rpms/grafana
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS grafana-10.2.6-20.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-03-30 10:31:23 -04:00
parent bd6c085547
commit 4a5e32fdd9
9 changed files with 237 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@ -1,3 +1,3 @@
SOURCES/grafana-10.2.6.tar.gz
SOURCES/grafana-vendor-10.2.6-8.tar.xz
SOURCES/grafana-webpack-10.2.6-8.tar.gz
SOURCES/grafana-vendor-10.2.6-11.tar.xz
SOURCES/grafana-webpack-10.2.6-11.tar.gz

4
.grafana.metadata
View File

@ -1,3 +1,3 @@
5c65a9460e0d0ecff29e397b5889b4167f046142 SOURCES/grafana-10.2.6.tar.gz
2b4545a05745a2d2abb719ea9bd86b87f045cf42 SOURCES/grafana-vendor-10.2.6-8.tar.xz
3d7618ff21be2346cf59955487aa766f06e7a18c SOURCES/grafana-webpack-10.2.6-8.tar.gz
80512e6390fd349f9511269026061a2342f3f613 SOURCES/grafana-vendor-10.2.6-11.tar.xz
128ba33fc426b99ef66e9230a9c68925b9822b85 SOURCES/grafana-webpack-10.2.6-11.tar.gz

28
SOURCES/0012-fix-jwt-CVE.patch Normal file
View File

@ -0,0 +1,28 @@
diff --git a/go.mod b/go.mod
index fcbc09da5e6..1771902bc1c 100644
--- a/go.mod
+++ b/go.mod
@@ -164,7 +164,7 @@ require (
github.com/go-openapi/spec v0.20.9 // indirect
github.com/go-openapi/swag v0.22.4 // indirect
github.com/go-openapi/validate v0.22.1 // indirect
- github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform
+ github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform
github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
github.com/golang/glog v1.1.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
diff --git a/go.sum b/go.sum
index d05dfb55fd4..3a045f712eb 100644
--- a/go.sum
+++ b/go.sum
@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw
github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs=
github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc=
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=

32
SOURCES/0013-fix-CVE-2025-4123.patch Normal file
View File

@ -0,0 +1,32 @@
From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001
From: Sam Feifer <sfeifer@redhat.com>
Date: Wed, 7 May 2025 16:27:08 -0400
Subject: [PATCH] fix CVE-2025-4123
diff --git a/conf/defaults.ini b/conf/defaults.ini
index e1e5468bfa3..4221144bf54 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -363,7 +363,7 @@ x_xss_protection = true
# Enable adding the Content-Security-Policy header to your requests.
# CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
-content_security_policy = false
+content_security_policy = true
# Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
# $NONCE in the template includes a random nonce.
diff --git a/conf/sample.ini b/conf/sample.ini
index 51d2b6c512b..fd588b48225 100644
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -364,7 +364,7 @@
# Enable adding the Content-Security-Policy header to your requests.
# CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
-;content_security_policy = false
+;content_security_policy = true
# Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
# $NONCE in the template includes a random nonce.

49
SOURCES/0014-Fix-CVE-2026-21721.patch Normal file
View File

@ -0,0 +1,49 @@
From 3efa5e004426fed8f25ec513f2dce4658e3b6564 Mon Sep 17 00:00:00 2001
From: Sam Feifer <sfeifer@redhat.com>
Date: Mon, 16 Feb 2026 15:35:19 -0500
Subject: [PATCH] Fix CVE-2026-21721
---
pkg/api/api.go | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/pkg/api/api.go b/pkg/api/api.go
index 3db3cbafe73..b8c1dd5736e 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -461,12 +461,13 @@ func (hs *HTTPServer) registerRoutes() {
dashboardRoute.Get("/uid/:uid", authorize(ac.EvalPermission(dashboards.ActionDashboardsRead)), routing.Wrap(hs.GetDashboard))
dashboardRoute.Delete("/uid/:uid", authorize(ac.EvalPermission(dashboards.ActionDashboardsDelete)), routing.Wrap(hs.DeleteDashboardByUID))
dashboardRoute.Group("/uid/:uid", func(dashUidRoute routing.RouteRegister) {
+ dashUIDScope := dashboards.ScopeDashboardsProvider.GetResourceScopeUID(ac.Parameter(":uid"))
dashUidRoute.Get("/versions", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersions))
dashUidRoute.Post("/restore", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.RestoreDashboardVersion))
dashUidRoute.Get("/versions/:id", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersion))
dashUidRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) {
- dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead)), routing.Wrap(hs.GetDashboardPermissionList))
- dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite)), routing.Wrap(hs.UpdateDashboardPermissions))
+ dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead, dashUIDScope)), routing.Wrap(hs.GetDashboardPermissionList))
+ dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite, dashUIDScope)), routing.Wrap(hs.UpdateDashboardPermissions))
})
})
@@ -481,13 +482,14 @@ func (hs *HTTPServer) registerRoutes() {
// Deprecated: use /uid/:uid API instead.
dashboardRoute.Group("/id/:dashboardId", func(dashIdRoute routing.RouteRegister) {
+ dashIDScope := dashboards.ScopeDashboardsProvider.GetResourceScope(ac.Parameter(":dashboardId"))
dashIdRoute.Get("/versions", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersions))
dashIdRoute.Get("/versions/:id", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersion))
dashIdRoute.Post("/restore", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.RestoreDashboardVersion))
dashIdRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) {
- dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead)), routing.Wrap(hs.GetDashboardPermissionList))
- dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite)), routing.Wrap(hs.UpdateDashboardPermissions))
+ dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead, dashIDScope)), routing.Wrap(hs.GetDashboardPermissionList))
+ dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite, dashIDScope)), routing.Wrap(hs.UpdateDashboardPermissions))
})
})
})
--
2.52.0

1
SOURCES/create_bundles.sh
View File

@ -21,6 +21,7 @@ pushd "${SOURCE_DIR}"
# Vendor Go dependencies
patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch
patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch
go mod vendor
# Generate Go files

2
SOURCES/grafana.sysusers
View File

@ -1,2 +1,2 @@
#Type Name ID GECOS Home directory
u grafana - "Grafana user account" /usr/share/grafana
u grafana - "Grafana user account" /var/lib/grafana

53
SOURCES/grafana.te
View File

@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false)
## </desc>
gen_tunable(grafana_can_tcp_connect_mysql_port, false)
## <desc>
## <p>
## Allow grafana to connect to postgresql's default tcp port of 5432
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
## <desc>
## <p>
## Allow grafana to connect to prometheus' default tcp port of 9090
@ -41,6 +34,19 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
## </desc>
gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
## <desc>
## <p>
## Allow grafana to connect to postgresql's default tcp port of 5432
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
## <desc>
## <p>
## Allow grafana to connect to ldap's tcp port
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_ldap_port, false)
type grafana_t;
type grafana_exec_t;
@ -95,10 +101,23 @@ allow grafana_t self:unix_dgram_socket create_socket_perms;
allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect };
allow grafana_t grafana_var_lib_t:file { execute execute_no_trans };
allow grafana_t grafana_var_lib_t:file map;
allow grafana_t self:unix_stream_socket connectto;
allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
optional_policy(`
require {
type cgroup_t;
class dir { search };
class file { open read };
}
allow grafana_t cgroup_t:dir search;
allow grafana_t cgroup_t:file { open read };
')
optional_policy(`
require {
type smtp_port_t;
@ -107,6 +126,14 @@ optional_policy(`
allow grafana_t smtp_port_t:tcp_socket name_connect;
')
optional_policy(`
require {
type ntop_port_t;
class tcp_socket { name_bind };
}
allow grafana_t ntop_port_t:tcp_socket name_bind;
')
optional_policy(`
require {
type usr_t;
@ -142,6 +169,14 @@ optional_policy(`
allow grafana_t autofs_t:dir getattr;
')
optional_policy(`
require {
type postfix_local_t;
class dir { search };
}
allow postfix_local_t grafana_var_lib_t:dir search;
')
manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
@ -213,6 +248,10 @@ tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default
corenet_tcp_connect_postgresql_port(grafana_t)
')
tunable_policy(`grafana_can_tcp_connect_ldap_port',`
corenet_tcp_connect_ldap_port(grafana_t)
')
optional_policy(`
systemd_private_tmp(grafana_tmp_t)
')

131
SPECS/grafana.spec
View File

@ -19,13 +19,14 @@
end}
%global gomodulesmode GO111MODULE=auto
%global gotestflags %{gotestflags} -tags=integration
%global _gotestflags_save %{?gotestflags}
%global gotestflags %{?_gotestflags_save} -tags=integration
%global selinux_variants mls targeted
Name: grafana
Version: 10.2.6
Release: 10%{?dist}
Release: 20%{?dist}
Summary: Metrics dashboard and graph editor
License: AGPL-3.0-only
URL: https://grafana.org
@ -36,13 +37,13 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name}
# Source1 contains the bundled Go and Node.js dependencies
# Note: In case there were no changes to this tarball, the NVR of this tarball
# lags behind the NVR of this package.
Source1: grafana-vendor-%{version}-8.tar.xz
Source1: grafana-vendor-%{version}-11.tar.xz
%if %{compile_frontend} == 0
# Source2 contains the precompiled frontend
# Note: In case there were no changes to this tarball, the NVR of this tarball
# lags behind the NVR of this package.
Source2: grafana-webpack-%{version}-8.tar.gz
Source2: grafana-webpack-%{version}-11.tar.gz
%endif
# Source3 contains the systemd-sysusers configuration
@ -78,6 +79,9 @@ Patch9: 0009-update-wrappers-and-systemd-with-distro-paths.patch
# https://github.com/grafana/grafana/commit/bae86dbeb0ad68a205454e98e76985dc393183d4
Patch10: 0010-remove-bcrypt-references.patch
Patch11: 0011-fix-dompurify-CVE.patch
Patch12: 0012-fix-jwt-CVE.patch
Patch13: 0013-fix-CVE-2025-4123.patch
Patch14: 0014-Fix-CVE-2026-21721.patch
# Patches affecting the vendor tarball
Patch1001: 1001-vendor-patch-removed-backend-crypto.patch
@ -119,7 +123,7 @@ Requires: shared-mime-info
%if 0%{?fedora} >= 35 || 0%{?rhel} >= 8
# This ensures that the grafana-selinux package and all its dependencies are
# not pulled into containers and other systems that do not use SELinux
Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted)
Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any)
%else
Requires: grafana-selinux = %{version}-%{release}
%endif
@ -249,7 +253,7 @@ Provides: bundled(golang(github.com/andybalholm/brotli)) = 1.0.4
Provides: bundled(golang(github.com/go-kit/log)) = 0.2.1
Provides: bundled(golang(github.com/go-openapi/loads)) = 0.21.2
Provides: bundled(golang(github.com/go-openapi/runtime)) = 0.26.0
Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.0
Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.2
Provides: bundled(golang(github.com/golang/protobuf)) = 1.5.3
Provides: bundled(golang(github.com/googleapis/gax-go/v2)) = 2.12.0
Provides: bundled(golang(github.com/gorilla/mux)) = 1.8.0
@ -741,15 +745,11 @@ Graphite, InfluxDB & OpenTSDB.
# SELinux package
%package selinux
Summary: SELinux policy module supporting grafana
BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted
%if "%{_selinux_policy_version}" != ""
Requires: selinux-policy >= %{_selinux_policy_version}
%endif
Requires: %{name} = %{version}-%{release}
Requires: selinux-policy-targeted
Requires(post): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana
Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana
Summary: SELinux policy module supporting grafana
Requires: selinux-policy-any
Requires(post): selinux-policy-any, /usr/sbin/semanage
Requires(postun): /usr/sbin/semanage
BuildRequires: selinux-policy-devel
%description selinux
SELinux policy module supporting grafana
@ -764,10 +764,6 @@ rm -r plugins-bundled
%setup -q -T -D -b 2
%endif
# SELinux policy
mkdir SELinux
cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
@ -779,6 +775,9 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
%patch -P 9 -p1
%patch -P 10 -p1
%patch -P 11 -p1
%patch -P 12 -p1
%patch -P 13 -p1
%patch -P 14 -p1
%patch -P 1001 -p1
%if %{enable_fips_mode}
@ -809,15 +808,11 @@ for cmd in grafana grafana-cli grafana-server; do
done
# SELinux policy
cd SELinux
for selinuxvariant in %{selinux_variants}
do
make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
mv grafana.pp grafana.pp.${selinuxvariant}
make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
done
cd -
mkdir selinux
cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux
make -f %{_datadir}/selinux/devel/Makefile grafana.pp
bzip2 -9 grafana.pp
%install
# dirs, shared files, public html, webpack
@ -882,14 +877,12 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \
install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf
# SELinux policy
cd SELinux
for selinuxvariant in %{selinux_variants}
do
install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
install -p -m 644 grafana.pp.${selinuxvariant} \
%{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp
install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2
install -D -p -m 0644 selinux/grafana.if \
%{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if
done
cd -
%pre
%sysusers_create_compat %{SOURCE3}
@ -995,39 +988,67 @@ export TZ=GMT
%doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md
# SELinux policy
%pre selinux
%selinux_relabel_pre
%post selinux
for selinuxvariant in %{selinux_variants}
do
/usr/sbin/semodule -s ${selinuxvariant} -i \
%{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || :
%selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null
/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
semodule -X400 -r grafana &>/dev/null || true
done
/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || :
/sbin/restorecon -RvF /etc/grafana &> /dev/null || :
/sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
%selinux_relabel_post
%postun selinux
if [ $1 -eq 0 ] ; then
/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
for selinuxvariant in %{selinux_variants}
do
/usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || :
done
/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || :
/sbin/restorecon -RvF /etc/grafana &> /dev/null || :
/sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
if [ "$1" -le "1" ]; then # First install
# The daemon needs to be restarted for the custom label to be applied.
# This will fail in case "post selinux" is executed before the service file is installed,
# but then it is safe to ignore since the service will first start with the proper label
%systemd_postun_with_restart grafana.service &> /dev/null || :
fi
%postun selinux
for selinuxvariant in %{selinux_variants}
do
if [ $1 -eq 0 ]; then
/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
%selinux_modules_uninstall -s ${selinuxvariant} grafana
%selinux_relabel_post -s ${selinuxvariant}
fi
done
%files selinux
%defattr(-,root,root,0755)
%doc SELinux/*
%{_datadir}/selinux/*/grafana.pp
%{_datadir}/selinux/packages/*/grafana.pp.*
%{_datadir}/selinux/devel/include/distributed/grafana.if
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
%changelog
* Tue Feb 17 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-20
- Resolves RHEL-144960: CVE-2026-21721
- Resolves RHEL-145419: CVE-2025-61728
- Resolves RHEL-146103: CVE-2025-61726
- Resolves RHEL-149639: CVE-2025-68121
* Mon Jan 26 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-19
- Resolves RHEL-140549: CVE-2025-61729
* Mon Dec 1 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-18
- Resolves RHEL-125696: CVE-2025-58183
- Resolves RHEL-132757: Grafana-selinux prevents plugins from searching cgroups
* Wed Jun 18 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-15
- Resolves RHEL-97518: Rework grafana-selinux spec file sections
- Resolves RHEL-87861: Add additional SELinux rules for grafana-selinux package to allow LDAP connections
* Tue May 13 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-13
- Resolves RHEL-89953: CVE-2025-4123
* Tue Apr 29 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-12
- Resolves RHEL-85419: Move grafana home directory to /var/lib/grafana
* Tue Mar 25 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-11
- Resolves RHEL-84636: CVE-2025-30204
* Wed Jan 29 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-10
- Resolves RHEL-75919: grafana selinux issue with autofs_t