[renovate]

This PR contains the following updates:

Package	Type	Update	Change
grafana/alloy	final	minor	v1.20.1 → v1.21.0
grafana/alloy		minor	v1.20.1 → v1.21.0
grafana/grafana	final	patch	13.2.3 → 13.2.4
grafana/grafana		patch	13.2.3 → 13.2.4
grafana/loki	final	patch	3.7.8 → 3.7.9
grafana/loki		patch	3.7.8 → 3.7.9

---

Release Notes

grafana/alloy

v1.21.0

Compare Source

⚠ BREAKING CHANGES

• otelcol.receiver.kafka: otelcol.receiver.kafka and otelcol.exporter.kafka metadata > retry > max_retries now defaults to 20 (was 3) and is now actually applied. Upstream's Kafka client silently ignored it since the franz-go migration. otelcol.exporter.kafka now also applies backoff. (#​7366)
• otelcol.connector.signaltometrics: otelcol.connector.signaltometrics error_mode now defaults to ignore (was propagate). A failing OTTL expression now skips the record and logs the error instead of dropping the whole payload. Set error_mode = "propagate" to restore the previous behavior. (#​7366)
• loki.write: loki.write configurations that set wal { enabled = true } now fail to load unless Alloy runs with --stability.level=experimental. To keep using the WAL, add --stability.level=experimental to the alloy run command. To keep the default stability level, remove the wal block or set enabled = false. (#​7257)
• loki.write: Remove tenant label from metrics (#​7232)

Features 🌟

• Add CAP_DAC_OVERRIDE in the allowed Linux capabilities list (#​7303) (dddc5d8) (@​grcevski)
• database_observability.postgres: Enable stat_statements by default (#​7224) (044d3a4) (@​matthewnolf)
• database_observability.sql_server: Add health_check collector (#​7205) (c1d90e0) (@​rgeyer)
• database_observability.sql_server: Add support for clustering mode (#​7208) (90100b3) (@​matthewnolf)
• database_observability.sql_server: Support monitoring multiple database blocks (#​7207) (bbf24e2) (@​matthewnolf)
• database_observability: Add engine label for explain_plan log digests (mysql/postgres) (#​6944) (551c3ad) (@​rgeyer)
• database_observability: Add relabel blocks to database_instance (#​7369) (320c17e) (@​matthewnolf)
• helm: Add resizePolicy to alloy and config-reloader containers (#​7274) (9983d74) (@​younsl)
• loki.source.cloudflare: Add api_url argument (#​7353) (befe940) (@​thampiotr)
• otelcol.connector.signaltometrics: error_mode now defaults to ignore (was propagate) (#​7366) (1e353a6) (@​ptodev)
• otelcol.encoding.jsonlog: Add the parse_ints argument (#​7377) (42fe191) (@​ptodev)
• otelcol.exporter.loadbalancing: Add the randomness and attributes routing keys, and the routing_attributes argument (#​7377) (42fe191) (@​ptodev)
• otelcol.receiver.kafka: metadata > retry > max_retries now defaults to 20 (was 3) (#​7366) (1e353a6) (@​ptodev)
• otelcol.receiver.kafka: Deprecate metadata > full, which has no effect upstream. This also applies to otelcol.exporter.kafka (#​7366) (1e353a6) (@​ptodev)
• otelcol.receiver.vcenter: Add the proxy_url argument (#​7377) (42fe191) (@​ptodev)
• otelcol: Add a partition block (metadata_keys, cache_size, idle_timeout) to the sending_queue > batch block of exporters (#​7377) (42fe191) (@​ptodev)
• otelcol: Upgrade to OTel Collector v0.162.0 (#​7366) (1e353a6) (@​ptodev)
• Remove the experimental prometheus.exporter.catchpoint component (#​7309) (7b24cb1) (@​dehaansa)
• Update Beyla to version 3.38.0 (#​7322) (bd8d703) (@​grcevski)

Bug Fixes 🐛

• database_observability.postgres: Stop retrying explain plans with missing session settings (#​7325) (0bdc41d) (@​cristiangreco)
• database_observability.sql_server: Redact native explain-plan XML (#​7230) (5b01d2a) (@​rgeyer, @​cristiangreco)
• database_observability: Correct explain plan cost semantics (#​7307) (2cdeba9) (@​cristiangreco, @​cursoragent)
• database_observability: Escape strings to avoid logfmt parsing issues (#​7302) (8b722eb) (@​fridgepoet)
• database_observability: Use strconv.Quote on database-derived strings (#​7288) (7aad05f) (@​cristiangreco)
• deps: Update gosnowflake to v2.2.0 to fix GO-2026-6665 (#​7340) (4b1e336) (@​thampiotr)
• local.file_match, loki.source.file: Fix matching through Widows junctions (#​7261) (653850b) (@​ptodev)
• loki.process: Move stage.label validation to syntax.Validator (#​7308) (b24cd5d) (@​michael-duren)
• loki.process: Move stage.label_keep validation to syntax.Validator (#​7244) (1f29bd7) (@​michael-duren)
• loki.process: Move stage.limit validation to syntax.Validator (#​7278) (9423ed4) (@​michael-duren)
• loki.process: Move stage.output validation to syntax.Validator (#​7243) (97a5026) (@​michael-duren)
• loki.process: Move stage.regex to syntax.Validator (#​7342) (0cbb482) (@​michael-duren)
• loki.process: Move stage.static_labels validation to syntax.Validator (#​7175) (2b92bfb) (@​michael-duren)
• loki.process: Move stage.structured_metadata_drop validation to syntax.Validator (#​7245) (8b55f30) (@​michael-duren)
• loki.process: Move stage.tenant validation to syntax.Validator (#​7263) (5f45ab2) (@​michael-duren)
• loki.source.docker: Do not time out log streams (#​7297) (4b2e798) (@​SaiPisey2)
• loki.source.file: Reduce CPU usage for long lines (#​7291) (f98aef2) (@​kalleep)
• loki.source.kubernetes: Forward log lines with out-of-order timestamps (#​7080) (41d9001) (@​johnpinto-clarity)
• loki.write: Catch more runtime errors when parsing config (#​7216) (32c2180) (@​kalleep)
• loki.write: Prevent panic on failed update (#​7128) (3aa1c65) (@​kalleep)
• loki.write: Remove tenant label from metrics (#​7232) (ad6125b) (@​kalleep)
• loki.write: Require experimental stability level to enable the WAL (#​7257) (cc12943) (@​dehaansa)
• loki.write: Retry wal write errors (#​7316) (fc8eb73) (@​kalleep)
• loki.write: Zero-initialize counters when the metrics registry is reused (#​7258) (04838bf) (@​dehaansa)
• loki: Add the timestamp to batch size calculation (#​7226) (222798c) (@​grobinson-grafana)
• loki: Include estimate for stream labels in batch size (#​7176) (6c131a1) (@​grobinson-grafana)
• loki: Make loki_write_sent_bytes_total and loki_write_dropped_bytes_total count uncompressed bytes (#​7228) (4de4474) (@​grobinson-grafana)
• otelcol.connector.host_info: Mirror upstream logic and fix potential sources of over-count (#​7236) (4371d71) (@​jcreixell)
• otelcol.exporter.loki: Release fanout lock when the context ends mid-forward (#​7259) (0308c4d) (@​dehaansa)
• otelcol.receiver.cloudflare: Default max_request_body_size to 20MiB (#​7194) (2eadc7b) (@​sindef)
• otelcol.receiver.filelog: Use alphabetical instead of lexicographic sort type (#​7212) (d652b74) (@​geonusp)
• otelcol.receiver.vcenter: Convert max_query_metrics when converting an OpenTelemetry Collector config (#​7377) (42fe191) (@​ptodev)
• otelcol: Convert the exporter sending_queue > batch block when converting an OpenTelemetry Collector config (#​7377) (42fe191) (@​ptodev)
• otelcol: Converters now read the upstream keepalive section of HTTP client and server configs (#​7366) (1e353a6) (@​ptodev)
• prometheus.remote_write: Tolerate unknown WAL record types on replay (#​7189) (26d1a25) (@​kgeckhart)

Upgrading

Read the release notes for specific instructions on upgrading from older versions:

Installation

Refer to our installation guide for how to install Grafana Alloy.

grafana/grafana

v13.2.4

Security

• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

Features and enhancements

• Alerting: Strip sensitive headers from oauth2 cross-host redirects #​134433, @​JacobsonMT
• Dashboard: Fall back when collection deletion is unsupported #​134224, @​bestend
• Git Sync: Clarify repository links for pure Git #​134253, @​ferruvich
• Provisioning: Allow resource previews in unsynced folders #​134391, @​grafana-writer[bot]
• Provisioning: Reject invalid resource names before API calls #​133776, @​grafana-writer[bot]
• Provisioning: Show last checked time in Pull status #​134483, @​ferruvich
• Provisioning: Skip previews for pull requests from forks #​133799, @​ferruvich
• Provisioning: Stop PR previews when refs disappear #​133855, @​ferruvich
• Provisioning: Support legacy paths and diagnose missing source annotations #​133779, @​grafana-writer[bot]
• Provisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs #​134478, @​mustafasencer

Bug fixes

• CVE-2026-92539: IAM: Fix: SCIM (Enterprise)

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud