ./monitor/
-      description: Monitor your alerting metrics to ensure you identify potential issues before they become critical.
+    - title: Additional configuration
+      href: ./set-up/
+      description: Use advanced configuration options to further tailor your alerting setup. These options can enhance security, scalability, and automation in complex environments.
      height: 24
 ---

--- a/docs/sources/alerting/alerting-rules/create-grafana-managed-rule.md
+++ b/docs/sources/alerting/alerting-rules/create-grafana-managed-rule.md
@@ -64,16 +64,21 @@ refs:
      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/annotation-label/
    - pattern: /docs/grafana-cloud/
      destination: /docs/grafana-cloud/alerting-and-irm/alerting/fundamentals/alert-rules/annotation-label/
-  alert-list:
+  link-alert-rules-to-panels:
    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/visualizations/alert-list/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/link-alert-rules-to-panels/
    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/visualizations/alert-list/
-  time-series:
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/link-alert-rules-to-panels/
+  data-sources:
    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/visualizations/time-series/
+      destination: /docs/grafana/<GRAFANA_VERSION>/datasources/
    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/visualizations/time-series/
+    - destination: /docs/grafana-cloud/connect-externally-hosted/data-sources/
+  compatible-data-sources:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/#supported-data-sources
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/fundamentals/alert-rules/#supported-data-sources
 ---

 # Configure Grafana-managed alert rules
@@ -83,15 +88,39 @@ Grafana-managed rules are the most flexible alert rule type. They allow you to c
 Multiple alert instances can be created as a result of one alert rule (also known as a multi-dimensional alerting).

 {{% admonition type="note" %}}
-For Grafana Cloud, you can create 100 free Grafana-managed alert rules.
+For Grafana Cloud Free Forever, you can create up to 100 free Grafana-managed alert rules with each alert rule having a maximum of 1000 alert instances.
+
+For all paid tiers (Cloud Pro and Advanced), there is a soft limit of 2000 alert rules and unlimited alert instances. To increase the limit, open a support ticket from the [Cloud portal](https://grafana.com/docs/grafana-cloud/account-management/support/).
+
 {{% /admonition %}}

-Grafana managed alert rules can only be edited or deleted by users with Edit permissions for the folder storing the rules.
+Grafana-managed alert rules can only be edited or deleted by users with Edit permissions for the folder storing the rules.

-If you delete an alerting resource created in the UI, you can no longer retrieve it.
+If you delete an alert resource created in the UI, you can no longer retrieve it.
 To make a backup of your configuration and to be able to restore deleted alerting resources, create your alerting resources using file provisioning, Terraform, or the Alerting API.

-In the following sections, we’ll guide you through the process of creating your Grafana-managed alert rules.
+## Before you begin
+
+If you are using Grafana OSS:
+
+1. Configure your [data sources](ref:data-sources).
+2. Check which [data sources](ref:compatible-data-sources) are compatible with and supported by Grafana Alerting.
+
+If you are using Grafana OSS, Enterprise, or Cloud:
+
+You can use default or advanced options for Grafana-managed alert rule creation. The default options streamline rule creation with a cleaner header and a single query and condition. For more complex rules, use advanced options to add multiple queries and expressions.
+
+Default and advanced options are enabled by default for Grafana Cloud users and this feature is being rolled out progressively.
+
+For OSS users,enable the `alertingQueryAndExpressionsStepMode` feature toggle.
+
+{{% admonition type="note" %}}
+Once you have created an alert rule using one of the options, the system defaults to this option for the next alert rule you create.
+
+You can toggle between the two options. However, if you want to switch from advanced options to the default, it may be that your query and expressions cannot be converted. In this case, a warning message checks whether you want to continue to reset to default settings.
+{{% /admonition %}}
+
+## Steps

 To create a Grafana-managed alert rule, use the in-product alert creation flow and follow these steps.

@@ -108,14 +137,26 @@ To get started quickly, refer to our [tutorial on getting started with Grafana a

 Define a query to get the data you want to measure and a condition that needs to be met before an alert rule fires.

+{{< collapse title="Default options" >}}
+
+1. Add a query.
+1. Add an alert condition.
+
+   The **When** input includes the reducer function and the last input is the threshold.
+
+1. Click **Preview** to verify.
+   {{< /collapse >}}
+
+{{< collapse title="Advanced options" >}}
+
 1. Select a data source.
 1. From the **Options** dropdown, specify a [time range](ref:time-units-and-relative-ranges).

-   **Note:**
+{{% admonition type="note" %}}
+Grafana Alerting only supports fixed relative time ranges, for example, `now-24hr: now`.

-   Grafana Alerting only supports fixed relative time ranges, for example, `now-24hr: now`.
-
-   It does not support absolute time ranges: `2021-12-02 00:00:00 to 2021-12-05 23:59:592` or semi-relative time ranges: `now/d to: now`.
+It does not support absolute time ranges: `2021-12-02 00:00:00 to 2021-12-05 23:59:592` or semi-relative time ranges: `now/d to: now`.
+{{% /admonition %}}

 1. Add a query.

@@ -138,6 +179,7 @@ Define a query to get the data you want to measure and a condition that needs to
   You can only add one recovery threshold in a query and it must be the alert condition.

 1. Click **Set as alert condition** on the query or expression you want to set as your alert condition.
+   {{< /collapse >}}

 ## Set alert evaluation behavior

@@ -230,15 +272,9 @@ Annotations add metadata to provide more information on the alert in your alert
   Webpage where you keep your runbook for the alert

 1. Optional: Add a custom annotation
-1. Optional: Add a **dashboard and panel link**.
+1. Optional: **Link dashboard and panel**.

-   Links alerts to panels in a dashboard.
-
-   {{% admonition type="note" %}}
-   At the moment, alerts are only supported in the [time series](ref:time-series) and [alert list](ref:alert-list) visualizations.
-   {{% /admonition %}}
-
-   {{< docs/play title="visualizations with linked alerts in Grafana" url="https://play.grafana.org/d/000000074/" >}}
+   [Link the alert rule to a panel](ref:link-alert-rules-to-panels) to facilitate alert investigation.

 1. Click **Save rule**.

@@ -267,13 +303,3 @@ You can also configure the alert instance state when its evaluation returns an e
 | Keep Last State     | Maintains the alert instance in its last state. Useful for mitigating temporary issues, refer to [Keep last state](ref:keep-last-state).                                                                                               |

 When you configure the No data or Error behavior to `Alerting` or `Normal`, Grafana will attempt to keep a stable set of fields under notification `Values`. If your query returns no data or an error, Grafana re-uses the latest known set of fields in `Values`, but will use `-1` in place of the measured value.
-
-## Create alerts from panels
-
-Create alerts from any panel type. This means you can reuse the queries in the panel and create alerts based on them.
-
-1. Navigate to a dashboard in the **Dashboards** section.
-2. In the top right corner of the panel, click on the three dots (ellipses).
-3. From the dropdown menu, select **More...** and then choose **New alert rule**.
-
-This will open the alert rule form, allowing you to configure and create your alert based on the current panel's query.
--- a/docs/sources/alerting/alerting-rules/create-mimir-loki-managed-recording-rule.md
+++ b/docs/sources/alerting/alerting-rules/create-mimir-loki-managed-recording-rule.md
@@ -1,184 +0,0 @@
---
-aliases:
-  - ../unified-alerting/alerting-rules/create-cortex-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-cortex-loki-managed-recording-rule/
-  - ../unified-alerting/alerting-rules/create-mimir-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-mimir-loki-managed-recording-rule/
-canonical: https://grafana.com/docs/grafana/latest/alerting/alerting-rules/create-mimir-loki-managed-recording-rule/
-description: Create recording rules for an external Grafana Mimir or Loki instance
-keywords:
-  - grafana
-  - alerting
-  - guide
-  - rules
-  - recording rules
-  - configure
-labels:
-  products:
-    - cloud
-    - enterprise
-    - oss
-title: Configure recording rules
-weight: 300
-refs:
-  configure-grafana:
-    - pattern: /docs/
-      destination: /docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/
-  annotation-label:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/annotation-label/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/alerting-and-irm/alerting/fundamentals/alert-rules/annotation-label/
---
-
-# Configure recording rules
-
-{{< admonition type="note" >}}
-In Grafana Cloud, you can only create data source-managed recording rules.
-
-In Grafana OSS and Enterprise, you can create both Grafana-managed and data source-managed recording rules if you enable the `grafanaManagedRecordingRules` feature flag.
-
-For more information on enabling feature toggles, refer to [Configure feature toggles](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles).
-{{< /admonition >}}
-
-Recording rules calculate frequently needed expressions or computationally expensive expressions in advance and save the result as a new set of time series. Querying this new time series is faster, especially for dashboards since they query the same expression every time the dashboards refresh.
-
-For more information on recording rules in Prometheus, refer to [Defining recording rules in Prometheus](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/).
-
-Recording rules are run as instant rules, which means that they run every 10s. To overwrite this configuration, update the min_interval in your custom configuration file.
-
-[min_interval](ref:configure-grafana) sets the minimum interval to enforce between rule evaluations. The default value is 10s which equals the scheduler interval. Rules will be adjusted if they are less than this value or if they are not multiple of the scheduler interval (10s). Higher values can help with resource management as fewer evaluations are scheduled over time.
-
-This setting has precedence over each individual rule frequency. If a rule frequency is lower than this value, then this value is enforced.
-
-## Configure data source-managed recording rules
-
-Configure data source-managed recording rules.
-
-### Before you begin
-
- Verify that you have write permission to the Prometheus or Loki data source. Otherwise, you will not be able to create or update Grafana Mimir managed alerting rules.
-
- For Grafana Mimir and Loki data sources, enable the ruler API by configuring their respective services.
-
-  - **Loki** - The `local` rule storage type, default for the Loki data source, supports only viewing of rules. To edit rules, configure one of the other rule storage types.
-
-  - **Grafana Mimir** - use the `/prometheus` prefix. The Prometheus data source supports both Grafana Mimir and Prometheus, and Grafana expects that both the [Query API](/docs/mimir/latest/operators-guide/reference-http-api/#querier--query-frontend) and [Ruler API](/docs/mimir/latest/operators-guide/reference-http-api/#ruler) are under the same URL. You cannot provide a separate URL for the Ruler API.
-
-To configure data-source managed recording rules, complete the following steps.
-
-1. Click **Alerts & IRM** -> **Alerting** ->
-   **Alert rules**.
-1. Scroll to the **Data source-managed section** and click **+New recording rule**.
-
-#### Enter recording rule name
-
-The recording rule name must be a Prometheus metric name and contain no whitespace.
-
-#### Define recording rule
-
-Select your data source and enter a query.
-
-#### Add namespace and group
-
-1. From the **Namespace** dropdown, select an existing rule namespace or add a new one.
-
-   Namespaces can contain one or more rule groups and only have an organizational purpose.
-
-1. From the **Group** dropdown, select an existing group within the selected namespace or add a new one.
-
-   Newly created rules are appended to the end of the group. Rules within a group are run sequentially at a regular interval, with the same evaluation time.
-
-#### Add labels
-
-1. Add custom labels selecting existing key-value pairs from the drop down, or add new labels by entering the new key or value.
-
-1. Click **Save rule** to save the rule or **Save rule and exit** to save the rule and go back to the Alerting page.
-
-## Configure Grafana-managed recording rules
-
-Configure Grafana-managed recording rules.
-
-{{< admonition type="note" >}}
-This feature is only available for Grafana OSS and Enterprise users. It is not available in Grafana Cloud.
-{{< /admonition >}}
-
-### Before you begin
-
- Enable the `grafanaManagedRecordingRules` [feature flag](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/).
-
-To configure Grafana-managed recording rules, complete the following steps.
-
-1. Click **Alerts & IRM** -> **Alerting** ->
-   **Alert rules**.
-1. Scroll to the **Grafana-managed section** and click **+New recording rule**.
-
-#### Enter a recording rule and metric name
-
-Enter a names to identify your recording rule and metric. The metric name must be a Prometheus metric name and contain no whitespace.
-
-For more information, refer to [Metrics and labels](https://prometheus.io/docs/concepts/data_model/#metric-names-and-labels).
-
-#### Define recording rule
-
-Define a query to get the data you want to measure and a condition that needs to be met before an alert rule fires.
-
-1. Select a data source.
-1. From the **Options** dropdown, specify a time range.
-
-{{< admonition type="note" >}}
-Grafana Alerting only supports fixed relative time ranges, for example, `now-24hr: now`.
-
-It does not support absolute time ranges: `2021-12-02 00:00:00 to 2021-12-05 23:59:592` or semi-relative time ranges: `now/d to: now`.
-{{< /admonition >}}
-
-1. Add a query.
-
-   To add multiple queries, click **Add query**.
-
-   All alert rules are managed by Grafana by default. If you want to switch to a data source-managed alert rule, click **Switch to data source-managed alert rule**.
-
-2. Add one or more [expressions].
-
-   a. For each expression, select either **Classic condition** to create a single alert rule, or choose from the **Math**, **Reduce**, and **Resample** options to generate separate alert for each series.
-
-   {{% admonition type="note" %}}
-   When using Prometheus, you can use an instant vector and built-in functions, so you don't need to add additional expressions.
-   {{% /admonition %}}
-
-   b. Click **Preview** to verify that the expression is successful.
-
-3. To add a recovery threshold, turn the **Custom recovery threshold** toggle on and fill in a value for when your alert rule should stop firing.
-
-   You can only add one recovery threshold in a query and it must be the alert condition.
-
-4. Click **Set as alert condition** on the query or expression you want to set as your alert condition.
-
-#### Set evaluation behavior
-
-Use alert rule evaluation to determine how frequently an alert rule should be evaluated and how quickly it should change its state.
-
-To do this, you need to make sure that your alert rule is in the right evaluation group and set a pending period time that works best for your use case.
-
-1. Select a folder or click **+ New folder**.
-1. Select an evaluation group or click **+ New evaluation group**.
-
-   If you are creating a new evaluation group, specify the interval for the group.
-
-   All rules within the same group are evaluated concurrently over the same time interval.
-
-1. Enter a pending period.
-
-   The pending period is the period in which an alert rule can be in breach of the condition until it fires.
-
-   Once a condition is met, the alert goes into the **Pending** state. If the condition remains active for the duration specified, the alert transitions to the **Firing** state, else it reverts to the **Normal** state.
-
-1. Turn on pause alert notifications, if required.
-
-   {{< admonition type="note" >}}
-   You can pause alert rule evaluation to prevent noisy alerting while tuning your alerts.
-   Pausing stops alert rule evaluation and doesn't create any alert instances.
-   This is different to mute timings, which stop notifications from being delivered, but still allows for alert rule evaluation and the creation of alert instances.
-   {{< /admonition >}}
-
-#### Add labels
-
-Add labels to your rule for searching, silencing, or routing to a notification policy.
--- a/docs/sources/alerting/alerting-rules/create-mimir-loki-managed-rule.md
+++ b/docs/sources/alerting/alerting-rules/create-mimir-loki-managed-rule.md
@@ -1,8 +1,8 @@
 ---
 aliases:
-  - ../unified-alerting/alerting-rules/create-cortex-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-cortex-loki-managed-recording-rule/
-  - ../unified-alerting/alerting-rules/create-mimir-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-mimir-loki-managed-recording-rule/
  - ../unified-alerting/alerting-rules/create-mimir-loki-managed-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-mimir-loki-managed-rule/
+  - ../unified-alerting/alerting-rules/edit-cortex-loki-namespace-group/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/edit-cortex-loki-namespace-group/
+  - ../unified-alerting/alerting-rules/edit-mimir-loki-namespace-group/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/edit-mimir-loki-namespace-group/
 canonical: https://grafana.com/docs/grafana/latest/alerting/alerting-rules/create-mimir-loki-managed-rule/
 description: Configure data source-managed alert rules alert for an external Grafana Mimir or Loki instance
 keywords:
@@ -29,16 +29,11 @@ refs:
      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/annotation-label/
    - pattern: /docs/grafana-cloud/
      destination: /docs/grafana-cloud/alerting-and-irm/alerting/fundamentals/alert-rules/annotation-label/
-  alert-list:
+  link-alert-rules-to-panels:
    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/visualizations/alert-list/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/link-alert-rules-to-panels/
    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/visualizations/alert-list/
-  time-series:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/panels-visualizations/visualizations/time-series/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana-cloud/visualizations/panels-visualizations/visualizations/time-series/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/link-alert-rules-to-panels/
 ---

 # Configure data source-managed alert rules
@@ -142,14 +137,8 @@ Annotations add metadata to provide more information on the alert in your alert
   Webpage where you keep your runbook for the alert

 1. Optional: Add a custom annotation
-1. Optional: Add a **dashboard and panel link**.
+1. Optional: **Link dashboard and panel**.

-   Links alerts to panels in a dashboard.
-
-   {{% admonition type="note" %}}
-   At the moment, alerts are only supported in the [time series](ref:time-series) and [alert list](ref:alert-list) visualizations.
-   {{% /admonition %}}
-
-   {{< docs/play title="visualizations with linked alerts in Grafana" url="https://play.grafana.org/d/000000074/" >}}
+   [Link the alert rule to a panel](ref:link-alert-rules-to-panels) to facilitate alert investigation.

 1. Click **Save rule**.
--- a/docs/sources/alerting/alerting-rules/create-recording-rules/_index.md
+++ b/docs/sources/alerting/alerting-rules/create-recording-rules/_index.md
@@ -0,0 +1,54 @@
+---
+aliases:
+  - ../fundamentals/alert-rules/recording-rules/ # /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/recording-rules/
+  - ../unified-alerting/alerting-rules/create-cortex-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-cortex-loki-managed-recording-rule/
+  - ../unified-alerting/alerting-rules/create-mimir-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/unified-alerting/alerting-rules/create-mimir-loki-managed-recording-rule/
+  - ../alerting-rules/create-mimir-loki-managed-recording-rule/ # /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/create-mimir-loki-managed-recording-rule/
+canonical: https://grafana.com/docs/grafana/latest/alerting/alerting-rules/create-recording-rules/
+description: Recording rules allow you to pre-compute frequently needed or computationally expensive expressions and save the results as a new set of time series. Querying precomputed results is faster and can reduce system load.
+keywords:
+  - grafana
+  - alerting
+  - guide
+  - rules
+  - recording rules
+  - configure
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+title: Create recording rules
+weight: 400
+refs:
+  grafana-managed-recording-rules:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/create-recording-rules/create-grafana-managed-recording-rules/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/create-recording-rules/create-grafana-managed-recording-rules/
+  data-source-managed-recording-rules:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/create-recording-rules/create-data-source-managed-recording-rules/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/create-recording-rules/create-data-source-managed-recording-rules/
+---
+
+# Configure recording rules
+
+Recording rules allows you to periodically pre-compute frequently used or computationally expensive queries, saving the results as a new time series metric.
+
+For instance, you can create a recording rule generating a new metric, `error_9001_count`, which counts occurrences of a specific log error within one minute. Then, query the `error_9001_count` metric in dashboards and alert rules.
+
+Recording rules can be helpful in various scenarios, such as:
+
+- **Faster queries** are needed: Performing heavy aggregations or querying large data sets is quicker with precomputed results than real-time queries.
+- **Reducing system load:** Precomputing specific queries in advance can reduce system overload caused by multiple simultaneous queries.
+- **Simplifying complex aggregations:** Create a new metric from complex aggregations to facilitate alert and dashboard setup.
+- **Reusing queries across alerts:** Improve efficiency by reusing the same query across similar alert rules and dashboards.
+
+The evaluation group of the recording rule determines how often the metric is pre-computed.
+
+Similar to alert rules, Grafana supports two types of recording rules:
+
+1. [Grafana-managed recording rules](ref:grafana-managed-recording-rules), which can query any Grafana data source supported by alerting.
+2. [Data source-managed recording rules](ref:data-source-managed-recording-rules), which can query Prometheus-based data sources like Mimir or Loki.
--- a/docs/sources/alerting/alerting-rules/create-recording-rules/create-data-source-managed-recording-rules.md
+++ b/docs/sources/alerting/alerting-rules/create-recording-rules/create-data-source-managed-recording-rules.md
@@ -0,0 +1,79 @@
+---
+canonical: https://grafana.com/docs/grafana/latest/alerting/alerting-rules/create-recording-rules/create-data-source-managed-recording-rules/
+description: Recording rules allow you to pre-compute expensive queries in advance and save the results as a new set of time series. Data source-managed recording rules can create a recording rule for Prometheus-based data sources like Mimir or Loki.
+keywords:
+  - grafana
+  - alerting
+  - guide
+  - rules
+  - recording rules
+  - configure
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+title: Create data source-managed recording rules
+weight: 402
+refs:
+  create-recording-rules:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/create-recording-rules/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/create-recording-rules/
+---
+
+# Create data source-managed recording rules
+
+[Recording rules](ref:create-recording-rules) allow you to periodically pre-compute frequently used or computationally expensive queries, saving the results as a new time series metric.
+
+Alert rules and dashboards can then query the new metric resulting from the recording rule. This is faster than querying real-time data and can help to reduce system load.
+
+Data source-managed recording rules can query Prometheus-based data sources like Mimir or Loki. For more information on recording rules in Prometheus, refer to [Defining recording rules in Prometheus](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/).
+
+Note that in data source-managed groups, the alert rules and recording rules within the same evaluation group are evaluated sequentially. This is useful to ensure that a recording rule is evaluated before any other alert rule queries the pre-computed metric.
+
+## Before you begin
+
+- Verify that you have write permission to the Prometheus or Loki data source. Otherwise, you will not be able to create or update Grafana Mimir managed alerting rules.
+
+- For Grafana Mimir and Loki data sources, enable the ruler API by configuring their respective services.
+
+  - **Loki** - The `local` rule storage type, default for the Loki data source, supports only viewing of rules. To edit rules, configure one of the other rule storage types.
+
+  - **Grafana Mimir** - use the `/prometheus` prefix. The Prometheus data source supports both Grafana Mimir and Prometheus, and Grafana expects that both the [Query API](/docs/mimir/latest/operators-guide/reference-http-api/#querier--query-frontend) and [Ruler API](/docs/mimir/latest/operators-guide/reference-http-api/#ruler) are under the same URL. You cannot provide a separate URL for the Ruler API.
+
+## Add new recording rule
+
+To create a new data source-managed recording rule:
+
+1. Click **Alerts & IRM** -> **Alerting** -> **Alert rules**.
+1. Scroll to the **Data source-managed section** and click **+New recording rule**.
+
+## Enter recording rule name
+
+The recording rule name must be a Prometheus metric name and contain no whitespace.
+
+## Define recording rule
+
+Select your data source and enter a query. The queries used in data source-managed recording rules always run as instant queries.
+
+## Add namespace and group
+
+1. From the **Namespace** dropdown, select an existing rule namespace or add a new one.
+
+   Namespaces can contain one or more rule groups and only have an organizational purpose.
+
+1. From the **Group** dropdown, select an existing group within the selected namespace or add a new one.
+
+   Newly created rules are appended to the end of the group. Rules within a group are run sequentially at a regular interval, with the same evaluation time.
+
+## Add labels
+
+Optionally, you can add custom labels to the resulting metric by selecting existing key-value pairs from the drop down or entering the new key or value.
+
+## Query the new metric in dashboards or alert rules
+
+Click **Save rule** or **Save rule and exit** to save the rule.
+
+Once saved, the new recording metric is available for use in dashboards and alert rules.
--- a/docs/sources/alerting/alerting-rules/create-recording-rules/create-grafana-managed-recording-rules.md
+++ b/docs/sources/alerting/alerting-rules/create-recording-rules/create-grafana-managed-recording-rules.md
@@ -0,0 +1,151 @@
+---
+canonical: https://grafana.com/docs/grafana/latest/alerting/alerting-rules/create-recording-rules/create-grafana-managed-recording-rules/
+description: Recording rules allow you to pre-compute expensive queries in advance and save the results as a new set of time series. Grafana-managed recording rules can create a recording rule for any data source supported by alerting.
+keywords:
+  - grafana
+  - alerting
+  - guide
+  - rules
+  - recording rules
+  - configure
+labels:
+  products:
+    - cloud
+    - enterprise
+    - oss
+title: Create Grafana-managed recording rules
+weight: 401
+refs:
+  expressions:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/queries-conditions/#expression-queries
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/fundamentals/alert-rules/queries-conditions/#expression-queries
+  create-recording-rules:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/alerting-rules/create-recording-rules/
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/alerting-rules/create-recording-rules/
+  alerting-data-sources:
+    - pattern: /docs/grafana/
+      destination: /docs/grafana/<GRAFANA_VERSION>/alerting/fundamentals/alert-rules/#supported-data-sources
+    - pattern: /docs/grafana-cloud/
+      destination: /docs/grafana-cloud/alerting-and-irm/alerting/fundamentals/alert-rules/#supported-data-sources
+  configure-grafana-min-interval:
+    - pattern: /docs/
+      destination: /docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/#min_interval
+  configure-feature-toggles:
+    - pattern: /docs/
+      destination: /docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/feature-toggles/
+---
+
+# Create Grafana-managed recording rules
+
+[Recording rules](ref:create-recording-rules) allow you to periodically pre-compute frequently used or computationally expensive queries, saving the results as a new time series metric.
+
+Alert rules and dashboards can then query the new metric resulting from the recording rule. This is faster than querying real-time data and can help to reduce system load.
+
+Grafana does not contain an embedded time-series database to store recording rule results. You must bring your own Prometheus-compatible database to store the series generated by recording rules.
+
+Grafana-managed recording rules offer the same Prometheus-like semantics but allow you to query [data sources supported by alerting](ref:alerting-data-sources). Additionally, you can use recording rules to import and map data from other data sources into Prometheus.
+
+{{< admonition type="note" >}}
+
+Grafana-managed recording rules are enabled by default in Grafana Cloud.
+
+In Grafana OSS and Enterprise, you must enable them by following the [Before you begin](#before-you-begin) instructions.
+
+{{< /admonition >}}
+
+To configure Grafana-managed recording rules, complete the following steps.
+
+## Before you begin
+
+This section only applies to Grafana OSS and Grafana Enterprise.
+
+First, enable the `grafanaManagedRecordingRules` [feature flag](ref:configure-feature-toggles).
+
+Then, enable the feature by setting `enabled = true` in the `[recording_rules]` section of the Grafana config .ini. Provide the URL of your Prometheus-compatible remote-write endpoint in the `url` field, along with optional credentials or headers.
+
+```
+[recording_rules]
+enabled = true
+url = http://my-example-prometheus.local:9090/api/prom/push
+basic_auth_username = my-user
+basic_auth_password = my-pass
+
+[recording_rules.custom_headers]
+X-My-Header = MyValue
+```
+
+## Add new recording rule
+
+To create a new Grafana-managed recording rule:
+
+1. Click **Alerts & IRM** -> **Alerting** ->
+   **Alert rules**.
+1. Scroll to the **Grafana-managed section** and click **+New recording rule**.
+
+1. Enter the names to identify your recording rule and metric.
+
+   The metric name must be a Prometheus metric name and contain no whitespace. For details, refer to [Prometheus metric names](https://prometheus.io/docs/concepts/data_model/#metric-names-and-labels).
+
+## Define recording rule
+
+Define a query to get the data you want to measure and set the recording rule output.
+
+1. Select a data source.
+1. From the **Options** dropdown, specify a time range.
+
+   {{< admonition type="note" >}}
+   Grafana Alerting only supports fixed relative time ranges, for example, `now-24hr: now`.
+
+   It does not support absolute time ranges: `2021-12-02 00:00:00 to 2021-12-05 23:59:592` or semi-relative time ranges: `now/d to: now`.
+   {{< /admonition >}}
+
+1. Add a query.
+
+   To add multiple queries, click **Add query**.
+
+1. Add one or more [expressions](ref:expressions).
+
+   a. For each expression, select either **Classic condition** to create a single recording rule, or choose from the **Math**, **Reduce**, and **Resample** options.
+
+   When using Prometheus, you can use an instant vector and built-in functions, so you don't need to add additional expressions.
+
+   b. Click **Preview** to verify that the expression is successful.
+
+1. Click **Set as recording rule output** on the query or expression you want to set as your rule output.
+
+## Set evaluation behavior
+
+Use recording rule evaluation to determine how frequently a recording rule should be evaluated.
+
+To do this, you need to make sure that your recording rule is in the right evaluation group with an interval that works best for your use case.
+
+1. Select a folder or click **+ New folder**.
+1. Select an evaluation group or click **+ New evaluation group**.
+
+   If you are creating a new evaluation group, specify the interval for the group.
+
+   All rules within the same group are evaluated concurrently over the same time interval. Every recording rule in a group uses the same evaluation time, meaning that all queries from the same group are always aligned with each other.
+
+1. Before or after creating a recording rule, you have the option to **Pause evaluation** if necessary.
+
+### Advanced configuration
+
+[min_interval](ref:configure-grafana-min-interval) sets the minimum interval to enforce between rule evaluations. The default value is 10s which equals the scheduler interval. Rules are adjusted if they are less than this value or if they are not multiple of the scheduler interval (10s). Higher values can help with resource management as fewer evaluations are scheduled over time.
+
+This setting has precedence over each individual rule frequency. If a rule frequency is lower than this value, then this value is enforced.
+
+This setting applies to both Grafana-managed alert and recording rules.
+
+## Add labels
+
+Optionally, you can add custom labels to the resulting metric by selecting existing key-value pairs from the drop down or entering the new key or value.
+
+## Query the new metric in dashboards or alert rules
+
+Click **Save rule** or **Save rule and exit** to save the rule.
+
+Once saved, the new recording metric is available for use in dashboards and alert rules.
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`module: "github.com/grafana/grafana/apps/playlist/kinds"`