main
Reapply "Dashboards: Skip service for /api/dashboard/db (#122027)" (#124908) (#125950)
Users: Use SHA-256 for Gravatar email identifier (#122319)
Tempo: Remove from core plugins (#127056)
OpenFeature: Add a flag to gradually roll out root OFREP url (#130255)
Chore: use any rather than interface{} (#74066)
chore: [back-end] convert provisioning feature toggle to config param (#129030)
PluginProxy: log denial when a plugin route's reqRole check fails (#130262)
chore(deps): Switch to maintained gopkg.in/yaml fork (#114131)
[chore] Update go to v1.26.0, and the golangci-lint action to v9 (#118436)
Apply security patch security-patch-202505051005.patch (#105754)
React 19: remove double builds (#129850)
Chore: Remove Bingo as Drone is removed (#110020)
patch(security): apply May 2026 patches (#124824)
CI: Bump golangci-lint to 2.0.2 (#103572)
admin api: Fix reencryption of private_key in signing_key table, introduce test for reencryption (#105010)
Alerting: Remove legacy alerting (#83671)
Auth: Add anonymous users view and stats (#78685)
Preferences: Support Create+Update+Delete over apiserver (#111715)
Auth: Fix SAML user IsExternallySynced not being set correctly (#98487)
Alerting: Allow restricting contact point integration types (#118858)
Annotations: handle /tags in migration proxy (#129495)
Datasources: whole-dashboard on-demand diagnostics (async backend, MVP) (#128598)
Chore: Update test database initialization (#81673)
Macaron: remove custom Request type (#37874)
Build: Separate Swagger from Grafana assets (#123798)
FS: Refactor frontendsettings into seperate base module (#126573)
Fix: Return auth labels from `/api/users/lookup` (#113584)
Preferences: Close behaviour gaps between legacy and unified storage (#127780)
Chore: Fix invalid group names in tests (#125997)
AccessControl: Use UIDs for Resource permissions frontend (#95552)
Snapshots: Decouple external snapshots feature from k8s API (#125296)
Datasources: Disable deprecated numeric id using APIs by default (#119930)
DataSource/Proxy: decouple from DataSourceService from ds_proxy (#125752)
add redirect to single tentant when unsupported features deteched (#128473)
Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid (#125398)
Query: Rename query.grafana.app to datasource.grafana.app (#118267)
Diagnostics: log bundle generation outcomes and failures (#129692)
Data source diagnostic metrics: Add on-prem usage and outcome metrics (#128890)
Datasources: Test that on-demand diagnostics endpoints are server-admin only (#128896)
DataSources/Proxy: Use map[string]any rather than simplejson (#125465)
Plugins: Remove rendering related code (#123519)
unified-storage: fix case permission on folder list query (#122334)
Team: inject legacy database provider (#129491)
Dashboards: Deprecate the dashboard and folder apis in swagger (#121222)
Dashboards: Refactor to keep perms separated (#122041)
Folders: Move folder specific errors to the folder service (#122050)
Chore: Bump Go to 1.23.0 (#92105)
Chore: Move ReqContext to contexthandler service (#62102)
Plugins: Add plugins/:slug/entitlement path to gnet proxy allowed path (#126420)
Spanner-related fixes (#102376)
Auth: Separate anonymous settings to its own struct (#97791)
Server: Support simultaneous TCP and Unix domain socket serving (#118627)
Navigation: Skip building the server nav tree when the client-built tree is enabled (#129181)
Live: Add RBAC for pushing to live (#120547)
patch: apply patches for June 2nd release (#125789)
Auth: URL-encode redirectTo cookie value in OAuth login flow (#121953)
Chore: Add html_handler_requests metric (#113991)
docs(openapi): Cleanup tag usage and minor fixes (#105546)
Chore: Fix goimports grouping in pkg/api (#62419)
Authlib: Use types package rather than claims (#99243)
IAM: Redirect org user update endpoint to k8s API (#129084)
Chore: Add K8s client provider (#122900)
Plugins: Avoid returning 404 for `AutoEnabled` apps (#93436)
Chore: Evaluate if an app is disabled for API requests (#79564)
Chore: Refactor backend plugin errors (#74928)
AppPlugins: Refactor plugin proxy for easier reuse in apiserver (#124075)
Plugins: Preserve trailing slash in plugin proxy (#86859)
InfluxDB: Remove from core plugins (#129602)
Plugins: Add include-datasource param to show nested datasources in catalog (#122957)
Preferences: promote api to v1 (#127173)
Preferences: Use dashboard uid for the home dashboard (#106666)
Add auth spans and remove deduplication code for scopes (#89804)
Rendering: Remove support for unimplemented render session (#119962)
chore: remove the kubernetesShortURLs feature toggle (#126795)
ShortURL: Improve error handling in k8s goto redirect (#124983)
ShortURL: Improve get error handling and delete (#125654)
K8s: Schema v2: Return 406 in /api (#101842)
fix(users): handle error when user login is updated to an already used one (#130389)
Redirect logic update (#118663)
Forbid more redirect patterns (#110337)
Chore: Improve spans frontend settings/bootdata methods (#127130)