What perses/perses shipped
Written by FoxPlug from the repository's own releases; not affiliated with Perses. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/perses/perses; Perses did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Datasource proxy targets are now validated, restricting where the HTTP and SQL proxy may connect and preventing SSRF. Pull request #4518
- Datasource variable references passed by Go SDK callers are now emitted as plain JSON strings instead of the structured object form. Pull request #4545
- When authentication is enabled, an
encryption_keymust now be provided in the configuration. Pull request #4550 - Dashboards can now be duplicated into another project where the user has permission to create dashboards. Pull request #4536
- Grafana migration now keeps the dashboard default time range, refresh interval and timezone instead of always using a one hour duration. Pull request #4555
- A go-sdk/annotation package adds annotation support to the Go SDK, with constructors and a dashboard.AddAnnotation helper. Pull request #4448
- Go-sdk/datasource gains a NewSelector convenience constructor that detects a dollar prefix and chooses the variable or static selector. Pull request #4557
- The HTTP datasource proxy no longer forwards the caller credentials used to authenticate against Perses to the datasource. Pull request #4553
- Response headers from the datasource proxy are hardened so datasource headers do not apply to the Perses server. Pull request #4558
- OAuth passthrough now uses the refreshed token in the current proxy request instead of only setting it in the response cookies. Pull request #4554
Why it matters
This week brings a breaking configuration change and a security tightening around what the datasource proxy can reach and what headers it returns, so upgrades need attention. Dashboard duplication across projects and a Grafana migration that preserves time range, refresh interval and timezone make day to day dashboard work easier. The Go SDK also gains annotation support and a simpler datasource selector constructor.
Changelog entry
- Validate datasource proxy targets to prevent SSRF, restricting where the HTTP and SQL proxy may connect. Pull request #4518
- Emit datasource variable references from the Go SDK as plain JSON strings. Pull request #4545
- Require
encryption_keyin the configuration when authentication is enabled. Pull request #4550 - Allow duplicating a dashboard into another project where the user can create dashboards. Pull request #4536
- Grafana migration keeps the default time range, refresh interval and timezone. Pull request #4555
- Add annotation support to the Go SDK with a new go-sdk/annotation package. Pull request #4448
- Add a NewSelector convenience constructor to go-sdk/datasource. Pull request #4557
- Stop forwarding the caller credentials to the datasource in the HTTP proxy. Pull request #4553
- Harden the headers of datasource proxy responses. Pull request #4558
- Use the refreshed OAuth token in the current proxy request. Pull request #4554
- Fix percli plugin build failing with ambiguous import by downloading all CUE dependencies before vendoring. Pull request #4564
- Fix vulnerable dependencies and upgrade to Go 1.28.2 with go lint aligned. Pull request #4572
0.55 work this week: datasource proxy targets are validated to prevent SSRF, caller credentials are no longer forwarded, and encryption_key is required when auth is enabled. Dashboards can be duplicated into another project, Grafana migration keeps time range, refresh interval an
This week's 0.55 work touches configuration, proxy security and dashboards. The datasource proxy now validates its targets to prevent SSRF, no longer forwards the credentials the client uses against Perses to the datasource, and its response headers are hardened. Also breaking: when auth is enabled, encryption_key must be provided. Dashboards can now be duplicated into another project where you can create dashboards. Grafana migration keeps the default time range, refresh interval and timezone instead of always using one hour. The Go SDK gains an annotation package and a NewSelector convenience constructor for datasource options.
Week of September 28, 2026
What shipped
- Released 0.55.0-beta.4 with datasource proxy timeout configuration, complete dashboard and plugin CUE schema endpoints, HTTP transport reuse per datasource, and parallel plugin archive extraction. Release
- Datasource proxy now bounds HTTP timeout with server config to prevent resource exhaustion from unreachable hosts. Pull request #4525
- SQL proxy fixed TLS handling, read-only transaction enforcement, and driver options that could leak between datasources. Pull request #4522
- SQL proxy now rejects SELECT INTO OUTFILE/DUMPFILE queries in read-only transactions to prevent unintended data exports. Pull request #4535
- HTTP proxy reuses connections per datasource instead of creating new transports for every request. Pull request #4521
- Fonts and images with content hashes are now cached as immutable assets instead of being revalidated on every page load. Pull request #4533
- Plugin archive extraction skips already-extracted plugins by checking for a marker file, reducing startup time. Pull request #4534
- Dashboard search within projects now includes tags in search results instead of silently filtering them out. Pull request #4446
- File database writes are now atomic to prevent readers from observing empty or partially written files. Pull request #4513
- Documentation page added covering security considerations for deployment including authentication, datasource proxy, and secret encryption. Pull request #4512
Why it matters
This week includes the 0.55.0-beta.4 release addressing multiple production concerns: SQL proxy security fixes prevent datasource TLS leaks and unintended data exports, HTTP handling improvements reduce resource waste through connection reuse and timeout bounds, and file database atomicity prevents data corruption from concurrent access.
Changelog entry
- FEATURE: Datasource proxy timeout bounded by server config to prevent resource exhaustion Release
- FEATURE: Complete dashboard and plugin CUE schema endpoints exposed Release
- BUGFIX: SQL proxy TLS config isolation between datasources and read-only transaction enforcement Pull request #4522
- ENHANCEMENT: SQL proxy rejects INTO OUTFILE/DUMPFILE in read-only transactions Pull request #4535
- ENHANCEMENT: HTTP proxy reuses transport per saved datasource Pull request #4521
- ENHANCEMENT: Fonts and images with content hashes cached as immutable assets Pull request #4533
- ENHANCEMENT: Skip extraction of plugin archives already extracted Pull request #4534
- BUGFIX: Dashboard tags included in project view search Pull request #4446
- BUGFIX: Secret read permission for embedded datasources in ephemeral dashboards Pull request #4524
- BUGFIX: File database writes now atomic to prevent partial reads Pull request #4513
- DOCS: Security considerations page added for deployment Pull request #4512
0.55.0-beta.4 released: SQL proxy security fixes, bounded HTTP timeouts, connection reuse per datasource, atomic file database writes, and improved plugin extraction performance.
Perses 0.55.0-beta.4 is out with critical security and performance improvements. SQL proxy now properly isolates TLS configs between datasources and rejects unintended data exports. HTTP proxy reuses connections and enforces configurable timeouts to prevent resource exhaustion. File database writes are atomic, and plugin extraction skips already-processed archives. See the release notes for complete details.
Week of September 21, 2026
What shipped
- Secrets and GlobalSecrets can now only reference files in allowed directories, preventing users from exfiltrating arbitrary files through the datasource proxy. Pull request #4503
- Plugin archives are now extracted concurrently at startup instead of sequentially, improving loading time. Pull request #4507
- Dashboard and plugin CUE schema endpoint is restored and exposed for external use. Pull request #4505
- The UI project list now uses the search endpoint to fetch dashboards without full spec data, reducing payload size. Pull request #4366
- CUE dependency is upgraded to v0.17.1 with a workaround for a bug in that version. Pull request #4504
- Wildcard access mixed with specific project access is now properly validated without throwing errors. Pull request #4511
- User names are safely decoded for the permission API, fixing a regression with Kubernetes and OIDC user names. Pull request #4510
- Browser cache control headers for static files are improved, allowing JS files to be stored locally and reducing load on plugins. Pull request #4497
- DaC SDK panel group library now correctly resolves layout kind using CUE module replacement. Pull request #4470
- Secret read permission is now checked when creating embedded datasources in dashboards that reference secrets. Pull request #4487
Why it matters
Closes a security vulnerability allowing file exfiltration through secrets. directly addresses startup performance complaints. Several bugfixes improve reliability with mixed permissions and identity providers.
Changelog entry
- Plugin archives are collected and deduplicated before concurrent extraction at startup, improving load time Pull request #4507
- Wildcard access validation now handles mixed permission lists correctly without returning errors Pull request #4511
- DaC SDK panelgroup library resolves layout kind correctly using CUE v0.17.1 module replacement Pull request #4470
- User names are safely decoded for permission API when using Kubernetes or OIDC authentication Pull request #4510
- Dashboard and plugin CUE schema endpoint is restored and publicly exposed Pull request #4505
- Project list UI now uses search endpoint for dashboards, reducing payload by excluding full spec data Pull request #4366
- CUE dependency upgraded to v0.17.1 with workaround for upstream bug Pull request #4504
- File references in secrets and global secrets are now restricted to allowed directories only Pull request #4503
- Cache-Control headers improved for static files, enabling browser storage of JS and plugin assets Pull request #4497
- Secret read permission is validated when creating embedded datasources in dashboards Pull request #4487
V0.55.0-beta.3 shipped: faster plugin loading with concurrent extraction, improved caching for static assets, tighter security on file references in secrets, and better validation for wildcard permissions.
V0.55.0-beta.3 is out with security improvements, performance gains, and reliability fixes. Plugin archives now extract in parallel for faster startup. Secrets are restricted to allowed directories, preventing file exfiltration. Static asset caching is improved. Wildcard permissions mixed with specific project access are properly validated. User names from Kubernetes and OIDC are safely decoded.
Week of September 14, 2026
What shipped
- Dashboard lock mode is now available, preventing unintended modifications to dashboards. Pull request #4370
- Dashboards and tabs can now be opened in new browser tabs using React Router Link components. Pull request #4252
- Datasource discovery configuration now supports a default flag to designate default datasources by plugin kind. Pull request #4368
- Auto refresh intervals are now configurable, allowing users to set custom refresh rates. Pull request #4432
- OIDC provider now supports custom login properties beyond email-based login derivation. Pull request #4468
- Static UI assets now include Cache-Control headers for improved browser caching of immutable files. Pull request #4475
- CLI login command now properly detects non-interactive terminals and provides better error messages. Pull request #4469
- CUE SDK bug fix corrects a wrong library reference. Pull request #4471
- Query parameters are now preserved when redirection runs with
api_prefix. Pull request #4449 - HTTP client error handling for authentication failures has been fixed. Pull request #4450
Why it matters
This week delivers several usability improvements including dashboard lock mode, better tab navigation, and configurable refresh intervals. Authentication and deployment flexibility are enhanced through OIDC custom properties and improved terminal detection. Bug fixes address query parameter preservation and HTTP error handling.
Changelog entry
- [FEATURE] Add dashboard lock mode Pull request #4370
- [ENHANCEMENT] Allow opening dashboards and tabs in new tabs Pull request #4252
- [FEATURE] Add default flag to datasource discovery configuration Pull request #4368
- [FEATURE] Add configurable refresh interval Pull request #4432
- [ENHANCEMENT] Support custom login property for the OIDC provider Pull request #4468
- [ENHANCEMENT] Add Cache-Control headers for static UI assets Pull request #4475
- [ENHANCEMENT] CLI/LOGIN: check the terminal if it is interactive Pull request #4469
- [BUGFIX] CUE SDK: fix wrong lib Pull request #4471
- [BUGFIX] Fix drop of query parameter when redirection is running with
api_prefixPull request #4449 - [BUGFIX] Fix error not well handled in perses http client for auth Pull request #4450
V0.55.0-beta.2 prep: dashboard lock mode, new tab opening, configurable refresh intervals, OIDC custom login properties, and improved caching for static assets.
This week's updates to Perses bring meaningful improvements to dashboard management and deployment flexibility. Dashboard lock mode prevents accidental modifications, tabs now open in new windows, and users can configure custom refresh intervals. Authentication gains flexibility with OIDC custom login property support, while static asset caching and query parameter preservation improve overall performance and reliability.