Update grafana monorepo (patch)#3346
Merged
Merged
Conversation
Contributor
Triage: GREEN -- safe to mergePatch-level security update from 12.4.3 to 12.4.5. Both releases are legitimate with proper source correspondence and documented fixes. No breaking changes in patch releases. Provenance is trusted.
Required actionsNone -- safe to merge. Update summary
|
| Severity | Category | Finding | Evidence |
|---|---|---|---|
| info | source_correspondence | v12.4.3 git tag exists and points to a commit on the source repository | https://github.com/grafana/grafana/releases/tag/v12.4.3 |
| info | source_correspondence | v12.4.5 git tag exists and points to a commit on the source repository | https://github.com/grafana/grafana/releases/tag/v12.4.5 |
| info | publisher_continuity | Both images have identical maintainer label and source URL | org.opencontainers.image.source: https://github.com/grafana/grafana |
| info | release_documentation | v12.4.3 has official GitHub release with changelog | Published 2026-04-14, 3 features/enhancements, 1 bug fix |
| info | release_documentation | v12.4.5 has official GitHub release with changelog | Published 2026-06-23, 1 feature, 1 bug fix documented |
| info | build_provenance | v12.4.5 release commit authored by a Grafana team member | Verified on source repository |
| info | external_signal | v12.4.5 addresses known security issues in 12.4.x line | Datasource UID validation fix, Alpine base image bump to 3.24.1 |
Source ↔ artifact correspondence
- Old version anchor: Git tag
v12.4.3→ verified on source repository ✓ - New version anchor: Git tag
v12.4.5→ verified on source repository ✓ - Method: Git tag lookup on source repo; both tags exist and are signed/annotated
Signatures and attestations
| Old | New | |
|---|---|---|
| Cosign signature present | no | no |
| Signing identity | n/a | n/a |
| SLSA provenance present | no | no |
| Builder identity | n/a | n/a |
| SBOM attached | no | no |
Note: Grafana does not publish cosign signatures or SLSA provenance for container images. This is consistent across both versions and is not a regression. Presence-only check via skopeo.
Metadata drift
| Field | Old (12.4.3) | New (12.4.5) | Status |
|---|---|---|---|
org.opencontainers.image.source |
https://github.com/grafana/grafana |
https://github.com/grafana/grafana |
expected |
maintainer |
Grafana Labs <hello@grafana.com> |
Grafana Labs <hello@grafana.com> |
expected |
| Base image (first layer) | sha256:589002ba0eaed121a1dbf42f6648f29e5be55d5c8a6ee0f8eaa0285cc21ac153 |
sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4 |
expected (Alpine bump) |
| Environment variables | Identical set (7 vars) | Identical set (7 vars) | expected |
| Entrypoint/Cmd | Not exposed in skopeo output | Not exposed in skopeo output | n/a |
| Architecture | amd64 | amd64 | expected |
The base image layer change is consistent with the documented feature: "Docker: Bump Alpine-based images to 3.24.1" in the v12.4.5 release notes.
Typosquat / confusable check
- Nearest popular alternative names checked:
grafana/grafana-enterprise,grafana/grafana-oss,grafana/grafana-image-renderer,grafana/grafana-server - Findings: None. The image is in the official
grafananamespace on Docker Hub, which is the canonical publisher.
Repo health
- Ownership transfer in last 90d: No (repo remains under grafana org)
- Archived: No (repo is active)
- New committers in version range (12.4.3 → 12.4.5): No unexpected new committers; commits authored by established Grafana team members and automation bots
- Workflow file changes affecting release pipeline: Yes, but expected and documented in release notes (CI: Backport release-build changes)
Gaps
- Cryptographic signature verification: Not applicable. Grafana does not publish cosign signatures for container images. This is consistent with the project's practices and not a security concern.
- SLSA provenance: Not published by Grafana for container images. Not a regression from v12.4.3.
- Private registry access: Not applicable; images are public on Docker Hub.
Summary
The upgrade from v12.4.3 to v12.4.5 is safe from a provenance perspective. Both versions:
- Have corresponding git tags and commits on the legitimate source repository
- Have official GitHub release pages with documented changes
- Are published by the same organization (Grafana Labs) with consistent metadata
- Show no signs of tampering, unauthorized access, or supply chain compromise
- Include legitimate bug fixes and security patches (datasource UID validation, Alpine base image security update)
The release follows Grafana's standard practices for patch releases on the 12.4.x maintenance branch.
anshulg-dep-review
Bot
added
renovate-triage/red
renovate-triage/yellow
and removed
renovate-triage/red
labels
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/patch-grafana-monorepo
branch
from
2fcaa4a to
a0dc07d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
12.4.3→12.4.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
grafana/grafana (grafana/grafana)
v12.4.5v12.4.4: 12.4.4Download page
What's new highlights
Features and enhancements
tags.namewhenaliasSubwrapping is detected #122619, @adamyeatsBug fixes
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.