{"id":"CVE-2026-33244","aliases":["CLSA-2026-1788960805","CLSA-2026-1792419193","CLSA-2026-1792425411","CLSA-2026-1792430035","CLSA-2026-1793811163","EUVD-2026-33986","GHSA-f22v-gfqf-p8f3","SUSE-SU-2026:3713-1","SUSE-SU-2026:3714-1"],"status":"published","title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","description":"React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`\u003cBrowserRouter\u003e`) or Data Mode (`createBrowserRouter/\u003cRouterProvider\u003e`). This is patched in version 7.13.2.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00144,"percentile":0.0376,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-06-02T16:59:31Z","modified":"2026-11-10T19:46:01Z","fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.13.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1"},{"fixed":"7.13.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.1-tuxcare.0"},{"fixed":"7.13.1-tuxcare.4"}]}],"versions":["7.13.1","7.13.1-tuxcare.1","7.13.1-tuxcare.2","7.13.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.5.1"},{"fixed":"7.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150002.3.16.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150002.4.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150000.3.75.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150000.1.98.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150100.4.37.2"}]}],"bundled":9}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"},{"vendor":"shopify","product":"react-router"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33244","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router/pull/14880","tags":["web"]},{"url":"https://github.com/remix-run/react-router/commit/ea28e66926460656815cee9b7f2dfaa872513a8c","tags":["web"]},{"url":"https://github.com/remix-run/react-router/blob/react-router%407.13.2/CHANGELOG.md#v7132","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f22v-gfqf-p8f3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33244.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263713-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263272","tags":["report"]},{"url":"https://bugzilla.suse.com/1265827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267416","tags":["report"]},{"url":"https://bugzilla.suse.com/1269917","tags":["report"]},{"url":"https://bugzilla.suse.com/1271327","tags":["report"]},{"url":"https://bugzilla.suse.com/1271331","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-33244","title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","description":"React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`\u003cBrowserRouter\u003e`) or Data Mode (`createBrowserRouter/\u003cRouterProvider\u003e`). This is patched in version 7.13.2.","status":"published","published":"2026-06-02T16:59:31.104Z","modified":"2026-06-02T17:28:13.207Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-33986","description":"React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`\u003cBrowserRouter\u003e`) or Data Mode (`createBrowserRouter/\u003cRouterProvider\u003e`). This is patched in version 7.13.2.","status":"published","published":"2026-06-02T16:59:31Z","modified":"2026-06-02T17:28:13Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:55.651138Z"}],"ghsa":[{"id":"GHSA-f22v-gfqf-p8f3","title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","description":"When using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://reactrouter.com/how-to/pre-rendering) enabled, an improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.\n\n\u003e [!NOTE]\n\u003e This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`\u003cRouterProvider\u003e`).","status":"published","published":"2026-06-03T20:33:01Z","modified":"2026-09-08T16:28:03Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"nvd":[{"id":"CVE-2026-33244","description":"React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`\u003cBrowserRouter\u003e`) or Data Mode (`createBrowserRouter/\u003cRouterProvider\u003e`). This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:16:28.03Z","modified":"2026-07-21T19:10:00.107Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-33244","title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","description":"React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`\u003cBrowserRouter\u003e`) or Data Mode (`createBrowserRouter/\u003cRouterProvider\u003e`). This is patched in version 7.13.2.","status":"published","published":"2026-06-02T16:59:31.104Z","modified":"2026-10-28T02:31:02.91092616Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"GHSA-f22v-gfqf-p8f3","title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","description":"When using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://reactrouter.com/how-to/pre-rendering) enabled, an improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.\n\n\u003e [!NOTE]\n\u003e This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`\u003cRouterProvider\u003e`).","status":"published","published":"2026-06-03T20:33:01Z","modified":"2026-09-08T16:45:04.231964105Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"CLSA-2026-1788960805","title":"TuxCare security update for 2 packages (3 CVEs)","description":"TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-09-09T13:33:25Z","modified":"2026-10-19T19:15:10.875246428Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792419193","title":"TuxCare security update for @react-router/cloudflare (1 CVE)","description":"TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:13:09Z","modified":"2026-11-10T19:46:01.731620122Z","updated_at":"2026-11-10T20:12:20.089751Z"},{"id":"CLSA-2026-1792425411","title":"TuxCare security update for @react-router/fs-routes (1 CVE)","description":"TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T15:56:47Z","modified":"2026-11-10T19:45:56.721687171Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792430035","title":"TuxCare security update for create-react-router (1 CVE)","description":"TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T17:13:52Z","modified":"2026-11-10T19:45:56.891637671Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1793811163","title":"TuxCare security update for react-router (2 CVEs)","description":"TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.13.1-tuxcare.4.","status":"published","published":"2026-11-04T17:52:44Z","modified":"2026-11-04T19:00:36.305947004Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"SUSE-SU-2026:3713-1","title":"Security update for Multi-Linux Manager Client Tools - Monitoring stack","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version 0.55.0 (bsc#1266615)\n\ngolang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:\n    \n- Security fixes:\n\n  - CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)\n  - CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)\n  - CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)\n  - CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)\n    \n- Other bugs fixed and changes:\n\n   * STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint\n   * Chore: Bump golang.org/x/net to version 0.55.0\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T02:53:30Z","modified":"2026-08-24T17:30:04.93156196Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3714-1","title":"Security update for Multi-Linux Manager Monitoring stack","description":"This update fixes the following issues:\n\nprometheus-postgres_exporter:\n\n- CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass \n  and privilege escalation (bsc#1248699)\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version 0.55.0 (bsc#1266615)\n\ngolang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:\n\nSecurity fixes:\n\n- CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)\n- CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)\n- CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)\n- CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)\n\nOther changes and fixes:\n    \n- STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint\n- Chore: Bump golang.org/x/net to version 0.55.0\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T02:55:28Z","modified":"2026-11-10T17:23:21.319856144Z","updated_at":"2026-11-10T17:35:04.393608Z"}]}}