What perses/perses shipped
Written by FoxPlug from public releases; not affiliated with Perses. An automatic summary of the public release, pull request and commit data of github.com/perses/perses. Perses did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Secrets and GlobalSecrets can now only reference files in allowed directories, preventing users from exfiltrating arbitrary files through the datasource proxy. Pull request #4503
- Plugin archives are now extracted concurrently at startup instead of sequentially, improving loading time. Pull request #4507
- Dashboard and plugin CUE schema endpoint is restored and exposed for external use. Pull request #4505
- The UI project list now uses the search endpoint to fetch dashboards without full spec data, reducing payload size. Pull request #4366
- CUE dependency is upgraded to v0.17.1 with a workaround for a bug in that version. Pull request #4504
- Wildcard access mixed with specific project access is now properly validated without throwing errors. Pull request #4511
- User names are safely decoded for the permission API, fixing a regression with Kubernetes and OIDC user names. Pull request #4510
- Browser cache control headers for static files are improved, allowing JS files to be stored locally and reducing load on plugins. Pull request #4497
- DaC SDK panel group library now correctly resolves layout kind using CUE module replacement. Pull request #4470
- Secret read permission is now checked when creating embedded datasources in dashboards that reference secrets. Pull request #4487
Why it matters
[7] closes a security vulnerability allowing file exfiltration through secrets. [0] directly addresses startup performance complaints. Several bugfixes [1][3][19] improve reliability with mixed permissions and identity providers.
Changelog entry
- Plugin archives are collected and deduplicated before concurrent extraction at startup, improving load time Pull request #4507
- Wildcard access validation now handles mixed permission lists correctly without returning errors Pull request #4511
- DaC SDK panelgroup library resolves layout kind correctly using CUE v0.17.1 module replacement Pull request #4470
- User names are safely decoded for permission API when using Kubernetes or OIDC authentication Pull request #4510
- Dashboard and plugin CUE schema endpoint is restored and publicly exposed Pull request #4505
- Project list UI now uses search endpoint for dashboards, reducing payload by excluding full spec data Pull request #4366
- CUE dependency upgraded to v0.17.1 with workaround for upstream bug Pull request #4504
- File references in secrets and global secrets are now restricted to allowed directories only Pull request #4503
- Cache-Control headers improved for static files, enabling browser storage of JS and plugin assets Pull request #4497
- Secret read permission is validated when creating embedded datasources in dashboards Pull request #4487
v0.55.0-beta.3 shipped: faster plugin loading with concurrent extraction, improved caching for static assets, tighter security on file references in secrets, and better validation for wildcard permissions.
v0.55.0-beta.3 is out with security improvements, performance gains, and reliability fixes. Plugin archives now extract in parallel for faster startup. Secrets are restricted to allowed directories, preventing file exfiltration. Static asset caching is improved. Wildcard permissions mixed with specific project access are properly validated. User names from Kubernetes and OIDC are safely decoded.
Week of September 14, 2026
What shipped
- Dashboard lock mode is now available, preventing unintended modifications to dashboards [4]. Pull request #4370
- Dashboards and tabs can now be opened in new browser tabs using React Router Link components [2]. Pull request #4252
- Datasource discovery configuration now supports a default flag to designate default datasources by plugin kind [11]. Pull request #4368
- Auto refresh intervals are now configurable, allowing users to set custom refresh rates [23]. Pull request #4432
- OIDC provider now supports custom login properties beyond email-based login derivation [8]. Pull request #4468
- Static UI assets now include Cache-Control headers for improved browser caching of immutable files [7]. Pull request #4475
- CLI login command now properly detects non-interactive terminals and provides better error messages [10]. Pull request #4469
- CUE SDK bug fix corrects a wrong library reference [6]. Pull request #4471
- Query parameters are now preserved when redirection runs with
api_prefix[21]. Pull request #4449 - HTTP client error handling for authentication failures has been fixed [16]. Pull request #4450
Why it matters
This week delivers several usability improvements including dashboard lock mode, better tab navigation, and configurable refresh intervals. Authentication and deployment flexibility are enhanced through OIDC custom properties and improved terminal detection. Bug fixes address query parameter preservation and HTTP error handling.
Changelog entry
- [FEATURE] Add dashboard lock mode Pull request #4370
- [ENHANCEMENT] Allow opening dashboards and tabs in new tabs Pull request #4252
- [FEATURE] Add default flag to datasource discovery configuration Pull request #4368
- [FEATURE] Add configurable refresh interval Pull request #4432
- [ENHANCEMENT] Support custom login property for the OIDC provider Pull request #4468
- [ENHANCEMENT] Add Cache-Control headers for static UI assets Pull request #4475
- [ENHANCEMENT] CLI/LOGIN: check the terminal if it is interactive Pull request #4469
- [BUGFIX] CUE SDK: fix wrong lib Pull request #4471
- [BUGFIX] Fix drop of query parameter when redirection is running with
api_prefixPull request #4449 - [BUGFIX] Fix error not well handled in perses http client for auth Pull request #4450
v0.55.0-beta.2 prep: dashboard lock mode, new tab opening, configurable refresh intervals, OIDC custom login properties, and improved caching for static assets.
This week's updates to Perses bring meaningful improvements to dashboard management and deployment flexibility. Dashboard lock mode prevents accidental modifications, tabs now open in new windows, and users can configure custom refresh intervals. Authentication gains flexibility with OIDC custom login property support, while static asset caching and query parameter preservation improve overall performance and reliability.