Port details

www/grafana 13.1.1_5

Dashboard and graph editor for multiple data stores

unaddressed

VuXML only

fixed

open problem reports

Port info

Maintainer: drtr0jan@yandex.ru
Packages: latest: 13.1.1_5
Upstream: Higher version available: 13.2.4
Last update: 2026-10-20 to 13.1.1_5 · d81b7ba3c3
Quarterly: 2026Q4: 13.1.1_5 · last MFH 2026-10-20 60647eff54
WWW: https://grafana.com/grafana/
Links: cgit · VuXML

Install

Package

# pkg install grafana

installs 13.1.1_5 from latest; from quarterly (2026Q4) 13.1.1_5

Port

# cd /usr/ports/www/grafana && make install clean

Size

153 MiB download · 857 MiB installed

Depends on

nothing

License

AGPLv3

Creates

user grafana, group grafana

pkg-message

Shown after installing

There's a regression in Grafana 13+: Some bundled plugins
are built separately and don't support FreeBSD
(https://github.com/grafana/grafana/issues/108486). There're
errors in the log while Grafana starting
(https://bugs.freebsd.org/296083) like:
===
fork/exec ... gpx_grafana_elasticsearch_datasource_freebsd_amd64:
no such file or directory
===
To avoid the error specify in grafana.conf:
===
[plugins]
disable_plugins = elasticsearch, zipkin
===

Packages by version and architecture

latest

FreeBSD version	amd64	aarch64	i386
FreeBSD 16	13.1.1_5	13.1.1_4	–
FreeBSD 15	13.1.1_5	13.1.1_4	–
FreeBSD 14	13.1.1_5	13.1.1_4	✗

quarterly (2026Q4)

FreeBSD version	amd64	aarch64	i386
FreeBSD 15	13.1.1_5	13.1.1_4	–
FreeBSD 14	13.1.1_5	13.1.1_4	✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 13.1.1_5.

Fixed (45)

Show 45 fixed

VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).

CVE	CVSS	Published	Description
CVE-2026-14199	7.1	2026-09-02	Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key conca…

Grafana -- RCE on Grafana via sqlExpressionsentered 2026-05-26

CVE-2026-27876

Grafana -- OpenFeature evaluation API reads input data with no boundsentered 2026-05-26

CVE-2026-27880

Grafana -- Public Dashboards time range restriction on annotations can be bypassedentered 2026-05-26

CVE-2026-21722

Grafana -- Grafana Testdata datasource can issue unbounded memory allocationsentered 2026-05-26

CVE-2026-28375

Grafana -- Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoSentered 2026-05-26

CVE-2026-33375

Grafana -- Public dashboards discloses all direct mode datasourcesentered 2026-05-26

CVE-2026-27877

Grafana -- XSS in Grafana Explore stack traceentered 2026-05-26

CVE-2025-41117

Grafana -- Query resampling can cause unbounded memory allocationsentered 2026-05-26

CVE-2026-27879

Grafana -- DingDing contact points exposed in Grafana Alertingentered 2025-06-18

CVE-2025-3415

grafana -- XSS vulnerabilityentered 2025-05-27

CVE-2025-4123

Grafana -- User deletion issueentered 2025-05-23

CVE-2025-3580

Grafana -- DOM XSS vulnerabilityentered 2025-04-24

CVE-2025-2703

Grafana -- Authorization bypass in data source proxy APIentered 2025-04-24

CVE-2025-3454

Grafana -- Bypass Viewer and Editor permissionsentered 2025-04-24

CVE-2025-3260

Grafana -- Data source permission escalationentered 2024-03-11

CVE-2024-1442

Grafana -- Email verification is not required after email changeentered 2024-02-20

CVE-2023-6152

Grafana -- Account takeover / authentication bypassentered 2023-06-23

CVE-2023-3128

Grafana -- Grafana DS proxy race conditionentered 2023-06-07

CVE-2023-2801

Grafana -- Broken access control: viewer can send test alertsentered 2023-06-07

CVE-2023-2183

Grafana -- Critical vulnerability in golangentered 2023-04-26

CVE-2023-24538

Grafana -- Exposure of sensitive information to an unauthorized actorentered 2023-04-26

CVE-2023-1387

Grafana -- Stored XSS in Graphite FunctionDescription tooltipentered 2023-03-29

CVE-2023-1410

Grafana -- Stored XSS in geomap panel plugin via attributionentered 2023-03-01

CVE-2023-0507

Grafana -- Stored XSS in text panel pluginentered 2023-03-01

CVE-2023-22462

Grafana -- Stored XSS in TraceView panelentered 2023-03-01

CVE-2023-0594

Grafana -- Spoofing originalUrl of snapshotsentered 2023-02-09

CVE-2022-39324

Grafana -- Stored XSS in ResourcePicker componententered 2023-02-09

CVE-2022-23552

Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination pluginsentered 2022-11-12

CVE-2022-31130

Grafana -- Improper authenticationentered 2022-11-12

CVE-2022-39229

Grafana -- Privilege escalationentered 2022-11-12

CVE-2022-39328

Grafana -- Privilege escalationentered 2022-11-12

CVE-2022-39306

Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination pluginsentered 2022-11-12

CVE-2022-39201

Grafana -- Plugin signature bypassentered 2022-11-12

CVE-2022-31123

Grafana -- Username enumerationentered 2022-11-12

CVE-2022-39307

Grafana -- Privilege escalationentered 2022-09-21

CVE-2022-35957

Grafana -- Unauthorized file disclosureentered 2022-09-01

CVE-2022-31176

Grafana -- Stored XSSentered 2022-07-15

CVE-2022-31097

Grafana -- OAuth Account Takeoverentered 2022-07-15

CVE-2022-31107

Grafana -- Directory Traversalentered 2021-12-12

CVE-2021-43813

Grafana -- Directory Traversalentered 2021-12-12

CVE-2021-43815

Grafana -- Incorrect Access Controlentered 2021-12-11

CVE-2021-41244

Grafana -- Path Traversalentered 2021-12-11

CVE-2021-43798

Grafana -- XSSentered 2021-12-11

CVE-2021-41174

Grafana -- Snapshot authentication bypassentered 2021-10-06

CVE-2021-39226

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (67)

2026-10-20 13:05Dag-Erling Smørgrav (des) · 13.1.1_5 MFH 2026Q4 ✓

various: Bump Go ports for Go 1.26.10 / 1.27.3

d81b7ba3c3

2026-10-08 22:44Dag-Erling Smørgrav (des) · 13.1.1_4 MFH 2026Q4 ✓

various: Bump Go ports

031fc6bfbf

2026-10-01 09:52Dag-Erling Smørgrav (des) · 13.1.1_3

various: Drop Go 1.26+ version pin

This is a nop since 1.26 is the oldest supported version.

2c73fa4d6e

2026-09-03 06:50Adam Weinberger (adamw) · 13.1.1_3

many: Bump go ports for 1.26.8 and 1.27.1

dd0905142a

2026-08-19 19:39Dag-Erling Smørgrav (des) · 13.1.1_2 MFH 2026Q3 ✓

various: Bump go ports for go-1.25.14 / 1.26.7

4867821cd6

2026-08-14 02:38Dag-Erling Smørgrav (des) · 13.1.1_1 MFH 2026Q3 ✓

various: Bump go ports for go-1.25.13 / 1.26.6

6d39dcf04e

2026-07-26 03:56Vladimir Druzenko (vvd) · 13.1.1 MFH 2026Q3 ✓

www/grafana: Update 13.0.1 => 13.1.1

Release notes:
https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v13-1

Changelogs:
https://github.com/grafana/grafana/releases/tag/v13.1.0
https://github.com/grafana/grafana/releases/tag/v13.1.1

PR:		297047 296083
Sponsored by:	UNIS Labs

494ee50f74

2026-07-10 09:54Dag-Erling Smørgrav (des) · 13.0.1_3 MFH 2026Q3 ✓

various: Bump go ports for go-1.25.12 / 1.26.5

4ea3547132

2026-06-03 19:54Dag-Erling Smørgrav (des) · 13.0.1_2

various: Bump go ports for go-1.25.11 / go-1.26.4

dd8dc2a59d

2026-05-09 19:25Adam Weinberger (adamw) · 13.0.1_1

various: Bump ports for Go 1.25.10

4e243a83f8

2026-04-22 03:27Vladimir Druzenko (vvd) · 13.0.1

www/grafana: Update 12.4.2 => 13.0.1

Release notes:
https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v13-0

Changelogs:
https://github.com/grafana/grafana/releases/tag/v12.4.3
https://github.com/grafana/grafana/releases/tag/v13.0.1

PR:		294695
Sponsored by:	UNIS Labs

33ddf35e17

2026-04-10 17:57Dag-Erling Smørgrav (des) · 12.4.2_1

various: Bump go ports for go-1.25.9 / 1.26.2

7507e72a84

2026-03-30 02:49Vladimir Druzenko (vvd) · 12.4.2

www/grafana: Update 12.4.0 => 12.4.2 (Fixes critical vulnerability)

Changelogs:
https://github.com/grafana/grafana/releases/tag/v12.4.1
https://github.com/grafana/grafana/releases/tag/v12.4.2

PR:		294105
Security:	CVE-2026-27876
Security:	CVE-2026-27877
Security:	CVE-2026-28375
Security:	CVE-2026-27879
Security:	CVE-2026-27880
Security:	CVE-2026-27876
Security:	CVE-2026-33375
Sponsored by:	UNIS Labs
MFH:		2026Q1

bce768403c

2026-03-06 04:33Adam Weinberger (adamw) · 12.4.0_1

various: Bump ports for Go 1.25.8

a8d318da7c

2026-03-04 17:02Vladimir Druzenko (vvd) · 12.4.0

www/grafana: Update 12.3.3 => 12.4.0

Release Notes:
https://grafana.com/blog/grafana-12-4-release-all-the-latest-features/

What's new:
https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v12-4/

Changelogs:
https://github.com/grafana/grafana/releases/tag/v12.3.4
https://github.com/grafana/grafana/releases/tag/v12.4.0

PR:	293564

e52cf2b91f

2026-02-18 03:49Vladimir Druzenko (vvd) · 12.3.3

www/grafana: Update 12.3.0 => 12.3.3 (Fixes security vulnerabilities)

Changelogs:
https://github.com/grafana/grafana/releases/tag/v12.3.1
https://github.com/grafana/grafana/releases/tag/v12.3.2
https://github.com/grafana/grafana/releases/tag/v12.3.3

PR:		293245
Security:	CVE-2026-21722
Security:	CVE-2025-41117
MFH:		2026Q1

3f4049ec39

2026-02-05 17:48Adam Weinberger (adamw) · 12.3.0_4

various: Bump Go ports for 1.25.7

5a5747a5a0

2026-01-29 23:04Vladimir Druzenko (vvd) · 12.3.0_3

www/grafana: Remove runtime dependency on ca_root_nss

There is no need for it anymore.

PR:		292780
Approved by:	Boris Korzun <drtr0jan@yandex.ru> (maintainer)
MFH:		2026Q1

daa6b36d24

2026-01-16 18:27Adam Weinberger (adamw) · 12.3.0_2

various: Bump Go ports for 1.25.6

9f4bc8d0b7

2025-12-16 00:06Dag-Erling Smørgrav (des) · 12.3.0_1

many: Unpin Go ports

* Ports that were pinned to a deprecated version of Go (1.23 or older)
  have been unpinned.

* Ports that were pinned to a still-supported version of Go (1.24 or
  newer) have been converted to requesting that as their minimum Go
  version.

* Ports that had been forcibly deprecated for pinning an expired Go
  version have been undeprecated.

75d873b56a

2025-12-03 19:24Adam Weinberger (adamw) · 12.3.0_1

various: Bump Go ports for 1.25.5

ec872485e4

2025-11-21 23:33Vladimir Druzenko (vvd) · 12.3.0

www/grafana: Update 12.2.0 => 12.3.0

Changelogs:
https://github.com/grafana/grafana/blob/main/CHANGELOG.md#1230-2025-11-19

PR:		291109
Security:	CVE-2025-41115
MFH:		2025Q4

bad451b90f

2025-11-06 18:03Adam Weinberger (adamw) · 12.2.0_1

various: Bump Go ports for 1.24.10

0dfced16fb

2025-10-18 23:59Vladimir Druzenko (vvd) · 12.2.0

www/grafana: Update 12.1.0 => 12.2.0

Release notes:
https://grafana.com/blog/2025/09/25/grafana-12-2-release-all-the-latest-features/

What's new:
https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v12-2/

Changelogs:
https://github.com/grafana/grafana/releases/tag/v12.1.1
https://github.com/grafana/grafana/releases/tag/v12.1.2
https://github.com/grafana/grafana/releases/tag/v12.2.0

Fix build with non-default user/group.

PR:	289851

814b89b8b0

2025-10-14 17:13Adam Weinberger (adamw) · 12.1.0_4

various: Bump go ports for go-1.24.9

90f976619b

2025-10-08 02:41Adam Weinberger (adamw) · 12.1.0_3

many: Bump dependent ports after go124 update

2e7587aaf8

2025-09-04 19:53Adam Weinberger (adamw) · 12.1.0_2

many: Bump go ports for go-1.24.7

31a5a229a7

2025-08-07 02:02Adam Weinberger (adamw) · 12.1.0_1

go ports: Bump for 1.24.6

53610681ea

2025-08-01 01:20Vladimir Druzenko (vvd) · 12.1.0

www/grafana: Improve port

Replace 10 mkdirs with 1.

PR:		288533
Approved by:	Boris Korzun <drtr0jan@yandex.ru> (maintainer)

54b0c1ef53

2025-08-01 01:07Vladimir Druzenko (vvd) · 12.1.0

www/grafana: Update 12.0.2 => 12.1.0 (Fixes high vulnerabilities)

* CVE-2025-6023 - XSS via client path traversal and open redirect
* CVE-2025-6197 - Open redirect via organization switching
https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/

Release notes:
https://grafana.com/blog/2025/07/28/grafana-12.1-release-all-the-latest-features/
What's new:
https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v12-1/
Changelog:
https://github.com/grafana/grafana/releases/tag/v12.1.0

PR:		288533
Security:	CVE-2025-6023
Security:	CVE-2025-6197
MFH:		2025Q3

ff919ab3e5

2025-07-09 18:11Adam Weinberger (adamw) · 12.0.2_1

many: Bump PORTREVISION for go-1.24.5 update

275975297b

2025-06-18 16:26Vladimir Druzenko (vvd) · 12.0.2

www/grafana: Update 12.0.1 => 12.0.2 (Fixes security vulnerability)

Release Notes:
https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/

Changelog:
https://github.com/grafana/grafana/releases/tag/v12.0.2

PR:		287634
Security:	CVE-2025-3415

d13758d0c0

2025-06-06 22:00Adam Weinberger (adamw) · 12.0.1_1

various: Bump PORTREVISION after go124-1.24.4 update

94be418de3

2025-05-23 18:18Vladimir Druzenko (vvd) · 12.0.1

www/grafana: Update 12.0.0 => 12.0.1 (Fixes security vulnerabilities)

Release Notes:
https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/

Changelog:
https://github.com/grafana/grafana/releases/tag/v12.0.1

Update ONLY_FOR_ARCHS.
Remove go version after default go version was increased to 1.24.

PR:		287019
Security:	CVE-2025-4123
Security:	CVE-2025-3580
MFH:		2025Q2

6e1ab017f3

2025-05-21 21:58Adam Weinberger (adamw) · 12.0.0_1

go: Bump go124-dependent ports

Earlier I bumped the default Go to 1.24. Ports that specify a lower
version will still build with those lower version (for now), so they
don't need a bumping. Instead I'm bumping anything that (now) has go124
as a dependency.

0bdd2ad334

2025-05-13 14:38Vladimir Druzenko (vvd) · 12.0.0

www/grafana: Update 11.6.1 => 12.0.0

Changelog:
https://github.com/grafana/grafana/releases/tag/v12.0.0

What's new:
https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v12-0/

While here fix portclippy warning.

PR:		286766

47b3a3f42e

2025-04-24 18:51Vladimir Druzenko (vvd) · 11.6.1

www/grafana: Update 11.6.0 => 11.6.1

Changelog:
https://github.com/grafana/grafana/releases/tag/v11.6.1

CVEs fixed:
* CVE-2025-2703 - DOM XSS vulnerability (Medium)
* CVE-2025-3260 - Bypass Viewer and Editor permission (High)
* CVE-2025-3454 - Authorization bypass in data source proxy API (Medium)
https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/

PR:		286323
Security:	CVE-2025-2703
Security:	CVE-2025-3260
Security:	CVE-2025-3454
MFH:		2025Q2

090b96f085

2025-04-02 04:07Adam Weinberger (adamw) · 11.6.0_1

go: Bump ports for go124 update

a4e30d4f4f

2025-03-26 13:59Vladimir Druzenko (vvd) · 11.6.0

www/grafana: Update 11.5.2 => 11.6.0

What's new:
https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-6/

Changelogs:
https://github.com/grafana/grafana/releases/tag/v11.5.3
https://github.com/grafana/grafana/releases/tag/v11.6.0

PR:	285668

2ee267ef46

2025-03-05 17:02Adam Weinberger (adamw) · 11.5.2_1

Bump all go ports for yesterday's releases

d0642a6176

2025-02-25 12:42Philippe Audeoud (jadawin) · 11.5.2

www/grafana: update to 11.5.2

Changelog: https://github.com/grafana/grafana/releases/tag/v11.5.2

PR:		285022

1f7fa4ca8a

2025-02-25 00:53Ashish SHUKLA (ashish) · 11.5.1_1

all: Bump after lang/go123 update

PR:		284681

f9fbe03c69

2025-02-05 11:52Vladimir Druzenko (vvd) · 11.5.1

www/grafana: Update 11.4.0 -> 11.5.1

What's new:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/

Changelog:
* https://github.com/grafana/grafana/releases/tag/v11.5.1
* https://github.com/grafana/grafana/releases/tag/v11.5.0

PR:	284579

5816993700

2025-01-21 23:21Ashish SHUKLA (ashish) · 11.4.0_1

all: Bump after lang/go123 update

MFH:		2025Q1

ca07a602a8

2024-12-22 18:12Vladimir Druzenko (vvd) · 11.4.0

www/grafana: Update 10.4.5 → 11.4.0

What's new:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

Changelogs:
* https://github.com/grafana/grafana/releases/tag/v11.4.0
* https://github.com/grafana/grafana/releases/tag/v11.3.0
* https://github.com/grafana/grafana/releases/tag/v11.2.0
* https://github.com/grafana/grafana/releases/tag/v11.1.0
* https://github.com/grafana/grafana/releases/tag/v11.0.0

While here split too long lines in Makefile.

PR:	281851

390dfbf1b6

2024-08-09 08:24Ashish SHUKLA (ashish) · 10.4.5_1

all: Bump after lang/go121 update

aa8c0111bf

2024-07-12 23:42Vladimir Druzenko (vvd) · 10.4.5

www/grafana: update 10.4.1 → 10.4.5

Changelogs:
https://github.com/grafana/grafana/releases/tag/v10.4.5
https://github.com/grafana/grafana/releases/tag/v10.4.4
https://github.com/grafana/grafana/releases/tag/v10.4.3
https://github.com/grafana/grafana/releases/tag/v10.4.2

PR:	280249

f2cab23883

2024-07-03 10:29Ashish SHUKLA (ashish) · 10.4.1_4

all: Bump after lang/go121 update

c4b51c2028

2024-06-15 11:52Ashish SHUKLA (ashish) · 10.4.1_3

all: Bump after lang/go121 update

MFH:		2024Q2

746fa696a1

2024-05-13 19:56Ashish SHUKLA (ashish) · 10.4.1_2

all: Bump after lang/go121 update

MFH:		2024Q2

fce0cc3272

comms/libimobiledevice +1 related 5 unaddressed · 6.9	Oct 26
devel/libgsf 1 unaddressed · 5.3	Oct 26
www/p5-Plack 1 unaddressed · –	Oct 25
www/p5-Starman 4 unaddressed · –	Oct 25
www/p5-Web-Simple 1 unaddressed · –	Oct 24
devel/open62541 1 CVE · 9.2 fixed 1.5.8	Oct 24
dns/lua-resty-dns 1 unaddressed · 6.3	Oct 24
devel/libwasmtime 2 unaddressed · 9.9	Oct 23
devel/py-twisted 7 unaddressed · 8.7	Oct 23
www/p5-HTTP-Headers-ActionPack 1 unaddressed · –	Oct 23
print/py-pypdf 25 unaddressed · 8.7	Oct 23
www/phpbb3 1 unaddressed · 8.3	Oct 23
net-mgmt/cacti 1 unaddressed · 8.8 VuXML	Oct 23
deskutils/xdg-desktop-portal 2 CVEs · 8.8 fixed 1.22.1	Oct 23
graphics/qt6-3d +29 related 7 CVEs · 8.7 fixed 6.11.2	Oct 23

ImageMagick6	Oct 26
ImageMagick6-nox11	Oct 26
ImageMagick7	Oct 26
ImageMagick7-nox11	Oct 26
node	Oct 24
node22	Oct 24
node24	Oct 24
node26	Oct 24
traefik	Oct 24
ca_root_nss	Oct 23
gitlab-ce	Oct 23
gitlab-ee	Oct 23
mailpit	Oct 23
vifm	Oct 23
brotli	Oct 22
chromium	Oct 22
jackson-core	Oct 22
jackson-databind	Oct 22
jackson-databind	Oct 22
keycloak	Oct 22
linux-chrome	Oct 22
ungoogled-chromium	Oct 22
FreeBSD	Oct 21
p5-DBI	Oct 21
php82	Oct 21