• [f8bdcd54ed] - deps: V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249
• [3b93fd6b2b] - deps: V8: backport 1a0089053443 (Jakob Linke) #65764
• [5aaf62faaa] - deps: V8: backport c9c0abfa51f0 (Jakob Linke) #65764
• [3b8eb1a920] - deps: V8: backport ebd15783b7ba (Marja Hölttä) #65764
• [ab70b5d681] - deps: V8: cherry-pick 853553fe755c (Victor Gomes) #66241
• [17ec999f24] - stream: keep async context of parked writes (Matteo Collina) #66907

• [CHANGE] API: The experimental search endpoints now clamp batch_size to 1000. (#19731, @roidelapluie)
• [CHANGE] Configuration: Default --web.external-url to https when --web.config.file enables TLS. (#19241, @hexonal)
• [CHANGE] PromQL: Subquery samples are now included in the query TotalSamples and TotalSamplesPerStep statistics, and SamplesRead now counts reads from subqueries with an @ modifier in range queries. (#19165, @DanCech)
• [CHANGE] Remote write: Stop exposing the deprecated prometheus_remote_storage_metadata_total, prometheus_remote_storage_metadata_failed_total, prometheus_remote_storage_metadata_retried_total, and prometheus_remote_storage_metadata_bytes_total metrics for Remote Write 2.0 queues. (#20080, @shilohlee98)
• [CHANGE] Remote write receiver: Count Remote Write 2.x samples and histograms ingested without metadata in prometheus_api_remote_write_without_metadata_appended_samples_total even when metadata-wal-records is disabled. (#19812, @bwplotka)
• [CHANGE] TSDB: Reject exemplars whose label names are not unique, instead of storing them and serving a duplicate JSON key from /api/v1/query_exemplars. (#19896, @Ramya-9353)
• [FEATURE] API: Allow overriding PromQL Start Timestamp processing on a per-query basis using the X-Prometheus-Use-Start-Timestamps HTTP header. (#19066, @69iqqq)
• [FEATURE] Agent: Support metadata-wal-records in Prometheus Agent mode. (#19684, @bwplotka)
• [FEATURE] PromQL: Add experimental integral() function for computing integral-over-time of range vectors behind the --enable-feature=promql-experimental-functions flag. (#14440, @jjo)
• [FEATURE] PromQL: Add experimental query cost estimation, actual cost reporting, and configurable execution limits, enabled with --enable-feature=query-cost. (#20028, @roidelapluie)
• [FEATURE] PromQL: Smoothed and Anchored vector selectors are now stable and always-on. (#19697, @roidelapluie)
• [FEATURE] PromQL: Use start timestamps to detect counter resets when float timeseries are queried using extended range selector modifiers (anchored, smoothed). This feature is hidden behind use-start-timestamps feature flag. (#18966, @vpranckaitis)
• [FEATURE] Promtool: print test filename during promtool tests (#18271, @dnwe)
• [FEATURE] PromQL: Allow unquoted Unicode letters and dots behind a feature flag (#20162, @roidelapluie)
• [ENHANCEMENT] Search API: Warn when participating remote-read storage does not support search. (#19992, @aknuds1)
• [ENHANCEMENT] Remote Read: Add native histogram prometheus_remote_read_handler_gate_wait_duration_seconds to measure concurrency-gate wait duration, including requests canceled while waiting. (#18355, @ogulcanaydogan)
• [ENHANCEMENT] Remote Write: Add experimental flag convert_nhcb_to_classic to convert NHCB to classic histograms for external systems that dont support NHCBs. (#17205, @Naman-B-Parlecha)
• [ENHANCEMENT] promtool: Add --allow-incompatible-block-duration so users can specify any max-block-duration instead of being restricted to the default Prometheus block durations. (#19363, @sarthaksarthak9)
• [PERF] Remote write: Cache repeated OTLP histogram metric names. (#19717, @perfloop-agent)
• [PERF] OpenMetrics 2.0 parser: Reuse classic histogram and summary expansion buffers across scrapes. (#19907, @bwplotka)
• [PERF] PromQL: Decode only histogram sum/count (not buckets) for timestamp(), start_timestamp() and absent(). (#19738, @linasm)
• [PERF] PromQL: Only select the fixed window for subqueries with an @ modifier. (#19863, @roidelapluie)
• [PERF] Remote write / TSDB: Deduplicate per-series metadata structs in memory with unique.Handle. (#20040, @bwplotka)
• [PERF] Scrape: Avoid some copies of scrape response bodies. (#19394, @shubhgupta2104)
• [PERF] TSDB: Improve XOR2 compression and append performance by selecting value windows based on encoding cost. (#19962, @roidelapluie)
• [PERF] TSDB: Reduce memory used writing and reading checkpoint metadata records. (#19712, @kgeckhart)
• [PERF] Scrape: Convert classic histograms to NHCB directly in the OpenMetrics 2.0 parser without wrapping in NHCBParser. (#19880, @bwplotka)
• [PERF] Scrape: Reduce OpenMetrics 2.0 parser allocations and CPU overhead by lazily constructing composite series and exemplar labels. (#19895, @bwplotka)
• [BUGFIX] Remote read: Abort failed streaming responses without writing duplicate headers or appending plain-text errors to the protobuf stream (#19749, @aknuds1)
• [BUGFIX] TSDB: Fix loss of out-of-order samples when a WAL checkpoint drops a series record that the out-of-order write-behind log still needs (#19737, @replay)
• [BUGFIX] TSDB: Fix queries that seek within a head chunk returning samples committed after the query started (#19854, @aknuds1)
• [BUGFIX] TSDB: Preserve mapped chunks when WAL replay merges multiple references for the same series, preventing missing out-of-order samples and duplicate in-order chunks after restart (#19805, @dmatth1)
• [BUGFIX] Fix auto-reload logic to reload after reverting a failed configuration change (#19838, @eholzbach)
• [BUGFIX] API: Do not match metric family metadata for doubled _total and _info suffixes in experimental search API. (#19910, @tcp13equals2)
• [BUGFIX] API: Reject timeout and lookback_delta values that overflow int64 instead of turning them into a negative duration (#19658, @youdie006)
• [BUGFIX] API: Resolve metric family metadata for suffixed metric names in search results, in experimental search API. (#19824, @roidelapluie)
• [BUGFIX] AWS SD: Describe each ElastiCache cluster once instead of twice for clusters that are not replication group members. (#19434, @ekalinin)
• [BUGFIX] Build: Allow installing promtool with version-suffixed go install commands (#19754, @aknuds1)
• [BUGFIX] Discovery: Fix a panic in Azure service discovery when a VM tag has a null value. (#19755, @shoemoney)
• [BUGFIX] Federation: fix corruption of float native histograms. (#19679, @MichaHoffmann)
• [BUGFIX] Fix ts_of_last_over_time for samples before the Unix epoch. (#19828, @fallintoplace)
• [BUGFIX] Histograms: Fix ConvertNHCBToClassic inflating classic bucket counts for integer native histograms whose spans have gaps. (#19659, @youdie006)
• [BUGFIX] Logging: Preserve rule and TSDB block values in JSON logs. (#19572, @shilohlee98)
• [BUGFIX] OTLP receiver: Drop exemplars with timestamps more than 10 minutes in the future instead of storing them and blocking subsequent exemplars for that series. (#19812, @bwplotka)
• [BUGFIX] OTLP: Count only out-of-order exemplars in prometheus_api_otlp_out_of_order_exemplars_total, not every rejected exemplar. (#20030, @aknuds1)
• [BUGFIX] OTLP: Do not drop exemplars that have a trace_id or span_id filtered attribute in addition to a trace or span ID. The trace context now takes precedence over the colliding attribute, as required by the OpenTelemetry specification. (#20004, @krajorama)
• [BUGFIX] OTLP: Do not emit le="+Inf" twice when a histogram's explicit bounds end at +Inf, and warn about the bound. (#19425, @serhiy-bzhezytskyy)
• [BUGFIX] OTLP: Stop dropping exemplars that arrive out of timestamp order within a data point. (#20029, @aknuds1)
• [BUGFIX] OpenMetrics 2.0: Attach histogram exemplars to matching classic _bucket series and preserve them when scraping both native and classic histograms. (#20020, @dashpole)
• [BUGFIX] PromQL: Avoid intermediate overflow in rad() and deg() conversions. (#19901, @fallintoplace)
• [BUGFIX] PromQL: Consistently ignore and drop __type__ and __unit__ labels in without aggregations, absent(), info(), and binary operator fill matching. (#19986, @dashpole)
• [BUGFIX] PromQL: Do not panic when printing the partial AST returned alongside a parse error. (#19797, @zenador)
• [BUGFIX] PromQL: Drop type and unit in binary operations so they are transparent to users, similar to how name is handled. (#18680, @iam-prane-eth)
• [BUGFIX] PromQL: Fix ==, !=, changes() and count_values on native histograms giving wrong results inside histogram_count(), histogram_sum() and histogram_avg(). (#20024, @linasm)
• [BUGFIX] PromQL: Fix histogram_fraction returning wrong results for native histograms with custom buckets when a bucket boundary is exactly 0. (#19657, @youdie006)
• [BUGFIX] PromQL: Fix histogram_quantile and histogram_quantiles interpolating within the wrong bucket for native histograms whose sum is NaN. (#19973, @bhabishnu)
• [BUGFIX] PromQL: Fix lexing of subqueries whose range is a duration keyword expression, e.g. foo[range():1s]. (#19729, @roidelapluie)
• [BUGFIX] PromQL: Fix warning and error locations for duration expressions min_of and max_of. (#19742, @roidelapluie)
• [BUGFIX] PromQL: Ignore NaN classic histogram bucket boundaries in histogram_quantile, histogram_quantiles and histogram_fraction and return correct value instead of NaN if there are normal buckets. (#20057, @fallintoplace)
• [BUGFIX] PromQL: Preserve infinite values at exact quantile ranks. (#19899, @fallintoplace)
• [BUGFIX] PromQL: Preserve original operand sides for experimental fill modifiers with group_right matching. (#19939, @inanna-malick)
• [BUGFIX] PromQL: Preserve subquery step expressions when printing queries after preprocessing. (#19743, @roidelapluie)
• [BUGFIX] PromQL: Range vector functions no longer raise a spurious "vector cannot contain metrics with the same labelset" error when series have different metric names but the same remaining labels, as long as their timestamps do not overlap within the evaluated range window (#18631, @kasharkzy)
• [BUGFIX] PromQL: do not count subquery materialized samples in total samples statistics (#19873, @roidelapluie)
• [BUGFIX] Remote write: Prevent future-dated exemplars from scaling shards down to the minimum. (#19866, @thampiotr)
• [BUGFIX] Agent: Prevent future sent timestamps from advancing WAL truncation beyond the minimum retention window. (#19866, @thampiotr)
• [BUGFIX] Rules: Restore firing alerts with for durations shorter than --rules.alert.for-grace-period after a restart. (#19882, @ajaykr0905)
• [BUGFIX] Scrape: fix failing scrape when float histogram is emitted over protobuf with count, zero count and buckets all zero, for example a result of recording rate(x[1m]) over constant histogram. (#19682, @MichaHoffmann)
• [BUGFIX] Search API: Return the lexically smallest label values when limit is set on /api/v1/search/label_values, instead of an arbitrary subset (#19694, @tcp13equals2)
• [BUGFIX] TSDB: Fix WAL watcher permanently skipping checkpoint series garbage collection when lagging behind head truncation. (#20041, @bwplotka)
• [BUGFIX] Search API: Avoid panics when the requested time range has no participating storage. (#19992, @aknuds1)
• [BUGFIX] TSDB: Fix a race in selected-series and stale-series compaction where a sample committed after the block was written but before the series was evicted from the head could be silently lost. The fix no longer depends on isolation being enabled. (#19666, @duricanikolic)
• [BUGFIX] TSDB: Fix a rare case where a sample could be lost during selected-series or stale-series compaction if an unrelated write to the same series ran cleanup that erased the evidence needed to protect it. (#19672, @duricanikolic)
• [BUGFIX] TSDB: Fix spurious "unknown series references" warnings during WAL replay after a restart, when the only blocks on disk were produced by selected-series or stale-series compaction. (#19734, @duricanikolic)
• [BUGFIX] TSDB: Increment prometheus_tsdb_wal_corruptions_total when WAL corruption is detected during checkpoint creation, so the metric reflects corruption found at compaction time rather than only after a restart-triggered repair. (#19858, @mstinsky)
• [BUGFIX] TSDB: Preserve series identities needed to recover exemplars after compaction and restart. (#19940, @duricanikolic)
• [BUGFIX] TSDB: Reject native histograms whose span offsets overflow the int32 bucket index instead of storing them with corrupted buckets. (#20034, @Ramya-9353)
• [BUGFIX] TSDB: fix no passing metadata-wal-records to TSDB from main feature flag. (#19678, @krajorama)
• [BUGFIX] Templates: Preserve IPv6 addresses with dotted zone identifiers in stripDomain. (#19908, @ItsRoy69)
• [BUGFIX] UI: Don't automatically open an autocomplete dropdown after closing a function call body or aggregation operator with a closing parenthesis. (#19825, @juliusv)
• [BUGFIX] Web: Fix HTTP/2 negotiation silently falling back to HTTP/1.1 under Go 1.27+ when TLS is enabled with http2: true. The server now correctly advertises h2 via ALPN and multiplexes concurrent requests over a single connection. (#19848, @dongjiang1989)
• [BUGFIX] mixin: Fix double-counting of failed samples in the PrometheusRemoteStorageFailures alert denominator. (#19877, @nikhilsaxena04)
• [BUGFIX] promtool: Honor --enable-feature when evaluating rules in test rules. (#20046, @dennisme)
• [BUGFIX] Scrape: Ensure UTF-8 works with the experimental OpenMetrics 2.0 (#19902, @bwplotka)
• [BUGFIX] Scrape: Reject sum-only classic histograms during NHCB conversion (#19315, @shubhgupta2104)

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tursodatabase/turso/releases/download/v0.9.0-pre.2/turso_cli-installer.sh | sh

powershell -ExecutionPolicy Bypass -c "irm https://github.com/tursodatabase/turso/releases/download/v0.9.0-pre.2/turso_cli-installer.ps1 | iex"

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo tursodatabase/turso

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

This release marks the transition of Node.js 26.x into Long Term Support (LTS) with the codename 'Lithium'. It will continue to receive updates through to the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24 or 22 or earlier) please note that since Node.js 25 the official binaries for Linux are linked against libatomic, which may need to be installed separately depending on your Linux distribution.

Download page What's new highlights

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-103506
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967

• Git Sync: Ignore hidden paths in repository scans and diffs #135028, @ferruvich
• Provisioning: Default save from a branch preview to the previewed branch #135174, @Clarity-89
• Provisioning: Never replace the repository root folder during incremental sync #135463, @ferruvich

• Plugins: Don't report loaded plugins as not registered when a request times out #135665, @leventebalogh
• Provisioning: Fix PR dashboard previews when served from a sub-path #135559, @gustaff-weldon

Download page What's new highlights

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967

• Provisioning: Default save from a branch preview to the previewed branch #135173, @Clarity-89

Download page What's new highlights

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967

• Provisioning: Default save from a branch preview to the previewed branch #135175, @Clarity-89

Download page What's new highlights

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967

Download page What's new highlights

• Security: Fix CVE-2026-100105
• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-81841
• Security: Fix CVE-2026-88858
• Security: Fix CVE-2026-88967
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

• Access control: reject global role creation in single-org mode (Enterprise)
• Alerting: Add AccessControlAction entries for inhibition rules #130977, @rodrigopk
• Alerting: Add notifications API boundary module #134537, @rodrigopk
• Alerting: Add the Config API data layer for external Alertmanager auto-sync #129478, @rodrigopk
• Alerting: Allow drag and drop for yaml file as import source for import wizard #132705, @rodrigopk
• Alerting: Cleanup promote staged config code #130974, @rodrigopk
• Alerting: Disable datasource picker while an import is staged #133181, @rodrigopk
• Alerting: Make stage default import method in GMA import wizard #130634, @rodrigopk
• Alerting: Make the Import wizard review step preview look clickable #132711, @rodrigopk
• Alerting: Migrate the Import-to-GMA wizard's auto-sync integration #131523, @rodrigopk
• Alerting: Migrate the auto-sync settings hook and panel onto the Config API #131521, @rodrigopk
• Alerting: Promote AlertRule, RecordingRule and RuleSequence to v1beta1 #134883, @moustafab
• Alerting: Promote a staged import configuration #130327, @rodrigopk
• Alerting: Read staged config origin from the managed_by field #130787, @rodrigopk
• Alerting: Redact secrets from the Import-to-GMA preview modal #132827, @rodrigopk
• Alerting: Refactor useIsAutoSyncActive onto the shared Config-API helpers #131520, @rodrigopk
• Alerting: Remove import method from import to GMA wizard #130609, @rodrigopk
• Alerting: Retire the legacy admin_config auto-sync path #131524, @rodrigopk
• Alerting: Show Auto-sync support in the import wizard picker #131084, @rodrigopk
• Alerting: Support Mimir alertmanager_config files in Import to GMA wizard #135637, @rodrigopk
• Alerting: Surface external Alertmanager sync health in the settings UI #131527, @rodrigopk
• Alerting: stop auto-sync from force-skipping the Rules step in the GMA import wizard #131072, @rodrigopk
• Auth: Bound OAuth token refresh lock waits by time instead of attempts #133929, @cinaglia
• Canvas: Load the standalone plugin by default #134873, @gtk-grafana
• Chore: Upgrade to k8s v0.37.0 (and grafana-app-sdk v0.60.0) #132571, @stevesg
• Dashboard: Adds new a subtitle option for panel descriptions #129164, @torkelo
• Dashboard: Fall back when collection deletion is unsupported #128259, @bestend
• Dashboards: Add $__namespace global variable #132167, @ivanortegaalba
• Dashboards: Allow Add variable + btn to add filters, links and annos as well #130841, @mdvictor
• Dashboards: Hide links to deleted folders in Recently Deleted #134469, @Clarity-89
• Dashboards: Improve Recently Deleted performance with server-side search #134126, @pstibrany
• Dashboards: Make the auto grid to be default #130749, @bfmatei
• Dashboards: Show Git Sync badges in folder search #132790, @Clarity-89
• Faro: add support for trackResources #130792, @ashharrison90
• FieldOverrides: Add ShowIfOverride to field config options #132419, @gtk-grafana
• Frontend: add subresource integrity #131596, @jackw
• Git Sync: Clarify repository links for pure Git #134238, @ferruvich
• Git Sync: Ignore hidden paths in repository scans and diffs #134731, @ferruvich
• GrafanaBootData: Restrict config.datasources usage via lint rule #130661, @mckn
• Heatmap: Keep exemplar marker size consistent across displays #134072, @fastfrwrd
• Home: Send the traces setup CTA to the OpenTelemetry onboarding guide #135135, @Clarity-89
• Homepage: Add an On call schedules tab with your shifts and who's on call #134747, @Clarity-89
• Homepage: Let the Synthetic Monitoring card ignore checks, targets, and probes #134217, @Clarity-89
• Homepage: Let the metrics card exclude hosts and filesystems from its disk alert #133472, @Clarity-89
• Homepage: Move card filters to a footer dropdown and show page kinds as icons #135851, @Clarity-89
• Homepage: Replace the Recent tab with Recent activity #134633, @Clarity-89
• Homepage: Stop the homepage from jumping while it loads #135321, @Clarity-89
• Log Details Sidebar: Change default action to replace the current log instead of opening a new tab #133129, @matyax
• Log Details: Surface errors in logs and update links styles #134427, @matyax
• Logs Table: Disable hover overflow by default #132882, @matyax
• Logs: Invert the orientation of the arrow in the Logs Table and Logs Panel #131156, @matyax
• Packaging: Remove bash dependency from alpine Docker image #132643, @TheoBrigitte
• PanelEdit: Conditional field config display & edit context #132398, @gtk-grafana
• PanelOptions: Add context options to overrides #132414, @gtk-grafana
• Plugins: Avoid to delete RBAC roles when upgrading #134143, @andresmgot
• Plugins: Expose OpenFeature provider discovery to backend plugins #129735, @adamyeats
• Plugins: Forward SSL certificate environment variables #131848, @osmocomet
• Plugins: Show the correct warning when grafana.com is unreachable #132028, @lazerg
• Provisioning: Add generic git OAuth app connections #134186, @amalavet
• Provisioning: Add link back to the original dashboard in preview banner #129037, @MissingRoberto
• Provisioning: Allow permission updates on provisioned folders #134725, @ferruvich
• Provisioning: Allow resource previews in unsynced folders #133250, @ferruvich
• Provisioning: Always interpret folder metadata in resources and sync #134726, @ferruvich
• Provisioning: Always protect folder metadata from direct file writes #135038, @ferruvich
• Provisioning: Always use folder metadata in Git Sync #134355, @Clarity-89
• Provisioning: Default save from a branch preview to the previewed branch #135136, @Clarity-89
• Provisioning: GitHub-style doc tabs for folder README #129073, @MissingRoberto
• Provisioning: Handle repository build timeouts and branch outages #135072, @ferruvich
• Provisioning: Keep folder when removing _folder.json leaves its UID unchanged #135574, @ferruvich
• Provisioning: Link README items to Grafana pages when viewed in Grafana #128455, @MissingRoberto
• Provisioning: Make backend user attribution unconditional #134709, @ferruvich
• Provisioning: Never replace the repository root folder during incremental sync #135397, @ferruvich
• Provisioning: Reject invalid resource names before API calls #133666, @ferruvich
• Provisioning: Respect Git Sync polling intervals after unchanged refs #134380, @ferruvich
• Provisioning: Show last checked time in Pull status #134476, @ferruvich
• Provisioning: Skip previews for pull requests from forks #132522, @ferruvich
• Provisioning: Stop PR previews when refs disappear #132547, @ferruvich
• Provisioning: Style branch/target-branch as GitHub-like pills in preview banner #131133, @MissingRoberto
• Provisioning: Support generic git OAuth connections in the UI #134187, @amalavet
• Provisioning: Support legacy paths and diagnose missing source annotations #133225, @ferruvich
• Provisioning: Surface the finalizer blocking a stuck repository deletion #133241, @MissingRoberto
• Provisioning: Treat manager-kind conflicts as warnings #132364, @ferruvich
• Provisioning: Use resource.action for preview banner title accuracy #131134, @MissingRoberto
• Provisioning: recover from a deleted PR branch (pre-flight + save to new branch) #128977, @MissingRoberto
• Provisioning: render mermaid diagrams in folder README #129096, @MissingRoberto
• Provisioning: tolerate quota lookup failures for existing repositories #131703, @ferruvich
• QueryEditor: Add extension point to the top toolbar #132289, @aocenas
• RBAC: Allow removing unowned permissions through access-control APIs (Enterprise)
• RBAC: Document APIs allow removing unowned permissions through access-control APIs #132518, @gamab
• Replace subtitle switch UI string #132965, @imatwawana
• Reports: say in the report when a variable value no longer exists (Enterprise)
• Sandbox: Config flag deprecation message #135329, @jesdavpet
• Sandbox: Show deprecation warning in UI tooltip (Enterprise)
• Standard options: Add Ordinal unit. #130091, @simonprickett
• Table: Calculate column widths independently of scrollbar visibility #134337, @fastfrwrd
• Table: Prevent initial column width jump with vertical scrollbars #133615, @fastfrwrd
• TimeRangePicker: Default isOnCanvas to true #135833, @torkelo
• TopNav: Logo should not shrink #131170, @torkelo
• Trace View: Open Logs link in a new tab (Drilldown) or in split view (Explore) #132987, @matyax
• TraceView: Add Go to span on the header error banner #132550, @joey-grafana
• TraceView: Add a trace banner for error and warning spans #132250, @joey-grafana
• TraceView: Expand attribute plugin cross-sell promos #131472, @joey-grafana
• TraceView: Open the banner span from Go to span and surface exception #133122, @joey-grafana
• TraceView: Use design system tokens in the header, minimap and timeline #133339, @joey-grafana
• TraceView: Use design system tokens in waterfall rows and span details #133434, @joey-grafana
• Traces to logs: Extend support, and discover trace and span related logs from #130515, @matyax
• Transformations: Allow setting static refIDs per transformation #131458, @Develer
• Transformations: Resolve variables in the classic transformation editor #135569, @Develer
• UI: Luxon on by default #134865, @fastfrwrd
• Unified storage: Enable automatic cleanup of deleted resources by default #133330, @pstibrany
• alerting: Remove method step from import to GMA wizard #130616, @rodrigopk

• Alerting: Fix alerts going to the built-in Alertmanager after startup for external-only orgs #134481, @gillesdemey
• Alerting: Fix instance rows vanishing at coarse query steps in Triage #133516, @rodrigopk
• Alerting: Fix notification policy drop and query drift in rule saves #131645, @rodrigopk
• Alerting: Fix rule groups missing from a folder until "Show more" is clicked #131078, @JacobsonMT
• Alerting: Fix stale dry-run validation and YAML errors in the Import wizard #132707, @rodrigopk
• Alerting: Fix useAutoSyncConfiguration's queries behind Org Admin + feature toggle #130627, @rodrigopk
• Alerting: fix GetManagedRoute returning imported route for unrelated names #132563, @JacobsonMT
• Alerting: reject managed route names with leading/trailing whitespace #132566, @JacobsonMT
• Dashboard: Preserve panel subtitle in V2 save model #133723, @adi-IL
• Dashboards: Fix Classic model returning v2 JSON when saving a provisioned dashboard #131718, @ivanortegaalba
• Dashboards: Fix adhoc and groupby variable datasource on UI import #131817, @ivanortegaalba
• Dashboards: Fix browse crash and hangs when a dashboard shares its folder's UID #132634, @Clarity-89
• Dashboards: Fix edit state props when swapping dashboard state in place #132001, @ifrost
• Dashboards: Fix missing deletion dates in Recently Deleted #133734, @pstibrany
• Dashboards: Fix query variable refresh reset to onDashboardLoad on v2 UI import #131837, @ivanortegaalba
• Dashboards: Keep tags set on a new dashboard when saving it #131459, @ivanortegaalba
• Dashboards: Keep variable values and time settings set by an applied spec instead of reverting them to the URL #134200, @ivanortegaalba
• Dashboards: Preserve query variable refresh setting on v2 dashboard import #132007, @Sergej-Vlasov
• Dashboards: Show values preview for data source variables in the edit pane #131736, @ivanortegaalba
• Library panels: Fix skeleton alignment #133965, @ashharrison90
• Navigation: Hide NetworkError when switching organization #131955, @AshrithaSB
• Packaging: Fix issue with bundled plugins not being moved properly #131033, @kminehart
• PanelEditor: Fix options pane not resizable beyond the preview's content width #131581, @ivanortegaalba
• Plugins: Don't report loaded plugins as not registered when a request times out #135591, @leventebalogh
• Provisioning: Fix PR dashboard previews when served from a sub-path #132569, @gustaff-weldon
• Provisioning: Fix folder cleanup and hidden directory scans #135050, @ferruvich
• Provisioning: Fix folder rename UID collision during full sync #130401, @ferruvich
• Provisioning: Fix sync step flicker in Git Sync wizard #134108, @Clarity-89
• Reporting: Fix race condition with repeat panels on the /d-render/ page #128536, @mmandrus
• SQL Expressions: Read enum fields as their text #135225, @nicwestvold
• SQL Expressions: Rename label columns that clash with generated column names #134869, @nicwestvold
• Security: Fix CVE-2026-17183 #131061, @github-actions[bot]
• Table: Fix nested apply-to-row coloring to use the nested frame's own fields #129426, @fastfrwrd
• Table: Fix the height a wrapped header row reserves #132230, @fastfrwrd
• Table: fix JSON cell indentation, styling, and hover reveal #130452, @fastfrwrd

• Plugins marketplace: rename config.ini section from marketplace to plugins_marketplace #132172, @xnyo

• ConfirmModal: Ensure focus correctly traps when invoked from a dropdown menu #132764, @ashharrison90
• Datasources: Remove deprecated isDefault from DataSourceInstanceListItem #133886, @leventebalogh
• GrafanaUI: Fix focus ring appearance #132808, @ashharrison90
• MultiCombobox: Ensure height is consistent between empty/filled states #131255, @ashharrison90
• Runtime: Stabilize async data source APIs #134390, @leventebalogh
• Runtime: Stabilize plugin settings APIs #134723, @leventebalogh

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during CLIENT PAUSE WRITE or CLUSTER FAILOVER by @smkher (#3645)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• valkey-check-aof now recognizes RDB base files with the VALKEY signature instead of misreporting a valid multipart AOF as invalid by @sarthakaggarwal97 (#4739)
• Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided by @murphyjacob4 (#3598)
• Reject relative expire times in SET/GETEX, RESTORE, and ValkeyModule_SetExpire that overflow when added to the current time, preventing server aborts from negative expires by @madolson (#4880)
• HDEL, HGETDEL, HPERSIST, and HEXPIRE no longer propagate fields they treat as expired, preventing replica and AOF-reload divergence by @xdk-amz (#4772)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• COPY of a hash now includes expired-but-unreaped fields so their deletion is propagated and replicas stay in sync by @pirate329 (#4939)
• Sorted set range commands with a negative LIMIT offset now return an empty result instead of a spurious element on btree-encoded keys by @xiaocj (#4637)
• Fix atomic slot migration not replicating evictions on the import target, which let replicas grow far past maxmemory by @shanezx-sc (#4920)
• Redact error text in server logs when hide-user-data-from-log is enabled, so command arguments no longer leak into logs by @zackcam (#4815)
• Fix HSETEX and HGETEX failing to parse their arguments when the key is named fields by @sebxt (#4945)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix atomic slot migration with cluster-databases > 1 applying writes made during the snapshot to the wrong database on the target by @pirate329 (#4952)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)

Full Changelog: https://github.com/valkey-io/valkey/compare/9.0.6...9.0.7