fix(deps): update npm dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@dagrejs/dagre	^1.1.4 -> ^1.1.5
@grafana/data (source)	11.5.0 -> 11.6.3
@grafana/ui (source)	11.5.0 -> 11.6.3
@svgr/webpack (source)	^8.0.1 -> ^8.1.0
@types/react (source)	^18.3.20 -> ^18.3.23
@types/react-dom (source)	^18.3.5 -> ^18.3.7
@xyflow/react (source)	^12.4.4 -> ^12.7.1
dompurify	^3.2.4 -> ^3.2.6
postcss (source)	^8.4.31 -> ^8.5.6
react-router-dom (source)	^6.30.0 -> ^6.30.1
typescript (source)	^5.8.2 -> ^5.8.3

---

Release Notes

dagrejs/dagre (@​dagrejs/dagre)

v1.1.5

Compare Source

grafana/grafana (@​grafana/data)

v11.6.3: 11.6.3

Compare Source

Download page
What's new highlights

Bug fixes

• Security: Fixes CVE-2025-3415

v11.6.2: 11.6.2

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go version to 1.24.3 #​105103, @​macabu
• Dependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.4-git to v2.5.0 #​105443, @​macabu
• Dependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12 #​105369, @​macabu
• Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0 #​105251, @​macabu

Bug fixes

• Dashboard: Fixes issue with row repeats and first row #​104467, @​torkelo
• Graphite: Ensure template variables are interpolated correctly #​105388, @​aangelisc
• Graphite: Fix Graphite series interpolation #​104568, @​aangelisc
• Prometheus: Fix semver import path #​104943, @​jackw
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.6.1: 11.6.1

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Update JWT library (CVE-2025-30204) #​102727, @​grambbledook
• DashboardScenePage: Correct slug in self referencing data links #​103854, @​Sergej-Vlasov
• Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 #​102863, @​macabu
• Go: Bump to 1.24.2 #​103523, @​Proximyst
• Go: Bump to 1.24.2 (Enterprise)
• GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay #​102869, @​mthorning
• Prometheus: Add support for cloud partners Prometheus data sources #​103941, @​kevinwcyu

Bug fixes

• Alertmanager: Add Role-Based Access Control via reqAction Field #​103479, @​olegpixel
• GrafanaUI: Remove blurred background from overlay backdrops to improve performance #​103647, @​joshhunt
• InfluxDB: Fix nested variable interpolation #​104096, @​aangelisc
• LDAP test: Fix page crash #​102684, @​ashharrison90
• Org redirection: Fix linking between orgs #​102870, @​ashharrison90
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703
• Security: Fix CVE-2025-3260

v11.6.0: 11.6.0

Compare Source

Download page
What's new highlights

Features and enhancements

• API keys: Migrate API keys to service accounts at startup #​96924, @​dmihai
• AccessControl: Allow plugin roles to include plugins:write #​101089, @​gamab
• Alerting: Add DAG errors to alert rule creation and view #​99423, @​soniaAguilarPeiron
• Alerting: Add Jira integration to cloud AMs #​100482, @​soniaAguilarPeiron
• Alerting: Add alert rule version history - part1 #​99490, @​soniaAguilarPeiron
• Alerting: Add migration to clean up rule versions table #​102562, @​yuri-tceretian
• Alerting: Add multiple threshold operators #​99516, @​paulojmdias
• Alerting: Add tracking for the mode used in query and notifications step when c… #​100824, @​soniaAguilarPeiron
• Alerting: Adding color option for slack receiver #​99615, @​wymangr
• Alerting: Allow selection of recording rule write target on per-rule basis. #​101778, @​stevesg
• Alerting: Allow specifying uid for new rules added to groups #​99858, @​moustafab
• Alerting: Improve template testing by trying non-root scopes #​101471, @​JacobsonMT
• Alerting: Include time range in template dashboard and panel urls #​101095, @​JacobsonMT
• Alerting: Keep the latest version of deleted rule in version table #​101481, @​yuri-tceretian
• Alerting: Promote alertingSaveStateCompressed flag to public preview #​99935, @​alexander-akhmetov
• Alerting: Remove ID and OrgID from hash calculation #​100140, @​yuri-tceretian
• Alerting: Remove feature toggle alertingNoNormalState #​99905, @​yuri-tceretian
• Alerting: Remove rule group edit from single rule editor #​100191, @​gillesdemey
• Alerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist #​100264, @​fayzal-g
• Alerting: Rule history restore feature #​100609, @​soniaAguilarPeiron
• Alerting: Support Jira Integration #​100480, @​yuri-tceretian
• Alerting: Track if new gm rules are created with queries and expressions transformable to simple mode #​101121, @​soniaAguilarPeiron
• Alerting: Update IRM copies in Configuration Tracker #​100069, @​teodosii
• Alerting: Update design of rule details tab and add updated by #​99895, @​tomratcliffe
• Alerting: Update irm links for incident and oncall in case new irm plugin is present #​99952, @​soniaAguilarPeiron
• Alerting: Use exponential backoff in the remote Alertmanager readiness check #​99756, @​santihernandezc
• Alerting: Use uid instead of id in AnnotationsStateHistory #​101207, @​soniaAguilarPeiron
• Auth: Add IP address login attempt validation #​98123, @​colin-stuart
• Auth: Add support for the TlsSkipVerify parameter to JWT Auth #​91514, @​Ret2Me
• Auth: Make ssoSettingsSAML GA and enabled by default #​101766, @​mgyongyosi
• Azure Monitor: Filter namespaces by resource group #​100325, @​alyssabull
• Azure: Resource picker improvements #​101462, @​aangelisc
• Azure: Variable editor and resource picker improvements #​101695, @​alyssabull
• Badge: Add darkgrey color #​100699, @​Clarity-89
• Canvas: One click links and actions #​99616, @​adela-almasan
• Chore: Bump Go to 1.23.7 #​101576, @​macabu
• Chore: Bump Go to 1.23.7 (Enterprise)
• Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 #​102533, @​macabu
• Chore: Remove sqlQuerybuilderFunctionParameters feature toggle #​100809, @​zoltanbedi
• CloudWatch: Track Logs Insights query language #​100254, @​idastambuk
• Configuration tracker: Update copy in IRM and point to new IRM slack integration #​100440, @​teodosii
• Dashboard: Folder move unexpected behavior #​100394, @​yincongcyincong
• Dashboards: Allow custom quick time ranges specified in dashboard model #​93724, @​sknaumov
• Dashboards: Monitor dashboard loading performance #​99629, @​dprokop
• Dashboards: Remove default empty string from variable create view #​98922, @​yincongcyincong
• Dashboards: WeekStart is now of type WeekStart | undefined instead of string #​101123, @​oscarkilhed
• DesignSystem: Menu and popover styling update to use new elevated background token #​100255, @​torkelo
• Docker: Use our own glibc 2.40 binaries #​99903, @​DanCech
• Docs: Add a note on query caching for Cloudwatch datasource #​100180, @​idastambuk
• Drilldown: Require datasources:explore RBAC action #​101366, @​svennergr
• Elasticsearch: Remove frontend testDatasource method #​99894, @​idastambuk
• Elasticsearch: Replace level in adhoc filters with level field name #​100315, @​iwysiu
• Elasticsearch: Replace term size dropdown with text input #​99718, @​iwysiu
• Explore: Add hide_logs_download and hide button to download logs #​99512, @​svennergr
• Explore: Move drilldown apps from Explore to a new navbar item "Drilldown" #​100409, @​adrapereira
• ExploreMetrics: Add toggle to enable routing to externalized Explore Metrics app plugin #​99481, @​NWRichmond
• Feat: OSS connections page state filter and update all added #​100688, @​s4kh
• Features: Remove openSearchBackendFlowEnabled feature toggle #​99068, @​idastambuk
• Folders: Add validation that folder is not a parent of itself #​101569, @​stephaniehingtgen
• Geomap: WebGL for Marker Layer #​95457, @​drew08t
• Grafana/ui: Export UsersIndicator #​100698, @​Clarity-89
• Graphite: Compare query builder query to raw query #​101104, @​bossinc
• Histogram: Handle multiple native histograms #​98404, @​domasx2
• Image Renderer: Add support for SSL in plugin mode #​98009, @​nmarrs
• ImportDashboards: Use NestedFolderPicker #​99696, @​joshhunt
• Loki: Removal of Resolution in query editors #​101860, @​svennergr
• Menu: Uniform padding to make menu item hover state look better #​100275, @​torkelo
• MetricsDrilldown: Update name of queryless metrics experience #​100675, @​yangkb09
• MultiCombobox: Export from grafana/ui #​100368, @​Clarity-89
• NodeGraph: Improve view traces for uninstrumented services #​98442, @​edvard-falkskar
• PluginExtensions: Added support for sharing functions #​98888, @​theSuess
• PluginExtensions: Added support for sharing functions (Enterprise)
• PluginExtensions: Exposing registry meta for components returned via usePluginComponents #​100587, @​mckn
• Plugins: Improve plugin details UX for core plugins #​99830, @​oshirohugo
• Plugins: Remove managedPluginsInstall feature toggle #​100416, @​oshirohugo
• Plugins: Remove managedPluginsInstall feature toggle (Enterprise)
• Plugins: Remove uninstall plugin step from cli plugins update-all #​101632, @​oshirohugo
• Prometheus: Get the utcOffset value of timezone when it's specified #​99910, @​itsmylife
• Prometheus: Remove query assistant and related components #​100669, @​edwardcqian
• QueryOptions: Handle invalid time shift values #​101670, @​ivanortegaalba
• RBAC: Remove accessControlOnCall feature toggle #​101222, @​gamab
• RBAC: Remove accessControlOnCall feature toggle (Enterprise)
• Reporting: Add email subject support (Enterprise)
• Security: Update to Go 1.23.5 (Enterprise)
• Tempo: Support TraceQL instant metrics queries #​99732, @​joey-grafana
• Tempo: TraceQL metrics streaming #​99037, @​adrapereira
• Time regions: Add option for cron syntax to support complex schedules #​99548, @​leeoniya
• TimePicker: Ability to manually specify quick ranges #​101465, @​Sergej-Vlasov
• TimeRangePicker: Options list padding #​100343, @​torkelo
• TopNav: Move news into profile menu #​99535, @​bergquist
• Trace View: Add link from the Trace View to the Profiles Drilldown #​101422, @​joey-grafana
• Transformation: Add support for variables to ALL transformations #​100225, @​dprokop
• Transformations: Add round() to Unary mode of Add field from calc #​101295, @​leeoniya
• VizActions: Add confirmation message #​100012, @​adela-almasan
• grafana-ui: Update InlineField error prop type to React.ReactNode #​100347, @​Clarity-89

Bug fixes

• Alerting: Add error handling for missing data source #​101508, @​gillesdemey
• Alerting: Call RLock() before reading sendAlertsTo map #​99812, @​santihernandezc
• Alerting: Disable create rule menu item from panel when unifiedAlerting is disabled #​100701, @​soniaAguilarPeiron
• Alerting: Fix KeyValueMap input bug #​101367, @​soniaAguilarPeiron
• Alerting: Fix crash when invalid matcher is used in silence query params #​101500, @​gillesdemey
• Alerting: Fix evaluation of rules with no-op math expressions #​101436, @​moustafab
• Alerting: Fix exporting new rule with a new group #​101404, @​soniaAguilarPeiron
• Alerting: Fix fieldSelector encoding #​99751, @​gillesdemey
• Alerting: Fix inheritance of the timing options for policy tree #​99398, @​gillesdemey
• Alerting: Fix notification templates layout #​101232, @​gillesdemey
• Alerting: Fix state reason #​101530, @​yuri-tceretian
• Alerting: Fix token-based Slack image upload to work with channel names #​100988, @​JacobsonMT
• App Platform: Pin bleve to fix CVE-2022-31022 #​102531, @​Proximyst
• App: Fix web app behaviour on iOS #​100382, @​ashharrison90
• Auth: Fix AzureAD config UI's ClientAuthentication dropdown #​100752, @​mgyongyosi
• Auth: Fix redirect with JWT auth URL login #​100295, @​mgyongyosi
• AuthN: Refetch user on "ErrUserAlreadyExists" #​100346, @​kalleep
• Caching: Fix duplicate metric registration for cache size (Enterprise)
• CloudWatch: Fix condition for running annotation queries to require dimensions #​101660, @​kevinwcyu
• Combobox: Fix list not being virtualized initially in some cases #​100188, @​tskarhed
• Dashboard: Fix for overwriting an edited dashboard in the old architecture #​100247, @​bfmatei
• Dashboard: Fix the unintentional time range and variables updates on saving #​101475, @​harisrozajac
• Dashboard: Playlist - Fix issue with back button #​99401, @​yincongcyincong
• DashboardList: Throttle the re-renders #​99982, @​bfmatei
• Dashboards: Bring back scripted dashboards #​100575, @​dprokop
• Dashboards: Fix missing v/e/i keybindings to return back to dashboard #​102364, @​mdvictor
• Explore: Fix resizing split view with Loki query editor #​100257, @​ifrost
• ExploreMetrics: Fix escaping of regex metacharacters in label filters #​100513, @​NWRichmond
• Fix: Optimise frontend Postgresql plugin cache busting #​100406, @​jackw
• InfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL) #​100762, @​aangelisc
• Interval variable: Fix $__auto value behavior #​100479, @​yincongcyincong
• Log Context: Fix bug where variables are not replaced in dashboards #​100433, @​svennergr
• OpenTSDB: Support v2.4 #​100673, @​aangelisc
• PDF: Fix repeating panels when there are less items than maxPerRow (Enterprise)
• Plugin Metrics: Eliminate data race in plugin metrics middleware #​99396, @​clord
• Plugins: Fix update button behavior on downgrade #​101048, @​oshirohugo
• Plugins: Fix version tab breaking for non semantic version #​101225, @​oshirohugo
• PromLib: Take AdHoc filters into account when requesting suggestions without label #​101555, @​tskarhed
• Prometheus: Fix cursor jump in prometheus code editor #​100273, @​itsmylife
• Prometheus: Fix operator handling when making label expressions utf-8 friendly #​100475, @​NWRichmond
• Prometheus: Fix setting utcOffset when absolute time range is used #​101065, @​itsmylife
• RBAC: Don't check folder access if annotationPermissionUpdate FT is enabled #​99717, @​IevaVasiljeva
• SSO: Fix team_ids validation for Generic OAuth #​100732, @​dmihai
• Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows #​101776, @​IevaVasiljeva
• Share: Fix short links when root_url is different from the browser URL #​99950, @​AgnesToulet

Breaking changes

• Data source: Change Permissions for query to only have query and not read OR query (Enterprise)

Plugin development fixes & changes

• GrafanaUI: Deprecate Select in favor of Combobox #​100294, @​joshhunt
• Multi/Combobox: Use pointer cursor when not focused #​100878, @​tskarhed
• Slider: Fix text input box being too wide #​100138, @​joshhunt

v11.5.6: 11.5.6

Compare Source

Download page
What's new highlights

Bug fixes

• Security: Fixes CVE-2025-3415

v11.5.5: 11.5.5

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go version to 1.24.3 #​105109, @​macabu
• Dependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.3 to v2.5.0 #​105441, @​macabu
• Dependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12 #​105373, @​macabu
• Dependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0 #​105252, @​macabu

Bug fixes

• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.5.4: 11.5.4

Compare Source

Download page
What's new highlights

Features and enhancements

• Azure Monitor: Filter namespaces by resource group #​103654, @​alyssabull
• Azure: Add support for custom namespace and custom metrics variable queries #​103650, @​aangelisc
• Azure: Resource picker improvements #​103638, @​aangelisc
• Azure: Support more complex variable interpolation #​103651, @​aangelisc
• Azure: Variable editor and resource picker improvements #​103657, @​aangelisc
• Chore: Update CVE-affected dependencies #​102709, @​grambbledook
• DashboardScenePage: Correct slug in self referencing data links #​103853, @​Sergej-Vlasov
• Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 #​102865, @​macabu
• Go: Bump to 1.24.2 #​103525, @​Proximyst
• Go: Bump to 1.24.2 (Enterprise)
• Prometheus: Add support for cloud partners Prometheus data sources #​103942, @​kevinwcyu

Bug fixes

• InfluxDB: Fix nested variable interpolation #​104095, @​aangelisc
• LDAP test: Fix page crash #​102683, @​ashharrison90
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.5.3: 11.5.3

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go to 1.23.7 #​101581, @​macabu
• Chore: Bump Go to 1.23.7 (Enterprise)

Bug fixes

• Alerting: Fix token-based Slack image upload to work with channel names #​101078, @​JacobsonMT
• Auth: Fix AzureAD config UI's ClientAuthentication dropdown #​100869, @​mgyongyosi
• Dashboard: Fix the unintentional time range and variables updates on saving #​101671, @​harisrozajac
• Dashboards: Fix missing v/e/i keybindings to return back to dashboard #​102365, @​mdvictor
• InfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL) #​100977, @​aangelisc
• Org redirection: Fix linking between orgs #​102089, @​ashharrison90

v11.5.2: 11.5.2

Compare Source

Download page
What's new highlights

Features and enhancements

• Docker: Use our own glibc 2.40 binaries #​99918, @​DanCech
• TransformationFilter: Include transformation outputs in transformation filtering options #​99878, @​Sergej-Vlasov
• grafana-ui: Update InlineField error prop type to React.ReactNode #​100373, @​Clarity-89

Bug fixes

• Alerting: Allow specifying uid for new rules added to groups #​100450, @​yuri-tceretian
• Alerting: Allow specifying uid for new rules added to groups #​100450, @​yuri-tceretian
• Alerting: Call RLock() before reading sendAlertsTo map #​99880, @​santihernandezc
• Auth: Fix redirect with JWT auth URL login #​100355, @​mgyongyosi
• AuthN: Refetch user on "ErrUserAlreadyExists" #​100582, @​kalleep
• Azure: Correctly set application insights resource values #​99599, @​aangelisc
• CodeEditor: Fix cursor alignment #​99863, @​ashharrison90
• DashboardList: Throttle the re-renders #​100046, @​bfmatei
• Dashboards: Bring back scripted dashboards #​100633, @​dprokop
• Plugin Metrics: Eliminate data race in plugin metrics middleware #​100078, @​clord
• RBAC: Don't check folder access if annotationPermissionUpdate FT is enabled #​100117, @​IevaVasiljeva

v11.5.1: 11.5.1

Compare Source

Download page
What's new highlights

Bug fixes

• CodeEditor: Fix cursor alignment #​99090, @​ashharrison90
• TransformationFilter: Include transformation outputs in transformation filtering options: Include transformation outputs in transformation filtering options #​98323, @​Sergej-Vlasov

xyflow/xyflow (@​xyflow/react)

v12.7.1

Compare Source

Patch Changes

• #​5354 c4312d89 Thanks @​moklick! - Add TSDoc annotations

• #​5333 3d7e8b6b Thanks @​peterkogo! - Add missing type exports

• #​5353 4dd3ae66 Thanks @​aidanbarrett! - Add missing FinalConnectionState parameter to onReconnectEnd prop types

• Updated dependencies [c4312d89, 3d7e8b6b, 9c61000c]:

  • @​xyflow/system@​0.0.63

v12.7.0

Compare Source

Minor Changes

• #​5299 848b486b Thanks @​printerscanner! - Add ariaRole prop to nodes and edges

• #​5280 dba6faf2 Thanks @​moklick! - Improve typing for Nodes

• #​5276 6ce44a05 Thanks @​moklick! - Add an ease and interpolate option to all function that alter the viewport

• #​5277 f59730ce Thanks @​printerscanner! - Add ariaLabelConfig prop for customizing UI text like aria labels and descriptions.

• #​5317 09458f52 Thanks @​moklick! - Add domAttributes option for nodes and edges

• #​5326 050b511c Thanks @​peterkogo! - Prevent NodeResizer controls to become too small when zooming out

• #​5308 09fab679 Thanks @​printerscanner! - Focus nodes on tab if not within the viewport and add a new prop autoPanOnNodeFocus

Patch Changes

• Updated dependencies [848b486b, dba6faf2, 6ce44a05, f59730ce, 09458f52, 050b511c]:
  • @​xyflow/system@​0.0.62

v12.6.4

Compare Source

Patch Changes

• #​5263 e4a8d4b4 Thanks @​moklick! - Multi select key works when input is focused

• #​5266 77107453 Thanks @​peterkogo! - Fix connection snapping for handles larger than connectionRadius

• Updated dependencies [77107453]:

  • @​xyflow/system@​0.0.61

v12.6.3

Compare Source

Patch Changes

• #​5259 [77bf79c4](

---

Configuration

📅 Schedule: Branch creation - Between 06:00 AM and 10:59 AM, only on Monday ( * 6-10 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.