grafana/grafana
The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
How grafana is put together
Grafana is an open-source observability and data visualization platform built as a Go backend serving a TypeScript/React single-page frontend. The backend is organized as a modular monolith with a Kubernetes-inspired API server architecture, decomposed into many independently-versioned Go modules under apps/ (dashboard, alerting, provisioning, secret, iam, etc.) plus a large core under pkg/. The frontend is a monorepo of workspace packages (@grafana/ui, @grafana/data, @grafana/runtime) plus the main app in public/app, bundled with webpack/rspack and tested with Jest and Playwright. Data flows from frontend requests through the Go API server to pluggable datasources, with dashboards, alert rules, and configuration persisted to a relational datastore.
Languages
Frameworks
Datastores
Infrastructure
Major components
apps/* Go modules
Independently-versioned Kubernetes-style apps (dashboard, alerting, provisioning, secret, iam, folder, playlist, etc.) implementing resource APIs and controllers.
pkg/ backend core
Core Go backend: services, infra, storage, plugins, and API server wiring shared across apps.
public/app frontend
Main TypeScript/React single-page application with features, plugins, and datasource UIs.
packages/ frontend workspaces
Reusable published npm packages (@grafana/ui, @grafana/data, @grafana/runtime, api-clients) consumed by the app and plugins.
Unified storage (pkg/storage/unified)
Resource-oriented storage layer with kv, resource, and protobuf definitions backing the k8s-inspired API.
Datasource plugins (public/app/plugins/datasource)
Built-in datasources (CloudWatch, Azure Monitor, Graphite, MySQL, InfluxDB, testdata) with decoupled build/test.
Alerting
Alert rule evaluation, notification, and historian backed by grafana/alerting and Prometheus alertmanager fork.
Identity & Access (apps/iam, authlib)
Authentication, authorization, LDAP/SAML/JWT identity handling, and secrets management.
Dashboards got smarter defaults and new controls while search, storage, and secrets infrastructure was hardened and instrumented.
3 weeksWeek of 2026-08-24
Week of 2026-08-24latest
Dashboards got smarter defaults and new controls while search, storage, and secrets infrastructure was hardened and instrumented.
Week of 2026-08-17
A very large week centered on rolling out the new per-resource search system and provisioning metrics, plus many table, accessibility, and reliability fixes.
Week of 2026-08-10
A lighter week focused on testing, bundle-size optimization, and incremental provisioning and alerting improvements.
Over the last few weeks, Grafana's team steadily modernized dashboards (auto grid becoming the default, richer variable and filter controls) while overhauling how the system searches and stores data behind the scenes. A large push went into provisioning reliability—removing arbitrary file caps and adding detailed metrics—alongside broad quality work like security hardening for secrets and SSO, accessibility fixes, and heavy test coverage. The trend is a mix of user-facing polish and deep infrastructure investment in search, storage, and provisioning.
Week by week
2026-08-24Dashboards got smarter defaults and new controls while search, storage, and secrets infrastructure was hardened and instrumented.latest6 changes
Feature
Auto grid becomes the default dashboard layout
New dashboards now use the automatic grid arrangement out of the box, reducing manual panel positioning.
Feature
Trash (recycle bin) enabled by default for dashboards
Users can now recover deleted dashboards through a trash feature that's on by default.
Feature
Group-by enabled by default on new filter variables
Newly created ad-hoc filter variables automatically support grouping data by a field.
Fix
Snapshots no longer show empty panels with repeat variables
Fixed a bug where dashboard snapshots using repeated variables in transformations rendered blank panels.
Chore
Added tracing to secrets decryption services
Instrumented the secrets decrypt clients with OpenTelemetry tracing for better monitoring and debugging.
Docs
Overhauled Pyroscope data source documentation
Rewrote the documentation for connecting to the Pyroscope profiling data source.
2026-08-17A very large week centered on rolling out the new per-resource search system and provisioning metrics, plus many table, accessibility, and reliability fixes.6 changes
Feature
Per-resource search endpoints served by default
The new search endpoints for individual resource types are now active by default across the platform.
Feature
Star folders and highlight the Starred view
Users can now mark folders as starred and see them highlighted in the navigation.
Feature
Provisioning gains size, duration, and outcome metrics
Added detailed measurements tracking how long provisioning operations take and how much data they handle.
Fix
Fixed table JSON cell indentation and styling
Improved how JSON data displays inside table cells, including hover reveal and formatting.
Chore
Stabilized flaky dashboard and panel tests
Fixed several automated tests that intermittently failed due to timing and page-wide element matching.
Refactor
Lazy-load the moment date library
Deferred loading of a date-handling library to speed up initial page load.
2026-08-10A lighter week focused on testing, bundle-size optimization, and incremental provisioning and alerting improvements.6 changes
Chore
Expanded end-to-end coverage for custom grid dashboards
Added automated tests for panel resizing, repeat direction, and max panels per row in custom grids.
Refactor
Kept the OTLP exporter out of the initial bundle
Trimmed the startup download by excluding a telemetry exporter from the initial page load.
Fix
Fixed assistant edits resetting the dashboard tab and URL
Resolved a bug where AI-assistant edits would unexpectedly reset the selected tab and page state.
Chore
Redact secrets in SSO settings responses
Ensured sensitive SSO configuration values are hidden in multi-tenant settings responses.
Feature
Added a data sources gateway feature toggle
Introduced a switch to enable a new gateway path for data source connections.
Fix
Fixed navigation logo movement when docking the menu
Stopped the logo from shifting position when users toggle the docked side menu.
Dependencies and code review
Dependency advisories
Security Watch
3 vulnerable packages (5 advisories) across 314 scanned dependencies.
js-yaml 4.1.0
2 advisories. Fixed in 3.15.0.
How it can be abusedAn attacker who can get specially crafted YAML into something this project parses, like imported configuration or plugin files, could make the parsing take effectively forever, freezing the browser tab or a build job instead of returning an error. This affects anyone running the frontend build tools or loading such content in the app.
- highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
- highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
lodash 4.17.23
1 advisory. Fixed in 4.18.0.
How it can be abusedAn attacker could exploit this only if the app passes text they control into lodash's template function, which would let them run arbitrary JavaScript in another user's browser. Grafana uses lodash for general utility helpers across its frontend packages but does not build templates from user-supplied input, so ordinary users of a Grafana instance are not realistically exposed.
- highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names
nanoid 5.0.9
2 advisories. Fixed in 3.3.16.
How it can be abusedAn attacker could only trigger this if the app passed bad inputs like zero or negative lengths into nanoid's custom generator code, which would make it hang forever and tie up the browser tab or server worker. This requires a developer mistake in how Grafana's frontend calls the library rather than anything an attacker controls directly.
- highGHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
- highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required