From 3aee13800d298e7b0ca5217e1222bfd11f9bd648 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] monitoring: grafana 13.2.0, loki 3.7.6, alloy v1.18.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Grafana's core binary is clean at 13.2.0 where 12.4.9 carried the one critical
still on our books. The image also reports far more high findings, and the
comment above the line explains why that is not a reason to go back: 13.x ships
thirteen datasource plugins inside the image, every one of those findings lives
in a plugin binary, and none of the affected datasources is one we use.

Loki drops from 41 high to 8, alloy from 44 to 14. Neither carries state that
has to migrate.

Grafana's does, and it migrates without a way back. sorb accepted that: the
volume holds preferences and history, while both datasource UIDs are pinned in
provisioning and all eleven dashboards come from files — so even losing it
entirely restores to the same UIDs the 657 dashboard references expect.
---
 monitoring/docker-compose.yml | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml
index 59fc8bd..af920c1 100644
--- a/monitoring/docker-compose.yml
+++ b/monitoring/docker-compose.yml
@@ -156,7 +156,8 @@ services:
       - traefik
 
   loki:
-    image: grafana/loki:3.7.1
+    # 3.7.1 -> 3.7.6, gemessen: 41 HIGH -> 8, keine CRITICAL in beiden.
+    image: grafana/loki:3.7.6
     container_name: loki
     restart: unless-stopped
     volumes:
@@ -173,7 +174,9 @@ services:
       - traefik
 
   alloy:
-    image: grafana/alloy:v1.16.0
+    # v1.16.0 -> v1.18.1, gemessen: 44 HIGH -> 14. v1.19.0 gibt es nur als
+    # Vorabfassung; im Cluster laeuft alloy aus dem Chart, nicht von hier.
+    image: grafana/alloy:v1.18.1
     container_name: alloy
     restart: unless-stopped
     volumes:
@@ -196,7 +199,16 @@ services:
       - loki
 
   grafana:
-    image: grafana/grafana:12.4.9
+    # ⚠️ NICHT auf die 12er-Reihe zurueckdrehen, weil Trivy hier mehr HIGH
+    # meldet als dort. Ab 13.x liegen 13 Datenquellen-Plugins IM Image (12.4.9
+    # hatte keine): 5 Scan-Ziele werden 16, und alle 162 HIGH sitzen in diesen
+    # Plugin-Binaries - opentsdb, jaeger, stackdriver, tempo, cloudmonitoring,
+    # also Datenquellen, die wir nicht benutzen. 135 davon sind ein und
+    # dieselbe Go-stdlib, wiederholt ueber Binaries mit alter Toolchain.
+    # Der KERN von 13.2.0 traegt 0 CRITICAL und 0 HIGH; 12.4.9 trug dort 1
+    # und 3. Die groessere Zahl gehoert zum groesseren Image, nicht zur
+    # schlechteren Fassung.
+    image: grafana/grafana:13.2.0
     container_name: grafana
     restart: unless-stopped
     environment: