fix(deps): update npm dependencies (minor, patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@grafana/data (source)	11.5.0 -> 11.6.1
@grafana/ui (source)	11.5.0 -> 11.6.1
@svgr/webpack (source)	^8.0.1 -> ^8.1.0
@types/react-dom (source)	^18.3.5 -> ^18.3.6
@xyflow/react (source)	^12.4.4 -> ^12.6.0
dompurify	^3.2.4 -> ^3.2.5
postcss (source)	^8.4.31 -> ^8.5.3
typescript (source)	^5.8.2 -> ^5.8.3

---

Release Notes

grafana/grafana (@​grafana/data)

v11.6.1: 11.6.1

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Update JWT library (CVE-2025-30204) #​102727, @​grambbledook
• DashboardScenePage: Correct slug in self referencing data links #​103854, @​Sergej-Vlasov
• Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 #​102863, @​macabu
• Go: Bump to 1.24.2 #​103523, @​Proximyst
• Go: Bump to 1.24.2 (Enterprise)
• GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay #​102869, @​mthorning
• Prometheus: Add support for cloud partners Prometheus data sources #​103941, @​kevinwcyu

Bug fixes

• Alertmanager: Add Role-Based Access Control via reqAction Field #​103479, @​olegpixel
• GrafanaUI: Remove blurred background from overlay backdrops to improve performance #​103647, @​joshhunt
• InfluxDB: Fix nested variable interpolation #​104096, @​aangelisc
• LDAP test: Fix page crash #​102684, @​ashharrison90
• Org redirection: Fix linking between orgs #​102870, @​ashharrison90
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703
• Security: Fix CVE-2025-3260

v11.6.0: 11.6.0

Compare Source

Download page
What's new highlights

Features and enhancements

• API keys: Migrate API keys to service accounts at startup #​96924, @​dmihai
• AccessControl: Allow plugin roles to include plugins:write #​101089, @​gamab
• Alerting: Add DAG errors to alert rule creation and view #​99423, @​soniaAguilarPeiron
• Alerting: Add Jira integration to cloud AMs #​100482, @​soniaAguilarPeiron
• Alerting: Add alert rule version history - part1 #​99490, @​soniaAguilarPeiron
• Alerting: Add migration to clean up rule versions table #​102562, @​yuri-tceretian
• Alerting: Add multiple threshold operators #​99516, @​paulojmdias
• Alerting: Add tracking for the mode used in query and notifications step when c… #​100824, @​soniaAguilarPeiron
• Alerting: Adding color option for slack receiver #​99615, @​wymangr
• Alerting: Allow selection of recording rule write target on per-rule basis. #​101778, @​stevesg
• Alerting: Allow specifying uid for new rules added to groups #​99858, @​moustafab
• Alerting: Improve template testing by trying non-root scopes #​101471, @​JacobsonMT
• Alerting: Include time range in template dashboard and panel urls #​101095, @​JacobsonMT
• Alerting: Keep the latest version of deleted rule in version table #​101481, @​yuri-tceretian
• Alerting: Promote alertingSaveStateCompressed flag to public preview #​99935, @​alexander-akhmetov
• Alerting: Remove ID and OrgID from hash calculation #​100140, @​yuri-tceretian
• Alerting: Remove feature toggle alertingNoNormalState #​99905, @​yuri-tceretian
• Alerting: Remove rule group edit from single rule editor #​100191, @​gillesdemey
• Alerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist #​100264, @​fayzal-g
• Alerting: Rule history restore feature #​100609, @​soniaAguilarPeiron
• Alerting: Support Jira Integration #​100480, @​yuri-tceretian
• Alerting: Track if new gm rules are created with queries and expressions transformable to simple mode #​101121, @​soniaAguilarPeiron
• Alerting: Update IRM copies in Configuration Tracker #​100069, @​teodosii
• Alerting: Update design of rule details tab and add updated by #​99895, @​tomratcliffe
• Alerting: Update irm links for incident and oncall in case new irm plugin is present #​99952, @​soniaAguilarPeiron
• Alerting: Use exponential backoff in the remote Alertmanager readiness check #​99756, @​santihernandezc
• Alerting: Use uid instead of id in AnnotationsStateHistory #​101207, @​soniaAguilarPeiron
• Auth: Add IP address login attempt validation #​98123, @​colin-stuart
• Auth: Add support for the TlsSkipVerify parameter to JWT Auth #​91514, @​Ret2Me
• Auth: Make ssoSettingsSAML GA and enabled by default #​101766, @​mgyongyosi
• Azure Monitor: Filter namespaces by resource group #​100325, @​alyssabull
• Azure: Resource picker improvements #​101462, @​aangelisc
• Azure: Variable editor and resource picker improvements #​101695, @​alyssabull
• Badge: Add darkgrey color #​100699, @​Clarity-89
• Canvas: One click links and actions #​99616, @​adela-almasan
• Chore: Bump Go to 1.23.7 #​101576, @​macabu
• Chore: Bump Go to 1.23.7 (Enterprise)
• Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 #​102533, @​macabu
• Chore: Remove sqlQuerybuilderFunctionParameters feature toggle #​100809, @​zoltanbedi
• CloudWatch: Track Logs Insights query language #​100254, @​idastambuk
• Configuration tracker: Update copy in IRM and point to new IRM slack integration #​100440, @​teodosii
• Dashboard: Folder move unexpected behavior #​100394, @​yincongcyincong
• Dashboards: Allow custom quick time ranges specified in dashboard model #​93724, @​sknaumov
• Dashboards: Monitor dashboard loading performance #​99629, @​dprokop
• Dashboards: Remove default empty string from variable create view #​98922, @​yincongcyincong
• Dashboards: WeekStart is now of type WeekStart | undefined instead of string #​101123, @​oscarkilhed
• DesignSystem: Menu and popover styling update to use new elevated background token #​100255, @​torkelo
• Docker: Use our own glibc 2.40 binaries #​99903, @​DanCech
• Docs: Add a note on query caching for Cloudwatch datasource #​100180, @​idastambuk
• Drilldown: Require datasources:explore RBAC action #​101366, @​svennergr
• Elasticsearch: Remove frontend testDatasource method #​99894, @​idastambuk
• Elasticsearch: Replace level in adhoc filters with level field name #​100315, @​iwysiu
• Elasticsearch: Replace term size dropdown with text input #​99718, @​iwysiu
• Explore: Add hide_logs_download and hide button to download logs #​99512, @​svennergr
• Explore: Move drilldown apps from Explore to a new navbar item "Drilldown" #​100409, @​adrapereira
• ExploreMetrics: Add toggle to enable routing to externalized Explore Metrics app plugin #​99481, @​NWRichmond
• Feat: OSS connections page state filter and update all added #​100688, @​s4kh
• Features: Remove openSearchBackendFlowEnabled feature toggle #​99068, @​idastambuk
• Folders: Add validation that folder is not a parent of itself #​101569, @​stephaniehingtgen
• Geomap: WebGL for Marker Layer #​95457, @​drew08t
• Grafana/ui: Export UsersIndicator #​100698, @​Clarity-89
• Graphite: Compare query builder query to raw query #​101104, @​bossinc
• Histogram: Handle multiple native histograms #​98404, @​domasx2
• Image Renderer: Add support for SSL in plugin mode #​98009, @​nmarrs
• ImportDashboards: Use NestedFolderPicker #​99696, @​joshhunt
• Loki: Removal of Resolution in query editors #​101860, @​svennergr
• Menu: Uniform padding to make menu item hover state look better #​100275, @​torkelo
• MetricsDrilldown: Update name of queryless metrics experience #​100675, @​yangkb09
• MultiCombobox: Export from grafana/ui #​100368, @​Clarity-89
• NodeGraph: Improve view traces for uninstrumented services #​98442, @​edvard-falkskar
• PluginExtensions: Added support for sharing functions #​98888, @​theSuess
• PluginExtensions: Added support for sharing functions (Enterprise)
• PluginExtensions: Exposing registry meta for components returned via usePluginComponents #​100587, @​mckn
• Plugins: Improve plugin details UX for core plugins #​99830, @​oshirohugo
• Plugins: Remove managedPluginsInstall feature toggle #​100416, @​oshirohugo
• Plugins: Remove managedPluginsInstall feature toggle (Enterprise)
• Plugins: Remove uninstall plugin step from cli plugins update-all #​101632, @​oshirohugo
• Prometheus: Get the utcOffset value of timezone when it's specified #​99910, @​itsmylife
• Prometheus: Remove query assistant and related components #​100669, @​edwardcqian
• QueryOptions: Handle invalid time shift values #​101670, @​ivanortegaalba
• RBAC: Remove accessControlOnCall feature toggle #​101222, @​gamab
• RBAC: Remove accessControlOnCall feature toggle (Enterprise)
• Reporting: Add email subject support (Enterprise)
• Security: Update to Go 1.23.5 (Enterprise)
• Tempo: Support TraceQL instant metrics queries #​99732, @​joey-grafana
• Tempo: TraceQL metrics streaming #​99037, @​adrapereira
• Time regions: Add option for cron syntax to support complex schedules #​99548, @​leeoniya
• TimePicker: Ability to manually specify quick ranges #​101465, @​Sergej-Vlasov
• TimeRangePicker: Options list padding #​100343, @​torkelo
• TopNav: Move news into profile menu #​99535, @​bergquist
• Trace View: Add link from the Trace View to the Profiles Drilldown #​101422, @​joey-grafana
• Transformation: Add support for variables to ALL transformations #​100225, @​dprokop
• Transformations: Add round() to Unary mode of Add field from calc #​101295, @​leeoniya
• VizActions: Add confirmation message #​100012, @​adela-almasan
• grafana-ui: Update InlineField error prop type to React.ReactNode #​100347, @​Clarity-89

Bug fixes

• Alerting: Add error handling for missing data source #​101508, @​gillesdemey
• Alerting: Call RLock() before reading sendAlertsTo map #​99812, @​santihernandezc
• Alerting: Disable create rule menu item from panel when unifiedAlerting is disabled #​100701, @​soniaAguilarPeiron
• Alerting: Fix KeyValueMap input bug #​101367, @​soniaAguilarPeiron
• Alerting: Fix crash when invalid matcher is used in silence query params #​101500, @​gillesdemey
• Alerting: Fix evaluation of rules with no-op math expressions #​101436, @​moustafab
• Alerting: Fix exporting new rule with a new group #​101404, @​soniaAguilarPeiron
• Alerting: Fix fieldSelector encoding #​99751, @​gillesdemey
• Alerting: Fix inheritance of the timing options for policy tree #​99398, @​gillesdemey
• Alerting: Fix notification templates layout #​101232, @​gillesdemey
• Alerting: Fix state reason #​101530, @​yuri-tceretian
• Alerting: Fix token-based Slack image upload to work with channel names #​100988, @​JacobsonMT
• App Platform: Pin bleve to fix CVE-2022-31022 #​102531, @​Proximyst
• App: Fix web app behaviour on iOS #​100382, @​ashharrison90
• Auth: Fix AzureAD config UI's ClientAuthentication dropdown #​100752, @​mgyongyosi
• Auth: Fix redirect with JWT auth URL login #​100295, @​mgyongyosi
• AuthN: Refetch user on "ErrUserAlreadyExists" #​100346, @​kalleep
• Caching: Fix duplicate metric registration for cache size (Enterprise)
• CloudWatch: Fix condition for running annotation queries to require dimensions #​101660, @​kevinwcyu
• Combobox: Fix list not being virtualized initially in some cases #​100188, @​tskarhed
• Dashboard: Fix for overwriting an edited dashboard in the old architecture #​100247, @​bfmatei
• Dashboard: Fix the unintentional time range and variables updates on saving #​101475, @​harisrozajac
• Dashboard: Playlist - Fix issue with back button #​99401, @​yincongcyincong
• DashboardList: Throttle the re-renders #​99982, @​bfmatei
• Dashboards: Bring back scripted dashboards #​100575, @​dprokop
• Dashboards: Fix missing v/e/i keybindings to return back to dashboard #​102364, @​mdvictor
• Explore: Fix resizing split view with Loki query editor #​100257, @​ifrost
• ExploreMetrics: Fix escaping of regex metacharacters in label filters #​100513, @​NWRichmond
• Fix: Optimise frontend Postgresql plugin cache busting #​100406, @​jackw
• InfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL) #​100762, @​aangelisc
• Interval variable: Fix $__auto value behavior #​100479, @​yincongcyincong
• Log Context: Fix bug where variables are not replaced in dashboards #​100433, @​svennergr
• OpenTSDB: Support v2.4 #​100673, @​aangelisc
• PDF: Fix repeating panels when there are less items than maxPerRow (Enterprise)
• Plugin Metrics: Eliminate data race in plugin metrics middleware #​99396, @​clord
• Plugins: Fix update button behavior on downgrade #​101048, @​oshirohugo
• Plugins: Fix version tab breaking for non semantic version #​101225, @​oshirohugo
• PromLib: Take AdHoc filters into account when requesting suggestions without label #​101555, @​tskarhed
• Prometheus: Fix cursor jump in prometheus code editor #​100273, @​itsmylife
• Prometheus: Fix operator handling when making label expressions utf-8 friendly #​100475, @​NWRichmond
• Prometheus: Fix setting utcOffset when absolute time range is used #​101065, @​itsmylife
• RBAC: Don't check folder access if annotationPermissionUpdate FT is enabled #​99717, @​IevaVasiljeva
• SSO: Fix team_ids validation for Generic OAuth #​100732, @​dmihai
• Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows #​101776, @​IevaVasiljeva
• Share: Fix short links when root_url is different from the browser URL #​99950, @​AgnesToulet

Breaking changes

• Data source: Change Permissions for query to only have query and not read OR query (Enterprise)

Plugin development fixes & changes

• GrafanaUI: Deprecate Select in favor of Combobox #​100294, @​joshhunt
• Multi/Combobox: Use pointer cursor when not focused #​100878, @​tskarhed
• Slider: Fix text input box being too wide #​100138, @​joshhunt

v11.5.4: 11.5.4

Compare Source

Download page
What's new highlights

Features and enhancements

• Azure Monitor: Filter namespaces by resource group #​103654, @​alyssabull
• Azure: Add support for custom namespace and custom metrics variable queries #​103650, @​aangelisc
• Azure: Resource picker improvements #​103638, @​aangelisc
• Azure: Support more complex variable interpolation #​103651, @​aangelisc
• Azure: Variable editor and resource picker improvements #​103657, @​aangelisc
• Chore: Update CVE-affected dependencies #​102709, @​grambbledook
• DashboardScenePage: Correct slug in self referencing data links #​103853, @​Sergej-Vlasov
• Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 #​102865, @​macabu
• Go: Bump to 1.24.2 #​103525, @​Proximyst
• Go: Bump to 1.24.2 (Enterprise)
• Prometheus: Add support for cloud partners Prometheus data sources #​103942, @​kevinwcyu

Bug fixes

• InfluxDB: Fix nested variable interpolation #​104095, @​aangelisc
• LDAP test: Fix page crash #​102683, @​ashharrison90
• Security: Fix CVE-2025-3454
• Security: Fix CVE-2025-2703

v11.5.3: 11.5.3

Compare Source

Download page
What's new highlights

Features and enhancements

• Chore: Bump Go to 1.23.7 #​101581, @​macabu
• Chore: Bump Go to 1.23.7 (Enterprise)

Bug fixes

• Alerting: Fix token-based Slack image upload to work with channel names #​101078, @​JacobsonMT
• Auth: Fix AzureAD config UI's ClientAuthentication dropdown #​100869, @​mgyongyosi
• Dashboard: Fix the unintentional time range and variables updates on saving #​101671, @​harisrozajac
• Dashboards: Fix missing v/e/i keybindings to return back to dashboard #​102365, @​mdvictor
• InfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL) #​100977, @​aangelisc
• Org redirection: Fix linking between orgs #​102089, @​ashharrison90

v11.5.2: 11.5.2

Compare Source

Download page
What's new highlights

Features and enhancements

• Docker: Use our own glibc 2.40 binaries #​99918, @​DanCech
• TransformationFilter: Include transformation outputs in transformation filtering options #​99878, @​Sergej-Vlasov
• grafana-ui: Update InlineField error prop type to React.ReactNode #​100373, @​Clarity-89

Bug fixes

• Alerting: Allow specifying uid for new rules added to groups #​100450, @​yuri-tceretian
• Alerting: Allow specifying uid for new rules added to groups #​100450, @​yuri-tceretian
• Alerting: Call RLock() before reading sendAlertsTo map #​99880, @​santihernandezc
• Auth: Fix redirect with JWT auth URL login #​100355, @​mgyongyosi
• AuthN: Refetch user on "ErrUserAlreadyExists" #​100582, @​kalleep
• Azure: Correctly set application insights resource values #​99599, @​aangelisc
• CodeEditor: Fix cursor alignment #​99863, @​ashharrison90
• DashboardList: Throttle the re-renders #​100046, @​bfmatei
• Dashboards: Bring back scripted dashboards #​100633, @​dprokop
• Plugin Metrics: Eliminate data race in plugin metrics middleware #​100078, @​clord
• RBAC: Don't check folder access if annotationPermissionUpdate FT is enabled #​100117, @​IevaVasiljeva

v11.5.1: 11.5.1

Compare Source

Download page
What's new highlights

Bug fixes

• CodeEditor: Fix cursor alignment #​99090, @​ashharrison90
• TransformationFilter: Include transformation outputs in transformation filtering options: Include transformation outputs in transformation filtering options #​98323, @​Sergej-Vlasov

xyflow/xyflow (@​xyflow/react)

v12.6.0

Compare Source

Minor Changes

• #​5219 4236adbc Thanks @​moklick! - Add initialMinZoom, initialMaxZoom and initialFitViewOptions to ReactFlowProvider

• #​5227 a7d10ffc Thanks @​moklick! - Add resizeDirection prop for the NodeResizeControl component

Patch Changes

• #​5217 bce74e88 Thanks @​moklick! - Keep node seleciton on pane click if elementsSelectable=false

• Updated dependencies [a7d10ffc, 4e681f9c]:

  • @​xyflow/system@​0.0.57

v12.5.6

Compare Source

Patch Changes

• #​5212 0f43b8ea Thanks @​moklick! - Add polyfill for Promise.withResolvers

• #​5192 fc241253 Thanks @​peterkogo! - Optimize performance of nodesInitialized

• #​5196 7f902db4 Thanks @​moklick! - Hide edge marker and attribution for screenreaders

• #​5213 78782c16 Thanks @​moklick! - Do not trigger selection events if elementsSelectable=false

• #​5191 e5735b51 Thanks @​peterkogo! - Fix legacy padding being slightly larger than before

• Updated dependencies [0f43b8ea, fc241253, 98fe23c7, e5735b51]:

  • @​xyflow/system@​0.0.56

v12.5.5

Compare Source

Patch Changes

• #​5172 e6139a00 Thanks @​dimaMachina! - Improve TSDoc comments for useNodesData, useReactFlow, isNode and isEdge

• #​5165 d536abea Thanks @​dimaMachina! - Improve TSDoc comments for useViewport, useUpdateNodeInternals, useOnSelectionChange, useNodesInitialized hooks and UseOnSelectionChangeOptions, UseNodesInitializedOptions types

• #​5171 62d87409 Thanks @​dimaMachina! - Improve TSDoc comments for ReactFlowProps

• #​5154 d0237166 Thanks @​ibagov! - Improve TSDoc comments for onNodesChange

• #​5174 ae585d13 Thanks @​dimaMachina! - Improve TSDoc comments for BaseEdgeProps

• #​5159 0c1436d6 Thanks @​dimaMachina! - Improve TSDoc comments for useConnection hook

• #​5167 934ea42d Thanks @​dimaMachina! - Improve TSDoc comments for useEdges, useInternalNode, useNodes and useNodeId hooks

• #​5163 ab800054 Thanks @​dimaMachina! - Improve TSDoc comments for useNodesState and useEdgesState hook

• #​5160 b357f43d Thanks @​dimaMachina! - Improve TSDoc comments for type UseHandleConnectionsParams and useHandleConnections hook

• #​5162 29f4aeb2 Thanks @​dimaMachina! - Improve TSDoc comments for type UseNodeConnectionsParams and useNodeConnections hook

• #​5164 09021550 Thanks @​dimaMachina! - Improve TSDoc comments for type UseOnViewportChangeOptions and useOnViewportChange hook

• #​5166 701ad17e Thanks @​dimaMachina! - Improve TSDoc comments for useStore hook

• #​5170 eb2a33c6 Thanks @​dimaMachina! - Improve TSDoc comments for interface GetSimpleBezierPathParams and getSimpleBezierPath

• #​5161 c4efe749 Thanks @​dimaMachina! - Improve TSDoc comments for type UseKeyPressOptions and useKeyPress hook

• Updated dependencies [02a3b746, cbe305e1, 1f671bd4, aaebc462, 6ec942fc]:

  • @​xyflow/system@​0.0.55

v12.5.4

Compare Source

Patch Changes

• #​5134 7acab1e1 Thanks @​dimaMachina! - Adjust @default TSDoc tags for BackgroundProps

• #​5135 754a1671 Thanks @​dimaMachina! - Improve TSDoc comments for NodeResizerProps and ResizeControlProps

• #​5140 82e6860e Thanks @​dimaMachina! - Improve TSDoc comments for MiniMapProps and PanelProps

• #​5147 f819005b Thanks @​moklick! - Pass dimensions to final resize change event

• #​5143 b1e1cc11 Thanks @​dimaMachina! - Improve TSDoc comments for ReactFlowInstance and GeneralHelpers

• #​5138 d4eb8d52 Thanks @​dimaMachina! - Improve TSDoc comments for ViewportHelperFunctions and NodeToolbarProps

• #​5144 5a1ce56e Thanks @​dimaMachina! - Compare nodeStrokeWidth with number, not with string within MiniMap

• #​5141 06cf4c10 Thanks @​dimaMachina! - Improve TSDoc comments for Edge, BaseEdgeProps and ConnectionLineComponentProps

• Updated dependencies [f819005b, 24a1bc89, 36657cd6, [89de9ca8](https://redirect.github.com/xyflow/xyflow/commit/89de9ca83fbf9263a687a0f5f915e

---

Configuration

📅 Schedule: Branch creation - Between 06:00 AM and 10:59 AM, only on Monday ( * 6-10 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.