1.1.2 - Go dependency security update

Intelligence Gateway data source 1.1.2

Community-signed security update for digitalrcs-intelligencegateway-datasource, addressing Grafana review ticket #240360.

Security fix

• Updated golang.org/x/net to v0.62.0, fixing GO-2026-6860 and GO-2026-6866.
• Updated the required companion Go modules: golang.org/x/sys to v0.49.0 and golang.org/x/text to v0.43.0.
• Added fail-closed, module-level vulnerability scans of all six backend binaries to CI and to verification of the exact release ZIP.
• No application behavior, configuration contract, provider settings, npm dependency graph, Go toolchain, or Grafana SDK changes. The Intelligence Gateway panel remains at signed 1.1.1 and does not need a new submission for this fix.

Verification

• All six backend binaries from this signed ZIP: govulncheck -mode=binary -scan=module reports No vulnerabilities found.
• Grafana plugin validator: 55 analyzers completed, zero failures, including signature verification; neither reported Go vulnerability recurs.
• Post-merge CI: 48 browser tests passed across six Grafana versions, with no reported retries or flakes.
• Source vulnerability scan, backend tests, explicit backend race tests, and packaging checks passed.
• Community signature organization: digitalrcs. All manifest file hashes and the checksum sidecar match.
• GitHub artifact provenance verified against the release workflow, tag v1.1.2, and commit 6fe5d34d7a7dd0e479deaee4ffc2f86384a3a780.
• The unchanged full npm dependency audit contains 7 low and 5 moderate findings, with no high or critical findings. Clean Go scans do not imply the entire dependency graph has no findings.

The attached binary metadata report confirms all six binaries embed the fixed modules and intended source revision. Go's build metadata records vcs.modified=true, as in the previous official release; it is not represented as a clean-working-tree stamp. Signature and provenance verification are recorded separately.

Submission values

Field	Value
Plugin ID	digitalrcs-intelligencegateway-datasource
Version	1.1.2
Plugin ZIP	digitalrcs-intelligencegateway-datasource-1.1.2.zip
Source code	v1.1.2 source
SHA1	e24d5067507e9df3b1328e3a1578571654038dd4
SHA256	538dd9b49c3ed5ff695e4a2968a7b4833ea248ba9bfa3471621ea3ee7bcdf77b
Source commit	6fe5d34d7a7dd0e479deaee4ffc2f86384a3a780

Update the existing data-source submission in Grafana My Plugins, then reply to ticket #240360. GitHub publication does not update that portal submission or send a ticket reply. The existing signed panel 1.1.1 and earlier releases are unchanged.

Evidence

• Fix PR #27
• Post-merge CI
• Signed release and exact-archive verification
• Release attachments preserve the validator report, all-six-binary vulnerability report, validator image digest, provenance verification, and binary build metadata.

1.1.1 - Community-signed release

Community-signed release

Intelligence Gateway Secure AI data source 1.1.1 is publicly signed by DigitalRCS with Grafana's Community signature classification. It is the secure backend companion for the Intelligence Gateway panel. Install both plugins in the same Grafana instance.

This release preserves the reviewed 1.1.0 functionality and dependency versions. It adds the public signature and release checks that refuse an unsigned archive. The existing 1.1.0 downloads remain unchanged. Signing does not itself publish the plugin in Grafana's catalog; the existing submission must be updated with this package.

Grafana submission values

Field	Value
Plugin ID	digitalrcs-intelligencegateway-datasource
Version	1.1.1
Package	Signed plugin ZIP
Source	Immutable v1.1.1 source
SHA1	15027ec1b8123b0071189d3d11b4cb410a9e18e0
SHA256	e6467d2b280c20ca1b09f72eb54857d4ee13cf5b730ca9e4ab1bd6a44e4c4c46
Source commit	bf7bf9b1b1f7ba27bbb2cdb1d36dbe5b7b5c5f7a
OS and architecture	Single ZIP containing six backend targets

Use Submit Update on the existing data-source submission before updating the dependent panel. Paste the SHA1 value, not the checksum-file URL. Use the packaged plugin ZIP, not GitHub's source-code ZIP.

Verification

The exact signed archive passed manifest file-hash coverage, all six backend executable permissions, SHA1/SHA256 checks, and GitHub build provenance bound to this repository, release workflow, tag, and commit. Grafana Plugin Validator completed 55 analyzers with zero failed analyzer events, including signature and provenance validation. Release validation.

Post-merge build, lint, unit/backend tests, signing, and browser tests passed on Grafana 11.6.16, 12.0.10, 12.2.10, 12.4.14, 13.1.9, and 13.3.0. CI results.

Security assessment dated October 30, 2026: the full npm audit reports five moderate and seven low package entries, with zero high or critical findings. Production-only npm findings are four host-external React Router entries. Development-only findings affect qs and deepmerge; no audit finding is suppressed. The source Go scan reports zero reachable vulnerabilities or vulnerable imported packages. The validator's binary scan warns about GO-2026-6860 and GO-2026-6866 in the golang.org/x/net module. The exact stripped Linux binary has no symbol information available to that scanner, which falls back to conservative module-level matching. A release-equivalent Go 1.26.10 import check with CGO_ENABLED=0 confirms that the affected golang.org/x/net/html package is not imported. Do not describe the dependency graph or validator report as warning-free. Keep the Grafana host patched.

Grafana's suggested SDK HTTP-client integration and persistence of untouched configuration defaults remain separate, non-blocking follow-up work. Neither is included in this signing release.

For installation, configuration, security, and the distinction between a mock transport receipt and genuine AI inference, see the data-source wiki and catalog README.

1.1.0 - Secure images, provider profiles, and clearer setup

What's new

• Secure PNG/JPEG image requests from the companion panel: dashboard captures, selected panels, uploaded images, images-only analysis, or images combined with query data. Existing data-only analysis remains available.
• Provider profiles for OpenAI, LM Studio, Open WebUI, Grafana LLM app, Custom endpoints, and a bounded Copilot Studio Direct Line preview.
• A prominent DEMO ONLY - Mock AI (no inference) warning and setup checklist. The supplied mock returns a fixed delivery receipt; it does not analyze data or images. Configure a separate approved real provider for actual assessments.
• Backend image/model policy, payload limits, encrypted secret storage, bounded concurrency, and updated dependencies/toolchain.

Upgrade and setup

Install the secure data source and compatible panel side by side, restart Grafana, and reload the browser. Image analysis is opt-in and requires an approved vision-capable model. Credentials belong in the data source's secure fields, never dashboard JSON.

Installation and own-provider setup · Reviewer walkthrough · Detailed changes and limits

Verified release evidence

• Frontend/backend, security, packaging, API compatibility, and browser checks passed across Grafana 11.6.16, 12.0.10, 12.2.10, 12.4.13, 13.1.8, and 13.2.4.
• The exact release ZIP passed Grafana's default full validator with no failed analyzers. Its only plugin warning is the expected unsigned status.
• Six backend platforms are included with executable permissions. ZIP checksum and GitHub build provenance were independently verified against the release workflow, tag, and source commit.
• Source commit: 51a59796c8d486a675716c1111f34a4d786d324b.
• SHA1: f004c8cbb5ee62e344ad9a2174d73e4eed2ff92b.
• SHA256: 7fc3632a49d0792f81978afd24e7bb574f0117adebf4f4b91c5967459c3b3567.

Release validation run · Version-matched Grafana submission fields

This is an unsigned Grafana review build, not a publicly signed or catalog-certified plugin. Build provenance is not a Grafana signature. Mock testing does not establish live image understanding; provider/model combinations need separate validation. Copilot Studio remains preview without delegated enterprise SSO. Four documented moderate host-external npm Router entries remain; no high/critical npm findings or reachable Go vulnerabilities were found in the release checks.

v1.0.1 - Secure AI companion and catalog readiness

Intelligence Gateway Secure AI 1.0.1

Maintenance and catalog-review release for the secure companion data source used by Grafana Intelligence Gateway.

What changed

• Professional packaged catalog README, clearer companion-plugin installation, refreshed configuration screenshot, and updated wiki guidance.
• Model discovery returns administrator-approved IDs only. An empty allow-list now permits only the default model; explicit lists must include it.
• Removed unused OAuth client-secret and streaming controls. Streaming is rejected, including requests using legacy enabling settings. The explicit Allow insecure HTTP override remains available with its warning.
• Fixed a configuration-editor crash when changing providers on older supported Grafana versions by using a simple three-option selector.
• Patched frontend dependencies and updated the backend to Go 1.26.8, Grafana Go SDK 0.296.5, and gRPC 1.83.2. CI now checks high-severity npm advisories and reachable Go vulnerabilities.

Upgrade notes

If your 1.0.0 instance used an empty model allow-list to permit multiple models, explicitly add all required model IDs and include the default. Authentication remains API key or bearer token. Legacy client-secret/streaming settings are ignored; obsolete encrypted secrets are not automatically deleted. See Configuration.

Install this data source and the companion panel as separate sibling plugin directories in the same Grafana installation. Configure the provider instance in the dashboard's organization, then select it under the panel's AI provider, not as the source of your metrics. Restart Grafana after replacing plugin files.

Verification and review status

Local validation passed: TypeScript, lint, production build, 14 packaging tests, 22 top-level Go tests with race detection, seven data-source browser checks, and seven companion-panel browser checks on Grafana 13.1.3. The browser assessment uses an explicitly labeled mock, not new real-provider inference.

The release pull request passed all checks. Its seven browser checks passed on Grafana 11.6.16, 12.1.10, 12.3.11, 13.0.9, 13.2.2, and nightly; API compatibility and bundle checks also passed. The provider-selection regression was additionally reproduced and verified fixed locally on 13.0.9.

The exact downloadable archive was installed in the Docker review environment on Grafana 13.1.3 and passed all seven data-source and all seven companion-panel browser checks. Page identity, meaningful rendering, no error overlay, provider switching, HTTP-off rejection/HTTP-on success, and the panel's mock receipt were verified. No plugin runtime exception was observed; unrelated development live-reload and Grafana host asset/feature-flag warnings are documented. Mobile layouts and new live-provider inference were not retested for this maintenance release.

Independent archive inspection verified all six platform binaries, executable permissions, matching tagged catalog README/assets/changelog, and backend source-manifest hashes. Every binary uses Go 1.26.8, SDK 0.296.5, and gRPC 1.83.2. Strict GitHub attestation verification passed for the repository's release.yml, tag v1.0.1, commit 1b03e50a2ad9c3f2816bc062685e74272cf97686, and GitHub-hosted runners. Release build.

The full Grafana validator passed against this exact archive and immutable source tag using its default policy, authenticated provenance, and the verified SHA1 checksum. Source/security checks, all six backend binary vulnerability scans, dependency checks, ClamAV, React compatibility, metadata, links, and archive checks passed. The only warning was the expected unsigned plugin initial-review status. No custom rule exclusions or severity overrides were used. Optional credential-dependent LLM review is not claimed.

Archive checksums:

• SHA1: f5faa7206d18664107a87381385b8b10f4693a5f
• SHA256: 3dad8bdc1ba5d6ff285ea283f9c31b832f5fd6b9719f9c6a6b551910f4fd8df5

The pinned Go vulnerability scan reports no vulnerabilities. npm reports zero high/critical findings and four moderate inherited package entries representing two Router advisories. Those router implementations are not bundled in this plugin; the host Grafana installation must still be kept patched. See the dated assessment.

Unsigned initial-review build. GitHub publication and passing automated checks do not mean Grafana approval, certification, signing eligibility, or catalog availability. Coordinate the data-source and companion-panel submissions with Grafana.

For Grafana submission, use the downloadable ZIP asset, its SHA1 asset, and this immutable source tag. Testing guidance is in the wiki.

v1.0.0 - Grafana catalog review build

Initial Grafana catalog-review build of the Intelligence Gateway Secure AI data source.

Highlights:

• Grafana secureJsonData credential storage with server-side provider requests.
• OpenAI, LM Studio, and custom OpenAI-compatible provider policies.
• Administrator model, token, timeout, body, redirect, concurrency, and rate enforcement.
• HTTPS by default with an explicit, default-off Allow insecure HTTP administrator override for controlled organizational networks.
• Deterministic credential-free Docker reviewer environment and provisioned dashboard.
• Catalog screenshots, multi-version Grafana E2E coverage, full validator pass, and build provenance.

Submission values:

• Plugin ZIP: https://github.com/digitalrcs/grafana-intelligence-gateway-datasource/releases/download/v1.0.0/digitalrcs-intelligencegateway-datasource-1.0.0.zip
• Source tag: https://github.com/digitalrcs/grafana-intelligence-gateway-datasource/tree/v1.0.0
• SHA1: 4fbc6c11560aa21fadb4859ff5c1e8268c0bc5b6
• Testing guidance: https://github.com/digitalrcs/grafana-intelligence-gateway-datasource/wiki/Testing-and-Review
• Build attestation: https://github.com/digitalrcs/grafana-intelligence-gateway-datasource/attestations/40299439

This first-review archive is intentionally unsigned. Grafana permits unsigned initial submissions and assigns the public signature classification during review.