{"id":"CVE-2021-27358","aliases":["ALSA-2021:4226","BIT-grafana-2021-27358","EUVD-2022-1033","GHSA-h5rh-w6vm-9ghc","OESA-2021-1445","RHSA-2021:4226","RLSA-2021:4226","SUSE-SU-2021:1962-1","SUSE-SU-2021:1963-1","SUSE-SU-2021:2554-1","SUSE-SU-2021:2660-1","UBUNTU-CVE-2021-27358","openSUSE-SU-2021:1148-1","openSUSE-SU-2021:2662-1"],"status":"published","title":"Denial of service in Grafana","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.83042,"percentile":0.9968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306","CWE-400"],"published":"2021-03-18T19:43:04Z","modified":"2026-10-29T11:01:09Z","exploits":[{"source":"nuclei","id":"CVE-2021-27358","title":"Grafana Unauthenticated Snapshot Creation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27358.yaml"}],"fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["7.4.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["7.4.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.3"},{"fixed":"7.4.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"6.7.3"},{"fixed":"7.4.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"6.7.3"},{"fixed":"7.4.2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.11-1.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.11-1.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1615223676.777f0b3-3.25.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1618235096.90974ed-3.10.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-3.3.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.23.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.9.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-3.24.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-3.25.5"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-3.37.4"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev29-3.25.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev82-3.37.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-3.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.6.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.21.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.27.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-4.21.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.24.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.29.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.21.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.23.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-6.27.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev82-3.27.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-3.3.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1616146717.a89ae0f4e-3.34.4"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.23.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.9.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-3.24.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-3.25.5"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-3.37.4"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev29-3.25.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev82-3.37.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-3.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.6.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-activerecord-session_store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-4.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1616146720.44daffca0-9.81.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-1.24.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-9.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180608_12.47-16.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.29.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.16.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activerecord-session_store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.4.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1614096566.e8c2b27-3.44.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-5.3.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-4.18.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-3.9.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1623056900.7917e18-3.21.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190923_16.32-3.18.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-3.48.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-3.48.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-6.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.34-3.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-5.9.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-aodh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev7-12.32.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-12.33.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev7-12.30.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.3~dev29-14.34.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3~dev7-12.31.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-freezer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0.0~xrc2~dev2-10.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.3~dev3-12.31.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.33.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-horizon-hpe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-14.36.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.8~dev8-12.33.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-11.35.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2_5.0.2_5.0.2~dev31-11.32.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev5-12.37.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1_1.5.1_1.5.1~dev3-8.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2~dev2-12.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-13.38.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-11.36.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6~dev3-12.33.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5~dev4-11.32.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2_2.15.2_2.15.2~dev32-11.23.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-trove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2~dev2-11.32.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1614096566.e8c2b27-3.44.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-5.3.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-4.18.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-3.9.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1623056900.7917e18-3.21.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190923_16.32-3.18.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-3.48.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-3.48.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-6.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.34-3.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-5.9.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-aodh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev7-12.32.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-12.33.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev7-12.30.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.3~dev29-14.34.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3~dev7-12.31.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-freezer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0.0~xrc2~dev2-10.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.3~dev3-12.31.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.33.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-14.36.6"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.8~dev8-12.33.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-11.35.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2_5.0.2_5.0.2~dev31-11.32.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev5-12.37.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1_1.5.1_1.5.1~dev3-8.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2~dev2-12.28.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-13.38.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-11.36.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6~dev3-12.33.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5~dev4-11.32.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2_2.15.2_2.15.2~dev32-11.23.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-trove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2~dev2-11.32.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-5.3.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0+git.1622489449.a8e60e238-3.50.4"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0+git.1616001417.67fd9c2a1-4.52.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210512-1.32.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-4.18.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-3.9.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1623056900.7917e18-3.21.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190923_16.32-3.18.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-3.48.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev92-3.48.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-6.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.34-3.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-5.9.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.3"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-activerecord-session_store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.3.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.7-1.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.7-lp152.2.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.7-3.12.1"}]}],"bundled":5}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"netapp","product":"e-series_performance_analyzer"}],"references":[{"url":"https://github.com/grafana/grafana/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210513-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27358","tags":["web","advisory"]},{"url":"https://github.com/grafana/grafana/pull/31263","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h5rh-w6vm-9ghc"},{"url":"https://vulners.com/cve/CVE-2021-27358","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3114","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33195","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33197","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-34558","tags":["report"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210513-0007","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39226","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4226","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989570","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4226.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/mperVMGa98w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27358","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33195","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33197","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-34558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34558","tags":["advisory"]},{"url":"https://golang.org/doc/devel/release#go1.15.minor","tags":["article"]},{"url":"https://golang.org/doc/devel/release#go1.16.minor","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4226","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1044849","tags":["report"]},{"url":"https://bugzilla.suse.com/1048688","tags":["report"]},{"url":"https://bugzilla.suse.com/1115960","tags":["report"]},{"url":"https://bugzilla.suse.com/1148383","tags":["report"]},{"url":"https://bugzilla.suse.com/1170657","tags":["report"]},{"url":"https://bugzilla.suse.com/1171909","tags":["report"]},{"url":"https://bugzilla.suse.com/1172409","tags":["report"]},{"url":"https://bugzilla.suse.com/1172450","tags":["report"]},{"url":"https://bugzilla.suse.com/1174583","tags":["report"]},{"url":"https://bugzilla.suse.com/1178243","tags":["report"]},{"url":"https://bugzilla.suse.com/1179805","tags":["report"]},{"url":"https://bugzilla.suse.com/1181277","tags":["report"]},{"url":"https://bugzilla.suse.com/1181278","tags":["report"]},{"url":"https://bugzilla.suse.com/1181689","tags":["report"]},{"url":"https://bugzilla.suse.com/1181690","tags":["report"]},{"url":"https://bugzilla.suse.com/1182317","tags":["report"]},{"url":"https://bugzilla.suse.com/1182433","tags":["report"]},{"url":"https://bugzilla.suse.com/1183174","tags":["report"]},{"url":"https://bugzilla.suse.com/1183803","tags":["report"]},{"url":"https://bugzilla.suse.com/1184148","tags":["report"]},{"url":"https://bugzilla.suse.com/1185623","tags":["report"]},{"url":"https://bugzilla.suse.com/1186608","tags":["report"]},{"url":"https://bugzilla.suse.com/1186611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181379","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3281","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212554-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019074","tags":["report"]},{"url":"https://bugzilla.suse.com/1057496","tags":["report"]},{"url":"https://bugzilla.suse.com/1073879","tags":["report"]},{"url":"https://bugzilla.suse.com/1113302","tags":["report"]},{"url":"https://bugzilla.suse.com/1123064","tags":["report"]},{"url":"https://bugzilla.suse.com/1143893","tags":["report"]},{"url":"https://bugzilla.suse.com/1166139","tags":["report"]},{"url":"https://bugzilla.suse.com/1176784","tags":["report"]},{"url":"https://bugzilla.suse.com/1180507","tags":["report"]},{"url":"https://bugzilla.suse.com/1181828","tags":["report"]},{"url":"https://bugzilla.suse.com/1185836","tags":["report"]},{"url":"https://bugzilla.suse.com/940812","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21419","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212660-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183809","tags":["report"]},{"url":"https://bugzilla.suse.com/1183811","tags":["report"]},{"url":"https://bugzilla.suse.com/1183813","tags":["report"]},{"url":"https://bugzilla.suse.com/1184371","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28148","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-27358","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7FZP3KR7QVZ36DM2NRRT76CHYDLB44JX/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CQXNKFCX2C74T7LPZZCRD6GK2WWJTT4B/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-27358","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","status":"published","published":"2021-03-18T19:43:04Z","modified":"2024-08-03T20:48:16.124Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2022-1033","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","status":"published","published":"2021-03-18T19:43:04Z","modified":"2024-08-03T20:48:16Z","updated_at":"2026-11-03T03:24:49.368497Z"}],"ghsa":[{"id":"GHSA-h5rh-w6vm-9ghc","title":"Denial of service in Grafana","description":"The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.\n### Specific Go Packages Affected\ngithub.com/grafana/grafana/pkg/middleware","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-10-02T13:18:04Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:R","level":"medium"}],"cwes":["CWE-306","CWE-400"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2021-27358","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","status":"published","published":"2021-03-18T20:15:13.253Z","modified":"2026-06-17T03:44:42.4Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"CVE-2021-27358","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","status":"published","published":"2021-03-18T20:15:13.253Z","modified":"2026-10-20T10:54:35.10053997Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-h5rh-w6vm-9ghc","title":"Denial of service in Grafana","description":"The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.\n### Specific Go Packages Affected\ngithub.com/grafana/grafana/pkg/middleware","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-12-06T01:00:59.198319Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:R","level":"high"}],"cwes":["CWE-306","CWE-400"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"OESA-2021-1445","title":"grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026amp; OpenTSDB.\r\n\r\nSecurity Fix(es):\r\n\r\nGrafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.(CVE-2020-24303)\r\n\r\nA signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27846)\r\n\r\nThe snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.(CVE-2021-27358)\r\n\r\nOne of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.(CVE-2021-28148)\r\n\r\nThe team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn\u0026apos;t supposed to have.(CVE-2021-28147)\r\n\r\nGrafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot \u0026quot;public_mode\u0026quot; configuration setting is set to True (vs default of False), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot \u0026quot;public_mode\u0026quot; setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)","status":"published","published":"2021-11-26T11:04:43Z","modified":"2026-08-18T01:16:12.533143455Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4226","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2024-09-29T18:30:07Z","modified":"2026-08-08T10:01:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4226","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)\n\nSecurity Fix(es):\n\n* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)\n\n* grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)\n\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:46:47Z","modified":"2026-02-05T08:15:12.635566Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-27358","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","status":"published","published":"2021-03-18T20:15:00Z","modified":"2025-10-24T04:50:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2021:4226","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)\n\nSecurity Fix(es):\n\n* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)\n\n* grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)\n\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:46:47Z","modified":"2026-10-29T11:01:09.798224032Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-grafana-2021-27358","description":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","status":"published","published":"2024-03-06T11:00:20.966Z","modified":"2026-09-08T08:47:50.381073261Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"openSUSE-SU-2021:1148-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\n- CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)\n- Update to version 7.5.7:\n  * Updated relref to 'Configuring exemplars' section (#34240) (#34243)\n  * Added exemplar topic (#34147) (#34226)\n  * Quota: Do not count folders towards dashboard quota (#32519) (#34025)\n  * Instructions to separate emails with semicolons (#32499) (#34138)\n  * Docs: Remove documentation of v8 generic OAuth feature (#34018)\n  * Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)\n  * [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)\n  * Stop hoisting @icons/material (#33922)\n  * Chore: fix react-color version in yarn.lock (#33914)\n  * 'Release: Updated versions in package to 7.5.6' (#33909)\n  * Loki: fix label browser crashing when + typed (#33900) (#33901)\n  * Document `hide_version` flag (#33670) (#33881)\n  * Add isolation level db configuration parameter (#33830) (#33878)\n  * Sanitize PromLink button (#33874) (#33876)\n  * Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)\n  * Docs feedback: /administration/provisioning.md (#33804) (#33842)\n  * Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)\n  * Docs: Update _index.md (#33797) (#33799)\n  * Docs: Update installation.md (#33656) (#33703)\n  * GraphNG: uPlot 1.6.9 (#33598) (#33612)\n  * dont consider invalid email address a failed email (#33671) (#33681)\n  * InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)\n  * add template for dashboard url parameters  (#33549) (#33588)\n  * Add note to Snapshot API doc to specify that user has to provide the entire dashboard model  (#33572) (#33586)\n  * Update team.md (#33454) (#33536)\n  * Removed duplicate file 'dashboard_folder_permissions.md (#33497)\n  * Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)\n  * Documentation: Update developer-guide.md (#33478) (#33490)\n  * add closed parenthesis to fix a hyperlink (#33471) (#33481)\n\n- Update to version 7.5.5:\n  * 'Release: Updated versions in package to 7.5.5' (#33469)\n  * GraphNG: Fix exemplars window position (#33427) (#33462)\n  * Remove field limitation from slack notification (#33113) (#33455)\n  * Prometheus: Support POST in template variables (#33321) (#33441)\n  * Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)\n  * Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)\n  * Docs: Removed type from find annotations example. (#33399) (#33403)\n  * [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)\n  * Updated label for add panel. (#33285) (#33286)\n  * Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)\n  * Docs: Sync latest master docs with 7.5.x (#33156)\n  * Docs: Update getting-started-influxdb.md (#33234) (#33241)\n  * Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)\n  * Minor Changes in Auditing.md (#31435) (#33238)\n  * Docs: Add license check endpoint doc (#32987) (#33236)\n  * Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)\n  * Docs: InfluxDB doc improvements (#32815) (#33185)\n  * [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)\n  * update cla (#33181)\n  * Fix inefficient regular expression (#33155) (#33159)\n  * Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)\n  * Elasticsearch:  Add documentation for supported Elasticsearch query transformations (#33072) (#33128)\n  * Update team.md (#33060) (#33084)\n  * GE issue 1268 (#33049) (#33081)\n  * Fixed some formatting issues for PRs from yesterday. (#33078) (#33079)\n  * Explore: Load default data source in Explore when the provided source does not exist (#32992) (#33061)\n  * Docs: Replace next with latest in aliases (#33054) (#33059)\n  * Added missing link item. (#33052) (#33055)\n  * Backport 33034 (#33038)\n  * Docs: Backport 32916 to v7.5x  (#33008)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.4 (#32973) (#32998)\n  * Elasticsearch: Force re-rendering of each editor row type change (#32993) (#32996)\n  * Docs: Sync release branch with latest docs (#32986)\n\n- Update to version 7.5.4:\n  * 'Release: Updated versions in package to 7.5.4' (#32971)\n  * fix(datasource_srv): prevent infinite loop where default datasource is named default (#32949) (#32967)\n  * Added Azure Monitor support for Microsoft.AppConfiguration/configurationStores namespace (#32123) (#32968)\n  * fix sqlite3 tx retry condition operator precedence (#32897) (#32952)\n  * AzureMonitor: Add support for Virtual WAN namespaces (#32935) (#32947)\n  * Plugins: Allow a non-dashboard page to be the default home page (#32926) (#32945)\n  * GraphNG: uPlot 1.6.8 (#32859) (#32863)\n  * Alerting: Add ability to include aliases with dashes (/) and at (@) signs in InfluxDB (#32844)\n  * Prometheus: Allow exemplars endpoint in data source proxy (#32802) (#32804)\n  * [v7.5.x] Table: Fixes table data links so they refer to correct row after sorting (#32758)\n  * TablePanel: Makes sorting case-insensitive (#32435) (#32752)\n\n- Update to version 7.5.3:\n  * 'Release: Updated versions in package to 7.5.3' (#32745)\n  * FolderPicker: Prevent dropdown menu from disappearing off screen (#32603) (#32741)\n  * Loki: Remove empty annotations tags (#32359) (#32490)\n  * SingleStat: fix wrong call to getDataLinkUIModel (#32721) (#32739)\n  * Prometheus: Fix instant query to run two times when exemplars enabled (#32508) (#32726)\n  * Elasticsearch: Fix bucket script variable duplication in UI (#32705) (#32714)\n  * Variables: Confirms selection before opening new picker (#32586) (#32710)\n  * CloudWarch: Fix service quotas link (#32686) (#32689)\n  * Configuration: Prevent browser hanging / crashing with large number of org users (#32546) (#32598)\n  * chore: bump execa to v2.1.0 (#32543) (#32592)\n  * Explore: Fix bug where navigating to explore would result in wrong query and datasource to be shown (#32558)\n  * Fix broken gtime tests (#32582) (#32587)\n  * resolve conflicts (#32567)\n  * gtime: Make ParseInterval deterministic (#32539) (#32560)\n  * Dashboard: No longer includes default datasource when externally exporting dashboard with row (#32494) (#32535)\n  * TextboxVariable: Limits the length of the preview value (#32472) (#32530)\n  * AdHocVariable: Adds default data source (#32470) (#32476)\n  * Variables: Fixes Unsupported data format error for null values (#32480) (#32487)\n  * Prometheus: align exemplars check to latest api change (#32513) (#32515)\n  * 'Release: Updated versions in package to 7.5.2' (#32502)\n  * SigV4: Add support EC2 IAM role auth and possibility to toggle auth providers  (#32444) (#32488)\n  * Set spanNulls to default (#32471) (#32486)\n  * Graph: Fix setting right y-axis when standard option unit is configured (#32426) (#32442)\n  * API: Return 409 on datasource version conflict (#32425) (#32433)\n  * API: Return 400 on invalid Annotation requests (#32429) (#32431)\n  * Variables: Fixes problem with data source variable when default ds is selected (#32384) (#32424)\n  * Table: Fixes so links work for image cells (#32370) (#32410)\n  * Variables: Fixes error when manually non-matching entering custom value in variable input/picker (#32390) (#32394)\n  * DashboardQueryEditor: Run query after selecting source panel (#32383) (#32395)\n  * API: Datasource endpoint should return 400 bad request if id and orgId is invalid (#32392) (#32397)\n  * 'Release: Updated versions in package to 7.5.1' (#32362)\n  * MSSQL: Upgrade go-mssqldb (#32347) (#32361)\n  * GraphNG: Fix tooltip displaying wrong or no data (#32312) (#32348)\n  * 'Release: Updated versions in package to 7.5.0' (#32308)\n  * Loki: Fix text search in Label browser (#32293) (#32306)\n  * Explore: Show all dataFrames in data tab in Inspector (#32161) (#32299)\n  * PieChartV2: Add migration from old piechart (#32259) (#32291)\n  * LibraryPanels: Adds Type and Description to DB (#32258) (#32288)\n  * LibraryPanels: Prevents deletion of connected library panels (#32277) (#32284)\n  * Library Panels: Add 'Discard' button to panel save modal (#31647) (#32281)\n  * LibraryPanels: Changes to non readonly reducer (#32193) (#32200)\n  * Notifications: InfluxDB - Fix regex to include metrics with hyphen in aliases (#32224) (#32262)\n  * SSE/InfluxDB: Change InfluxQL to work with server side expressions (#31691) (#32102)\n  * DashboardSettings: Fixes issue with tags list not updating when changes are made (#32241) (#32247)\n  * Logs: If log message missing, use empty string (#32080) (#32243)\n  * CloudWatch: Use latest version of aws sdk (#32217) (#32223)\n  * Release: Updated versions in package to 7.5.0-beta.2 (#32158)\n  * HttpServer: Make read timeout configurable but disabled by default (#31575) (#32154)\n  * GraphNG: Ignore string fields when building data for uPlot in GraphNG (#32150) (#32151)\n  * Fix loading timezone info on windows (#32029) (#32149)\n  * SQLStore: Close session in withDbSession (#31775) (#32108)\n  * Remove datalink template suggestions for accessing specific fields when there are multiple dataframes. (#32057) (#32148)\n  * GraphNG: make sure dataset and config are in sync when initializing and re-initializing uPlot (#32106) (#32125)\n  * MixedDataSource: Name is updated when data source variable changes (#32090) (#32144)\n  * Backport 32005 to v7.5.x #32128 (#32130)\n  * Loki: Label browser UI updates (#31737) (#32119)\n  * ValueMappings: Fixes value 0 not being mapped (#31924) (#31929)\n  * GraphNG: Fix tooltip series color for multi data frame scenario (#32098) (#32103)\n  * LibraryPanels: Improves the Get All experience (#32028) (#32093)\n  * Grafana/ui: display all selected levels for selected value when searching (#32030) (#32032)\n  * Exemplars: always query exemplars (#31673) (#32024)\n  * [v7.5.x] TimePicker: Fixes hidden time picker shown in kiosk TV mode (#32055)\n  * Chore: Collect elasticsearch version usage stats (#31787) (#32063)\n  * Chore: Tidy up Go deps (#32053)\n  * GraphNG: Fix PlotLegend field display name being outdated (#32064) (#32066)\n  * Data proxy: Fix encoded characters in URL path should be proxied encoded (#30597) (#32060)\n  * [v7.5.x] Auth: Allow soft token revocation (#32037)\n  * Snapshots: Fix usage of sign in link from the snapshot page (#31986) (#32036)\n  * Make master green (#32011) (#32015)\n  * Query editor: avoid avoiding word wrap on query editor components (#31949) (#31982)\n  * Variables: Fixes filtering in picker with null items (#31979) (#31995)\n  * TooltipContainer - use resize observer instead of getClientBoundingRect (#31937) (#32003)\n  * Loki: Fix autocomplete when re-editing Loki label values (#31828) (#31987)\n  * Loki: Fix type errors in language_provider (#31902) (#31945)\n  * PanelInspect: Interpolates variables in CSV file name (#31936) (#31977)\n  * Cloudwatch: use shared library for aws auth (#29550) (#31946)\n  * Tooltip: partial perf improvement (#31774) (#31837) (#31957)\n  * Backport 31913 to v7.5.x (#31955)\n  * Grafana/ui: fix searchable options for Cascader with options update (#31906) (#31938)\n  * Variables: Do not reset description on variable type change (#31933) (#31939)\n  * [v7.5.x] AnnotationList: Adds spacing to UI  (#31888) (#31894)\n  * Elasticseach: Support histogram fields (#29079) (#31914)\n  * Chore: upgrade eslint and fork-ts-checker-webpack-plugin (#31854) (#31896)\n  * Update scripts and Dockerfiles to use Go 1.16.1 (#31881) (#31891)\n  * Templating: use dashboard timerange when variables are set to refresh 'On Dashboard Load' (#31721) (#31801)\n  * [v7.5.x] Tempo: Add test for backend data source (#31835) (#31882)\n  * Run go mod tidy to update go.mod and go.sum (#31859)\n  * Grafana/ui: display all selected levels for Cascader (#31729) (#31862)\n  * CloudWatch: Consume the grafana/aws-sdk (#31807) (#31861)\n  * Cloudwatch: ListMetrics API page limit (#31788) (#31851)\n  * Remove invalid attribute (#31848) (#31850)\n  * CloudWatch: Restrict auth provider and assume role usage according to… (#31845)\n  * CloudWatch: Add support for EC2 IAM role (#31804) (#31841)\n  * Loki, Prometheus: Change the placement for query type explanation (#31784) (#31819)\n  * Variables: Improves inspection performance and unknown filtering (#31811) (#31813)\n  * Change piechart plugin state to beta (#31797) (#31798)\n  * ReduceTransform: Include series with numeric string  names (#31763) (#31794)\n  * Annotations: Make the annotation clean up batch size configurable (#31487) (#31769)\n  * Fix escaping in ANSI and dynamic button removal (#31731) (#31767)\n  * DataLinks: Bring back single click links for Stat, Gauge and BarGauge panel (#31692) (#31718)\n  * log skipped, performed and duration for migrations (#31722) (#31754)\n  * Search: Make items more compact (#31734) (#31750)\n  * loki_datasource: add documentation to label_format and line_format (#31710) (#31746)\n  * Tempo: Convert tempo to backend data source2 (#31733)\n  * Elasticsearch: Fix script fields in query editor (#31681) (#31727)\n  * Elasticsearch: revert to isoWeek when resolving weekly indices (#31709) (#31717)\n  * Admin: Keeps expired api keys visible in table after delete (#31636) (#31675)\n  * Tempo: set authentication header properly (#31699) (#31701)\n  * Tempo: convert to backend data source (#31618) (#31695)\n  * Update package.json (#31672)\n  * Release: Bump version to 7.5.0-beta.1 (#31664)\n  * Fix whatsNewUrl version to 7.5 (#31666)\n  * Chore: add alias for what's new 7.5 (#31669)\n  * Docs: Update doc for PostgreSQL authentication (#31434)\n  * Docs: document report template variables (#31637)\n  * AzureMonitor: Add deprecation message for App Insights/Insights Analytics (#30633)\n  * Color: Fixes issue where colors where reset to gray when switch panels (#31611)\n  * Live: Use pure WebSocket transport (#31630)\n  * Docs: Fix broken image link (#31661)\n  * Docs: Add Whats new in 7.5 (#31659)\n  * Docs: Fix links for 7.5 (#31658)\n  * Update enterprise-configuration.md (#31656)\n  * Explore/Logs: Escaping of incorrectly escaped log lines (#31352)\n  * Tracing: Small improvements to trace types (#31646)\n  * Update _index.md (#31645)\n  * AlertingNG: code refactoring (#30787)\n  * Remove pkill gpg-agent (#31169)\n  * Remove format for plugin routes (#31633)\n  * Library Panels: Change unsaved change detection logic (#31477)\n  * CloudWatch: Added AWS Timestream Metrics and Dimensions (#31624)\n  * add new metrics and dimensions (#31595)\n  * fix devenv dashboard content typo (#31583)\n  * DashList: Sort starred and searched dashboard alphabetically (#31605)\n  * Docs: Update whats-new-in-v7-4.md (#31612)\n  * SSE: Add 'Classic Condition' on backend (#31511)\n  * InfluxDB: Improve maxDataPoints error-message in Flux-mode, raise limits (#31259)\n  * Alerting: PagerDuty: adding current state to the payload (#29270)\n  * devenv: Fix typo (#31589)\n  * Loki: Label browser (#30351)\n  * LibraryPanels: No save modal when user is on same dashboard (#31606)\n  * Bug: adding resolution for `react-use-measure` to prevent plugin tests from failing. (#31603)\n  * Update node-graph.md (#31571)\n  * test: pass Cypress options objects into selector wrappers (#31567)\n  * Loki: Add support for alerting (#31424)\n  * Tracing: Specify type of the data frame that is expected for TraceView (#31465)\n  * LibraryPanels: Adds version column (#31590)\n  * PieChart: Add color changing options to pie chart (#31588)\n  * Explore: keep enabled/disabled state in angular based QueryEditors correctly (#31558)\n  * Bring back correct legend sizing afer PlotLegend refactor (#31582)\n  * Alerting: Fix bug in Discord for when name for metric value is absent (#31257)\n  * LibraryPanels: Deletes library panels during folder deletion (#31572)\n  * chore: bump lodash to 4.17.21 (#31549)\n  * Elasticsearch: Fix impossibility to perform non-logs queries after importing queries from loki or prometheus in explore (#31518)\n  * TestData: Fixes never ending annotations scenario (#31573)\n  * CloudWatch: Added AWS Network Firewall metrics and dimensions (#31498)\n  * propagate plugin unavailable message to UI (#31560)\n  * ConfirmButton: updates story from knobs to controls (#31476)\n  * Loki: Refactor line limit to use grafana/ui component (#31509)\n  * LibraryPanels: Adds folder checks and permissions (#31473)\n  * Add guide on custom option editors (#31254)\n  * PieChart: Update text color and minor changes (#31546)\n  * Grafana-data: bump markedjs to v2.x to resolve vulnerability (#31036)\n  * Chore(deps): Bump google.golang.org/api from 0.39.0 to 0.40.0 (#31210)\n  * PieChart: Improve piechart legend and options (#31446)\n  * Chore(deps): Bump google.golang.org/grpc from 1.35.0 to 1.36.0 (#31541)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.37.7 to 1.37.20 (#31538)\n  * Chore(deps): Bump github.com/prometheus/common from 0.17.0 to 0.18.0 (#31539)\n  * Add multiselect options ui (#31501)\n  * Profile: Fixes profile preferences being accessible when anonymous access was enabled (#31516)\n  * Variables: Fixes error with: cannot read property length of undefined (#31458)\n  * Explore: Show ANSI colored logs in logs context (#31510)\n  * LogsPanel: Show all received logs  (#31505)\n  * AddPanel: Design polish  (#31484)\n  * TimeSeriesPanel: Remove unnecessary margin from legend  (#31467)\n  * influxdb: flux: handle is-hidden (#31324)\n  * Graph: Fix tooltip not showing when close to the edge of viewport  (#31493)\n  * FolderPicker: Remove useNewForms from FolderPicker (#31485)\n  * Add reportVariables feature toggle (#31469)\n  * Grafana datasource: support multiple targets (#31495)\n  * Update license-restrictions.md (#31488)\n  * Docs: Derived fields links in logs detail view (#31482)\n  * Docs: Add new data source links to Enterprise page (#31480)\n  * Convert annotations to dataframes (#31400)\n  * ReleaseNotes: Updated changelog and release notes for v7.4.2 (#31475)\n  * GrafanaUI: Fixes typescript error for missing css prop (#31479)\n  * Login: handle custom token creation error messages (#31283)\n  * Library Panels: Don't list current panel in available panels list (#31472)\n  * DashboardSettings: Migrate Link Settings to React (#31150)\n  * Frontend changes for library panels feature (#30653)\n  * Alerting notifier SensuGo: improvements in default message (#31428)\n  * AppPlugins: Options to disable showing config page in nav (#31354)\n  * add aws config (#31464)\n  * Heatmap: Fix missing/wrong value in heatmap legend (#31430)\n  * Chore: Fixes small typos (#31461)\n  * Graphite/SSE: update graphite to work with server side expressions (#31455)\n  * update the lastest version to 7.4.3 (#31457)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.3 (#31454)\n  * AWS: Add aws plugin configuration (#31312)\n  * Revert ''Release: Updated versions in package to 7.4.3' (#31444)' (#31452)\n  * Remove UserSyncInfo.tsx (#31450)\n  * Elasticsearch: Add word highlighting to search results (#30293)\n  * Chore: Fix eslint react hook warnings in grafana-ui (#31092)\n  * CloudWatch: Make it possible to specify custom api endpoint (#31402)\n  * Chore: fixed incorrect naming for disable settings (#31448)\n  * TraceViewer: Fix show log marker in spanbar (#30742)\n  * LibraryPanels: Adds permissions to getAllHandler (#31416)\n  * NamedColorsPalette: updates story from knobs to controls (#31443)\n  * 'Release: Updated versions in package to 7.4.3' (#31444)\n  * ColorPicker: updates story from knobs to controls (#31429)\n  * Streaming: Fixes an issue with time series panel and streaming data source when scrolling back from being out of view (#31431)\n  * ClipboardButton: updates story from knobs to controls (#31422)\n  * we should never log unhashed tokens (#31432)\n  * CI: Upgrade Dockerfiles wrt. Go, Node, Debian (#31407)\n  * Elasticsearch: Fix query initialization logic \u0026 query transformation from Promethous/Loki (#31322)\n  * Postgres: allow providing TLS/SSL certificates as text in addition to file paths (#30353)\n  * CloudWatch: Added AWS Ground Station metrics and dimensions (#31362)\n  * TraceViewer: Fix trace to logs icon to show in right pane (#31414)\n  * add hg team as migrations code owners (#31420)\n  * Remove tidy-check script (#31423)\n  * InfluxDB: handle columns named 'table' (#30985)\n  * Prometheus: Use configured HTTP method for /series and /labels endpoints (#31401)\n  * Devenv: Add gdev-influxdb2 data source (#31250)\n  * Update grabpl from 0.5.38 to 0.5.42 version (#31419)\n  * Move NOOP_CONTROL to storybook utils and change to a standalone file (#31421)\n  * remove squadcast details from docs (#31413)\n  * Add new Cloudwatch AWS/DDoSProtection metrics and dimensions (#31297)\n  * Logging: add frontend logging helpers to @grafana/runtime package (#30482)\n  * CallToActionCard: updates story from knobs to controls (#31393)\n  * Add eu-south-1 cloudwatch region, closes #31197 (#31198)\n  * Chore: Upgrade eslint packages (#31408)\n  * Cascader: updates story from knobs to controls (#31399)\n  * addressed issues 28763 and 30314. (#31404)\n  * Added section Query a time series database by id (#31337)\n  * Prometheus: Change default httpMethod for new instances to POST (#31292)\n  * Data source list: Use Card component (#31326)\n  * Chore: Remove gotest.tools dependency (#31391)\n  * Revert 'StoryBook: Introduces Grafana Controls (#31351)' (#31388)\n  * Chore(deps): Bump github.com/prometheus/common from 0.15.0 to 0.17.0 (#31387)\n  * AdHocVariables: Fixes crash when values are stored as numbers (#31382)\n  * Chore(deps): Bump github.com/golang/mock from 1.4.4 to 1.5.0 (#31379)\n  * Chore: Fix strict errors, down to 416 (#31365)\n  * Chore(deps): Bump github.com/getsentry/sentry-go from 0.9.0 to 0.10.0 (#31378)\n  * StoryBook: Introduces Grafana Controls (#31351)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.2 (#31313)\n  * Theming: Support for runtime theme switching and hooks for custom themes (#31301)\n  * Devenv: Remove old-versioned loki blocks and update prometheus2 block  (#31282)\n  * Zipkin: Show success on test data source (#30829)\n  * Update grot template (needs more info) (#31350)\n  * DatasourceSrv: Fix instance retrieval when datasource variable value set to 'default' (#31347)\n  * TimeSeriesPanel: Fixes overlapping time axis ticks (#31332)\n  * Grafana/UI: Add basic legend to the PieChart (#31278)\n  * SAML: single logout only enabled in enterprise (#31325)\n  * QueryEditor: handle query.hide changes in angular based query-editors (#31336)\n  * DashboardLinks: Fixes another issue where dashboard links cause full page reload (#31334)\n  * LibraryPanels: Syncs panel title with name (#31311)\n  * Chore: Upgrade golangci-lint (#31330)\n  * Add info to docs about concurrent session limits (#31333)\n  * Table: Fixes issue with fixed min and auto max with bar gauge cell (#31316)\n  * BarGuage: updates story from knobs to controls (#31223)\n  * Docs: Clarifies how to add Key/Value pairs (#31303)\n  * Usagestats: Exclude folders from total dashboard count (#31320)\n  * ButtonCascader: updates story from knobs to controls (#31288)\n  * test: allow check for Table as well as Graph for Explore e2e flow (#31290)\n  * Grafana-UI: Update tooltip type (#31310)\n  * fix 7.4.2 release note (#31299)\n  * Add `--tries 3` arg when triggering e2e-tests upon releasing (#31285)\n  * Chore: reduce strict errors for variables (#31241)\n  * update latest release version (#31296)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.2 (#31291)\n  * Correct name of Discord notifier tests (#31277)\n  * Docs: Clarifies custom date formats for variables (#31271)\n  * BigValue: updates story from knobs to controls (#31240)\n  * Docs: Annotations update (#31194)\n  * Introduce functions for interacting with library panels API (#30993)\n  * Search: display sort metadata (#31167)\n  * Folders: Editors should be able to edit name and delete folders (#31242)\n  * Make Datetime local (No date if today) working (#31274)\n  * UsageStats: Purpose named variables (#31264)\n  * Snapshots: Disallow anonymous user to create snapshots (#31263)\n  * only update usagestats every 30min (#31131)\n  * Chore: grafana-toolkit uses grafana-ui and grafana-data workspaces (#30701)\n  * Grafana-UI: Add id to Select to make it easier to test (#31230)\n  * Prometheus: Fix enabling of disabled queries when editing in dashboard (#31055)\n  * UI/Card: Fix handling of 'onClick' callback (#31225)\n  * Loki: Add line limit for annotations (#31183)\n  * Remove deprecated and breaking loki config field (#31227)\n  * SqlDataSources: Fixes the Show Generated SQL button in query editors (#31236)\n  * LibraryPanels: Disconnect before connect during dashboard save (#31235)\n  * Disable Change Password for OAuth users (#27886)\n  * TagsInput: Design update and component refactor (#31163)\n  * Variables: Adds back default option for data source variable (#31208)\n  * IPv6: Support host address configured with enclosing square brackets (#31226)\n  * Postgres: Fix timeGroup macro converts long intervals to invalid numbers when TimescaleDB is enabled (#31179)\n  * GraphNG: refactor core to class component (#30941)\n  * Remove last synchronisation field from LDAP debug view (#30984)\n  * Chore: Upgrade grafana-plugin-sdk-go to v0.88.0 (#30975)\n  * Graph: Make axes unit option work even when field option unit is set (#31205)\n  * AlertingNG:  Test definition  (#30886)\n  * Docs: Update Influx config options (#31146)\n  * WIP: Skip this call when we skip migrations (#31216)\n  * use 0.1.0 (#31215)\n  * DataSourceSrv: Filter out non queryable data sources by default (#31144)\n  * QueryEditors: Fixes issue that happens after moving queries then editing would update other queries (#31193)\n  * Chore: report eslint no-explicit-any errors to metrics (#31182)\n  * Chore(deps): Bump cloud.google.com/go/storage from 1.12.0 to 1.13.0 (#31211)\n  * Chore(deps): Bump xorm.io/xorm from 0.8.1 to 0.8.2 (#30773)\n  * Alerting: Fix modal text for deleting obsolete notifier (#31171)\n  * Chore(deps): Bump github.com/linkedin/goavro/v2 from 2.9.7 to 2.10.0 (#31204)\n  * Variables: Fixes missing empty elements from regex filters (#31156)\n  * StatPanels: Fixes to palette color scheme is not cleared when loading panel (#31126)\n  * Fixed the typo. (#31189)\n  * Docs: Rewrite preferences docs (#31154)\n  * Explore/Refactor: Simplify URL handling (#29173)\n  * DashboardLinks: Fixes links always cause full page reload (#31178)\n  * Replace PR with Commit truncated hash when build fails (#31177)\n  * Alert: update story to use controls (#31145)\n  * Permissions: Fix team and role permissions on folders/dashboards not displayed for non Grafana Admin users (#31132)\n  * CloudWatch: Ensure empty query row errors are not passed to the panel (#31172)\n  * Update prometheus.md (#31173)\n  * Variables: Extend option pickers to accept custom onChange callback (#30913)\n  * Prometheus: Multiply exemplars timestamp to follow api change (#31143)\n  * DashboardListPanel: Fixes issue with folder picker always showing All and using old form styles (#31160)\n  * Add author name and pr number in drone pipeline notifications (#31124)\n  * Prometheus: Add documentation for ad-hoc filters (#31122)\n  * DataSourceSettings: Fixes add header button, it should not trigger a save \u0026 test action (#31135)\n  * Alerting: Fix so that sending an alert with the Alertmanager notifier doesn't fail when one of multiple configured URL's are down (#31079)\n  * Chore: Update latest.json (#31139)\n  * Docs: add 7.4.1 relese notes link (#31137)\n  * PieChart: Progress on new core pie chart  (#28020)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.1 (#31133)\n  * Eslint: no-duplicate-imports rule (bump grafana-eslint-config) (#30989)\n  * Transforms: Fixes Outer join issue with duplicate field names not getting the same unique field names as before  (#31121)\n  * MuxWriter: Handle error for already closed file (#31119)\n  * Logging: sourcemap transform asset urls from CDN in logged stacktraces (#31115)\n  * Search: add sort information in dashboard results (#30609)\n  * area/grafana/e2e: ginstall should pull version specified (#31056)\n  * Exemplars: Change CTA style (#30880)\n  * Influx: Make max series limit configurable and show the limiting message if applied (#31025)\n  * Docs: request security (#30937)\n  * update configurePanel for 7.4.0 changes (#31093)\n  * Elasticsearch: fix log row context erroring out (#31088)\n  * Prometheus: Fix issues with ad-hoc filters (#30931)\n  * LogsPanel: Add deduplication option for logs (#31019)\n  * Drone: Make sure CDN upload is ok before pushing docker images (#31075)\n  * PluginManager: Remove some global state (#31081)\n  * test: update addDashboard flow for v7.4.0 changes (#31059)\n  * Transformations: Fixed typo in FilterByValue transformer description. (#31078)\n  * Docs: Group id should be 0 instead of 1 in Docker upgrade notes (#31074)\n  * Usage stats: Adds source/distributor setting (#31039)\n  * CDN: Add CDN upload step to enterprise and release pipelines (#31058)\n  * Chore: Replace native select with grafana ui select  (#31030)\n  * Docs: Update json-model.md (#31066)\n  * Docs: Update whats-new-in-v7-4.md (#31069)\n  * Added hyperlinks to Graphite documentation (#31064)\n  * DashboardSettings: Update to new form styles (#31022)\n  * CDN: Fixing drone CI config (#31052)\n  * convert path to posix by default (#31045)\n  * DashboardLinks: Fixes crash when link has no title (#31008)\n  * Alerting: Fixes so notification channels are properly deleted (#31040)\n  * Explore: Remove emotion error when displaying logs (#31026)\n  * Elasticsearch: Fix alias field value not being shown in query editor (#30992)\n  * CDN: Adds uppload to CDN step to drone CI (#30879)\n  * Improved glossary (#31004)\n  * BarGauge: Improvements to value sizing and table inner width calculations  (#30990)\n  * Drone: Fix deployment image (#31027)\n  * ColorPicker: migrated styles from sass to emotion (#30909)\n  * Dashboard: Migrate general settings to react (#30914)\n  * Chore(deps): Bump github.com/jung-kurt/gofpdf from 1.10.1 to 1.16.2 (#30586)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.36.31 to 1.37.7 (#31018)\n  * Prometheus: Min step defaults to seconds when no unit is set to prevent errors when running alerts. (#30966)\n  * Chore(deps): Bump github.com/magefile/mage from 1.10.0 to 1.11.0 (#31017)\n  * Chore(deps): Bump github.com/grpc-ecosystem/go-grpc-middleware (#31013)\n  * Graph: Fixes so graph is shown for non numeric time values (#30972)\n  * CloudMonitoring: Prevent resource type variable function from crashing (#30901)\n  * Chore(deps): Bump google.golang.org/api from 0.33.0 to 0.39.0 (#30971)\n  * Build: Releases e2e and e2e-selectors too (#31006)\n  * TextPanel: Fixes so panel title is updated when variables change (#30884)\n  * Docs: Update configuration.md (login_maximum_inactive_lifetime_duration, login_maximum_lifetime_duration) (#31000)\n  * instrumentation: make the first database histogram bucket smaller (#30995)\n  * Grafana/UI: Remove DismissableFeatureInfoBox and replace with LocalSt… (#30988)\n  * StatPanel: Fixes issue formatting date values using unit option (#30979)\n  * Chore(deps): Bump actions/cache from v2 to v2.1.4 (#30973)\n  * Units: Fixes formatting of duration units (#30982)\n  * Elasticsearch: Show Size setting for raw_data metric (#30980)\n  * Alerts: Dedupe alerts so that we do not fill the screen with the same alert messsage (#30935)\n  * make sure service and slo display name is passed to segment comp (#30900)\n  * assign changes in cloud datasources to the new cloud datasources team (#30645)\n  * Table: Updates devenv test dashboard after change to TestData Randrom Table response (#30927)\n  * Theme: Use higher order theme color variables rather then is light/dark logic (#30939)\n  * Docs: Add alias for what's new in 7.4 (#30945)\n  * e2e: extends selector factory to plugins (#30932)\n  * Chore: Upgrade docker build image (#30820)\n  * Docs: updated developer guide (#29978)\n  * Alerts: Update Alert storybook to show more states (#30908)\n  * Variables: Adds queryparam formatting option (#30858)\n  * Chore: pad unknown values with undefined (#30808)\n  * Transformers: add search to transform selection (#30854)\n  * Exemplars: change api to reflect latest changes (#30910)\n  * docs: use selinux relabelling on docker containers (#27685)\n  * Docs: Fix bad image path for alert notification template (#30911)\n  * Make value mappings correctly interpret numeric-like strings (#30893)\n  * Chore: Update latest.json (#30905)\n  * Docs: Update whats-new-in-v7-4.md (#30882)\n  * Dashboard: Ignore changes to dashboard when the user session expires (#30897)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0 (#30902)\n  * test: add support for timeout to be passed in for addDatasource (#30736)\n  * increase page size and make sure the cache supports query params (#30892)\n  * DataSourceSettings: Adds info box and link to Grafana Cloud (#30891)\n  * OAuth: custom username docs (#28400)\n  * Panels: Remove value mapping of values that have been formatted #26763 (#30868)\n  * Alerting: Fixes alert panel header icon not showing (#30840)\n  * AlertingNG: Edit Alert Definition (#30676)\n  * Logging: sourcemap support for frontend stacktraces (#30590)\n  * Added 'Restart Grafana' topic. (#30844)\n  * Docs: Org, Team, and User Admin (#30756)\n  * bump grabpl version to 0.5.36 (#30874)\n  * Plugins: Requests validator (#30445)\n  * Docs: Update whats-new-in-v7-4.md (#30876)\n  * Docs: Add server view folder (#30849)\n  * Fixed image name and path  (#30871)\n  * Grafana-ui: fixes closing modals with escape key (#30745)\n  * InfluxDB: Add http configuration when selecting InfluxDB v2 flavor  (#30827)\n  * TestData: Fixes issue with for ever loading state when all queries are hidden (#30861)\n  * Chart/Tooltip: refactored style declaration (#30824)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30853)\n  * Grafana-ui: fixes no data message in Table component (#30821)\n  * grafana/ui: Update pagination component for large number of pages (#30151)\n  * Alerting: Customise OK notification priorities for Pushover notifier (#30169)\n  * DashboardLinks: Support variable expression in to tooltip - Issue #30409 (#30569)\n  * Chore: Remove panelTime.html, closes #30097 (#30842)\n  * Docs: Time series panel, bar alignment docs (#30780)\n  * Chore: add more docs annotations (#30847)\n  * Transforms: allow boolean in field calculations (#30802)\n  * Prometheus: Add tooltip to explain possibility to use patterns in text and title fields in annotations (#30825)\n  * Update prometheus.md with image link fix (#30833)\n  * BarChart: inside-align strokes, upgrade uPlot to 1.6.4. (#30806)\n  * Update license-expiration.md (#30839)\n  * Explore rewrite (#30804)\n  * Prometheus: Set type of labels to string (#30831)\n  * GrafanaUI: Add a way to persistently close InfoBox (#30716)\n  * Fix typo in transformer registry (#30712)\n  * Elasticsearch: Display errors with text responses (#30122)\n  * CDN: Fixes cdn path when Grafana is under sub path (#30822)\n  * TraceViewer: Fix lazy loading (#30700)\n  * FormField: migrated sass styling to emotion (#30392)\n  * AlertingNG: change API permissions (#30781)\n  * Variables: Clears drop down state when leaving dashboard (#30810)\n  * Grafana-UI: Add story/docs for ErrorBoundary (#30304)\n  * Add missing callback dependency (#30797)\n  * PanelLibrary: Adds library panel meta information to dashboard json (#30770)\n  * Chore(deps): Bump gonum.org/v1/gonum from 0.6.0 to 0.8.2 (#30343)\n  * Chore(deps): Bump gopkg.in/yaml.v2 from 2.3.0 to 2.4.0 (#30771)\n  * GraphNG: improve behavior when switching between solid/dash/dots (#30796)\n  * Chore(deps): Bump github.com/hashicorp/go-hclog from 0.14.1 to 0.15.0 (#30778)\n  * Add width for Variable Editors (#30791)\n  * Chore: Remove warning when calling resource (#30752)\n  * Auth: Use SigV4 lib from grafana-aws-sdk  (#30713)\n  * Panels: Fixes so panels are refreshed when scrolling past them fast (#30784)\n  * GraphNG: add bar alignment option (#30499)\n  * Expressions: Measure total transformation requests and elapsed time (#30514)\n  * Menu: Mark menu components as internal (#30740)\n  * TableInputCSV: migrated styles from sass to emotion (#30554)\n  * CDN: Fix passing correct prefix to GetContentDeliveryURL (#30777)\n  * Chore(deps): Bump gopkg.in/ini.v1 from 1.57.0 to 1.62.0 (#30772)\n  * CDN: Adds support for serving assets over a CDN (#30691)\n  * PanelEdit: Trigger refresh when changing data source (#30744)\n  * Chore: remove __debug_bin (#30725)\n  * BarChart: add alpha bar chart panel (#30323)\n  * Docs: Time series panel (#30690)\n  * Backend Plugins: Convert test data source to use SDK contracts (#29916)\n  * Docs: Update whats-new-in-v7-4.md (#30747)\n  * Add link to Elasticsearch docs. (#30748)\n  * Mobile: Fixes issue scrolling on mobile in chrome (#30746)\n  * TagsInput: Make placeholder configurable (#30718)\n  * Docs: Add config settings for fonts in reporting (#30421)\n  * Add menu.yaml to .gitignore (#30743)\n  * bump cypress to 6.3.0 (#30644)\n  * Datasource: Use json-iterator configuration compatible with standard library (#30732)\n  * AlertingNG: Update UX to use new PageToolbar component (#30680)\n  * Docs: Add usage insights export feature (#30376)\n  * skip symlinks to directories when generating plugin manifest (#30721)\n  * PluginCiE2E: Upgrade base images (#30696)\n  * Variables: Fixes so text format will show All instead of custom all (#30730)\n  * PanelLibrary: better handling of deleted panels (#30709)\n  * Added section 'Curated dashboards for Google Cloud Monitoring' for 7.4 What's New (#30724)\n  * Added 'curated dashboards' information and broke down, rearranged topics. (#30659)\n  * Transform: improve the 'outer join' performance/behavior (#30407)\n  * Add alt text to plugin logos (#30710)\n  * Deleted menu.yaml file (#30717)\n  * Dashboard: Top Share URL icon should share panel URL when on viewPanel page (#30000)\n  * Added entry for web server. (#30715)\n  * DashboardPicker: switch to promise-based debounce, return dashboard UID (#30706)\n  * Use connected GraphNG in Explore (#30707)\n  * Fix documentation for streaming data sources (#30704)\n  * PanelLibrary: changes casing of responses and adds meta property (#30668)\n  * Influx: Show all datapoints for dynamically windowed flux query (#30688)\n  * Trace: trace to logs design update (#30637)\n  * DeployImage: Switch base images to Debian (#30684)\n  * Chore: remove CSP debug logging line (#30689)\n  * Docs: 7.4 documentation for expressions (#30524)\n  * PanelEdit: Get rid of last remaining usage of navbar-button (#30682)\n  * Grafana-UI: Fix setting default value for MultiSelect (#30671)\n  * CustomScrollbar: migrated styles from sass to emotion (#30506)\n  * DashboardSettings \u0026 PanelEdit: Use new PageToolbar (#30675)\n  * Explore: Fix jumpy live tailing (#30650)\n  * ci(npm-publish): add missing github package token to env vars (#30665)\n  * PageToolbar: Extracting navbar styles \u0026 layout into a modern emotion based component (#30588)\n  * AlertingNG: pause/unpause definitions via the API (#30627)\n  * Docs: Refer to product docs in whats new for alerting templating feature (#30652)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30666)\n  * Variables: Fixes display value when using capture groups in regex (#30636)\n  * Docs: Update _index.md (#30655)\n  * Docs: Auditing updates (#30433)\n  * Docs: add hidden_users configuration field (#30435)\n  * Docs: Define TLS/SSL terminology (#30533)\n  * Docs: Fix expressions enabled description (#30589)\n  * Docs: Update ES screenshots (#30598)\n  * Licensing Docs: Adding license restrictions docs (#30216)\n  * Update documentation-style-guide.md (#30611)\n  * Docs: Update queries.md (#30616)\n  * chore(grafana-ui): bump storybook to 6.1.15 (#30642)\n  * DashboardSettings: fixes vertical scrolling (#30640)\n  * Usage Stats: Remove unused method for getting user stats (#30074)\n  * Grafana/UI: Unit picker should not set a category as unit (#30638)\n  * Graph: Fixes auto decimals issue in legend and tooltip (#30628)\n  * AlertingNG: List saved Alert definitions in Alert Rule list (#30603)\n  * chore: bump redux toolkit to 1.5.0 for immer 8.0.1 vulnerability fix (#30605)\n  * Grafana/UI: Add disable prop to Segment (#30539)\n  * Variables: Fixes so queries work for numbers values too (#30602)\n  * Admin: Fixes so form values are filled in from backend (#30544)\n  * Docs: Add new override info and add whats new 7.4 links (#30615)\n  * TestData: Improve what's new in v7.4 (#30612)\n  * Docs: Update 7.4 What's New to use more correct description of alerting notification template feature (#30502)\n  * NodeGraph: Add docs (#30504)\n  * Loki: Improve live tailing errors and fix Explore's logs container type errors (#30517)\n  * TimeRangePicker: Updates components to use new ToolbarButton \u0026 ButtonGroup (#30570)\n  * Update styling.md guide (#30594)\n  * TestData: Adding what's new in v7.4 to the devenv dashboards (#30568)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.35.5 to 1.36.31 (#30583)\n  * Chore(deps): Bump github.com/prometheus/client_golang (#30585)\n  * Chore(deps): Bump gopkg.in/macaron.v1 from 1.3.9 to 1.4.0 (#30587)\n  * Chore(deps): Bump github.com/google/uuid from 1.1.5 to 1.2.0 (#30584)\n  * Explore: Fix logs hover state so that it is visible and in dark mode \u0026 simply hover code (#30572)\n  * RefreshPicker: Fixes so valid intervals in url are visible in RefreshPicker (#30474)\n  * Add documentation for Exemplars (#30317)\n  * OldGraph: Fix height issue in Firefox (#30565)\n  * XY Chart: fix editor error with empty frame (no fields) (#30573)\n  * ButtonSelect \u0026 RefreshPicker: Rewrite of components to use new emotion based ToolbarButton \u0026 Menu (#30510)\n  * XY Chart: share legend config with timeseries (#30559)\n  * configuration.md: Document Content Security Policy options (#30413)\n  * DataFrame: cache frame/field index in field state (#30529)\n  * List + before -; rm old Git ref; reformat. (#30543)\n  * Expressions: Add option to disable feature (#30541)\n  * Explore: Fix loading visualisation on the top of the new time series panel (#30553)\n  * Prometheus: Fix show query instead of Value if no __name__ and metric (#30511)\n  * Decimals: Big Improvements to auto decimals and fixes to auto decimals bug found in 7.4-beta1  (#30519)\n  * Postgres: Convert tests to stdlib (#30536)\n  * Storybook: Migrate card story to use controls  (#30535)\n  * AlertingNG: Enable UI to Save Alert Definitions (#30394)\n  * Postgres: Be consistent about TLS/SSL terminology (#30532)\n  * Loki: Append refId to logs uid (#30418)\n  * Postgres: Fix indentation (#30531)\n  * GraphNG: uPlot 1.6.3 (fix bands not filling below 0). close #30523. (#30527)\n  * updates for e2e docker image (#30465)\n  * GraphNG: uPlot 1.6.2 (#30521)\n  * Docs: Update whats-new-in-v7-4.md (#30520)\n  * Prettier: ignore build and devenv dirs (#30501)\n  * Chore: Upgrade grabpl version (#30486)\n  * Explore: Update styling of buttons (#30493)\n  * Cloud Monitoring: Fix legend naming with display name override (#30440)\n  * GraphNG: Disable Plot logging by default (#30390)\n  * Admin: Fixes so whole org drop down is visible when adding users to org (#30481)\n  * Docs: include Makefile option for local assets (#30455)\n  * Footer: Fixes layout issue in footer  (#30443)\n  * TimeSeriesPanel: Fixed default value for gradientMode (#30484)\n  * Docs: fix typo in what's new doc (#30489)\n  * Chore: adds wait to e2e test (#30488)\n  * chore: update packages dependent on dot-prop to fix security vulnerability (#30432)\n  * Dashboard: Remove Icon and change copy -\u003e Copy to clipboard in the share embedded panel modal (#30480)\n  * Chore: fix spelling mistake (#30473)\n  * Chore: Restrict internal imports from other packages (#30453)\n  * Docs: What's new fixes and improvements (#30469)\n  * Timeseries: only migrage point size when configured (#30461)\n  * Alerting: Hides threshold handle for percentual thresholds (#30431)\n  * Graph: Fixes so only users with correct permissions can add annotations (#30419)\n  * Chore: update latest version to 7.4.0-beta1 (#30452)\n  * Docs: Add whats new 7.4 links (#30463)\n  * Update whats-new-in-v7-4.md (#30460)\n  * docs: 7.4 what's new (Add expressions note) (#30446)\n  * Chore: Upgrade build pipeline tool (#30456)\n  * PanelModel: Make sure the angular options are passed to react panel type changed handler (#30441)\n  * Expressions: Fix button icon (#30444)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30449)\n  * Docs: Fix img link for alert notification template (#30436)\n  * grafana/ui: Fix internal import from grafana/data (#30439)\n  * prevent field config from being overwritten (#30437)\n  * PanelOptions: Refactoring applying panel and field options out of PanelModel and add property clean up for properties not in field config registry  (#30389)\n  * Dashboard: Remove template variables option from ShareModal (#30395)\n  * Added doc content for variables inspector code change by Hugo (#30408)\n  * Docs: update license expiration behavior for reporting (#30420)\n  * Chore: use old version format in package.json (#30430)\n  * Chore: upgrade NPM security vulnerabilities (#30397)\n  * 'Release: Updated versions in package to 7.5.0-pre.0' (#30428)\n  * contribute: Add backend and configuration guidelines for PRs (#30426)\n  * Chore: Update what's new URL (#30424)\n- Update to version 7.4.5\n- CVE-2021-28146, CVE-2021-28147: Fix API permissions issues related to team-sync. (Enterprise) (bsc#1183811, bsc#1183809)\n- CVE-2021-28148: Usage insights requires signed in users. (Enterprise) (bsc#1183813)\n- CVE-2021-27962: Do not allow editors to incorrectly bypass permissions on the default data source. (Enterprise) (bsc#1184371)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-08-13T11:17:54Z","modified":"2026-02-04T03:24:52.617834Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2662-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\n- CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)\n- Update to version 7.5.7:\n  * Updated relref to 'Configuring exemplars' section (#34240) (#34243)\n  * Added exemplar topic (#34147) (#34226)\n  * Quota: Do not count folders towards dashboard quota (#32519) (#34025)\n  * Instructions to separate emails with semicolons (#32499) (#34138)\n  * Docs: Remove documentation of v8 generic OAuth feature (#34018)\n  * Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)\n  * [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)\n  * Stop hoisting @icons/material (#33922)\n  * Chore: fix react-color version in yarn.lock (#33914)\n  * 'Release: Updated versions in package to 7.5.6' (#33909)\n  * Loki: fix label browser crashing when + typed (#33900) (#33901)\n  * Document `hide_version` flag (#33670) (#33881)\n  * Add isolation level db configuration parameter (#33830) (#33878)\n  * Sanitize PromLink button (#33874) (#33876)\n  * Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)\n  * Docs feedback: /administration/provisioning.md (#33804) (#33842)\n  * Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)\n  * Docs: Update _index.md (#33797) (#33799)\n  * Docs: Update installation.md (#33656) (#33703)\n  * GraphNG: uPlot 1.6.9 (#33598) (#33612)\n  * dont consider invalid email address a failed email (#33671) (#33681)\n  * InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)\n  * add template for dashboard url parameters  (#33549) (#33588)\n  * Add note to Snapshot API doc to specify that user has to provide the entire dashboard model  (#33572) (#33586)\n  * Update team.md (#33454) (#33536)\n  * Removed duplicate file 'dashboard_folder_permissions.md (#33497)\n  * Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)\n  * Documentation: Update developer-guide.md (#33478) (#33490)\n  * add closed parenthesis to fix a hyperlink (#33471) (#33481)\n\n- Update to version 7.5.5:\n  * 'Release: Updated versions in package to 7.5.5' (#33469)\n  * GraphNG: Fix exemplars window position (#33427) (#33462)\n  * Remove field limitation from slack notification (#33113) (#33455)\n  * Prometheus: Support POST in template variables (#33321) (#33441)\n  * Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)\n  * Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)\n  * Docs: Removed type from find annotations example. (#33399) (#33403)\n  * [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)\n  * Updated label for add panel. (#33285) (#33286)\n  * Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)\n  * Docs: Sync latest master docs with 7.5.x (#33156)\n  * Docs: Update getting-started-influxdb.md (#33234) (#33241)\n  * Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)\n  * Minor Changes in Auditing.md (#31435) (#33238)\n  * Docs: Add license check endpoint doc (#32987) (#33236)\n  * Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)\n  * Docs: InfluxDB doc improvements (#32815) (#33185)\n  * [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)\n  * update cla (#33181)\n  * Fix inefficient regular expression (#33155) (#33159)\n  * Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)\n  * Elasticsearch:  Add documentation for supported Elasticsearch query transformations (#33072) (#33128)\n  * Update team.md (#33060) (#33084)\n  * GE issue 1268 (#33049) (#33081)\n  * Fixed some formatting issues for PRs from yesterday. (#33078) (#33079)\n  * Explore: Load default data source in Explore when the provided source does not exist (#32992) (#33061)\n  * Docs: Replace next with latest in aliases (#33054) (#33059)\n  * Added missing link item. (#33052) (#33055)\n  * Backport 33034 (#33038)\n  * Docs: Backport 32916 to v7.5x  (#33008)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.4 (#32973) (#32998)\n  * Elasticsearch: Force re-rendering of each editor row type change (#32993) (#32996)\n  * Docs: Sync release branch with latest docs (#32986)\n\n- Update to version 7.5.4:\n  * 'Release: Updated versions in package to 7.5.4' (#32971)\n  * fix(datasource_srv): prevent infinite loop where default datasource is named default (#32949) (#32967)\n  * Added Azure Monitor support for Microsoft.AppConfiguration/configurationStores namespace (#32123) (#32968)\n  * fix sqlite3 tx retry condition operator precedence (#32897) (#32952)\n  * AzureMonitor: Add support for Virtual WAN namespaces (#32935) (#32947)\n  * Plugins: Allow a non-dashboard page to be the default home page (#32926) (#32945)\n  * GraphNG: uPlot 1.6.8 (#32859) (#32863)\n  * Alerting: Add ability to include aliases with dashes (/) and at (@) signs in InfluxDB (#32844)\n  * Prometheus: Allow exemplars endpoint in data source proxy (#32802) (#32804)\n  * [v7.5.x] Table: Fixes table data links so they refer to correct row after sorting (#32758)\n  * TablePanel: Makes sorting case-insensitive (#32435) (#32752)\n\n- Update to version 7.5.3:\n  * 'Release: Updated versions in package to 7.5.3' (#32745)\n  * FolderPicker: Prevent dropdown menu from disappearing off screen (#32603) (#32741)\n  * Loki: Remove empty annotations tags (#32359) (#32490)\n  * SingleStat: fix wrong call to getDataLinkUIModel (#32721) (#32739)\n  * Prometheus: Fix instant query to run two times when exemplars enabled (#32508) (#32726)\n  * Elasticsearch: Fix bucket script variable duplication in UI (#32705) (#32714)\n  * Variables: Confirms selection before opening new picker (#32586) (#32710)\n  * CloudWarch: Fix service quotas link (#32686) (#32689)\n  * Configuration: Prevent browser hanging / crashing with large number of org users (#32546) (#32598)\n  * chore: bump execa to v2.1.0 (#32543) (#32592)\n  * Explore: Fix bug where navigating to explore would result in wrong query and datasource to be shown (#32558)\n  * Fix broken gtime tests (#32582) (#32587)\n  * resolve conflicts (#32567)\n  * gtime: Make ParseInterval deterministic (#32539) (#32560)\n  * Dashboard: No longer includes default datasource when externally exporting dashboard with row (#32494) (#32535)\n  * TextboxVariable: Limits the length of the preview value (#32472) (#32530)\n  * AdHocVariable: Adds default data source (#32470) (#32476)\n  * Variables: Fixes Unsupported data format error for null values (#32480) (#32487)\n  * Prometheus: align exemplars check to latest api change (#32513) (#32515)\n  * 'Release: Updated versions in package to 7.5.2' (#32502)\n  * SigV4: Add support EC2 IAM role auth and possibility to toggle auth providers  (#32444) (#32488)\n  * Set spanNulls to default (#32471) (#32486)\n  * Graph: Fix setting right y-axis when standard option unit is configured (#32426) (#32442)\n  * API: Return 409 on datasource version conflict (#32425) (#32433)\n  * API: Return 400 on invalid Annotation requests (#32429) (#32431)\n  * Variables: Fixes problem with data source variable when default ds is selected (#32384) (#32424)\n  * Table: Fixes so links work for image cells (#32370) (#32410)\n  * Variables: Fixes error when manually non-matching entering custom value in variable input/picker (#32390) (#32394)\n  * DashboardQueryEditor: Run query after selecting source panel (#32383) (#32395)\n  * API: Datasource endpoint should return 400 bad request if id and orgId is invalid (#32392) (#32397)\n  * 'Release: Updated versions in package to 7.5.1' (#32362)\n  * MSSQL: Upgrade go-mssqldb (#32347) (#32361)\n  * GraphNG: Fix tooltip displaying wrong or no data (#32312) (#32348)\n  * 'Release: Updated versions in package to 7.5.0' (#32308)\n  * Loki: Fix text search in Label browser (#32293) (#32306)\n  * Explore: Show all dataFrames in data tab in Inspector (#32161) (#32299)\n  * PieChartV2: Add migration from old piechart (#32259) (#32291)\n  * LibraryPanels: Adds Type and Description to DB (#32258) (#32288)\n  * LibraryPanels: Prevents deletion of connected library panels (#32277) (#32284)\n  * Library Panels: Add 'Discard' button to panel save modal (#31647) (#32281)\n  * LibraryPanels: Changes to non readonly reducer (#32193) (#32200)\n  * Notifications: InfluxDB - Fix regex to include metrics with hyphen in aliases (#32224) (#32262)\n  * SSE/InfluxDB: Change InfluxQL to work with server side expressions (#31691) (#32102)\n  * DashboardSettings: Fixes issue with tags list not updating when changes are made (#32241) (#32247)\n  * Logs: If log message missing, use empty string (#32080) (#32243)\n  * CloudWatch: Use latest version of aws sdk (#32217) (#32223)\n  * Release: Updated versions in package to 7.5.0-beta.2 (#32158)\n  * HttpServer: Make read timeout configurable but disabled by default (#31575) (#32154)\n  * GraphNG: Ignore string fields when building data for uPlot in GraphNG (#32150) (#32151)\n  * Fix loading timezone info on windows (#32029) (#32149)\n  * SQLStore: Close session in withDbSession (#31775) (#32108)\n  * Remove datalink template suggestions for accessing specific fields when there are multiple dataframes. (#32057) (#32148)\n  * GraphNG: make sure dataset and config are in sync when initializing and re-initializing uPlot (#32106) (#32125)\n  * MixedDataSource: Name is updated when data source variable changes (#32090) (#32144)\n  * Backport 32005 to v7.5.x #32128 (#32130)\n  * Loki: Label browser UI updates (#31737) (#32119)\n  * ValueMappings: Fixes value 0 not being mapped (#31924) (#31929)\n  * GraphNG: Fix tooltip series color for multi data frame scenario (#32098) (#32103)\n  * LibraryPanels: Improves the Get All experience (#32028) (#32093)\n  * Grafana/ui: display all selected levels for selected value when searching (#32030) (#32032)\n  * Exemplars: always query exemplars (#31673) (#32024)\n  * [v7.5.x] TimePicker: Fixes hidden time picker shown in kiosk TV mode (#32055)\n  * Chore: Collect elasticsearch version usage stats (#31787) (#32063)\n  * Chore: Tidy up Go deps (#32053)\n  * GraphNG: Fix PlotLegend field display name being outdated (#32064) (#32066)\n  * Data proxy: Fix encoded characters in URL path should be proxied encoded (#30597) (#32060)\n  * [v7.5.x] Auth: Allow soft token revocation (#32037)\n  * Snapshots: Fix usage of sign in link from the snapshot page (#31986) (#32036)\n  * Make master green (#32011) (#32015)\n  * Query editor: avoid avoiding word wrap on query editor components (#31949) (#31982)\n  * Variables: Fixes filtering in picker with null items (#31979) (#31995)\n  * TooltipContainer - use resize observer instead of getClientBoundingRect (#31937) (#32003)\n  * Loki: Fix autocomplete when re-editing Loki label values (#31828) (#31987)\n  * Loki: Fix type errors in language_provider (#31902) (#31945)\n  * PanelInspect: Interpolates variables in CSV file name (#31936) (#31977)\n  * Cloudwatch: use shared library for aws auth (#29550) (#31946)\n  * Tooltip: partial perf improvement (#31774) (#31837) (#31957)\n  * Backport 31913 to v7.5.x (#31955)\n  * Grafana/ui: fix searchable options for Cascader with options update (#31906) (#31938)\n  * Variables: Do not reset description on variable type change (#31933) (#31939)\n  * [v7.5.x] AnnotationList: Adds spacing to UI  (#31888) (#31894)\n  * Elasticseach: Support histogram fields (#29079) (#31914)\n  * Chore: upgrade eslint and fork-ts-checker-webpack-plugin (#31854) (#31896)\n  * Update scripts and Dockerfiles to use Go 1.16.1 (#31881) (#31891)\n  * Templating: use dashboard timerange when variables are set to refresh 'On Dashboard Load' (#31721) (#31801)\n  * [v7.5.x] Tempo: Add test for backend data source (#31835) (#31882)\n  * Run go mod tidy to update go.mod and go.sum (#31859)\n  * Grafana/ui: display all selected levels for Cascader (#31729) (#31862)\n  * CloudWatch: Consume the grafana/aws-sdk (#31807) (#31861)\n  * Cloudwatch: ListMetrics API page limit (#31788) (#31851)\n  * Remove invalid attribute (#31848) (#31850)\n  * CloudWatch: Restrict auth provider and assume role usage according to… (#31845)\n  * CloudWatch: Add support for EC2 IAM role (#31804) (#31841)\n  * Loki, Prometheus: Change the placement for query type explanation (#31784) (#31819)\n  * Variables: Improves inspection performance and unknown filtering (#31811) (#31813)\n  * Change piechart plugin state to beta (#31797) (#31798)\n  * ReduceTransform: Include series with numeric string  names (#31763) (#31794)\n  * Annotations: Make the annotation clean up batch size configurable (#31487) (#31769)\n  * Fix escaping in ANSI and dynamic button removal (#31731) (#31767)\n  * DataLinks: Bring back single click links for Stat, Gauge and BarGauge panel (#31692) (#31718)\n  * log skipped, performed and duration for migrations (#31722) (#31754)\n  * Search: Make items more compact (#31734) (#31750)\n  * loki_datasource: add documentation to label_format and line_format (#31710) (#31746)\n  * Tempo: Convert tempo to backend data source2 (#31733)\n  * Elasticsearch: Fix script fields in query editor (#31681) (#31727)\n  * Elasticsearch: revert to isoWeek when resolving weekly indices (#31709) (#31717)\n  * Admin: Keeps expired api keys visible in table after delete (#31636) (#31675)\n  * Tempo: set authentication header properly (#31699) (#31701)\n  * Tempo: convert to backend data source (#31618) (#31695)\n  * Update package.json (#31672)\n  * Release: Bump version to 7.5.0-beta.1 (#31664)\n  * Fix whatsNewUrl version to 7.5 (#31666)\n  * Chore: add alias for what's new 7.5 (#31669)\n  * Docs: Update doc for PostgreSQL authentication (#31434)\n  * Docs: document report template variables (#31637)\n  * AzureMonitor: Add deprecation message for App Insights/Insights Analytics (#30633)\n  * Color: Fixes issue where colors where reset to gray when switch panels (#31611)\n  * Live: Use pure WebSocket transport (#31630)\n  * Docs: Fix broken image link (#31661)\n  * Docs: Add Whats new in 7.5 (#31659)\n  * Docs: Fix links for 7.5 (#31658)\n  * Update enterprise-configuration.md (#31656)\n  * Explore/Logs: Escaping of incorrectly escaped log lines (#31352)\n  * Tracing: Small improvements to trace types (#31646)\n  * Update _index.md (#31645)\n  * AlertingNG: code refactoring (#30787)\n  * Remove pkill gpg-agent (#31169)\n  * Remove format for plugin routes (#31633)\n  * Library Panels: Change unsaved change detection logic (#31477)\n  * CloudWatch: Added AWS Timestream Metrics and Dimensions (#31624)\n  * add new metrics and dimensions (#31595)\n  * fix devenv dashboard content typo (#31583)\n  * DashList: Sort starred and searched dashboard alphabetically (#31605)\n  * Docs: Update whats-new-in-v7-4.md (#31612)\n  * SSE: Add 'Classic Condition' on backend (#31511)\n  * InfluxDB: Improve maxDataPoints error-message in Flux-mode, raise limits (#31259)\n  * Alerting: PagerDuty: adding current state to the payload (#29270)\n  * devenv: Fix typo (#31589)\n  * Loki: Label browser (#30351)\n  * LibraryPanels: No save modal when user is on same dashboard (#31606)\n  * Bug: adding resolution for `react-use-measure` to prevent plugin tests from failing. (#31603)\n  * Update node-graph.md (#31571)\n  * test: pass Cypress options objects into selector wrappers (#31567)\n  * Loki: Add support for alerting (#31424)\n  * Tracing: Specify type of the data frame that is expected for TraceView (#31465)\n  * LibraryPanels: Adds version column (#31590)\n  * PieChart: Add color changing options to pie chart (#31588)\n  * Explore: keep enabled/disabled state in angular based QueryEditors correctly (#31558)\n  * Bring back correct legend sizing afer PlotLegend refactor (#31582)\n  * Alerting: Fix bug in Discord for when name for metric value is absent (#31257)\n  * LibraryPanels: Deletes library panels during folder deletion (#31572)\n  * chore: bump lodash to 4.17.21 (#31549)\n  * Elasticsearch: Fix impossibility to perform non-logs queries after importing queries from loki or prometheus in explore (#31518)\n  * TestData: Fixes never ending annotations scenario (#31573)\n  * CloudWatch: Added AWS Network Firewall metrics and dimensions (#31498)\n  * propagate plugin unavailable message to UI (#31560)\n  * ConfirmButton: updates story from knobs to controls (#31476)\n  * Loki: Refactor line limit to use grafana/ui component (#31509)\n  * LibraryPanels: Adds folder checks and permissions (#31473)\n  * Add guide on custom option editors (#31254)\n  * PieChart: Update text color and minor changes (#31546)\n  * Grafana-data: bump markedjs to v2.x to resolve vulnerability (#31036)\n  * Chore(deps): Bump google.golang.org/api from 0.39.0 to 0.40.0 (#31210)\n  * PieChart: Improve piechart legend and options (#31446)\n  * Chore(deps): Bump google.golang.org/grpc from 1.35.0 to 1.36.0 (#31541)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.37.7 to 1.37.20 (#31538)\n  * Chore(deps): Bump github.com/prometheus/common from 0.17.0 to 0.18.0 (#31539)\n  * Add multiselect options ui (#31501)\n  * Profile: Fixes profile preferences being accessible when anonymous access was enabled (#31516)\n  * Variables: Fixes error with: cannot read property length of undefined (#31458)\n  * Explore: Show ANSI colored logs in logs context (#31510)\n  * LogsPanel: Show all received logs  (#31505)\n  * AddPanel: Design polish  (#31484)\n  * TimeSeriesPanel: Remove unnecessary margin from legend  (#31467)\n  * influxdb: flux: handle is-hidden (#31324)\n  * Graph: Fix tooltip not showing when close to the edge of viewport  (#31493)\n  * FolderPicker: Remove useNewForms from FolderPicker (#31485)\n  * Add reportVariables feature toggle (#31469)\n  * Grafana datasource: support multiple targets (#31495)\n  * Update license-restrictions.md (#31488)\n  * Docs: Derived fields links in logs detail view (#31482)\n  * Docs: Add new data source links to Enterprise page (#31480)\n  * Convert annotations to dataframes (#31400)\n  * ReleaseNotes: Updated changelog and release notes for v7.4.2 (#31475)\n  * GrafanaUI: Fixes typescript error for missing css prop (#31479)\n  * Login: handle custom token creation error messages (#31283)\n  * Library Panels: Don't list current panel in available panels list (#31472)\n  * DashboardSettings: Migrate Link Settings to React (#31150)\n  * Frontend changes for library panels feature (#30653)\n  * Alerting notifier SensuGo: improvements in default message (#31428)\n  * AppPlugins: Options to disable showing config page in nav (#31354)\n  * add aws config (#31464)\n  * Heatmap: Fix missing/wrong value in heatmap legend (#31430)\n  * Chore: Fixes small typos (#31461)\n  * Graphite/SSE: update graphite to work with server side expressions (#31455)\n  * update the lastest version to 7.4.3 (#31457)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.3 (#31454)\n  * AWS: Add aws plugin configuration (#31312)\n  * Revert ''Release: Updated versions in package to 7.4.3' (#31444)' (#31452)\n  * Remove UserSyncInfo.tsx (#31450)\n  * Elasticsearch: Add word highlighting to search results (#30293)\n  * Chore: Fix eslint react hook warnings in grafana-ui (#31092)\n  * CloudWatch: Make it possible to specify custom api endpoint (#31402)\n  * Chore: fixed incorrect naming for disable settings (#31448)\n  * TraceViewer: Fix show log marker in spanbar (#30742)\n  * LibraryPanels: Adds permissions to getAllHandler (#31416)\n  * NamedColorsPalette: updates story from knobs to controls (#31443)\n  * 'Release: Updated versions in package to 7.4.3' (#31444)\n  * ColorPicker: updates story from knobs to controls (#31429)\n  * Streaming: Fixes an issue with time series panel and streaming data source when scrolling back from being out of view (#31431)\n  * ClipboardButton: updates story from knobs to controls (#31422)\n  * we should never log unhashed tokens (#31432)\n  * CI: Upgrade Dockerfiles wrt. Go, Node, Debian (#31407)\n  * Elasticsearch: Fix query initialization logic \u0026 query transformation from Promethous/Loki (#31322)\n  * Postgres: allow providing TLS/SSL certificates as text in addition to file paths (#30353)\n  * CloudWatch: Added AWS Ground Station metrics and dimensions (#31362)\n  * TraceViewer: Fix trace to logs icon to show in right pane (#31414)\n  * add hg team as migrations code owners (#31420)\n  * Remove tidy-check script (#31423)\n  * InfluxDB: handle columns named 'table' (#30985)\n  * Prometheus: Use configured HTTP method for /series and /labels endpoints (#31401)\n  * Devenv: Add gdev-influxdb2 data source (#31250)\n  * Update grabpl from 0.5.38 to 0.5.42 version (#31419)\n  * Move NOOP_CONTROL to storybook utils and change to a standalone file (#31421)\n  * remove squadcast details from docs (#31413)\n  * Add new Cloudwatch AWS/DDoSProtection metrics and dimensions (#31297)\n  * Logging: add frontend logging helpers to @grafana/runtime package (#30482)\n  * CallToActionCard: updates story from knobs to controls (#31393)\n  * Add eu-south-1 cloudwatch region, closes #31197 (#31198)\n  * Chore: Upgrade eslint packages (#31408)\n  * Cascader: updates story from knobs to controls (#31399)\n  * addressed issues 28763 and 30314. (#31404)\n  * Added section Query a time series database by id (#31337)\n  * Prometheus: Change default httpMethod for new instances to POST (#31292)\n  * Data source list: Use Card component (#31326)\n  * Chore: Remove gotest.tools dependency (#31391)\n  * Revert 'StoryBook: Introduces Grafana Controls (#31351)' (#31388)\n  * Chore(deps): Bump github.com/prometheus/common from 0.15.0 to 0.17.0 (#31387)\n  * AdHocVariables: Fixes crash when values are stored as numbers (#31382)\n  * Chore(deps): Bump github.com/golang/mock from 1.4.4 to 1.5.0 (#31379)\n  * Chore: Fix strict errors, down to 416 (#31365)\n  * Chore(deps): Bump github.com/getsentry/sentry-go from 0.9.0 to 0.10.0 (#31378)\n  * StoryBook: Introduces Grafana Controls (#31351)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.2 (#31313)\n  * Theming: Support for runtime theme switching and hooks for custom themes (#31301)\n  * Devenv: Remove old-versioned loki blocks and update prometheus2 block  (#31282)\n  * Zipkin: Show success on test data source (#30829)\n  * Update grot template (needs more info) (#31350)\n  * DatasourceSrv: Fix instance retrieval when datasource variable value set to 'default' (#31347)\n  * TimeSeriesPanel: Fixes overlapping time axis ticks (#31332)\n  * Grafana/UI: Add basic legend to the PieChart (#31278)\n  * SAML: single logout only enabled in enterprise (#31325)\n  * QueryEditor: handle query.hide changes in angular based query-editors (#31336)\n  * DashboardLinks: Fixes another issue where dashboard links cause full page reload (#31334)\n  * LibraryPanels: Syncs panel title with name (#31311)\n  * Chore: Upgrade golangci-lint (#31330)\n  * Add info to docs about concurrent session limits (#31333)\n  * Table: Fixes issue with fixed min and auto max with bar gauge cell (#31316)\n  * BarGuage: updates story from knobs to controls (#31223)\n  * Docs: Clarifies how to add Key/Value pairs (#31303)\n  * Usagestats: Exclude folders from total dashboard count (#31320)\n  * ButtonCascader: updates story from knobs to controls (#31288)\n  * test: allow check for Table as well as Graph for Explore e2e flow (#31290)\n  * Grafana-UI: Update tooltip type (#31310)\n  * fix 7.4.2 release note (#31299)\n  * Add `--tries 3` arg when triggering e2e-tests upon releasing (#31285)\n  * Chore: reduce strict errors for variables (#31241)\n  * update latest release version (#31296)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.2 (#31291)\n  * Correct name of Discord notifier tests (#31277)\n  * Docs: Clarifies custom date formats for variables (#31271)\n  * BigValue: updates story from knobs to controls (#31240)\n  * Docs: Annotations update (#31194)\n  * Introduce functions for interacting with library panels API (#30993)\n  * Search: display sort metadata (#31167)\n  * Folders: Editors should be able to edit name and delete folders (#31242)\n  * Make Datetime local (No date if today) working (#31274)\n  * UsageStats: Purpose named variables (#31264)\n  * Snapshots: Disallow anonymous user to create snapshots (#31263)\n  * only update usagestats every 30min (#31131)\n  * Chore: grafana-toolkit uses grafana-ui and grafana-data workspaces (#30701)\n  * Grafana-UI: Add id to Select to make it easier to test (#31230)\n  * Prometheus: Fix enabling of disabled queries when editing in dashboard (#31055)\n  * UI/Card: Fix handling of 'onClick' callback (#31225)\n  * Loki: Add line limit for annotations (#31183)\n  * Remove deprecated and breaking loki config field (#31227)\n  * SqlDataSources: Fixes the Show Generated SQL button in query editors (#31236)\n  * LibraryPanels: Disconnect before connect during dashboard save (#31235)\n  * Disable Change Password for OAuth users (#27886)\n  * TagsInput: Design update and component refactor (#31163)\n  * Variables: Adds back default option for data source variable (#31208)\n  * IPv6: Support host address configured with enclosing square brackets (#31226)\n  * Postgres: Fix timeGroup macro converts long intervals to invalid numbers when TimescaleDB is enabled (#31179)\n  * GraphNG: refactor core to class component (#30941)\n  * Remove last synchronisation field from LDAP debug view (#30984)\n  * Chore: Upgrade grafana-plugin-sdk-go to v0.88.0 (#30975)\n  * Graph: Make axes unit option work even when field option unit is set (#31205)\n  * AlertingNG:  Test definition  (#30886)\n  * Docs: Update Influx config options (#31146)\n  * WIP: Skip this call when we skip migrations (#31216)\n  * use 0.1.0 (#31215)\n  * DataSourceSrv: Filter out non queryable data sources by default (#31144)\n  * QueryEditors: Fixes issue that happens after moving queries then editing would update other queries (#31193)\n  * Chore: report eslint no-explicit-any errors to metrics (#31182)\n  * Chore(deps): Bump cloud.google.com/go/storage from 1.12.0 to 1.13.0 (#31211)\n  * Chore(deps): Bump xorm.io/xorm from 0.8.1 to 0.8.2 (#30773)\n  * Alerting: Fix modal text for deleting obsolete notifier (#31171)\n  * Chore(deps): Bump github.com/linkedin/goavro/v2 from 2.9.7 to 2.10.0 (#31204)\n  * Variables: Fixes missing empty elements from regex filters (#31156)\n  * StatPanels: Fixes to palette color scheme is not cleared when loading panel (#31126)\n  * Fixed the typo. (#31189)\n  * Docs: Rewrite preferences docs (#31154)\n  * Explore/Refactor: Simplify URL handling (#29173)\n  * DashboardLinks: Fixes links always cause full page reload (#31178)\n  * Replace PR with Commit truncated hash when build fails (#31177)\n  * Alert: update story to use controls (#31145)\n  * Permissions: Fix team and role permissions on folders/dashboards not displayed for non Grafana Admin users (#31132)\n  * CloudWatch: Ensure empty query row errors are not passed to the panel (#31172)\n  * Update prometheus.md (#31173)\n  * Variables: Extend option pickers to accept custom onChange callback (#30913)\n  * Prometheus: Multiply exemplars timestamp to follow api change (#31143)\n  * DashboardListPanel: Fixes issue with folder picker always showing All and using old form styles (#31160)\n  * Add author name and pr number in drone pipeline notifications (#31124)\n  * Prometheus: Add documentation for ad-hoc filters (#31122)\n  * DataSourceSettings: Fixes add header button, it should not trigger a save \u0026 test action (#31135)\n  * Alerting: Fix so that sending an alert with the Alertmanager notifier doesn't fail when one of multiple configured URL's are down (#31079)\n  * Chore: Update latest.json (#31139)\n  * Docs: add 7.4.1 relese notes link (#31137)\n  * PieChart: Progress on new core pie chart  (#28020)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.1 (#31133)\n  * Eslint: no-duplicate-imports rule (bump grafana-eslint-config) (#30989)\n  * Transforms: Fixes Outer join issue with duplicate field names not getting the same unique field names as before  (#31121)\n  * MuxWriter: Handle error for already closed file (#31119)\n  * Logging: sourcemap transform asset urls from CDN in logged stacktraces (#31115)\n  * Search: add sort information in dashboard results (#30609)\n  * area/grafana/e2e: ginstall should pull version specified (#31056)\n  * Exemplars: Change CTA style (#30880)\n  * Influx: Make max series limit configurable and show the limiting message if applied (#31025)\n  * Docs: request security (#30937)\n  * update configurePanel for 7.4.0 changes (#31093)\n  * Elasticsearch: fix log row context erroring out (#31088)\n  * Prometheus: Fix issues with ad-hoc filters (#30931)\n  * LogsPanel: Add deduplication option for logs (#31019)\n  * Drone: Make sure CDN upload is ok before pushing docker images (#31075)\n  * PluginManager: Remove some global state (#31081)\n  * test: update addDashboard flow for v7.4.0 changes (#31059)\n  * Transformations: Fixed typo in FilterByValue transformer description. (#31078)\n  * Docs: Group id should be 0 instead of 1 in Docker upgrade notes (#31074)\n  * Usage stats: Adds source/distributor setting (#31039)\n  * CDN: Add CDN upload step to enterprise and release pipelines (#31058)\n  * Chore: Replace native select with grafana ui select  (#31030)\n  * Docs: Update json-model.md (#31066)\n  * Docs: Update whats-new-in-v7-4.md (#31069)\n  * Added hyperlinks to Graphite documentation (#31064)\n  * DashboardSettings: Update to new form styles (#31022)\n  * CDN: Fixing drone CI config (#31052)\n  * convert path to posix by default (#31045)\n  * DashboardLinks: Fixes crash when link has no title (#31008)\n  * Alerting: Fixes so notification channels are properly deleted (#31040)\n  * Explore: Remove emotion error when displaying logs (#31026)\n  * Elasticsearch: Fix alias field value not being shown in query editor (#30992)\n  * CDN: Adds uppload to CDN step to drone CI (#30879)\n  * Improved glossary (#31004)\n  * BarGauge: Improvements to value sizing and table inner width calculations  (#30990)\n  * Drone: Fix deployment image (#31027)\n  * ColorPicker: migrated styles from sass to emotion (#30909)\n  * Dashboard: Migrate general settings to react (#30914)\n  * Chore(deps): Bump github.com/jung-kurt/gofpdf from 1.10.1 to 1.16.2 (#30586)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.36.31 to 1.37.7 (#31018)\n  * Prometheus: Min step defaults to seconds when no unit is set to prevent errors when running alerts. (#30966)\n  * Chore(deps): Bump github.com/magefile/mage from 1.10.0 to 1.11.0 (#31017)\n  * Chore(deps): Bump github.com/grpc-ecosystem/go-grpc-middleware (#31013)\n  * Graph: Fixes so graph is shown for non numeric time values (#30972)\n  * CloudMonitoring: Prevent resource type variable function from crashing (#30901)\n  * Chore(deps): Bump google.golang.org/api from 0.33.0 to 0.39.0 (#30971)\n  * Build: Releases e2e and e2e-selectors too (#31006)\n  * TextPanel: Fixes so panel title is updated when variables change (#30884)\n  * Docs: Update configuration.md (login_maximum_inactive_lifetime_duration, login_maximum_lifetime_duration) (#31000)\n  * instrumentation: make the first database histogram bucket smaller (#30995)\n  * Grafana/UI: Remove DismissableFeatureInfoBox and replace with LocalSt… (#30988)\n  * StatPanel: Fixes issue formatting date values using unit option (#30979)\n  * Chore(deps): Bump actions/cache from v2 to v2.1.4 (#30973)\n  * Units: Fixes formatting of duration units (#30982)\n  * Elasticsearch: Show Size setting for raw_data metric (#30980)\n  * Alerts: Dedupe alerts so that we do not fill the screen with the same alert messsage (#30935)\n  * make sure service and slo display name is passed to segment comp (#30900)\n  * assign changes in cloud datasources to the new cloud datasources team (#30645)\n  * Table: Updates devenv test dashboard after change to TestData Randrom Table response (#30927)\n  * Theme: Use higher order theme color variables rather then is light/dark logic (#30939)\n  * Docs: Add alias for what's new in 7.4 (#30945)\n  * e2e: extends selector factory to plugins (#30932)\n  * Chore: Upgrade docker build image (#30820)\n  * Docs: updated developer guide (#29978)\n  * Alerts: Update Alert storybook to show more states (#30908)\n  * Variables: Adds queryparam formatting option (#30858)\n  * Chore: pad unknown values with undefined (#30808)\n  * Transformers: add search to transform selection (#30854)\n  * Exemplars: change api to reflect latest changes (#30910)\n  * docs: use selinux relabelling on docker containers (#27685)\n  * Docs: Fix bad image path for alert notification template (#30911)\n  * Make value mappings correctly interpret numeric-like strings (#30893)\n  * Chore: Update latest.json (#30905)\n  * Docs: Update whats-new-in-v7-4.md (#30882)\n  * Dashboard: Ignore changes to dashboard when the user session expires (#30897)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0 (#30902)\n  * test: add support for timeout to be passed in for addDatasource (#30736)\n  * increase page size and make sure the cache supports query params (#30892)\n  * DataSourceSettings: Adds info box and link to Grafana Cloud (#30891)\n  * OAuth: custom username docs (#28400)\n  * Panels: Remove value mapping of values that have been formatted #26763 (#30868)\n  * Alerting: Fixes alert panel header icon not showing (#30840)\n  * AlertingNG: Edit Alert Definition (#30676)\n  * Logging: sourcemap support for frontend stacktraces (#30590)\n  * Added 'Restart Grafana' topic. (#30844)\n  * Docs: Org, Team, and User Admin (#30756)\n  * bump grabpl version to 0.5.36 (#30874)\n  * Plugins: Requests validator (#30445)\n  * Docs: Update whats-new-in-v7-4.md (#30876)\n  * Docs: Add server view folder (#30849)\n  * Fixed image name and path  (#30871)\n  * Grafana-ui: fixes closing modals with escape key (#30745)\n  * InfluxDB: Add http configuration when selecting InfluxDB v2 flavor  (#30827)\n  * TestData: Fixes issue with for ever loading state when all queries are hidden (#30861)\n  * Chart/Tooltip: refactored style declaration (#30824)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30853)\n  * Grafana-ui: fixes no data message in Table component (#30821)\n  * grafana/ui: Update pagination component for large number of pages (#30151)\n  * Alerting: Customise OK notification priorities for Pushover notifier (#30169)\n  * DashboardLinks: Support variable expression in to tooltip - Issue #30409 (#30569)\n  * Chore: Remove panelTime.html, closes #30097 (#30842)\n  * Docs: Time series panel, bar alignment docs (#30780)\n  * Chore: add more docs annotations (#30847)\n  * Transforms: allow boolean in field calculations (#30802)\n  * Prometheus: Add tooltip to explain possibility to use patterns in text and title fields in annotations (#30825)\n  * Update prometheus.md with image link fix (#30833)\n  * BarChart: inside-align strokes, upgrade uPlot to 1.6.4. (#30806)\n  * Update license-expiration.md (#30839)\n  * Explore rewrite (#30804)\n  * Prometheus: Set type of labels to string (#30831)\n  * GrafanaUI: Add a way to persistently close InfoBox (#30716)\n  * Fix typo in transformer registry (#30712)\n  * Elasticsearch: Display errors with text responses (#30122)\n  * CDN: Fixes cdn path when Grafana is under sub path (#30822)\n  * TraceViewer: Fix lazy loading (#30700)\n  * FormField: migrated sass styling to emotion (#30392)\n  * AlertingNG: change API permissions (#30781)\n  * Variables: Clears drop down state when leaving dashboard (#30810)\n  * Grafana-UI: Add story/docs for ErrorBoundary (#30304)\n  * Add missing callback dependency (#30797)\n  * PanelLibrary: Adds library panel meta information to dashboard json (#30770)\n  * Chore(deps): Bump gonum.org/v1/gonum from 0.6.0 to 0.8.2 (#30343)\n  * Chore(deps): Bump gopkg.in/yaml.v2 from 2.3.0 to 2.4.0 (#30771)\n  * GraphNG: improve behavior when switching between solid/dash/dots (#30796)\n  * Chore(deps): Bump github.com/hashicorp/go-hclog from 0.14.1 to 0.15.0 (#30778)\n  * Add width for Variable Editors (#30791)\n  * Chore: Remove warning when calling resource (#30752)\n  * Auth: Use SigV4 lib from grafana-aws-sdk  (#30713)\n  * Panels: Fixes so panels are refreshed when scrolling past them fast (#30784)\n  * GraphNG: add bar alignment option (#30499)\n  * Expressions: Measure total transformation requests and elapsed time (#30514)\n  * Menu: Mark menu components as internal (#30740)\n  * TableInputCSV: migrated styles from sass to emotion (#30554)\n  * CDN: Fix passing correct prefix to GetContentDeliveryURL (#30777)\n  * Chore(deps): Bump gopkg.in/ini.v1 from 1.57.0 to 1.62.0 (#30772)\n  * CDN: Adds support for serving assets over a CDN (#30691)\n  * PanelEdit: Trigger refresh when changing data source (#30744)\n  * Chore: remove __debug_bin (#30725)\n  * BarChart: add alpha bar chart panel (#30323)\n  * Docs: Time series panel (#30690)\n  * Backend Plugins: Convert test data source to use SDK contracts (#29916)\n  * Docs: Update whats-new-in-v7-4.md (#30747)\n  * Add link to Elasticsearch docs. (#30748)\n  * Mobile: Fixes issue scrolling on mobile in chrome (#30746)\n  * TagsInput: Make placeholder configurable (#30718)\n  * Docs: Add config settings for fonts in reporting (#30421)\n  * Add menu.yaml to .gitignore (#30743)\n  * bump cypress to 6.3.0 (#30644)\n  * Datasource: Use json-iterator configuration compatible with standard library (#30732)\n  * AlertingNG: Update UX to use new PageToolbar component (#30680)\n  * Docs: Add usage insights export feature (#30376)\n  * skip symlinks to directories when generating plugin manifest (#30721)\n  * PluginCiE2E: Upgrade base images (#30696)\n  * Variables: Fixes so text format will show All instead of custom all (#30730)\n  * PanelLibrary: better handling of deleted panels (#30709)\n  * Added section 'Curated dashboards for Google Cloud Monitoring' for 7.4 What's New (#30724)\n  * Added 'curated dashboards' information and broke down, rearranged topics. (#30659)\n  * Transform: improve the 'outer join' performance/behavior (#30407)\n  * Add alt text to plugin logos (#30710)\n  * Deleted menu.yaml file (#30717)\n  * Dashboard: Top Share URL icon should share panel URL when on viewPanel page (#30000)\n  * Added entry for web server. (#30715)\n  * DashboardPicker: switch to promise-based debounce, return dashboard UID (#30706)\n  * Use connected GraphNG in Explore (#30707)\n  * Fix documentation for streaming data sources (#30704)\n  * PanelLibrary: changes casing of responses and adds meta property (#30668)\n  * Influx: Show all datapoints for dynamically windowed flux query (#30688)\n  * Trace: trace to logs design update (#30637)\n  * DeployImage: Switch base images to Debian (#30684)\n  * Chore: remove CSP debug logging line (#30689)\n  * Docs: 7.4 documentation for expressions (#30524)\n  * PanelEdit: Get rid of last remaining usage of navbar-button (#30682)\n  * Grafana-UI: Fix setting default value for MultiSelect (#30671)\n  * CustomScrollbar: migrated styles from sass to emotion (#30506)\n  * DashboardSettings \u0026 PanelEdit: Use new PageToolbar (#30675)\n  * Explore: Fix jumpy live tailing (#30650)\n  * ci(npm-publish): add missing github package token to env vars (#30665)\n  * PageToolbar: Extracting navbar styles \u0026 layout into a modern emotion based component (#30588)\n  * AlertingNG: pause/unpause definitions via the API (#30627)\n  * Docs: Refer to product docs in whats new for alerting templating feature (#30652)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30666)\n  * Variables: Fixes display value when using capture groups in regex (#30636)\n  * Docs: Update _index.md (#30655)\n  * Docs: Auditing updates (#30433)\n  * Docs: add hidden_users configuration field (#30435)\n  * Docs: Define TLS/SSL terminology (#30533)\n  * Docs: Fix expressions enabled description (#30589)\n  * Docs: Update ES screenshots (#30598)\n  * Licensing Docs: Adding license restrictions docs (#30216)\n  * Update documentation-style-guide.md (#30611)\n  * Docs: Update queries.md (#30616)\n  * chore(grafana-ui): bump storybook to 6.1.15 (#30642)\n  * DashboardSettings: fixes vertical scrolling (#30640)\n  * Usage Stats: Remove unused method for getting user stats (#30074)\n  * Grafana/UI: Unit picker should not set a category as unit (#30638)\n  * Graph: Fixes auto decimals issue in legend and tooltip (#30628)\n  * AlertingNG: List saved Alert definitions in Alert Rule list (#30603)\n  * chore: bump redux toolkit to 1.5.0 for immer 8.0.1 vulnerability fix (#30605)\n  * Grafana/UI: Add disable prop to Segment (#30539)\n  * Variables: Fixes so queries work for numbers values too (#30602)\n  * Admin: Fixes so form values are filled in from backend (#30544)\n  * Docs: Add new override info and add whats new 7.4 links (#30615)\n  * TestData: Improve what's new in v7.4 (#30612)\n  * Docs: Update 7.4 What's New to use more correct description of alerting notification template feature (#30502)\n  * NodeGraph: Add docs (#30504)\n  * Loki: Improve live tailing errors and fix Explore's logs container type errors (#30517)\n  * TimeRangePicker: Updates components to use new ToolbarButton \u0026 ButtonGroup (#30570)\n  * Update styling.md guide (#30594)\n  * TestData: Adding what's new in v7.4 to the devenv dashboards (#30568)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.35.5 to 1.36.31 (#30583)\n  * Chore(deps): Bump github.com/prometheus/client_golang (#30585)\n  * Chore(deps): Bump gopkg.in/macaron.v1 from 1.3.9 to 1.4.0 (#30587)\n  * Chore(deps): Bump github.com/google/uuid from 1.1.5 to 1.2.0 (#30584)\n  * Explore: Fix logs hover state so that it is visible and in dark mode \u0026 simply hover code (#30572)\n  * RefreshPicker: Fixes so valid intervals in url are visible in RefreshPicker (#30474)\n  * Add documentation for Exemplars (#30317)\n  * OldGraph: Fix height issue in Firefox (#30565)\n  * XY Chart: fix editor error with empty frame (no fields) (#30573)\n  * ButtonSelect \u0026 RefreshPicker: Rewrite of components to use new emotion based ToolbarButton \u0026 Menu (#30510)\n  * XY Chart: share legend config with timeseries (#30559)\n  * configuration.md: Document Content Security Policy options (#30413)\n  * DataFrame: cache frame/field index in field state (#30529)\n  * List + before -; rm old Git ref; reformat. (#30543)\n  * Expressions: Add option to disable feature (#30541)\n  * Explore: Fix loading visualisation on the top of the new time series panel (#30553)\n  * Prometheus: Fix show query instead of Value if no __name__ and metric (#30511)\n  * Decimals: Big Improvements to auto decimals and fixes to auto decimals bug found in 7.4-beta1  (#30519)\n  * Postgres: Convert tests to stdlib (#30536)\n  * Storybook: Migrate card story to use controls  (#30535)\n  * AlertingNG: Enable UI to Save Alert Definitions (#30394)\n  * Postgres: Be consistent about TLS/SSL terminology (#30532)\n  * Loki: Append refId to logs uid (#30418)\n  * Postgres: Fix indentation (#30531)\n  * GraphNG: uPlot 1.6.3 (fix bands not filling below 0). close #30523. (#30527)\n  * updates for e2e docker image (#30465)\n  * GraphNG: uPlot 1.6.2 (#30521)\n  * Docs: Update whats-new-in-v7-4.md (#30520)\n  * Prettier: ignore build and devenv dirs (#30501)\n  * Chore: Upgrade grabpl version (#30486)\n  * Explore: Update styling of buttons (#30493)\n  * Cloud Monitoring: Fix legend naming with display name override (#30440)\n  * GraphNG: Disable Plot logging by default (#30390)\n  * Admin: Fixes so whole org drop down is visible when adding users to org (#30481)\n  * Docs: include Makefile option for local assets (#30455)\n  * Footer: Fixes layout issue in footer  (#30443)\n  * TimeSeriesPanel: Fixed default value for gradientMode (#30484)\n  * Docs: fix typo in what's new doc (#30489)\n  * Chore: adds wait to e2e test (#30488)\n  * chore: update packages dependent on dot-prop to fix security vulnerability (#30432)\n  * Dashboard: Remove Icon and change copy -\u003e Copy to clipboard in the share embedded panel modal (#30480)\n  * Chore: fix spelling mistake (#30473)\n  * Chore: Restrict internal imports from other packages (#30453)\n  * Docs: What's new fixes and improvements (#30469)\n  * Timeseries: only migrage point size when configured (#30461)\n  * Alerting: Hides threshold handle for percentual thresholds (#30431)\n  * Graph: Fixes so only users with correct permissions can add annotations (#30419)\n  * Chore: update latest version to 7.4.0-beta1 (#30452)\n  * Docs: Add whats new 7.4 links (#30463)\n  * Update whats-new-in-v7-4.md (#30460)\n  * docs: 7.4 what's new (Add expressions note) (#30446)\n  * Chore: Upgrade build pipeline tool (#30456)\n  * PanelModel: Make sure the angular options are passed to react panel type changed handler (#30441)\n  * Expressions: Fix button icon (#30444)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30449)\n  * Docs: Fix img link for alert notification template (#30436)\n  * grafana/ui: Fix internal import from grafana/data (#30439)\n  * prevent field config from being overwritten (#30437)\n  * PanelOptions: Refactoring applying panel and field options out of PanelModel and add property clean up for properties not in field config registry  (#30389)\n  * Dashboard: Remove template variables option from ShareModal (#30395)\n  * Added doc content for variables inspector code change by Hugo (#30408)\n  * Docs: update license expiration behavior for reporting (#30420)\n  * Chore: use old version format in package.json (#30430)\n  * Chore: upgrade NPM security vulnerabilities (#30397)\n  * 'Release: Updated versions in package to 7.5.0-pre.0' (#30428)\n  * contribute: Add backend and configuration guidelines for PRs (#30426)\n  * Chore: Update what's new URL (#30424)\n- Update to version 7.4.5\n- CVE-2021-28146, CVE-2021-28147: Fix API permissions issues related to team-sync. (Enterprise) (bsc#1183811, bsc#1183809)\n- CVE-2021-28148: Usage insights requires signed in users. (Enterprise) (bsc#1183813)\n- CVE-2021-27962: Do not allow editors to incorrectly bypass permissions on the default data source. (Enterprise) (bsc#1184371)\n","status":"published","published":"2021-08-12T10:02:06Z","modified":"2026-02-04T03:01:01.530417Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:1962-1","title":"Security update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone","description":"This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:\n\nSecurity fixes included in this update:\n\ncassandra:\n- CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced\n correctly for certain internode_encryption settings (bsc#1181689)\n\ngrafana:\n- CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross\n site scripting vulnerabilities in the dashboard. (bsc#1172450)\n- CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)\n- CVE-2019-15043: Fixed a denial of service by an unauthenticated user\n in the snapshot HTTP API (bsc#1148383)\n- CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)\n- CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation\n popup (bsc#1170657)\n- CVE-2018-19039: Fixed an issue where a privileged user could\n exfiltrate files (bsc#1115960)\n- CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)\n- CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for\n ElasticSearch datasources (bsc#1178243)\n\nkibana:\n- CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable\n implementation, which could cause a denial of service. (bsc#1044849)\n- CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields.\n (bsc#1044849)\n- CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used\n by default. (bsc#1171909)\n\npython-Django:\n- CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl().\n (bsc#1182433)\n- CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)\n- CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted\n file names. (bsc#1185623)\n- CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView.\n (bsc#1186608)\n- CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses,\n which potentially leads to further attacks. (bsc#1186611)\n\npython-py:\n- CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)\n\npython-pysaml2:\n- CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed\n SAML documents. (bsc#1181277)\n- CVE-2021-21239: Fixed improper verification of cryptographic signatures when using\n CryptoBackendXmlSec1(). (bsc#1181278)\n\nrubygem-activerecord-session_store:\n- CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow\n an attack to hijack sessions. (bsc#1183174)\n\n\nNon-security changes included in this update:\n\nChanges in ardana-neutron:\n- Update to version 9.0+git.1615223676.777f0b3:\n  * Allow users to stop monitoring rootwrap daemon (bsc#1182317)\n\nChanges in ardana-swift:\n- Update to version 9.0+git.1618235096.90974ed:\n  * Run swiftlm-scan in the UTC timezone (bsc#1181690)\n\nChanges in cassandra:\n- update to 3.11.10 (bsc#1181689, CVE-2020-17516)  \n * Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)\n * Reduce amount of allocations during batch statement execution (CASSANDRA-16201)\n * Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)\n * Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)\n * Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)\n * SASI's `max_compaction_flush_memory_in_mb` settings over 100GB revert to default of 1GB (CASSANDRA-16071)\n * Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)\n * Improve empty hint file handling during startup (CASSANDRA-16162)\n * Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)\n * Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)\n * Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)\n * Synchronize transaction logs for JBOD (CASSANDRA-16225)\n * Fix the counting of cells per partition (CASSANDRA-16259)\n * Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)\n * Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)\n * Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)\n * Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)\n * Remove the SEPExecutor blocking behavior (CASSANDRA-16186)\n * Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)\n * Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)\n * Wait for schema agreement when bootstrapping (CASSANDRA-15158)\n * Fix the histogram merge of the table metrics (CASSANDRA-16259)\n * Synchronize Keyspace instance store/clear (CASSANDRA-16210)\n * Fix ColumnFilter to avoid querying cells of unselected complex columns (CASSANDRA-15977)\n * Fix memory leak in CompressedChunkReader (CASSANDRA-15880)\n * Don't attempt value skipping with mixed version cluster (CASSANDRA-15833)\n * Avoid failing compactions with very large partitions (CASSANDRA-15164)\n * Make sure LCS handles duplicate sstable added/removed notifications correctly (CASSANDRA-14103)\n * Fix OOM when terminating repair session (CASSANDRA-15902)\n * Avoid marking shutting down nodes as up after receiving gossip shutdown message (CASSANDRA-16094)\n * Check SSTables for latest version before dropping compact storage (CASSANDRA-16063)\n * Handle unexpected columns due to schema races (CASSANDRA-15899)\n * Add flag to ignore unreplicated keyspaces during repair (CASSANDRA-15160)\n * Package tools/bin scripts as executable (CASSANDRA-16151)\n * Fixed a NullPointerException when calling nodetool enablethrift (CASSANDRA-16127)\n * Correctly interpret SASI's `max_compaction_flush_memory_in_mb` setting in megabytes not bytes (CASSANDRA-16071)\n * Fix short read protection for GROUP BY queries (CASSANDRA-15459)\n * Frozen RawTuple is not annotated with frozen in the toString method (CASSANDRA-15857)\nMerged from 3.0:\n * Use IF NOT EXISTS for index and UDT create statements in snapshot schema files (CASSANDRA-13935)\n * Fix gossip shutdown order (CASSANDRA-15816)\n * Remove broken 'defrag-on-read' optimization (CASSANDRA-15432)\n * Check for endpoint collision with hibernating nodes (CASSANDRA-14599)\n * Operational improvements and hardening for replica filtering protection (CASSANDRA-15907)\n * stop_paranoid disk failure policy is ignored on CorruptSSTableException after node is up (CASSANDRA-15191)\n * Forbid altering UDTs used in partition keys (CASSANDRA-15933)\n * Fix empty/null json string representation (CASSANDRA-15896)\n * 3.x fails to start if commit log has range tombstones from a column which is also deleted (CASSANDRA-15970)\n * Handle difference in timestamp precision between java8 and java11 in LogFIle.java (CASSANDRA-16050)\nMerged from 2.2:\n * Fix CQL parsing of collections when the column type is reversed (CASSANDRA-15814)\n * Only allow strings to be passed to JMX authentication (CASSANDRA-16077)\n * Fix cqlsh output when fetching all rows in batch mode (CASSANDRA-15905)\n * Upgrade Jackson to 2.9.10 (CASSANDRA-15867)\n * Fix CQL formatting of read command restrictions for slow query log (CASSANDRA-15503)\n * Allow sstableloader to use SSL on the native port (CASSANDRA-14904)\n * Backport CASSANDRA-12189: escape string literals (CASSANDRA-15948)\n * Avoid hinted handoff per-host throttle being arounded to 0 in large cluster (CASSANDRA-15859)\n * Avoid emitting empty range tombstones from RangeTombstoneList (CASSANDRA-15924)\n * Avoid thread starvation, and improve compare-and-swap performance, in the slab allocators (CASSANDRA-15922)\n * Add token to tombstone warning and error messages (CASSANDRA-15890)\n * Fixed range read concurrency factor computation and capped as 10 times tpc cores (CASSANDRA-15752)\n * Catch exception on bootstrap resume and init native transport (CASSANDRA-15863)\n * Fix replica-side filtering returning stale data with CL \u003e ONE (CASSANDRA-8272, CASSANDRA-8273)\n * Fix duplicated row on 2.x upgrades when multi-rows range tombstones interact with collection ones (CASSANDRA-15805)\n * Rely on snapshotted session infos on StreamResultFuture.maybeComplete to avoid race conditions (CASSANDRA-15667)\n * EmptyType doesn't override writeValue so could attempt to write bytes when expected not to (CASSANDRA-15790)\n * Fix index queries on partition key columns when some partitions contains only static data (CASSANDRA-13666)\n * Avoid creating duplicate rows during major upgrades (CASSANDRA-15789)\n * liveDiskSpaceUsed and totalDiskSpaceUsed get corrupted if IndexSummaryRedistribution gets interrupted (CASSANDRA-15674)\n * Fix Debian init start/stop (CASSANDRA-15770)\n * Fix infinite loop on index query paging in tables with clustering (CASSANDRA-14242)\n * Fix chunk index overflow due to large sstable with small chunk length (CASSANDRA-15595)\n * Allow selecting static column only when querying static index (CASSANDRA-14242)\n * cqlsh return non-zero status when STDIN CQL fails (CASSANDRA-15623)\n * Don't skip sstables in slice queries based only on local min/max/deletion timestamp (CASSANDRA-15690)\n * Memtable memory allocations may deadlock (CASSANDRA-15367)\n * Run evictFromMembership in GossipStage (CASSANDRA-15592)\n * Fix nomenclature of allow and deny lists (CASSANDRA-15862)\n * Remove generated files from source artifact (CASSANDRA-15849)\n * Remove duplicated tools binaries from tarballs (CASSANDRA-15768)\n * Duplicate results with DISTINCT queries in mixed mode (CASSANDRA-15501)\n * Disable JMX rebinding (CASSANDRA-15653)\n * Fix writing of snapshot manifest when the table has table-backed secondary indexes (CASSANDRA-10968)\n * Fix parse error in cqlsh COPY FROM and formatting for map of blobs (CASSANDRA-15679)\n * Fix Commit log replays when static column clustering keys are collections (CASSANDRA-14365)\n * Fix Red Hat init script on newer systemd versions (CASSANDRA-15273)\n * Allow EXTRA_CLASSPATH to work on tar/source installations (CASSANDRA-15567)\n * Fix bad UDT sstable metadata serialization headers written by C* 3.0 on upgrade and in sstablescrub (CASSANDRA-15035)\n * Fix nodetool compactionstats showing extra pending task for TWCS - patch implemented (CASSANDRA-15409)\n * Fix SELECT JSON formatting for the 'duration' type (CASSANDRA-15075)\n * Fix LegacyLayout to have same behavior as 2.x when handling unknown column names (CASSANDRA-15081)\n * Update nodetool help stop output (CASSANDRA-15401)\n * Run in-jvm upgrade dtests in circleci (CASSANDRA-15506)\n * Include updates to static column in mutation size calculations (CASSANDRA-15293)\n * Fix point-in-time recoevery ignoring timestamp of updates to static columns (CASSANDRA-15292)\n * GC logs are also put under $CASSANDRA_LOG_DIR (CASSANDRA-14306)\n * Fix sstabledump's position key value when partitions have multiple rows (CASSANDRA-14721)\n * Avoid over-scanning data directories in LogFile.verify() (CASSANDRA-15364)\n * Bump generations and document changes to system_distributed and system_traces in 3.0, 3.11\n   (CASSANDRA-15441)\n * Fix system_traces creation timestamp; optimise system keyspace upgrades (CASSANDRA-15398)\n * Fix various data directory prefix matching issues (CASSANDRA-13974)\n * Minimize clustering values in metadata collector (CASSANDRA-15400)\n * Avoid over-trimming of results in mixed mode clusters (CASSANDRA-15405)\n * validate value sizes in LegacyLayout (CASSANDRA-15373)\n * Ensure that tracing doesn't break connections in 3.x/4.0 mixed mode by default (CASSANDRA-15385)\n * Make sure index summary redistribution does not start when compactions are paused (CASSANDRA-15265)\n * Ensure legacy rows have primary key livenessinfo when they contain illegal cells (CASSANDRA-15365)\n * Fix race condition when setting bootstrap flags (CASSANDRA-14878)\n * Fix NativeLibrary.tryOpenDirectory callers for Windows (CASSANDRA-15426)\n * Fix SELECT JSON output for empty blobs (CASSANDRA-15435)\n * In-JVM DTest: Set correct internode message version for upgrade test (CASSANDRA-15371)\n * In-JVM DTest: Support NodeTool in dtest (CASSANDRA-15429)\n * Fix NativeLibrary.tryOpenDirectory callers for Windows (CASSANDRA-15426)\n * Fix SASI non-literal string comparisons (range operators) (CASSANDRA-15169)\n * Make sure user defined compaction transactions are always closed (CASSANDRA-15123)\n * Fix cassandra-env.sh to use $CASSANDRA_CONF to find cassandra-jaas.config (CASSANDRA-14305)\n * Fixed nodetool cfstats printing index name twice (CASSANDRA-14903)\n * Add flag to disable SASI indexes, and warnings on creation (CASSANDRA-14866)\n * Add ability to cap max negotiable protocol version (CASSANDRA-15193)\n * Gossip tokens on startup if available (CASSANDRA-15335)\n * Fix resource leak in CompressedSequentialWriter (CASSANDRA-15340)\n * Fix bad merge that reverted CASSANDRA-14993 (CASSANDRA-15289)\n * Fix LegacyLayout RangeTombstoneList IndexOutOfBoundsException when upgrading and RangeTombstone bounds are asymmetric (CASSANDRA-15172)\n * Fix NPE when using allocate_tokens_for_keyspace on new DC/rack (CASSANDRA-14952)\n * Filter sstables earlier when running cleanup (CASSANDRA-15100)\n * Use mean row count instead of mean column count for index selectivity calculation (CASSANDRA-15259)\n * Avoid updating unchanged gossip states (CASSANDRA-15097)\n * Prevent recreation of previously dropped columns with a different kind (CASSANDRA-14948)\n * Prevent client requests from blocking on executor task queue (CASSANDRA-15013)\n * Toughen up column drop/recreate type validations (CASSANDRA-15204)\n * LegacyLayout should handle paging states that cross a collection column (CASSANDRA-15201)\n * Prevent RuntimeException when username or password is empty/null (CASSANDRA-15198)\n * Multiget thrift query returns null records after digest mismatch (CASSANDRA-14812)\n * Skipping illegal legacy cells can break reverse iteration of indexed partitions (CASSANDRA-15178)\n * Handle paging states serialized with a different version than the session's (CASSANDRA-15176)\n * Throw IOE instead of asserting on unsupporter peer versions (CASSANDRA-15066)\n * Update token metadata when handling MOVING/REMOVING_TOKEN events (CASSANDRA-15120)\n * Add ability to customize cassandra log directory using $CASSANDRA_LOG_DIR (CASSANDRA-15090)\n * Skip cells with illegal column names when reading legacy sstables (CASSANDRA-15086)\n * Fix assorted gossip races and add related runtime checks (CASSANDRA-15059)\n * Fix mixed mode partition range scans with limit (CASSANDRA-15072)\n * cassandra-stress works with frozen collections: list and set (CASSANDRA-14907)\n * Fix handling FS errors on writing and reading flat files - LogTransaction and hints (CASSANDRA-15053)\n * Avoid double closing the iterator to avoid overcounting the number of requests (CASSANDRA-15058)\n * Improve `nodetool status -r` speed (CASSANDRA-14847)\n * Improve merkle tree size and time on heap (CASSANDRA-14096)\n * Add missing commands to nodetool_completion (CASSANDRA-14916)\n * Anti-compaction temporarily corrupts sstable state for readers (CASSANDRA-15004)\n * Catch non-IOException in FileUtils.close to make sure that all resources are closed (CASSANDRA-15225)\n * Handle exceptions during authentication/authorization (CASSANDRA-15041)\n * Support cross version messaging in in-jvm upgrade dtests (CASSANDRA-15078)\n * Fix index summary redistribution cancellation (CASSANDRA-15045)\n * Fixing invalid CQL in security documentation (CASSANDRA-15020)\n * Allow instance class loaders to be garbage collected for inJVM dtest (CASSANDRA-15170)\n * Add support for network topology and query tracing for inJVM dtest (CASSANDRA-15319)\n * Correct sstable sorting for garbagecollect and levelled compaction (CASSANDRA-14870)\n * Severe concurrency issues in STCS,DTCS,TWCS,TMD.Topology,TypeParser\n * Add a script to make running the cqlsh tests in cassandra repo easier (CASSANDRA-14951)\n * If SizeEstimatesRecorder misses a 'onDropTable' notification, the size_estimates table will never be cleared for that table. (CASSANDRA-14905)\n * Counters fail to increment in 2.1/2.2 to 3.X mixed version clusters (CASSANDRA-14958)\n * Streaming needs to synchronise access to LifecycleTransaction (CASSANDRA-14554)\n * Fix cassandra-stress write hang with default options (CASSANDRA-14616)\n * Differentiate between slices and RTs when decoding legacy bounds (CASSANDRA-14919)\n * Netty epoll IOExceptions caused by unclean client disconnects being logged at INFO (CASSANDRA-14909)\n * Unfiltered.isEmpty conflicts with Row extends AbstractCollection.isEmpty (CASSANDRA-14588)\n * RangeTombstoneList doesn't properly clean up mergeable or superseded rts in some cases (CASSANDRA-14894)\n * Fix handling of collection tombstones for dropped columns from legacy sstables (CASSANDRA-14912)\n * Throw exception if Columns serialized subset encode more columns than possible (CASSANDRA-14591)\n * Drop/add column name with different Kind can result in corruption (CASSANDRA-14843)\n * Fix missing rows when reading 2.1 SSTables with static columns in 3.0 (CASSANDRA-14873)\n * Move TWCS message 'No compaction necessary for bucket size' to Trace level (CASSANDRA-14884)\n * Sstable min/max metadata can cause data loss (CASSANDRA-14861)\n * Dropped columns can cause reverse sstable iteration to return prematurely (CASSANDRA-14838)\n * Legacy sstables with  multi block range tombstones create invalid bound sequences (CASSANDRA-14823)\n * Expand range tombstone validation checks to multiple interim request stages (CASSANDRA-14824)\n * Reverse order reads can return incomplete results (CASSANDRA-14803)\n * Avoid calling iter.next() in a loop when notifying indexers about range tombstones (CASSANDRA-14794)\n * Fix purging semi-expired RT boundaries in reversed iterators (CASSANDRA-14672)\n * DESC order reads can fail to return the last Unfiltered in the partition (CASSANDRA-14766)\n * Fix corrupted collection deletions for dropped columns in 3.0 \u003c-\u003e  2.{1,2} messages (CASSANDRA-14568)\n * Fix corrupted static collection deletions in 3.0 \u003c-\u003e 2.{1,2} messages (CASSANDRA-14568)\n * Handle failures in parallelAllSSTableOperation (cleanup/upgradesstables/etc) (CASSANDRA-14657)\n * Improve TokenMetaData cache populating performance avoid long locking (CASSANDRA-14660)\n * Backport: Flush netty client messages immediately (not by default) (CASSANDRA-13651)\n * Fix static column order for SELECT * wildcard queries (CASSANDRA-14638)\n * sstableloader should use discovered broadcast address to connect intra-cluster (CASSANDRA-14522)\n * Fix reading columns with non-UTF names from schema (CASSANDRA-14468)\n * Don't enable client transports when bootstrap is pending (CASSANDRA-14525)\n * MigrationManager attempts to pull schema from different major version nodes (CASSANDRA-14928)\n * Fix incorrect cqlsh results when selecting same columns multiple times (CASSANDRA-13262)\n * Returns null instead of NaN or Infinity in JSON strings (CASSANDRA-14377)\n * Paged Range Slice queries with DISTINCT can drop rows from results (CASSANDRA-14956)\n\nChanges in crowbar-openstack:\n- Update to version 6.0+git.1616146717.a89ae0f4e:\n  * monasca: restart Kibana on update (bsc#1044849)\n\nChanges in grafana\n- Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)\n  * Prevent unauthenticated remote attackers from causing a DoS through the\n    snapshots API.\n\nChanges in kibana:\n- Ensure /etc/sysconfig/kibana is present\n\n- Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, ESA-2017-16)\n  * [4.6] ignore forked code for babel transpile build phase (#13483)\n  * Allow more than match queries in custom filters (#8614) (#10857)\n  * [state] don't make extra $location.replace() calls (#9954)\n  * [optimizer] move to querystring-browser package for up-to-date api\n  * [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls\n  * server: refactor log_interceptor to be more DRY (#9617)\n  * server: downgrade ECANCELED logs to debug (#9616)\n  * server: do not treat logged warnings as errors (#8746) (#9610)\n  * [server/logger] downgrade EPIPE errors to debug level (#9023)\n  * Add basepath when redirecting from a trailling slash (#9035)\n  * [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)\n  * [server/shortUrl] validate urls before shortening them\n- Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)\n  * This fixes an XSS vulnerability in URL fields\n- Remove %dir declaration from /opt/kibana/optimize to ensure\n  no files owned by root end up in there\n- Exclude /opt/kibana/optimize from %fdupes\n- Restart service on upgrade\n- Do not copy LICENSE.txt and README.txt to /opt/kibana\n- Fix rpmlint warnings/errors\n- Switch to explicit patch application\n- Fix source URL\n- Fix logic for systemd/systemv detection\n\n- Add 0001-Configurable-custom-response-headers-for-server.patch\n  (bsc#1171909, CVE-2020-10743)\n\n- Added kibana.yml symlink (bsc#1048688, FATE#323204)\nChanges in openstack-dashboard:\n- Update to version horizon-14.1.1.dev11:\n  * Consume tempest-horizon from PyPI release\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev17:\n  * Remove lower-constraints job\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev17:\n  * Remove lower-constraints job\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev164:\n  * Schedule networks to new segments if needed\n\n- Update to version neutron-13.0.8.dev162:\n  * Fix invalid JSON generated by quota details\n\n- Update to version neutron-13.0.8.dev160:\n  * Fix deletion of rfp interfaces when router is re-enabled\n\n- Update to version neutron-13.0.8.dev159:\n  * [OVS FW] Allow egress ICMPv6 only for know addresses\n  * [OVS FW] Clean conntrack entries with mark == CT\\_MARK\\_INVALID\n\n- Update to version neutron-13.0.8.dev155:\n  * Fix removal of dvr-src mac flows when non-gateway port on router is deleted\n\n- Update to version neutron-13.0.8.dev153:\n  * Add some wait time between stopping and starting again ovsdb monitor\n  * Workaround for TCP checksum issue with ovs-dpdk and  veth pair\n\n- Update to version neutron-13.0.8.dev149:\n  * Fix wrong packet\\_type set for IPv6 GRE tunnels in OVS\n\n- Update to version neutron-13.0.8.dev148:\n  * Fix losses of ovs flows when ovs is restarted\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev164:\n  * Schedule networks to new segments if needed\n\n- Update to version neutron-13.0.8.dev162:\n  * Fix invalid JSON generated by quota details\n\n- Update to version neutron-13.0.8.dev160:\n  * Fix deletion of rfp interfaces when router is re-enabled\n\n- Update to version neutron-13.0.8.dev159:\n  * [OVS FW] Allow egress ICMPv6 only for know addresses\n  * [OVS FW] Clean conntrack entries with mark == CT\\_MARK\\_INVALID\n\n- Update to version neutron-13.0.8.dev155:\n  * Fix removal of dvr-src mac flows when non-gateway port on router is deleted\n\n- Update to version neutron-13.0.8.dev153:\n  * Add some wait time between stopping and starting again ovsdb monitor\n  * Workaround for TCP checksum issue with ovs-dpdk and  veth pair\n\n- Update to version neutron-13.0.8.dev149:\n  * Fix wrong packet\\_type set for IPv6 GRE tunnels in OVS\n\n- Update to version neutron-13.0.8.dev148:\n  * Fix losses of ovs flows when ovs is restarted\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-12.0.1.dev29:\n  * gbp-validate: Tenant and resource level scoping\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev27:\n  * Import data\\_utils from the new location\n\n- Update to version group-based-policy-12.0.1.dev26:\n  * Add SNAT port's Mac Address to the host\\_snat\\_ips dictionary\n\n- Update to version group-based-policy-12.0.1.dev25:\n  * Add support for victoria\n  2014.2.rc1\n\n- Update to version group-based-policy-12.0.1.dev24:\n  * Fix deletion of SVI networks\n\n- Update to version group-based-policy-12.0.1.dev23:\n  * Allow per-port qos configuration on dhcp port\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev22:\n  * Add connectivity parameter to driver\n  * [AIM] Fix ERSPAN extension\n  2014.2.rc1\n\n- Update to version group-based-policy-12.0.1.dev19:\n  * Fix exception with cleanup\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev18:\n  * Add workaround to get\\_subnets\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev82:\n  * [stable-only] gate: Pin CEPH\\_RELEASE to nautilus in LM hook\n  * Change default num\\_retries for glance to 3\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev82:\n  * [stable-only] gate: Pin CEPH\\_RELEASE to nautilus in LM hook\n  * Change default num\\_retries for glance to 3\n\nChanges in python-Django1:\n- Add CVE-2021-33203.patch (bsc#1186608, CVE-2021-33203)\n    * Fixed potential path-traversal via admindocs' TemplateDetailView.\n- Add CVE-2021-33571.patch (bsc#1186611, CVE-2021-33571)\n    * Prevented leading zeros in IPv4 addresses.\n\n- Add CVE-2021-31542.patch (bsc#1185623, CVE-2021-31542)\n    * Fixed CVE-2021-31542 -- Tightened path and file name sanitation in file\n      uploads.\n\n- Add CVE-2021-28658.patch (bsc#1184148, CVE-2021-28658)\n  * Fixed potential directory-traversal via uploaded files\n\n- Add CVE-2021-23336.patch (bsc#1182433, CVE-2021-23336)\n  * Fixed web cache poisoning via django.utils.http.limited_parse_qsl()\n\n\nChanges in python-py:\n- Add CVE-2020-29651.patch ((bsc#1179805, CVE-2020-29651)\n  * svnwc: fix regular expression vulnerable to DoS in blame\n    functionality\n\nChanges in python-pysaml2:\n- Fix patches (SOC-11453)\n  * 0005-Fix-CVE-2021-21238-SAML-XML-Signature-wrapping.patch\n     - rename saml2.xml to saml2.samlxml to avoid overriding\n       the xml module in the system module path\n     - add missing __init__.py files\n     - add missing saml2/data package to setup.py\n  * 0007-Make-previous-commits-python2-compatible.patch so as not to\n     - Adjust to saml2.xml to saml2.samlxml changes\n     - Fix a few more syntax errors and Python2-isms.\n\n- Fix CVE-2021-21238, bsc#1181277 with\n  0002-Strengthen-XSW-tests.patch ,\n  0003-Fix-the-parser-to-not-break-on-ePTID-AttributeValues.patch ,\n  0004-Add-xsd-schemas.patch ,\n  0005-Fix-CVE-2021-21238-SAML-XML-Signature-wrapping.patch .\n  This adds a dependency on python-xmlschema, which depends on\n  python-elementpath, thus both need to be added for this to work.\n  The used python-xmlschema needs to support the sandbox argument\n  which was added in 1.2.0 and refined in 1.2.1, but that version\n  doesn't support python2, so a patched version that does both is\n  needed.\n  Add 0007-Make-previous-commits-python2-compatible.patch to\n  not add a dependency on reportlib_resources and make other\n  changes python2 compatible.\n. Fix CVE-2021-21239, bsc#1181278 with\n  0006-Fix-CVE-2021-21239-Restrict-the-key-data-that-xmlsec.patch\n\nChanges in python-xmlschema:\n\n- Add 3 patches to backport sandbox argument, which is needed by a security fix\n  in python-pysaml2 and one patch to make backport python2 compatible.\n- Upstream url changed\n- Add rpmlintrc to make it work on Leap 42.3\n- Update to 1.0.18:\n  * Fix for *ModelVisitor.iter_unordered_content()*\n  * Fixed default converter, AbderaConverter and JsonMLConverter for xs:anyType decode\n  * Fixed validation tests with all converters\n  * Added UnorderedConverter to validation tests\n- Update to 1.0.17:\n  * Enhancement of validation-only speed (~15%)\n  * Added *is_valid()* and *iter_errors()* to module API\n- Update to 1.0.16:\n  * Improved XMLResource class for working with compressed files\n  * Fix for validation with XSD wildcards and 'lax' process content\n  * Fix ambiguous items validation for xs:choice and xs:sequence models\n\n- Handle UnicodeDecodeErrors during build process\n\n- Update to 1.0.15:\n  * Improved XPath 2.0 bindings\n  * Added logging for schema initialization and building (handled with argument loglevel)\n  * Update encoding of collapsed contents with a new model based reordering method\n  * Removed XLink namespace from meta-schema (loaded from a fallback location like XHTML)\n  * Fixed half of failed W3C instance tests (remain 255 over 15344 tests)\n\n- Initial commit, needed by pytest 5.1.2\nChanges in python-elementpath:\n\n- Update to 1.3.1:\n  * Improved schema proxy\n  * Improved XSD type matching using paths\n  * Cached parent path for XPathContext (only Python 3)\n  * Improve typed selection with TypedAttribute and TypedElement named-tuples\n  * Add iter_results to XPathContext\n  * Remove XMLSchemaProxy from package\n  * Fix descendant shortcut operator '//'\n  * Fix text() function\n  * Fix typed select of '(name)' token\n  * Fix 24-hour time for DateTime\n\n- Skip test_hashing to fix 32bit builds\n\n- Initial commit needed by python-xmlschema\nChanges in rubygem-activerecord-session_store:\n- added CVE-2019-25025.patch (CVE-2019-25025, bsc#1183174)\n  * This requires CVE-2019-16782.patch to be included in\n    rubygem-actionpack-4_2 to work correctly.\n\nChanges in venv-openstack-keystone\n- Add python-xmlschema and python-elementpath for new python-pysaml2 version.\n","status":"published","published":"2021-06-11T13:13:53Z","modified":"2026-02-04T03:22:05.167952Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1963-1","title":"Security update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store","description":"This update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store contains the following fixes:\n\nSecurity fixes included in this update:\n\n\ncrowbar-openstack:\n- CVE-2016-8611: Added rate limiting for the '/images' API POST method\n(bsc#1005886).\n\ngrafana:\n- CVE-2021-27358: Fixed a denial of service via remote API call\n(bsc#1183803)\n\nkibana:\n- CVE-2017-11499: Fixed a vulnerability in nodejs, related to the\nHashTable implementation, which could cause a denial of service\n(bsc#1044849)\n- CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL\nfields (bsc#1044849)\n\npython-Django:\n- CVE-2021-3281: Fixed a directory traversal via archive.extract()\n(bsc#1181379)\n- CVE-2021-28658: Fixed a directory traversal via uploaded files\n(bsc#1184148)\n- CVE-2021-31542: Fixed a directory traversal via uploaded files with\nsuitably crafted file names (bsc#1185623)\n- CVE-2021-33203:Fixed potential path-traversal via admindocs'\nTemplateDetailView (bsc#1186608)\n- CVE-2021-33571: Tighten validator checks to not allow leading zeros in\nIPv4 addresses, which potentially leads to further attacks (bsc#1186611)\n\npython-py:\n- CVE-2020-29651: Fixed a denial of service via regular expressions\n(bsc#1179805)\n\nrubygem-activerecord-session_store:\n- CVE-2019-25025: Fixed a timing attacks targeting the session id which\ncould allow an attack to hijack sessions (bsc#1183174)\n\n\nNon-security fixes included in this update:\n\nChanges in crowbar-openstack:\n- Update to version 4.0+git.1616146720.44daffca0:\n  * monasca: restart Kibana on update (bsc#1044849)\n\nChanges in grafana_Update:\n- Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)\n  * Prevent unauthenticated remote attackers from causing a DoS through the\n    snapshots API.\n\nChanges in kibana_Update:\n- Ensure /etc/sysconfig/kibana is present\n\n- Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14,\n  ESA-2017-16)\n  * [4.6] ignore forked code for babel transpile build phase (#13483)\n  * Allow more than match queries in custom filters (#8614) (#10857)\n  * [state] don't make extra $location.replace() calls (#9954)\n  * [optimizer] move to querystring-browser package for up-to-date api\n  * [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls\n  * server: refactor log_interceptor to be more DRY (#9617)\n  * server: downgrade ECANCELED logs to debug (#9616)\n  * server: do not treat logged warnings as errors (#8746) (#9610)\n  * [server/logger] downgrade EPIPE errors to debug level (#9023)\n  * Add basepath when redirecting from a trailling slash (#9035)\n  * [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)\n  * [server/shortUrl] validate urls before shortening them\n- Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)\n  * This fixes an XSS vulnerability in URL fields\n- Remove %dir declaration from /opt/kibana/optimize to ensure\n  no files owned by root end up in there\n- Exclude /opt/kibana/optimize from %fdupes\n- Restart service on upgrade\n- Do not copy LICENSE.txt and README.txt to /opt/kibana\n- Fix rpmlint warnings/errors\n- Switch to explicit patch application\n- Fix source URL\n- Fix logic for systemd/systemv detection\n\nChanges in monasca-installer_Update:\n- Add support-influxdb-1.2.patch (SOC-11435)\n\nChanges in python-Django_Update:\n- Fixed potential path-traversal via admindocs' TemplateDetailView.(bsc#1186608, CVE-2021-33203)\n-  Prevented leading zeros in IPv4 addresses. (bsc#1186611, CVE-2021-33571)\n- Add delegate-os-path-filename-generation-to-storage.patch (bsc#1185623)\n    * Needed for CVE-2021-31542.patch to apply\n- Tightened path \u0026 file name sanitation in file uploads. (bsc#1185623, CVE-2021-31542)\n- Fixed potential directory-traversal via uploaded files. (bsc#1184148, CVE-2021-28658)\n- Fixes a potential directory traversal when extracting archives. (bsc#1181379, CVE-2021-3281)\n\nChanges in python-py_Update:\n- Add CVE-2020-29651.patch (CVE-2020-29651, bsc#1179805)\n  * svnwc: fix regular expression vulnerable to DoS in blame functionality\n- Ensure /usr/share/licenses exists\n\nChanges in rubygem-activerecord-session_store_Update:\n- added CVE-2019-25025.patch (CVE-2019-25025, bsc#1183174)\n  * This requires CVE-2019-16782.patch to be included in\n    rubygem-actionpack-4_2 to work correctly.\n\n","status":"published","published":"2021-06-11T13:14:14Z","modified":"2026-02-04T02:56:38.447387Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2554-1","title":"Security update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema ","description":"This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema fixes the following issues:\n\nSecurity fixes included on this update:\n\ncassandra-kit:\n- CVE-2020-17516: Internode encryption enforcement vulnerability\n\ncassandra:\n- CVE-2020-17516: Internode encryption enforcement vulnerability\n- CVE-2017-5929 logback: Fixed a serialization vulnerability in SocketServer and ServerSocketReceiver\n\ncrowbar-core:\nCVE-2020-26247: Potentially XXE or SSRF attacks by parsed Nokogiri::XML::Schema\n\ngrafana:\n- CVE-2021-27358: Unauthenticated remote attackers to trigger a Denial of Service via a remote API call\n\nkibana:\n- CVE-2017-11481: Fixed an XSS via URL fields\n- CVE-2017-11499: Fixed a constant hashtable seeds vulnerability\n\npython-Django:\n- CVE-2021-28658: Potential directory-traversal via uploaded files\n- CVE-2021-31542: Potential directory-traversal via uploaded files\n- CVE-2021-33203: Potential directory traversal via admindocs\n- CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses\n- CVE-2021-23336: Fixed web cache poisoning via django.utils.http.limited_parse_qsl\n\npython-eventlet:\n- CVE-2021-21419: Improper handling of highly compressed data and memory allocation with excessive size value\n\npython-pysaml2:\n- CVE-2021-21238: Fixed an improper verification of cryptographic signatures for signed SAML documents\n- CVE-2021-21239: Fixed an improper verification of cryptographic signatures when using CryptoBackendXmlSec1()_\n\npython-py:\n- CVE-2020-29651: Regular expression denial of service in svnwc.py\n\nrubygem-activerecord-session_store:\n- CVE-2019-25025: Fixed a hijack sessions by using timing attacks targeting the session id\nCVE-2019-16782\n\nNon-security fixes included on this update:\n\nChanges in ardana-cobbler:\n- Update to version 8.0+git.1614096566.e8c2b27:\n  * Change install_recommended to true (bsc#1181828)\n\nChanges in cassandra:\n- update to 3.11.10 (bsc#1181689, CVE-2020-17516)\n * Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)\n * Reduce amount of allocations during batch statement execution (CASSANDRA-16201)\n * Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)\n * Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)\n * Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)\n * SASI's `max_compaction_flush_memory_in_mb` settings over 100GB revert to default of 1GB (CASSANDRA-16071)\n * Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)\n * Improve empty hint file handling during startup (CASSANDRA-16162)\n * Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)\n * Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)\n * Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)\n * Synchronize transaction logs for JBOD (CASSANDRA-16225)\n * Fix the counting of cells per partition (CASSANDRA-16259)\n * Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)\n * Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)\n * Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)\n * Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)\n * Remove the SEPExecutor blocking behavior (CASSANDRA-16186)\n * Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)\n * Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)\n * Wait for schema agreement when bootstrapping (CASSANDRA-15158)\n * Fix the histogram merge of the table metrics (CASSANDRA-16259)\n * Synchronize Keyspace instance store/clear (CASSANDRA-16210)\n * Fix ColumnFilter to avoid querying cells of unselected complex columns (CASSANDRA-15977)\n * Fix memory leak in CompressedChunkReader (CASSANDRA-15880)\n * Don't attempt value skipping with mixed version cluster (CASSANDRA-15833)\n * Avoid failing compactions with very large partitions (CASSANDRA-15164)\n * Make sure LCS handles duplicate sstable added/removed notifications correctly (CASSANDRA-14103)\n * Fix OOM when terminating repair session (CASSANDRA-15902)\n * Avoid marking shutting down nodes as up after receiving gossip shutdown message (CASSANDRA-16094)\n * Check SSTables for latest version before dropping compact storage (CASSANDRA-16063)\n * Handle unexpected columns due to schema races (CASSANDRA-15899)\n * Add flag to ignore unreplicated keyspaces during repair (CASSANDRA-15160)\n * Package tools/bin scripts as executable (CASSANDRA-16151)\n * Fixed a NullPointerException when calling nodetool enablethrift (CASSANDRA-16127)\n * Correctly interpret SASI's `max_compaction_flush_memory_in_mb` setting in megabytes not bytes (CASSANDRA-16071)\n * Fix short read protection for GROUP BY queries (CASSANDRA-15459)\n * Frozen RawTuple is not annotated with frozen in the toString method (CASSANDRA-15857)\nMerged from 3.0:\n * Use IF NOT EXISTS for index and UDT create statements in snapshot schema files (CASSANDRA-13935)\n * Fix gossip shutdown order (CASSANDRA-15816)\n * Remove broken 'defrag-on-read' optimization (CASSANDRA-15432)\n * Check for endpoint collision with hibernating nodes (CASSANDRA-14599)\n * Operational improvements and hardening for replica filtering protection (CASSANDRA-15907)\n * stop_paranoid disk failure policy is ignored on CorruptSSTableException after node is up (CASSANDRA-15191)\n * Forbid altering UDTs used in partition keys (CASSANDRA-15933)\n * Fix empty/null json string representation (CASSANDRA-15896)\n * 3.x fails to start if commit log has range tombstones from a column which is also deleted (CASSANDRA-15970)\n * Handle difference in timestamp precision between java8 and java11 in LogFIle.java (CASSANDRA-16050)\nMerged from 2.2:\n * Fix CQL parsing of collections when the column type is reversed (CASSANDRA-15814)\n * Only allow strings to be passed to JMX authentication (CASSANDRA-16077)\n * Fix cqlsh output when fetching all rows in batch mode (CASSANDRA-15905)\n * Upgrade Jackson to 2.9.10 (CASSANDRA-15867)\n * Fix CQL formatting of read command restrictions for slow query log (CASSANDRA-15503)\n * Allow sstableloader to use SSL on the native port (CASSANDRA-14904)\n * Backport CASSANDRA-12189: escape string literals (CASSANDRA-15948)\n * Avoid hinted handoff per-host throttle being arounded to 0 in large cluster (CASSANDRA-15859)\n * Avoid emitting empty range tombstones from RangeTombstoneList (CASSANDRA-15924)\n * Avoid thread starvation, and improve compare-and-swap performance, in the slab allocators (CASSANDRA-15922)\n * Add token to tombstone warning and error messages (CASSANDRA-15890)\n * Fixed range read concurrency factor computation and capped as 10 times tpc cores (CASSANDRA-15752)\n * Catch exception on bootstrap resume and init native transport (CASSANDRA-15863)\n * Fix replica-side filtering returning stale data with CL \u003e ONE (CASSANDRA-8272, CASSANDRA-8273)\n * Fix duplicated row on 2.x upgrades when multi-rows range tombstones interact with collection ones (CASSANDRA-15805)\n * Rely on snapshotted session infos on StreamResultFuture.maybeComplete to avoid race conditions (CASSANDRA-15667)\n * EmptyType doesn't override writeValue so could attempt to write bytes when expected not to (CASSANDRA-15790)\n * Fix index queries on partition key columns when some partitions contains only static data (CASSANDRA-13666)\n * Avoid creating duplicate rows during major upgrades (CASSANDRA-15789)\n * liveDiskSpaceUsed and totalDiskSpaceUsed get corrupted if IndexSummaryRedistribution gets interrupted (CASSANDRA-15674)\n * Fix Debian init start/stop (CASSANDRA-15770)\n * Fix infinite loop on index query paging in tables with clustering (CASSANDRA-14242)\n * Fix chunk index overflow due to large sstable with small chunk length (CASSANDRA-15595)\n * Allow selecting static column only when querying static index (CASSANDRA-14242)\n * cqlsh return non-zero status when STDIN CQL fails (CASSANDRA-15623)\n * Don't skip sstables in slice queries based only on local min/max/deletion timestamp (CASSANDRA-15690)\n * Memtable memory allocations may deadlock (CASSANDRA-15367)\n * Run evictFromMembership in GossipStage (CASSANDRA-15592)\n * Fix nomenclature of allow and deny lists (CASSANDRA-15862)\n * Remove generated files from source artifact (CASSANDRA-15849)\n * Remove duplicated tools binaries from tarballs (CASSANDRA-15768)\n * Duplicate results with DISTINCT queries in mixed mode (CASSANDRA-15501)\n * Disable JMX rebinding (CASSANDRA-15653)\n * Fix writing of snapshot manifest when the table has table-backed secondary indexes (CASSANDRA-10968)\n * Fix parse error in cqlsh COPY FROM and formatting for map of blobs (CASSANDRA-15679)\n * Fix Commit log replays when static column clustering keys are collections (CASSANDRA-14365)\n * Fix Red Hat init script on newer systemd versions (CASSANDRA-15273)\n * Allow EXTRA_CLASSPATH to work on tar/source installations (CASSANDRA-15567)\n * Fix bad UDT sstable metadata serialization headers written by C* 3.0 on upgrade and in sstablescrub (CASSANDRA-15035)\n * Fix nodetool compactionstats showing extra pending task for TWCS - patch implemented (CASSANDRA-15409)\n * Fix SELECT JSON formatting for the 'duration' type (CASSANDRA-15075)\n * Fix LegacyLayout to have same behavior as 2.x when handling unknown column names (CASSANDRA-15081)\n * Update nodetool help stop output (CASSANDRA-15401)\n * Run in-jvm upgrade dtests in circleci (CASSANDRA-15506)\n * Include updates to static column in mutation size calculations (CASSANDRA-15293)\n * Fix point-in-time recoevery ignoring timestamp of updates to static columns (CASSANDRA-15292)\n * GC logs are also put under $CASSANDRA_LOG_DIR (CASSANDRA-14306)\n * Fix sstabledump's position key value when partitions have multiple rows (CASSANDRA-14721)\n * Avoid over-scanning data directories in LogFile.verify() (CASSANDRA-15364)\n * Bump generations and document changes to system_distributed and system_traces in 3.0, 3.11\n   (CASSANDRA-15441)\n * Fix system_traces creation timestamp; optimise system keyspace upgrades (CASSANDRA-15398)\n * Fix various data directory prefix matching issues (CASSANDRA-13974)\n * Minimize clustering values in metadata collector (CASSANDRA-15400)\n * Avoid over-trimming of results in mixed mode clusters (CASSANDRA-15405)\n * validate value sizes in LegacyLayout (CASSANDRA-15373)\n * Ensure that tracing doesn't break connections in 3.x/4.0 mixed mode by default (CASSANDRA-15385)\n * Make sure index summary redistribution does not start when compactions are paused (CASSANDRA-15265)\n * Ensure legacy rows have primary key livenessinfo when they contain illegal cells (CASSANDRA-15365)\n * Fix race condition when setting bootstrap flags (CASSANDRA-14878)\n * Fix NativeLibrary.tryOpenDirectory callers for Windows (CASSANDRA-15426)\n * Fix SELECT JSON output for empty blobs (CASSANDRA-15435)\n * In-JVM DTest: Set correct internode message version for upgrade test (CASSANDRA-15371)\n * In-JVM DTest: Support NodeTool in dtest (CASSANDRA-15429)\n * Fix NativeLibrary.tryOpenDirectory callers for Windows (CASSANDRA-15426)\n * Fix SASI non-literal string comparisons (range operators) (CASSANDRA-15169)\n * Make sure user defined compaction transactions are always closed (CASSANDRA-15123)\n * Fix cassandra-env.sh to use $CASSANDRA_CONF to find cassandra-jaas.config (CASSANDRA-14305)\n * Fixed nodetool cfstats printing index name twice (CASSANDRA-14903)\n * Add flag to disable SASI indexes, and warnings on creation (CASSANDRA-14866)\n * Add ability to cap max negotiable protocol version (CASSANDRA-15193)\n * Gossip tokens on startup if available (CASSANDRA-15335)\n * Fix resource leak in CompressedSequentialWriter (CASSANDRA-15340)\n * Fix bad merge that reverted CASSANDRA-14993 (CASSANDRA-15289)\n * Fix LegacyLayout RangeTombstoneList IndexOutOfBoundsException when upgrading and RangeTombstone bounds are asymmetric (CASSANDRA-15172)\n * Fix NPE when using allocate_tokens_for_keyspace on new DC/rack (CASSANDRA-14952)\n * Filter sstables earlier when running cleanup (CASSANDRA-15100)\n * Use mean row count instead of mean column count for index selectivity calculation (CASSANDRA-15259)\n * Avoid updating unchanged gossip states (CASSANDRA-15097)\n * Prevent recreation of previously dropped columns with a different kind (CASSANDRA-14948)\n * Prevent client requests from blocking on executor task queue (CASSANDRA-15013)\n * Toughen up column drop/recreate type validations (CASSANDRA-15204)\n * LegacyLayout should handle paging states that cross a collection column (CASSANDRA-15201)\n * Prevent RuntimeException when username or password is empty/null (CASSANDRA-15198)\n * Multiget thrift query returns null records after digest mismatch (CASSANDRA-14812)\n * Skipping illegal legacy cells can break reverse iteration of indexed partitions (CASSANDRA-15178)\n * Handle paging states serialized with a different version than the session's (CASSANDRA-15176)\n * Throw IOE instead of asserting on unsupporter peer versions (CASSANDRA-15066)\n * Update token metadata when handling MOVING/REMOVING_TOKEN events (CASSANDRA-15120)\n * Add ability to customize cassandra log directory using $CASSANDRA_LOG_DIR (CASSANDRA-15090)\n * Skip cells with illegal column names when reading legacy sstables (CASSANDRA-15086)\n * Fix assorted gossip races and add related runtime checks (CASSANDRA-15059)\n * Fix mixed mode partition range scans with limit (CASSANDRA-15072)\n * cassandra-stress works with frozen collections: list and set (CASSANDRA-14907)\n * Fix handling FS errors on writing and reading flat files - LogTransaction and hints (CASSANDRA-15053)\n * Avoid double closing the iterator to avoid overcounting the number of requests (CASSANDRA-15058)\n * Improve `nodetool status -r` speed (CASSANDRA-14847)\n * Improve merkle tree size and time on heap (CASSANDRA-14096)\n * Add missing commands to nodetool_completion (CASSANDRA-14916)\n * Anti-compaction temporarily corrupts sstable state for readers (CASSANDRA-15004)\n * Catch non-IOException in FileUtils.close to make sure that all resources are closed (CASSANDRA-15225)\n * Handle exceptions during authentication/authorization (CASSANDRA-15041)\n * Support cross version messaging in in-jvm upgrade dtests (CASSANDRA-15078)\n * Fix index summary redistribution cancellation (CASSANDRA-15045)\n * Fixing invalid CQL in security documentation (CASSANDRA-15020)\n * Allow instance class loaders to be garbage collected for inJVM dtest (CASSANDRA-15170)\n * Add support for network topology and query tracing for inJVM dtest (CASSANDRA-15319)\n * Correct sstable sorting for garbagecollect and levelled compaction (CASSANDRA-14870)\n * Severe concurrency issues in STCS,DTCS,TWCS,TMD.Topology,TypeParser\n * Add a script to make running the cqlsh tests in cassandra repo easier (CASSANDRA-14951)\n * If SizeEstimatesRecorder misses a 'onDropTable' notification, the size_estimates table will never be cleared for that table. (CASSANDRA-14905)\n * Counters fail to increment in 2.1/2.2 to 3.X mixed version clusters (CASSANDRA-14958)\n * Streaming needs to synchronise access to LifecycleTransaction (CASSANDRA-14554)\n * Fix cassandra-stress write hang with default options (CASSANDRA-14616)\n * Differentiate between slices and RTs when decoding legacy bounds (CASSANDRA-14919)\n * Netty epoll IOExceptions caused by unclean client disconnects being logged at INFO (CASSANDRA-14909)\n * Unfiltered.isEmpty conflicts with Row extends AbstractCollection.isEmpty (CASSANDRA-14588)\n * RangeTombstoneList doesn't properly clean up mergeable or superseded rts in some cases (CASSANDRA-14894)\n * Fix handling of collection tombstones for dropped columns from legacy sstables (CASSANDRA-14912)\n * Throw exception if Columns serialized subset encode more columns than possible (CASSANDRA-14591)\n * Drop/add column name with different Kind can result in corruption (CASSANDRA-14843)\n * Fix missing rows when reading 2.1 SSTables with static columns in 3.0 (CASSANDRA-14873)\n * Move TWCS message 'No compaction necessary for bucket size' to Trace level (CASSANDRA-14884)\n * Sstable min/max metadata can cause data loss (CASSANDRA-14861)\n * Dropped columns can cause reverse sstable iteration to return prematurely (CASSANDRA-14838)\n * Legacy sstables with  multi block range tombstones create invalid bound sequences (CASSANDRA-14823)\n * Expand range tombstone validation checks to multiple interim request stages (CASSANDRA-14824)\n * Reverse order reads can return incomplete results (CASSANDRA-14803)\n * Avoid calling iter.next() in a loop when notifying indexers about range tombstones (CASSANDRA-14794)\n * Fix purging semi-expired RT boundaries in reversed iterators (CASSANDRA-14672)\n * DESC order reads can fail to return the last Unfiltered in the partition (CASSANDRA-14766)\n * Fix corrupted collection deletions for dropped columns in 3.0  2.{1,2} messages (CASSANDRA-14568)\n * Fix corrupted static collection deletions in 3.0 2.{1,2} messages (CASSANDRA-14568)\n * Handle failures in parallelAllSSTableOperation (cleanup/upgradesstables/etc) (CASSANDRA-14657)\n * Improve TokenMetaData cache populating performance avoid long locking (CASSANDRA-14660)\n * Backport: Flush netty client messages immediately (not by default) (CASSANDRA-13651)\n * Fix static column order for SELECT * wildcard queries (CASSANDRA-14638)\n * sstableloader should use discovered broadcast address to connect intra-cluster (CASSANDRA-14522)\n * Fix reading columns with non-UTF names from schema (CASSANDRA-14468)\n * Don't enable client transports when bootstrap is pending (CASSANDRA-14525)\n * MigrationManager attempts to pull schema from different major version nodes (CASSANDRA-14928)\n * Fix incorrect cqlsh results when selecting same columns multiple times (CASSANDRA-13262)\n * Returns null instead of NaN or Infinity in JSON strings (CASSANDRA-14377)\n * Paged Range Slice queries with DISTINCT can drop rows from results (CASSANDRA-14956)\n * Validate supported column type with SASI analyzer (CASSANDRA-13669)\n * Remove BTree.Builder Recycler to reduce memory usage (CASSANDRA-13929)\n * Reduce nodetool GC thread count (CASSANDRA-14475)\n * Fix New SASI view creation during Index Redistribution (CASSANDRA-14055)\n * Remove string formatting lines from BufferPool hot path (CASSANDRA-14416)\n * Update metrics to 3.1.5 (CASSANDRA-12924)\n * Detect OpenJDK jvm type and architecture (CASSANDRA-12793)\n * Don't use guava collections in the non-system keyspace jmx attributes (CASSANDRA-12271)\n * Allow existing nodes to use all peers in shadow round (CASSANDRA-13851)\n * Fix cqlsh to read connection.ssl cqlshrc option again (CASSANDRA-14299)\n * Downgrade log level to trace for CommitLogSegmentManager (CASSANDRA-14370)\n * CQL fromJson(null) throws NullPointerException (CASSANDRA-13891)\n * Serialize empty buffer as empty string for json output format (CASSANDRA-14245)\n * Allow logging implementation to be interchanged for embedded testing (CASSANDRA-13396)\n * SASI tokenizer for simple delimiter based entries (CASSANDRA-14247)\n * Fix Loss of digits when doing CAST from varint/bigint to decimal (CASSANDRA-14170)\n * RateBasedBackPressure unnecessarily invokes a lock on the Guava RateLimiter (CASSANDRA-14163)\n * Fix wildcard GROUP BY queries (CASSANDRA-14209)\n * Fix corrupted static collection deletions in 3.0 -\u003e 2.{1,2} messages (CASSANDRA-14568)\n * Fix potential IndexOutOfBoundsException with counters (CASSANDRA-14167)\n * Always close RT markers returned by ReadCommand#executeLocally() (CASSANDRA-14515)\n * Reverse order queries with range tombstones can cause data loss (CASSANDRA-14513)\n * Fix regression of lagging commitlog flush log message (CASSANDRA-14451)\n * Add Missing dependencies in pom-all (CASSANDRA-14422)\n * Cleanup StartupClusterConnectivityChecker and PING Verb (CASSANDRA-14447)\n * Fix deprecated repair error notifications from 3.x clusters to legacy JMX clients (CASSANDRA-13121)\n * Cassandra not starting when using enhanced startup scripts in windows (CASSANDRA-14418)\n * Fix progress stats and units in compactionstats (CASSANDRA-12244)\n * Better handle missing partition columns in system_schema.columns (CASSANDRA-14379)\n * Delay hints store excise by write timeout to avoid race with decommission (CASSANDRA-13740)\n * Deprecate background repair and probablistic read_repair_chance table options\n   (CASSANDRA-13910)\n * Add missed CQL keywords to documentation (CASSANDRA-14359)\n * Fix unbounded validation compactions on repair / revert CASSANDRA-13797 (CASSANDRA-14332)\n * Avoid deadlock when running nodetool refresh before node is fully up (CASSANDRA-14310)\n * Handle all exceptions when opening sstables (CASSANDRA-14202)\n * Handle incompletely written hint descriptors during startup (CASSANDRA-14080)\n * Handle repeat open bound from SRP in read repair (CASSANDRA-14330)\n * Respect max hint window when hinting for LWT (CASSANDRA-14215)\n * Adding missing WriteType enum values to v3, v4, and v5 spec (CASSANDRA-13697)\n * Don't regenerate bloomfilter and summaries on startup (CASSANDRA-11163)\n * Fix NPE when performing comparison against a null frozen in LWT (CASSANDRA-14087)\n * Log when SSTables are deleted (CASSANDRA-14302)\n * Fix batch commitlog sync regression (CASSANDRA-14292)\n * Write to pending endpoint when view replica is also base replica (CASSANDRA-14251)\n * Chain commit log marker potential performance regression in batch commit mode (CASSANDRA-14194)\n * Fully utilise specified compaction threads (CASSANDRA-14210)\n * Pre-create deletion log records to finish compactions quicker (CASSANDRA-12763)\n * Fix bug that prevented compaction of SSTables after full repairs (CASSANDRA-14423)\n * Incorrect counting of pending messages in OutboundTcpConnection (CASSANDRA-11551)\n * Fix compaction failure caused by reading un-flushed data (CASSANDRA-12743)\n * Use Bounds instead of Range for sstables in anticompaction (CASSANDRA-14411)\n * Fix JSON queries with IN restrictions and ORDER BY clause (CASSANDRA-14286)\n * Backport circleci yaml (CASSANDRA-14240)\n * Check checksum before decompressing data (CASSANDRA-14284)\n * CVE-2017-5929 Security vulnerability in Logback warning in NEWS.txt (CASSANDRA-14183)\n- Use %license macro\n\nChanges in cassandra-kit:\n- Update to Cassandra 3.11.10 (bsc#1181689, CVE-2020-17516)\n\nChanges in crowbar-core:\n- Update to version 5.0+git.1622489449.a8e60e238:\n  * avoid v4.1.5 of delayed_job_active_record (noref)\n  * add CVE-2020-26247 to travis ignore list (bsc#1180507)\n\nChanges in crowbar-openstack:\n- Update to version 5.0+git.1616001417.67fd9c2a1:\n  * monasca: restart Kibana on update (bsc#1044849)\n\n- Update to version 5.0+git.1615542070.7841c34b7:\n  * monasca: fix monasca-server reinstall state check (SOC-11471)\n\nChanges in documentation-suse-openstack-cloud:\n- Update to version 8.20210512:\n  * Moved Monasca deployment to immediately after keystone (SOC-11525) (#1312)\n\n- Update to version 8.20210511:\n  * Update the correct SLES version to suse-12.3 (SOC-11521) (#1321)\n  * Renamed the repo name from SLE12-SP3-HA to SLE-HA12-SP3 (SOC-11523) (#1320)\n\n- Update to version 8.20210511:\n  * Add bm-power-status playbook to add sles compute section (#1317)\n\n- Update to version 8.20210507:\n  * Add instructions for checking MySQL cert expiry (SOC-11422) (#1311)\n\n- Update to version 8.20210304:\n  * Add nova and heat db purge cron jobs to maintenance section (SOC-9876) (#1307)\n\nChanges in grafana:\n- Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)\n  * Prevent unauthenticated remote attackers from causing a DoS through the\n    snapshots API.\n\nChanges in kibana:\n- Ensure /etc/sysconfig/kibana is present\n\n- Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, \n  ESA-2017-16)\n  * [4.6] ignore forked code for babel transpile build phase (#13483)\n  * Allow more than match queries in custom filters (#8614) (#10857)\n  * [state] don't make extra $location.replace() calls (#9954)\n  * [optimizer] move to querystring-browser package for up-to-date api\n  * [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls\n  * server: refactor log_interceptor to be more DRY (#9617)\n  * server: downgrade ECANCELED logs to debug (#9616)\n  * server: do not treat logged warnings as errors (#8746) (#9610)\n  * [server/logger] downgrade EPIPE errors to debug level (#9023)\n  * Add basepath when redirecting from a trailling slash (#9035)\n  * [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)\n  * [server/shortUrl] validate urls before shortening them\n- Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)\n  * This fixes an XSS vulnerability in URL fields\n- Remove %dir declaration from /opt/kibana/optimize to ensure\n  no files owned by root end up in there\n- Exclude /opt/kibana/optimize from %fdupes\n- Restart service on upgrade\n- Do not copy LICENSE.txt and README.txt to /opt/kibana\n- Fix rpmlint warnings/errors\n- Switch to explicit patch application\n- Fix source URL\n- Fix logic for systemd/systemv detection\n\nChanges in openstack-heat-templates:\n- Update to version 0.0.0+git.1623056900.7917e18:\n  * Fix zuul config for heat-templates-check\n\n- Update to version 0.0.0+git.1621405516.71a0f7a:\n  * Remove testr\n\nChanges in openstack-monasca-installer:\n- Add 0001-fix-influxdb-stop-task.patch (SOC-11470)\n- Add 0001-fix-cassandra-deployment.patch (SOC-11470)\n\nChanges in openstack-nova:\n- Update to version nova-16.1.9.dev92:\n  * Lowercase ironic driver hash ring and ignore case in cache\n  * Include only required fields in ironic node cache\n  * Add resource\\_class to fields in ironic node cache\n\n- Update to version nova-16.1.9.dev86:\n  * [stable-only] Move grenade jobs to experimental\n  * Update resources once in update\\_available\\_resource\n  * rt: Make resource tracker always invoking get\\_inventory()\n\n- Update to version nova-16.1.9.dev81:\n  * [stable-only] gate: Pin CEPH\\_RELEASE to nautilus in LM hook\n\n- Update to version nova-16.1.9.dev80:\n  * [placement] Add status and links fields to version document at /\n\nChanges in openstack-nova:\n- Update to version nova-16.1.9.dev92:\n  * Lowercase ironic driver hash ring and ignore case in cache\n  * Include only required fields in ironic node cache\n  * Add resource\\_class to fields in ironic node cache\n\n- Update to version nova-16.1.9.dev86:\n  * [stable-only] Move grenade jobs to experimental\n  * Update resources once in update\\_available\\_resource\n  * rt: Make resource tracker always invoking get\\_inventory()\n\n- Update to version nova-16.1.9.dev81:\n  * [stable-only] gate: Pin CEPH\\_RELEASE to nautilus in LM hook\n\n- Update to version nova-16.1.9.dev80:\n  * [placement] Add status and links fields to version document at /\n\nChanges in python-Django:\n- Add CVE-2021-33203.patch (bsc#1186608, CVE-2021-33203)\n    * Fixed potential path-traversal via admindocs' TemplateDetailView.\n- Add CVE-2021-33571.patch (bsc#1186611, CVE-2021-33571)\n    * Prevented leading zeros in IPv4 addresses.\n\n- Add CVE-2021-31542.patch (bsc#1185623, CVE-2021-31542)\n    * Fixed CVE-2021-31542 -- Tightened path and file name sanitation in file\n      uploads.\n\n- Add CVE-2021-28658.patch (bsc#1184148, CVE-2021-28658)\n  * Fixed potential directory-traversal via uploaded files\n\n- Add CVE-2021-23336.patch (bsc#1182433, CVE-2021-23336)\n  * Fixed web cache poisoning via django.utils.http.limited_parse_qsl()\n\nChanges in python-eventlet:\n- Add 0001-websocket-fd-leak-when-client-did-not-close-connecti.patch \n- Add 0002-websocket-Limit-maximum-uncompressed-frame-length-to.patch (bsc#1185836 CVE-2021-21419)\n    * websocket: Limit maximum uncompressed frame length to 8MiB\n\nChanges in python-py:\n- Add CVE-2020-29651.patch ((bsc#1179805, CVE-2020-29651)\n  * svnwc: fix regular expression vulnerable to DoS in blame\n    functionality\n\nChanges in python-pysaml2:\n- Add %dir declaration for %{_licensedir}\n\n- Fix CVE-2021-21238, bsc#1181277 with\n  0004-Strengthen-XSW-tests.patch ,\n  0005-Fix-the-parser-to-not-break-on-ePTID-AttributeValues.patch ,\n  0006-Add-xsd-schemas.patch ,\n  0007-Fix-CVE-2021-21238-SAML-XML-Signature-wrapping.patch .\n  This adds a dependency on python-xmlschema, which depends on\n  python-elementpath and build depends python-pathlib2, which depends on\n  python-scandir, thus all these need to be added for this to work.\n  The used python-xmlschema needs to support the sandbox argument\n  which was added in 1.2.0 and refined in 1.2.1, but that version\n  doesn't support python2, so a patched version that does both is\n  needed.\n  0009-Make-previous-commits-python2-compatible.patch to\n  not add a dependency on reportlib_resources and make other\n  changes python2 compatible.\n- Fix CVE-2021-21239, bsc#1181278 with\n  0008-Fix-CVE-2021-21239-Restrict-the-key-data-that-xmlsec.patch\n\nChanges in venv-openstack-keystone:\n- Add python-xmlschema and python-elementpath for new python-pysaml2 version.\n\nChanges in python-xmlschema:\n\n- Add missed BuildRequires on pathlib2\n\n- Add 3 patches to backport sandbox argument, which is needed by a security fix\n  in python-pysaml2 and one patch to make backport python2 compatible.\n- Upstream url changed\n- Add rpmlintrc to make it work on Leap 42.3\n- Update to 1.0.18:\n  * Fix for *ModelVisitor.iter_unordered_content()*\n  * Fixed default converter, AbderaConverter and JsonMLConverter for xs:anyType decode\n  * Fixed validation tests with all converters\n  * Added UnorderedConverter to validation tests\n- Update to 1.0.17:\n  * Enhancement of validation-only speed (~15%)\n  * Added *is_valid()* and *iter_errors()* to module API\n- Update to 1.0.16:\n  * Improved XMLResource class for working with compressed files\n  * Fix for validation with XSD wildcards and 'lax' process content\n  * Fix ambiguous items validation for xs:choice and xs:sequence models\n\n- Handle UnicodeDecodeErrors during build process\n\n- Update to 1.0.15:\n  * Improved XPath 2.0 bindings\n  * Added logging for schema initialization and building (handled with argument loglevel)\n  * Update encoding of collapsed contents with a new model based reordering method\n  * Removed XLink namespace from meta-schema (loaded from a fallback location like XHTML)\n  * Fixed half of failed W3C instance tests (remain 255 over 15344 tests)\n\n- Initial commit, needed by pytest 5.1.2\n\nChanges in python-elementpath:\n\n- Update to 1.3.1:\n  * Improved schema proxy\n  * Improved XSD type matching using paths\n  * Cached parent path for XPathContext (only Python 3)\n  * Improve typed selection with TypedAttribute and TypedElement named-tuples\n  * Add iter_results to XPathContext\n  * Remove XMLSchemaProxy from package\n  * Fix descendant shortcut operator '//'\n  * Fix text() function\n  * Fix typed select of '(name)' token\n  * Fix 24-hour time for DateTime\n\n- Skip test_hashing to fix 32bit builds\n\n- Initial commit needed by python-xmlschema\n\nChanges in python-six:\n- Update in SLE-12 (bsc#1176784, jsc#ECO-3105, jsc#PM-2352)\n\n- Fix testsuite on SLE-12\n  + Add python to BuildRequires for suse_version less 1500\n\n- Fix dbm deps as the MU for provides: python-dbm was not released\n  on sle12 yet\n- Add requirement on pytest \u003e 4.0 to see the pytest module works\n  with this MU\n\n- Do not cause buildcycle with previous change but rather\n  install the egg-info prepared metadata from the tarball\n\n- use setuptools for building to support pip 10.x (bsc#1166139)\n\n- update to 1.14.0\n * Add `six.assertNotRegex`\n * `six.moves._dummy_thread` now points to the `_thread` module on\n    Python 3.9+. Python 3.7 and later requires threading and deprecated the\n    `_dummy_thread` module\n * Remove support for Python 2.6 and Python 3.2\n * `six.wraps` now ignores missing attributes\n\n- Pull in dbm/gdbm module from python for testing\n\n- update to 0.13.0:\n  - Issue #298, pull request #299: Add `six.moves.dbm_ndbm`.\n  - Issue #155: Add `six.moves.collections_abc`, which aliases the `collections`\n    module on Python 2-3.2 and the `collections.abc` on Python 3.3 and greater.\n  - Pull request #304: Re-add distutils fallback in `setup.py`.\n  - Pull request #305: On Python 3.7, `with_metaclass` supports classes using PEP\n\n- Simplify the pytest call\n\n- Fix pytest call\n- Fixdocumentation package generating\n\n- Change %pretrans back to %pre to fix bootstrap issue\n  boo#1123064 bsc#1143893\n\n- Require just base python module, even full python is too much\n  and it is not required here\n\n- Update to 0.12.0:\n    * `six.add_metaclass` now preserves `__qualname__` from the\n      original class.\n    * Add `six.ensure_binary`, `six.ensure_text`, and\n      `six.ensure_str`.\n- Because of cyclical dependencies between six and Sphinx, we\n  need to to do multibuild.\n\n- Include in SLE-12 (FATE#326838, bsc#1113302)\n\n- remove egg-info directory in %pretrans\n- fix egg-info directory pattern\n- match any version of egg-info for a certain python version\n\n- Break the cycilical dependency on python-setuptools.\n\n- Remove argparse dependency\n\n- build python3 subpackage (FATE#324435, bsc#1073879)\n\n- remove egg-info directory before installation if it exists,\n  because setuptools produce directory and six switched to distutils\n  that produce a file\n  (and because rpm can't handle that by itself)\n  fixes bsc#1057496\n\n- Fix Source url\n\n- README-\u003eREADME.rst, add CHANGES\n- update to version 1.11.0:\n  * Pull request #178: `with_metaclass` now properly proxies\n    `__prepare__` to the underlying metaclass.\n  * Pull request #191: Allow `with_metaclass` to work with metaclasses\n    implemented in C.\n  * Pull request #203: Add parse_http_list and parse_keqv_list to\n    moved urllib.request.\n  * Pull request #172 and issue #171: Add unquote_to_bytes to moved\n    urllib.parse.\n  * Pull request #167: Add `six.moves.getoutput`.\n  * Pull request #80: Add `six.moves.urllib_parse.splitvalue`.\n  * Pull request #75: Add `six.moves.email_mime_image`.\n  * Pull request #72: Avoid creating reference cycles through\n    tracebacks in `reraise`.\n\n- Submit 1.9.0 to SLE-12 (fate#319030, fate#318838, bsc#940812)\n\n- sanitize release line in specfile\n\nChanges in rubygem-activerecord-session_store.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- added CVE-2019-25025.patch (CVE-2019-25025, bsc#1183174)\n  * This requires CVE-2019-16782.patch to be included in rubygem-actionpack-4_2\n  to work correctly.\n\nChanges in venv-openstack-keystone:\n- Add python-xmlschema and python-elementpath for new python-pysaml2 version.\n\n- Add python-defusedxml (bsc#1019074)\n\n- Inherit version number of venv from main component (SCRD-8523)\n\n  ","status":"published","published":"2021-07-28T15:27:22Z","modified":"2026-02-04T03:30:06.612594Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2660-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\n- CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)\n- Update to version 7.5.7:\n  * Updated relref to 'Configuring exemplars' section (#34240) (#34243)\n  * Added exemplar topic (#34147) (#34226)\n  * Quota: Do not count folders towards dashboard quota (#32519) (#34025)\n  * Instructions to separate emails with semicolons (#32499) (#34138)\n  * Docs: Remove documentation of v8 generic OAuth feature (#34018)\n  * Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)\n  * [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)\n  * Stop hoisting @icons/material (#33922)\n  * Chore: fix react-color version in yarn.lock (#33914)\n  * 'Release: Updated versions in package to 7.5.6' (#33909)\n  * Loki: fix label browser crashing when + typed (#33900) (#33901)\n  * Document `hide_version` flag (#33670) (#33881)\n  * Add isolation level db configuration parameter (#33830) (#33878)\n  * Sanitize PromLink button (#33874) (#33876)\n  * Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)\n  * Docs feedback: /administration/provisioning.md (#33804) (#33842)\n  * Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)\n  * Docs: Update _index.md (#33797) (#33799)\n  * Docs: Update installation.md (#33656) (#33703)\n  * GraphNG: uPlot 1.6.9 (#33598) (#33612)\n  * dont consider invalid email address a failed email (#33671) (#33681)\n  * InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)\n  * add template for dashboard url parameters  (#33549) (#33588)\n  * Add note to Snapshot API doc to specify that user has to provide the entire dashboard model  (#33572) (#33586)\n  * Update team.md (#33454) (#33536)\n  * Removed duplicate file 'dashboard_folder_permissions.md (#33497)\n  * Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)\n  * Documentation: Update developer-guide.md (#33478) (#33490)\n  * add closed parenthesis to fix a hyperlink (#33471) (#33481)\n\n- Update to version 7.5.5:\n  * 'Release: Updated versions in package to 7.5.5' (#33469)\n  * GraphNG: Fix exemplars window position (#33427) (#33462)\n  * Remove field limitation from slack notification (#33113) (#33455)\n  * Prometheus: Support POST in template variables (#33321) (#33441)\n  * Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)\n  * Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)\n  * Docs: Removed type from find annotations example. (#33399) (#33403)\n  * [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)\n  * Updated label for add panel. (#33285) (#33286)\n  * Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)\n  * Docs: Sync latest master docs with 7.5.x (#33156)\n  * Docs: Update getting-started-influxdb.md (#33234) (#33241)\n  * Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)\n  * Minor Changes in Auditing.md (#31435) (#33238)\n  * Docs: Add license check endpoint doc (#32987) (#33236)\n  * Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)\n  * Docs: InfluxDB doc improvements (#32815) (#33185)\n  * [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)\n  * update cla (#33181)\n  * Fix inefficient regular expression (#33155) (#33159)\n  * Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)\n  * Elasticsearch:  Add documentation for supported Elasticsearch query transformations (#33072) (#33128)\n  * Update team.md (#33060) (#33084)\n  * GE issue 1268 (#33049) (#33081)\n  * Fixed some formatting issues for PRs from yesterday. (#33078) (#33079)\n  * Explore: Load default data source in Explore when the provided source does not exist (#32992) (#33061)\n  * Docs: Replace next with latest in aliases (#33054) (#33059)\n  * Added missing link item. (#33052) (#33055)\n  * Backport 33034 (#33038)\n  * Docs: Backport 32916 to v7.5x  (#33008)\n  * ReleaseNotes: Updated changelog and release notes for 7.5.4 (#32973) (#32998)\n  * Elasticsearch: Force re-rendering of each editor row type change (#32993) (#32996)\n  * Docs: Sync release branch with latest docs (#32986)\n\n- Update to version 7.5.4:\n  * 'Release: Updated versions in package to 7.5.4' (#32971)\n  * fix(datasource_srv): prevent infinite loop where default datasource is named default (#32949) (#32967)\n  * Added Azure Monitor support for Microsoft.AppConfiguration/configurationStores namespace (#32123) (#32968)\n  * fix sqlite3 tx retry condition operator precedence (#32897) (#32952)\n  * AzureMonitor: Add support for Virtual WAN namespaces (#32935) (#32947)\n  * Plugins: Allow a non-dashboard page to be the default home page (#32926) (#32945)\n  * GraphNG: uPlot 1.6.8 (#32859) (#32863)\n  * Alerting: Add ability to include aliases with dashes (/) and at (@) signs in InfluxDB (#32844)\n  * Prometheus: Allow exemplars endpoint in data source proxy (#32802) (#32804)\n  * [v7.5.x] Table: Fixes table data links so they refer to correct row after sorting (#32758)\n  * TablePanel: Makes sorting case-insensitive (#32435) (#32752)\n\n- Update to version 7.5.3:\n  * 'Release: Updated versions in package to 7.5.3' (#32745)\n  * FolderPicker: Prevent dropdown menu from disappearing off screen (#32603) (#32741)\n  * Loki: Remove empty annotations tags (#32359) (#32490)\n  * SingleStat: fix wrong call to getDataLinkUIModel (#32721) (#32739)\n  * Prometheus: Fix instant query to run two times when exemplars enabled (#32508) (#32726)\n  * Elasticsearch: Fix bucket script variable duplication in UI (#32705) (#32714)\n  * Variables: Confirms selection before opening new picker (#32586) (#32710)\n  * CloudWarch: Fix service quotas link (#32686) (#32689)\n  * Configuration: Prevent browser hanging / crashing with large number of org users (#32546) (#32598)\n  * chore: bump execa to v2.1.0 (#32543) (#32592)\n  * Explore: Fix bug where navigating to explore would result in wrong query and datasource to be shown (#32558)\n  * Fix broken gtime tests (#32582) (#32587)\n  * resolve conflicts (#32567)\n  * gtime: Make ParseInterval deterministic (#32539) (#32560)\n  * Dashboard: No longer includes default datasource when externally exporting dashboard with row (#32494) (#32535)\n  * TextboxVariable: Limits the length of the preview value (#32472) (#32530)\n  * AdHocVariable: Adds default data source (#32470) (#32476)\n  * Variables: Fixes Unsupported data format error for null values (#32480) (#32487)\n  * Prometheus: align exemplars check to latest api change (#32513) (#32515)\n  * 'Release: Updated versions in package to 7.5.2' (#32502)\n  * SigV4: Add support EC2 IAM role auth and possibility to toggle auth providers  (#32444) (#32488)\n  * Set spanNulls to default (#32471) (#32486)\n  * Graph: Fix setting right y-axis when standard option unit is configured (#32426) (#32442)\n  * API: Return 409 on datasource version conflict (#32425) (#32433)\n  * API: Return 400 on invalid Annotation requests (#32429) (#32431)\n  * Variables: Fixes problem with data source variable when default ds is selected (#32384) (#32424)\n  * Table: Fixes so links work for image cells (#32370) (#32410)\n  * Variables: Fixes error when manually non-matching entering custom value in variable input/picker (#32390) (#32394)\n  * DashboardQueryEditor: Run query after selecting source panel (#32383) (#32395)\n  * API: Datasource endpoint should return 400 bad request if id and orgId is invalid (#32392) (#32397)\n  * 'Release: Updated versions in package to 7.5.1' (#32362)\n  * MSSQL: Upgrade go-mssqldb (#32347) (#32361)\n  * GraphNG: Fix tooltip displaying wrong or no data (#32312) (#32348)\n  * 'Release: Updated versions in package to 7.5.0' (#32308)\n  * Loki: Fix text search in Label browser (#32293) (#32306)\n  * Explore: Show all dataFrames in data tab in Inspector (#32161) (#32299)\n  * PieChartV2: Add migration from old piechart (#32259) (#32291)\n  * LibraryPanels: Adds Type and Description to DB (#32258) (#32288)\n  * LibraryPanels: Prevents deletion of connected library panels (#32277) (#32284)\n  * Library Panels: Add 'Discard' button to panel save modal (#31647) (#32281)\n  * LibraryPanels: Changes to non readonly reducer (#32193) (#32200)\n  * Notifications: InfluxDB - Fix regex to include metrics with hyphen in aliases (#32224) (#32262)\n  * SSE/InfluxDB: Change InfluxQL to work with server side expressions (#31691) (#32102)\n  * DashboardSettings: Fixes issue with tags list not updating when changes are made (#32241) (#32247)\n  * Logs: If log message missing, use empty string (#32080) (#32243)\n  * CloudWatch: Use latest version of aws sdk (#32217) (#32223)\n  * Release: Updated versions in package to 7.5.0-beta.2 (#32158)\n  * HttpServer: Make read timeout configurable but disabled by default (#31575) (#32154)\n  * GraphNG: Ignore string fields when building data for uPlot in GraphNG (#32150) (#32151)\n  * Fix loading timezone info on windows (#32029) (#32149)\n  * SQLStore: Close session in withDbSession (#31775) (#32108)\n  * Remove datalink template suggestions for accessing specific fields when there are multiple dataframes. (#32057) (#32148)\n  * GraphNG: make sure dataset and config are in sync when initializing and re-initializing uPlot (#32106) (#32125)\n  * MixedDataSource: Name is updated when data source variable changes (#32090) (#32144)\n  * Backport 32005 to v7.5.x #32128 (#32130)\n  * Loki: Label browser UI updates (#31737) (#32119)\n  * ValueMappings: Fixes value 0 not being mapped (#31924) (#31929)\n  * GraphNG: Fix tooltip series color for multi data frame scenario (#32098) (#32103)\n  * LibraryPanels: Improves the Get All experience (#32028) (#32093)\n  * Grafana/ui: display all selected levels for selected value when searching (#32030) (#32032)\n  * Exemplars: always query exemplars (#31673) (#32024)\n  * [v7.5.x] TimePicker: Fixes hidden time picker shown in kiosk TV mode (#32055)\n  * Chore: Collect elasticsearch version usage stats (#31787) (#32063)\n  * Chore: Tidy up Go deps (#32053)\n  * GraphNG: Fix PlotLegend field display name being outdated (#32064) (#32066)\n  * Data proxy: Fix encoded characters in URL path should be proxied encoded (#30597) (#32060)\n  * [v7.5.x] Auth: Allow soft token revocation (#32037)\n  * Snapshots: Fix usage of sign in link from the snapshot page (#31986) (#32036)\n  * Make master green (#32011) (#32015)\n  * Query editor: avoid avoiding word wrap on query editor components (#31949) (#31982)\n  * Variables: Fixes filtering in picker with null items (#31979) (#31995)\n  * TooltipContainer - use resize observer instead of getClientBoundingRect (#31937) (#32003)\n  * Loki: Fix autocomplete when re-editing Loki label values (#31828) (#31987)\n  * Loki: Fix type errors in language_provider (#31902) (#31945)\n  * PanelInspect: Interpolates variables in CSV file name (#31936) (#31977)\n  * Cloudwatch: use shared library for aws auth (#29550) (#31946)\n  * Tooltip: partial perf improvement (#31774) (#31837) (#31957)\n  * Backport 31913 to v7.5.x (#31955)\n  * Grafana/ui: fix searchable options for Cascader with options update (#31906) (#31938)\n  * Variables: Do not reset description on variable type change (#31933) (#31939)\n  * [v7.5.x] AnnotationList: Adds spacing to UI  (#31888) (#31894)\n  * Elasticseach: Support histogram fields (#29079) (#31914)\n  * Chore: upgrade eslint and fork-ts-checker-webpack-plugin (#31854) (#31896)\n  * Update scripts and Dockerfiles to use Go 1.16.1 (#31881) (#31891)\n  * Templating: use dashboard timerange when variables are set to refresh 'On Dashboard Load' (#31721) (#31801)\n  * [v7.5.x] Tempo: Add test for backend data source (#31835) (#31882)\n  * Run go mod tidy to update go.mod and go.sum (#31859)\n  * Grafana/ui: display all selected levels for Cascader (#31729) (#31862)\n  * CloudWatch: Consume the grafana/aws-sdk (#31807) (#31861)\n  * Cloudwatch: ListMetrics API page limit (#31788) (#31851)\n  * Remove invalid attribute (#31848) (#31850)\n  * CloudWatch: Restrict auth provider and assume role usage according to… (#31845)\n  * CloudWatch: Add support for EC2 IAM role (#31804) (#31841)\n  * Loki, Prometheus: Change the placement for query type explanation (#31784) (#31819)\n  * Variables: Improves inspection performance and unknown filtering (#31811) (#31813)\n  * Change piechart plugin state to beta (#31797) (#31798)\n  * ReduceTransform: Include series with numeric string  names (#31763) (#31794)\n  * Annotations: Make the annotation clean up batch size configurable (#31487) (#31769)\n  * Fix escaping in ANSI and dynamic button removal (#31731) (#31767)\n  * DataLinks: Bring back single click links for Stat, Gauge and BarGauge panel (#31692) (#31718)\n  * log skipped, performed and duration for migrations (#31722) (#31754)\n  * Search: Make items more compact (#31734) (#31750)\n  * loki_datasource: add documentation to label_format and line_format (#31710) (#31746)\n  * Tempo: Convert tempo to backend data source2 (#31733)\n  * Elasticsearch: Fix script fields in query editor (#31681) (#31727)\n  * Elasticsearch: revert to isoWeek when resolving weekly indices (#31709) (#31717)\n  * Admin: Keeps expired api keys visible in table after delete (#31636) (#31675)\n  * Tempo: set authentication header properly (#31699) (#31701)\n  * Tempo: convert to backend data source (#31618) (#31695)\n  * Update package.json (#31672)\n  * Release: Bump version to 7.5.0-beta.1 (#31664)\n  * Fix whatsNewUrl version to 7.5 (#31666)\n  * Chore: add alias for what's new 7.5 (#31669)\n  * Docs: Update doc for PostgreSQL authentication (#31434)\n  * Docs: document report template variables (#31637)\n  * AzureMonitor: Add deprecation message for App Insights/Insights Analytics (#30633)\n  * Color: Fixes issue where colors where reset to gray when switch panels (#31611)\n  * Live: Use pure WebSocket transport (#31630)\n  * Docs: Fix broken image link (#31661)\n  * Docs: Add Whats new in 7.5 (#31659)\n  * Docs: Fix links for 7.5 (#31658)\n  * Update enterprise-configuration.md (#31656)\n  * Explore/Logs: Escaping of incorrectly escaped log lines (#31352)\n  * Tracing: Small improvements to trace types (#31646)\n  * Update _index.md (#31645)\n  * AlertingNG: code refactoring (#30787)\n  * Remove pkill gpg-agent (#31169)\n  * Remove format for plugin routes (#31633)\n  * Library Panels: Change unsaved change detection logic (#31477)\n  * CloudWatch: Added AWS Timestream Metrics and Dimensions (#31624)\n  * add new metrics and dimensions (#31595)\n  * fix devenv dashboard content typo (#31583)\n  * DashList: Sort starred and searched dashboard alphabetically (#31605)\n  * Docs: Update whats-new-in-v7-4.md (#31612)\n  * SSE: Add 'Classic Condition' on backend (#31511)\n  * InfluxDB: Improve maxDataPoints error-message in Flux-mode, raise limits (#31259)\n  * Alerting: PagerDuty: adding current state to the payload (#29270)\n  * devenv: Fix typo (#31589)\n  * Loki: Label browser (#30351)\n  * LibraryPanels: No save modal when user is on same dashboard (#31606)\n  * Bug: adding resolution for `react-use-measure` to prevent plugin tests from failing. (#31603)\n  * Update node-graph.md (#31571)\n  * test: pass Cypress options objects into selector wrappers (#31567)\n  * Loki: Add support for alerting (#31424)\n  * Tracing: Specify type of the data frame that is expected for TraceView (#31465)\n  * LibraryPanels: Adds version column (#31590)\n  * PieChart: Add color changing options to pie chart (#31588)\n  * Explore: keep enabled/disabled state in angular based QueryEditors correctly (#31558)\n  * Bring back correct legend sizing afer PlotLegend refactor (#31582)\n  * Alerting: Fix bug in Discord for when name for metric value is absent (#31257)\n  * LibraryPanels: Deletes library panels during folder deletion (#31572)\n  * chore: bump lodash to 4.17.21 (#31549)\n  * Elasticsearch: Fix impossibility to perform non-logs queries after importing queries from loki or prometheus in explore (#31518)\n  * TestData: Fixes never ending annotations scenario (#31573)\n  * CloudWatch: Added AWS Network Firewall metrics and dimensions (#31498)\n  * propagate plugin unavailable message to UI (#31560)\n  * ConfirmButton: updates story from knobs to controls (#31476)\n  * Loki: Refactor line limit to use grafana/ui component (#31509)\n  * LibraryPanels: Adds folder checks and permissions (#31473)\n  * Add guide on custom option editors (#31254)\n  * PieChart: Update text color and minor changes (#31546)\n  * Grafana-data: bump markedjs to v2.x to resolve vulnerability (#31036)\n  * Chore(deps): Bump google.golang.org/api from 0.39.0 to 0.40.0 (#31210)\n  * PieChart: Improve piechart legend and options (#31446)\n  * Chore(deps): Bump google.golang.org/grpc from 1.35.0 to 1.36.0 (#31541)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.37.7 to 1.37.20 (#31538)\n  * Chore(deps): Bump github.com/prometheus/common from 0.17.0 to 0.18.0 (#31539)\n  * Add multiselect options ui (#31501)\n  * Profile: Fixes profile preferences being accessible when anonymous access was enabled (#31516)\n  * Variables: Fixes error with: cannot read property length of undefined (#31458)\n  * Explore: Show ANSI colored logs in logs context (#31510)\n  * LogsPanel: Show all received logs  (#31505)\n  * AddPanel: Design polish  (#31484)\n  * TimeSeriesPanel: Remove unnecessary margin from legend  (#31467)\n  * influxdb: flux: handle is-hidden (#31324)\n  * Graph: Fix tooltip not showing when close to the edge of viewport  (#31493)\n  * FolderPicker: Remove useNewForms from FolderPicker (#31485)\n  * Add reportVariables feature toggle (#31469)\n  * Grafana datasource: support multiple targets (#31495)\n  * Update license-restrictions.md (#31488)\n  * Docs: Derived fields links in logs detail view (#31482)\n  * Docs: Add new data source links to Enterprise page (#31480)\n  * Convert annotations to dataframes (#31400)\n  * ReleaseNotes: Updated changelog and release notes for v7.4.2 (#31475)\n  * GrafanaUI: Fixes typescript error for missing css prop (#31479)\n  * Login: handle custom token creation error messages (#31283)\n  * Library Panels: Don't list current panel in available panels list (#31472)\n  * DashboardSettings: Migrate Link Settings to React (#31150)\n  * Frontend changes for library panels feature (#30653)\n  * Alerting notifier SensuGo: improvements in default message (#31428)\n  * AppPlugins: Options to disable showing config page in nav (#31354)\n  * add aws config (#31464)\n  * Heatmap: Fix missing/wrong value in heatmap legend (#31430)\n  * Chore: Fixes small typos (#31461)\n  * Graphite/SSE: update graphite to work with server side expressions (#31455)\n  * update the lastest version to 7.4.3 (#31457)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.3 (#31454)\n  * AWS: Add aws plugin configuration (#31312)\n  * Revert ''Release: Updated versions in package to 7.4.3' (#31444)' (#31452)\n  * Remove UserSyncInfo.tsx (#31450)\n  * Elasticsearch: Add word highlighting to search results (#30293)\n  * Chore: Fix eslint react hook warnings in grafana-ui (#31092)\n  * CloudWatch: Make it possible to specify custom api endpoint (#31402)\n  * Chore: fixed incorrect naming for disable settings (#31448)\n  * TraceViewer: Fix show log marker in spanbar (#30742)\n  * LibraryPanels: Adds permissions to getAllHandler (#31416)\n  * NamedColorsPalette: updates story from knobs to controls (#31443)\n  * 'Release: Updated versions in package to 7.4.3' (#31444)\n  * ColorPicker: updates story from knobs to controls (#31429)\n  * Streaming: Fixes an issue with time series panel and streaming data source when scrolling back from being out of view (#31431)\n  * ClipboardButton: updates story from knobs to controls (#31422)\n  * we should never log unhashed tokens (#31432)\n  * CI: Upgrade Dockerfiles wrt. Go, Node, Debian (#31407)\n  * Elasticsearch: Fix query initialization logic \u0026 query transformation from Promethous/Loki (#31322)\n  * Postgres: allow providing TLS/SSL certificates as text in addition to file paths (#30353)\n  * CloudWatch: Added AWS Ground Station metrics and dimensions (#31362)\n  * TraceViewer: Fix trace to logs icon to show in right pane (#31414)\n  * add hg team as migrations code owners (#31420)\n  * Remove tidy-check script (#31423)\n  * InfluxDB: handle columns named 'table' (#30985)\n  * Prometheus: Use configured HTTP method for /series and /labels endpoints (#31401)\n  * Devenv: Add gdev-influxdb2 data source (#31250)\n  * Update grabpl from 0.5.38 to 0.5.42 version (#31419)\n  * Move NOOP_CONTROL to storybook utils and change to a standalone file (#31421)\n  * remove squadcast details from docs (#31413)\n  * Add new Cloudwatch AWS/DDoSProtection metrics and dimensions (#31297)\n  * Logging: add frontend logging helpers to @grafana/runtime package (#30482)\n  * CallToActionCard: updates story from knobs to controls (#31393)\n  * Add eu-south-1 cloudwatch region, closes #31197 (#31198)\n  * Chore: Upgrade eslint packages (#31408)\n  * Cascader: updates story from knobs to controls (#31399)\n  * addressed issues 28763 and 30314. (#31404)\n  * Added section Query a time series database by id (#31337)\n  * Prometheus: Change default httpMethod for new instances to POST (#31292)\n  * Data source list: Use Card component (#31326)\n  * Chore: Remove gotest.tools dependency (#31391)\n  * Revert 'StoryBook: Introduces Grafana Controls (#31351)' (#31388)\n  * Chore(deps): Bump github.com/prometheus/common from 0.15.0 to 0.17.0 (#31387)\n  * AdHocVariables: Fixes crash when values are stored as numbers (#31382)\n  * Chore(deps): Bump github.com/golang/mock from 1.4.4 to 1.5.0 (#31379)\n  * Chore: Fix strict errors, down to 416 (#31365)\n  * Chore(deps): Bump github.com/getsentry/sentry-go from 0.9.0 to 0.10.0 (#31378)\n  * StoryBook: Introduces Grafana Controls (#31351)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.2 (#31313)\n  * Theming: Support for runtime theme switching and hooks for custom themes (#31301)\n  * Devenv: Remove old-versioned loki blocks and update prometheus2 block  (#31282)\n  * Zipkin: Show success on test data source (#30829)\n  * Update grot template (needs more info) (#31350)\n  * DatasourceSrv: Fix instance retrieval when datasource variable value set to 'default' (#31347)\n  * TimeSeriesPanel: Fixes overlapping time axis ticks (#31332)\n  * Grafana/UI: Add basic legend to the PieChart (#31278)\n  * SAML: single logout only enabled in enterprise (#31325)\n  * QueryEditor: handle query.hide changes in angular based query-editors (#31336)\n  * DashboardLinks: Fixes another issue where dashboard links cause full page reload (#31334)\n  * LibraryPanels: Syncs panel title with name (#31311)\n  * Chore: Upgrade golangci-lint (#31330)\n  * Add info to docs about concurrent session limits (#31333)\n  * Table: Fixes issue with fixed min and auto max with bar gauge cell (#31316)\n  * BarGuage: updates story from knobs to controls (#31223)\n  * Docs: Clarifies how to add Key/Value pairs (#31303)\n  * Usagestats: Exclude folders from total dashboard count (#31320)\n  * ButtonCascader: updates story from knobs to controls (#31288)\n  * test: allow check for Table as well as Graph for Explore e2e flow (#31290)\n  * Grafana-UI: Update tooltip type (#31310)\n  * fix 7.4.2 release note (#31299)\n  * Add `--tries 3` arg when triggering e2e-tests upon releasing (#31285)\n  * Chore: reduce strict errors for variables (#31241)\n  * update latest release version (#31296)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.2 (#31291)\n  * Correct name of Discord notifier tests (#31277)\n  * Docs: Clarifies custom date formats for variables (#31271)\n  * BigValue: updates story from knobs to controls (#31240)\n  * Docs: Annotations update (#31194)\n  * Introduce functions for interacting with library panels API (#30993)\n  * Search: display sort metadata (#31167)\n  * Folders: Editors should be able to edit name and delete folders (#31242)\n  * Make Datetime local (No date if today) working (#31274)\n  * UsageStats: Purpose named variables (#31264)\n  * Snapshots: Disallow anonymous user to create snapshots (#31263)\n  * only update usagestats every 30min (#31131)\n  * Chore: grafana-toolkit uses grafana-ui and grafana-data workspaces (#30701)\n  * Grafana-UI: Add id to Select to make it easier to test (#31230)\n  * Prometheus: Fix enabling of disabled queries when editing in dashboard (#31055)\n  * UI/Card: Fix handling of 'onClick' callback (#31225)\n  * Loki: Add line limit for annotations (#31183)\n  * Remove deprecated and breaking loki config field (#31227)\n  * SqlDataSources: Fixes the Show Generated SQL button in query editors (#31236)\n  * LibraryPanels: Disconnect before connect during dashboard save (#31235)\n  * Disable Change Password for OAuth users (#27886)\n  * TagsInput: Design update and component refactor (#31163)\n  * Variables: Adds back default option for data source variable (#31208)\n  * IPv6: Support host address configured with enclosing square brackets (#31226)\n  * Postgres: Fix timeGroup macro converts long intervals to invalid numbers when TimescaleDB is enabled (#31179)\n  * GraphNG: refactor core to class component (#30941)\n  * Remove last synchronisation field from LDAP debug view (#30984)\n  * Chore: Upgrade grafana-plugin-sdk-go to v0.88.0 (#30975)\n  * Graph: Make axes unit option work even when field option unit is set (#31205)\n  * AlertingNG:  Test definition  (#30886)\n  * Docs: Update Influx config options (#31146)\n  * WIP: Skip this call when we skip migrations (#31216)\n  * use 0.1.0 (#31215)\n  * DataSourceSrv: Filter out non queryable data sources by default (#31144)\n  * QueryEditors: Fixes issue that happens after moving queries then editing would update other queries (#31193)\n  * Chore: report eslint no-explicit-any errors to metrics (#31182)\n  * Chore(deps): Bump cloud.google.com/go/storage from 1.12.0 to 1.13.0 (#31211)\n  * Chore(deps): Bump xorm.io/xorm from 0.8.1 to 0.8.2 (#30773)\n  * Alerting: Fix modal text for deleting obsolete notifier (#31171)\n  * Chore(deps): Bump github.com/linkedin/goavro/v2 from 2.9.7 to 2.10.0 (#31204)\n  * Variables: Fixes missing empty elements from regex filters (#31156)\n  * StatPanels: Fixes to palette color scheme is not cleared when loading panel (#31126)\n  * Fixed the typo. (#31189)\n  * Docs: Rewrite preferences docs (#31154)\n  * Explore/Refactor: Simplify URL handling (#29173)\n  * DashboardLinks: Fixes links always cause full page reload (#31178)\n  * Replace PR with Commit truncated hash when build fails (#31177)\n  * Alert: update story to use controls (#31145)\n  * Permissions: Fix team and role permissions on folders/dashboards not displayed for non Grafana Admin users (#31132)\n  * CloudWatch: Ensure empty query row errors are not passed to the panel (#31172)\n  * Update prometheus.md (#31173)\n  * Variables: Extend option pickers to accept custom onChange callback (#30913)\n  * Prometheus: Multiply exemplars timestamp to follow api change (#31143)\n  * DashboardListPanel: Fixes issue with folder picker always showing All and using old form styles (#31160)\n  * Add author name and pr number in drone pipeline notifications (#31124)\n  * Prometheus: Add documentation for ad-hoc filters (#31122)\n  * DataSourceSettings: Fixes add header button, it should not trigger a save \u0026 test action (#31135)\n  * Alerting: Fix so that sending an alert with the Alertmanager notifier doesn't fail when one of multiple configured URL's are down (#31079)\n  * Chore: Update latest.json (#31139)\n  * Docs: add 7.4.1 relese notes link (#31137)\n  * PieChart: Progress on new core pie chart  (#28020)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.1 (#31133)\n  * Eslint: no-duplicate-imports rule (bump grafana-eslint-config) (#30989)\n  * Transforms: Fixes Outer join issue with duplicate field names not getting the same unique field names as before  (#31121)\n  * MuxWriter: Handle error for already closed file (#31119)\n  * Logging: sourcemap transform asset urls from CDN in logged stacktraces (#31115)\n  * Search: add sort information in dashboard results (#30609)\n  * area/grafana/e2e: ginstall should pull version specified (#31056)\n  * Exemplars: Change CTA style (#30880)\n  * Influx: Make max series limit configurable and show the limiting message if applied (#31025)\n  * Docs: request security (#30937)\n  * update configurePanel for 7.4.0 changes (#31093)\n  * Elasticsearch: fix log row context erroring out (#31088)\n  * Prometheus: Fix issues with ad-hoc filters (#30931)\n  * LogsPanel: Add deduplication option for logs (#31019)\n  * Drone: Make sure CDN upload is ok before pushing docker images (#31075)\n  * PluginManager: Remove some global state (#31081)\n  * test: update addDashboard flow for v7.4.0 changes (#31059)\n  * Transformations: Fixed typo in FilterByValue transformer description. (#31078)\n  * Docs: Group id should be 0 instead of 1 in Docker upgrade notes (#31074)\n  * Usage stats: Adds source/distributor setting (#31039)\n  * CDN: Add CDN upload step to enterprise and release pipelines (#31058)\n  * Chore: Replace native select with grafana ui select  (#31030)\n  * Docs: Update json-model.md (#31066)\n  * Docs: Update whats-new-in-v7-4.md (#31069)\n  * Added hyperlinks to Graphite documentation (#31064)\n  * DashboardSettings: Update to new form styles (#31022)\n  * CDN: Fixing drone CI config (#31052)\n  * convert path to posix by default (#31045)\n  * DashboardLinks: Fixes crash when link has no title (#31008)\n  * Alerting: Fixes so notification channels are properly deleted (#31040)\n  * Explore: Remove emotion error when displaying logs (#31026)\n  * Elasticsearch: Fix alias field value not being shown in query editor (#30992)\n  * CDN: Adds uppload to CDN step to drone CI (#30879)\n  * Improved glossary (#31004)\n  * BarGauge: Improvements to value sizing and table inner width calculations  (#30990)\n  * Drone: Fix deployment image (#31027)\n  * ColorPicker: migrated styles from sass to emotion (#30909)\n  * Dashboard: Migrate general settings to react (#30914)\n  * Chore(deps): Bump github.com/jung-kurt/gofpdf from 1.10.1 to 1.16.2 (#30586)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.36.31 to 1.37.7 (#31018)\n  * Prometheus: Min step defaults to seconds when no unit is set to prevent errors when running alerts. (#30966)\n  * Chore(deps): Bump github.com/magefile/mage from 1.10.0 to 1.11.0 (#31017)\n  * Chore(deps): Bump github.com/grpc-ecosystem/go-grpc-middleware (#31013)\n  * Graph: Fixes so graph is shown for non numeric time values (#30972)\n  * CloudMonitoring: Prevent resource type variable function from crashing (#30901)\n  * Chore(deps): Bump google.golang.org/api from 0.33.0 to 0.39.0 (#30971)\n  * Build: Releases e2e and e2e-selectors too (#31006)\n  * TextPanel: Fixes so panel title is updated when variables change (#30884)\n  * Docs: Update configuration.md (login_maximum_inactive_lifetime_duration, login_maximum_lifetime_duration) (#31000)\n  * instrumentation: make the first database histogram bucket smaller (#30995)\n  * Grafana/UI: Remove DismissableFeatureInfoBox and replace with LocalSt… (#30988)\n  * StatPanel: Fixes issue formatting date values using unit option (#30979)\n  * Chore(deps): Bump actions/cache from v2 to v2.1.4 (#30973)\n  * Units: Fixes formatting of duration units (#30982)\n  * Elasticsearch: Show Size setting for raw_data metric (#30980)\n  * Alerts: Dedupe alerts so that we do not fill the screen with the same alert messsage (#30935)\n  * make sure service and slo display name is passed to segment comp (#30900)\n  * assign changes in cloud datasources to the new cloud datasources team (#30645)\n  * Table: Updates devenv test dashboard after change to TestData Randrom Table response (#30927)\n  * Theme: Use higher order theme color variables rather then is light/dark logic (#30939)\n  * Docs: Add alias for what's new in 7.4 (#30945)\n  * e2e: extends selector factory to plugins (#30932)\n  * Chore: Upgrade docker build image (#30820)\n  * Docs: updated developer guide (#29978)\n  * Alerts: Update Alert storybook to show more states (#30908)\n  * Variables: Adds queryparam formatting option (#30858)\n  * Chore: pad unknown values with undefined (#30808)\n  * Transformers: add search to transform selection (#30854)\n  * Exemplars: change api to reflect latest changes (#30910)\n  * docs: use selinux relabelling on docker containers (#27685)\n  * Docs: Fix bad image path for alert notification template (#30911)\n  * Make value mappings correctly interpret numeric-like strings (#30893)\n  * Chore: Update latest.json (#30905)\n  * Docs: Update whats-new-in-v7-4.md (#30882)\n  * Dashboard: Ignore changes to dashboard when the user session expires (#30897)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0 (#30902)\n  * test: add support for timeout to be passed in for addDatasource (#30736)\n  * increase page size and make sure the cache supports query params (#30892)\n  * DataSourceSettings: Adds info box and link to Grafana Cloud (#30891)\n  * OAuth: custom username docs (#28400)\n  * Panels: Remove value mapping of values that have been formatted #26763 (#30868)\n  * Alerting: Fixes alert panel header icon not showing (#30840)\n  * AlertingNG: Edit Alert Definition (#30676)\n  * Logging: sourcemap support for frontend stacktraces (#30590)\n  * Added 'Restart Grafana' topic. (#30844)\n  * Docs: Org, Team, and User Admin (#30756)\n  * bump grabpl version to 0.5.36 (#30874)\n  * Plugins: Requests validator (#30445)\n  * Docs: Update whats-new-in-v7-4.md (#30876)\n  * Docs: Add server view folder (#30849)\n  * Fixed image name and path  (#30871)\n  * Grafana-ui: fixes closing modals with escape key (#30745)\n  * InfluxDB: Add http configuration when selecting InfluxDB v2 flavor  (#30827)\n  * TestData: Fixes issue with for ever loading state when all queries are hidden (#30861)\n  * Chart/Tooltip: refactored style declaration (#30824)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30853)\n  * Grafana-ui: fixes no data message in Table component (#30821)\n  * grafana/ui: Update pagination component for large number of pages (#30151)\n  * Alerting: Customise OK notification priorities for Pushover notifier (#30169)\n  * DashboardLinks: Support variable expression in to tooltip - Issue #30409 (#30569)\n  * Chore: Remove panelTime.html, closes #30097 (#30842)\n  * Docs: Time series panel, bar alignment docs (#30780)\n  * Chore: add more docs annotations (#30847)\n  * Transforms: allow boolean in field calculations (#30802)\n  * Prometheus: Add tooltip to explain possibility to use patterns in text and title fields in annotations (#30825)\n  * Update prometheus.md with image link fix (#30833)\n  * BarChart: inside-align strokes, upgrade uPlot to 1.6.4. (#30806)\n  * Update license-expiration.md (#30839)\n  * Explore rewrite (#30804)\n  * Prometheus: Set type of labels to string (#30831)\n  * GrafanaUI: Add a way to persistently close InfoBox (#30716)\n  * Fix typo in transformer registry (#30712)\n  * Elasticsearch: Display errors with text responses (#30122)\n  * CDN: Fixes cdn path when Grafana is under sub path (#30822)\n  * TraceViewer: Fix lazy loading (#30700)\n  * FormField: migrated sass styling to emotion (#30392)\n  * AlertingNG: change API permissions (#30781)\n  * Variables: Clears drop down state when leaving dashboard (#30810)\n  * Grafana-UI: Add story/docs for ErrorBoundary (#30304)\n  * Add missing callback dependency (#30797)\n  * PanelLibrary: Adds library panel meta information to dashboard json (#30770)\n  * Chore(deps): Bump gonum.org/v1/gonum from 0.6.0 to 0.8.2 (#30343)\n  * Chore(deps): Bump gopkg.in/yaml.v2 from 2.3.0 to 2.4.0 (#30771)\n  * GraphNG: improve behavior when switching between solid/dash/dots (#30796)\n  * Chore(deps): Bump github.com/hashicorp/go-hclog from 0.14.1 to 0.15.0 (#30778)\n  * Add width for Variable Editors (#30791)\n  * Chore: Remove warning when calling resource (#30752)\n  * Auth: Use SigV4 lib from grafana-aws-sdk  (#30713)\n  * Panels: Fixes so panels are refreshed when scrolling past them fast (#30784)\n  * GraphNG: add bar alignment option (#30499)\n  * Expressions: Measure total transformation requests and elapsed time (#30514)\n  * Menu: Mark menu components as internal (#30740)\n  * TableInputCSV: migrated styles from sass to emotion (#30554)\n  * CDN: Fix passing correct prefix to GetContentDeliveryURL (#30777)\n  * Chore(deps): Bump gopkg.in/ini.v1 from 1.57.0 to 1.62.0 (#30772)\n  * CDN: Adds support for serving assets over a CDN (#30691)\n  * PanelEdit: Trigger refresh when changing data source (#30744)\n  * Chore: remove __debug_bin (#30725)\n  * BarChart: add alpha bar chart panel (#30323)\n  * Docs: Time series panel (#30690)\n  * Backend Plugins: Convert test data source to use SDK contracts (#29916)\n  * Docs: Update whats-new-in-v7-4.md (#30747)\n  * Add link to Elasticsearch docs. (#30748)\n  * Mobile: Fixes issue scrolling on mobile in chrome (#30746)\n  * TagsInput: Make placeholder configurable (#30718)\n  * Docs: Add config settings for fonts in reporting (#30421)\n  * Add menu.yaml to .gitignore (#30743)\n  * bump cypress to 6.3.0 (#30644)\n  * Datasource: Use json-iterator configuration compatible with standard library (#30732)\n  * AlertingNG: Update UX to use new PageToolbar component (#30680)\n  * Docs: Add usage insights export feature (#30376)\n  * skip symlinks to directories when generating plugin manifest (#30721)\n  * PluginCiE2E: Upgrade base images (#30696)\n  * Variables: Fixes so text format will show All instead of custom all (#30730)\n  * PanelLibrary: better handling of deleted panels (#30709)\n  * Added section 'Curated dashboards for Google Cloud Monitoring' for 7.4 What's New (#30724)\n  * Added 'curated dashboards' information and broke down, rearranged topics. (#30659)\n  * Transform: improve the 'outer join' performance/behavior (#30407)\n  * Add alt text to plugin logos (#30710)\n  * Deleted menu.yaml file (#30717)\n  * Dashboard: Top Share URL icon should share panel URL when on viewPanel page (#30000)\n  * Added entry for web server. (#30715)\n  * DashboardPicker: switch to promise-based debounce, return dashboard UID (#30706)\n  * Use connected GraphNG in Explore (#30707)\n  * Fix documentation for streaming data sources (#30704)\n  * PanelLibrary: changes casing of responses and adds meta property (#30668)\n  * Influx: Show all datapoints for dynamically windowed flux query (#30688)\n  * Trace: trace to logs design update (#30637)\n  * DeployImage: Switch base images to Debian (#30684)\n  * Chore: remove CSP debug logging line (#30689)\n  * Docs: 7.4 documentation for expressions (#30524)\n  * PanelEdit: Get rid of last remaining usage of navbar-button (#30682)\n  * Grafana-UI: Fix setting default value for MultiSelect (#30671)\n  * CustomScrollbar: migrated styles from sass to emotion (#30506)\n  * DashboardSettings \u0026 PanelEdit: Use new PageToolbar (#30675)\n  * Explore: Fix jumpy live tailing (#30650)\n  * ci(npm-publish): add missing github package token to env vars (#30665)\n  * PageToolbar: Extracting navbar styles \u0026 layout into a modern emotion based component (#30588)\n  * AlertingNG: pause/unpause definitions via the API (#30627)\n  * Docs: Refer to product docs in whats new for alerting templating feature (#30652)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30666)\n  * Variables: Fixes display value when using capture groups in regex (#30636)\n  * Docs: Update _index.md (#30655)\n  * Docs: Auditing updates (#30433)\n  * Docs: add hidden_users configuration field (#30435)\n  * Docs: Define TLS/SSL terminology (#30533)\n  * Docs: Fix expressions enabled description (#30589)\n  * Docs: Update ES screenshots (#30598)\n  * Licensing Docs: Adding license restrictions docs (#30216)\n  * Update documentation-style-guide.md (#30611)\n  * Docs: Update queries.md (#30616)\n  * chore(grafana-ui): bump storybook to 6.1.15 (#30642)\n  * DashboardSettings: fixes vertical scrolling (#30640)\n  * Usage Stats: Remove unused method for getting user stats (#30074)\n  * Grafana/UI: Unit picker should not set a category as unit (#30638)\n  * Graph: Fixes auto decimals issue in legend and tooltip (#30628)\n  * AlertingNG: List saved Alert definitions in Alert Rule list (#30603)\n  * chore: bump redux toolkit to 1.5.0 for immer 8.0.1 vulnerability fix (#30605)\n  * Grafana/UI: Add disable prop to Segment (#30539)\n  * Variables: Fixes so queries work for numbers values too (#30602)\n  * Admin: Fixes so form values are filled in from backend (#30544)\n  * Docs: Add new override info and add whats new 7.4 links (#30615)\n  * TestData: Improve what's new in v7.4 (#30612)\n  * Docs: Update 7.4 What's New to use more correct description of alerting notification template feature (#30502)\n  * NodeGraph: Add docs (#30504)\n  * Loki: Improve live tailing errors and fix Explore's logs container type errors (#30517)\n  * TimeRangePicker: Updates components to use new ToolbarButton \u0026 ButtonGroup (#30570)\n  * Update styling.md guide (#30594)\n  * TestData: Adding what's new in v7.4 to the devenv dashboards (#30568)\n  * Chore(deps): Bump github.com/aws/aws-sdk-go from 1.35.5 to 1.36.31 (#30583)\n  * Chore(deps): Bump github.com/prometheus/client_golang (#30585)\n  * Chore(deps): Bump gopkg.in/macaron.v1 from 1.3.9 to 1.4.0 (#30587)\n  * Chore(deps): Bump github.com/google/uuid from 1.1.5 to 1.2.0 (#30584)\n  * Explore: Fix logs hover state so that it is visible and in dark mode \u0026 simply hover code (#30572)\n  * RefreshPicker: Fixes so valid intervals in url are visible in RefreshPicker (#30474)\n  * Add documentation for Exemplars (#30317)\n  * OldGraph: Fix height issue in Firefox (#30565)\n  * XY Chart: fix editor error with empty frame (no fields) (#30573)\n  * ButtonSelect \u0026 RefreshPicker: Rewrite of components to use new emotion based ToolbarButton \u0026 Menu (#30510)\n  * XY Chart: share legend config with timeseries (#30559)\n  * configuration.md: Document Content Security Policy options (#30413)\n  * DataFrame: cache frame/field index in field state (#30529)\n  * List + before -; rm old Git ref; reformat. (#30543)\n  * Expressions: Add option to disable feature (#30541)\n  * Explore: Fix loading visualisation on the top of the new time series panel (#30553)\n  * Prometheus: Fix show query instead of Value if no __name__ and metric (#30511)\n  * Decimals: Big Improvements to auto decimals and fixes to auto decimals bug found in 7.4-beta1  (#30519)\n  * Postgres: Convert tests to stdlib (#30536)\n  * Storybook: Migrate card story to use controls  (#30535)\n  * AlertingNG: Enable UI to Save Alert Definitions (#30394)\n  * Postgres: Be consistent about TLS/SSL terminology (#30532)\n  * Loki: Append refId to logs uid (#30418)\n  * Postgres: Fix indentation (#30531)\n  * GraphNG: uPlot 1.6.3 (fix bands not filling below 0). close #30523. (#30527)\n  * updates for e2e docker image (#30465)\n  * GraphNG: uPlot 1.6.2 (#30521)\n  * Docs: Update whats-new-in-v7-4.md (#30520)\n  * Prettier: ignore build and devenv dirs (#30501)\n  * Chore: Upgrade grabpl version (#30486)\n  * Explore: Update styling of buttons (#30493)\n  * Cloud Monitoring: Fix legend naming with display name override (#30440)\n  * GraphNG: Disable Plot logging by default (#30390)\n  * Admin: Fixes so whole org drop down is visible when adding users to org (#30481)\n  * Docs: include Makefile option for local assets (#30455)\n  * Footer: Fixes layout issue in footer  (#30443)\n  * TimeSeriesPanel: Fixed default value for gradientMode (#30484)\n  * Docs: fix typo in what's new doc (#30489)\n  * Chore: adds wait to e2e test (#30488)\n  * chore: update packages dependent on dot-prop to fix security vulnerability (#30432)\n  * Dashboard: Remove Icon and change copy -\u003e Copy to clipboard in the share embedded panel modal (#30480)\n  * Chore: fix spelling mistake (#30473)\n  * Chore: Restrict internal imports from other packages (#30453)\n  * Docs: What's new fixes and improvements (#30469)\n  * Timeseries: only migrage point size when configured (#30461)\n  * Alerting: Hides threshold handle for percentual thresholds (#30431)\n  * Graph: Fixes so only users with correct permissions can add annotations (#30419)\n  * Chore: update latest version to 7.4.0-beta1 (#30452)\n  * Docs: Add whats new 7.4 links (#30463)\n  * Update whats-new-in-v7-4.md (#30460)\n  * docs: 7.4 what's new (Add expressions note) (#30446)\n  * Chore: Upgrade build pipeline tool (#30456)\n  * PanelModel: Make sure the angular options are passed to react panel type changed handler (#30441)\n  * Expressions: Fix button icon (#30444)\n  * ReleaseNotes: Updated changelog and release notes for 7.4.0-beta1 (#30449)\n  * Docs: Fix img link for alert notification template (#30436)\n  * grafana/ui: Fix internal import from grafana/data (#30439)\n  * prevent field config from being overwritten (#30437)\n  * PanelOptions: Refactoring applying panel and field options out of PanelModel and add property clean up for properties not in field config registry  (#30389)\n  * Dashboard: Remove template variables option from ShareModal (#30395)\n  * Added doc content for variables inspector code change by Hugo (#30408)\n  * Docs: update license expiration behavior for reporting (#30420)\n  * Chore: use old version format in package.json (#30430)\n  * Chore: upgrade NPM security vulnerabilities (#30397)\n  * 'Release: Updated versions in package to 7.5.0-pre.0' (#30428)\n  * contribute: Add backend and configuration guidelines for PRs (#30426)\n  * Chore: Update what's new URL (#30424)\n- Update to version 7.4.5\n- CVE-2021-28146, CVE-2021-28147: Fix API permissions issues related to team-sync. (Enterprise) (bsc#1183811, bsc#1183809)\n- CVE-2021-28148: Usage insights requires signed in users. (Enterprise) (bsc#1183813)\n- CVE-2021-27962: Do not allow editors to incorrectly bypass permissions on the default data source. (Enterprise) (bsc#1184371)\n","status":"published","published":"2021-08-12T10:01:36Z","modified":"2026-02-04T04:39:19.204912Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}