Grafana 13.2.0

Grafana 13.2.0 is out, and before anyone gets carried away: this is a big one, which means it's also a careful one. Let's not pretend a minor-version bump with a CVE attached is business as usual.

The Security Item First

The release ships with a security advisory, CVE-2026-17183. That alone is a reason to prioritize this upgrade on anything exposed beyond your internal network. Patch releases like this exist precisely because waiting has a cost.

What They Claim

The headline work is all in Alerting, and it's substantial — an import tab in the alerting settings page, an import-to-GMA wizard that now handles notification templates, staged configuration summaries computed server-side, and a migration of the notifications API to v1beta1. There's also a long-running refactor to recognize "default" and "user-defined" routing trees, split across four PRs.

Where It Gets Tricky

Here's the part the marketing slides won't tell you: that default routing-tree refactor and the notifications v1beta1 API migration are exactly the kind of changes that can shift how your existing alert routing behaves. If you've hand-crafted routing trees or rely on legacy notification endpoints, budget time to re-test your alert flows after upgrading — don't assume a green dashboard means green alerts.

Also note the 403-instead-of-500 fix on contact-point provenance mismatches. Good change, but it means previously-silent configuration errors now surface as explicit denials. That's correct, and it will annoy exactly one person in your org who has been getting away with sloppy provenance.

The Realist's Verdict

Overall: worth the upgrade, and the security baseline demands it anyway. Just treat it like the significant release it is — read the what's-new highlights, review your alerting config, and test before you promote it to production.