# grafana 13.1.2

The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

Snapshot of gominimal/pkgs commit `c930e3121426c055f690867bf78f5bbd9c2c9826` (pushed 2026-10-11T00:34:22.000Z).

## Install

```sh
min add grafana
```

## Direct advisories

None at this commit.

## Transitive advisories

None at this commit.

## Dependencies

- Build (1): base
- Runtime (1): glibc

## OpenSSF Scorecard

Aggregate score: 6.9 / 10. Scored by OpenSSF Scorecard. Repository scored: grafana/grafana. Scanned 2026-10-05.

Result on OpenSSF's viewer: https://scorecard.dev/viewer/?uri=github.com/grafana/grafana

Checks, scored 0-10 as the Scorecard tool reports them (N/A: not applicable or inconclusive):

| Check | Score | Reason |
| --- | --- | --- |
| [Binary-Artifacts](https://minimal.dev/docs/reference/scorecard#check-binary-artifacts) | 10 | No binaries found in the repo |
| [Branch-Protection](https://minimal.dev/docs/reference/scorecard#check-branch-protection) | 5 | Branch protection is not maximal on development and all release branches |
| [CII-Best-Practices](https://minimal.dev/docs/reference/scorecard#check-cii-best-practices) | 2 | Badge detected: InProgress |
| [Code-Review](https://minimal.dev/docs/reference/scorecard#check-code-review) | 10 | All changesets reviewed |
| [Dangerous-Workflow](https://minimal.dev/docs/reference/scorecard#check-dangerous-workflow) | 10 | No dangerous workflow patterns detected |
| [Fuzzing](https://minimal.dev/docs/reference/scorecard#check-fuzzing) | 10 | Project is fuzzed |
| [License](https://minimal.dev/docs/reference/scorecard#check-license) | 10 | License file detected |
| [Maintained](https://minimal.dev/docs/reference/scorecard#check-maintained) | 10 | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| [Packaging](https://minimal.dev/docs/reference/scorecard#check-packaging) | 10 | Packaging workflow detected |
| [Pinned-Dependencies](https://minimal.dev/docs/reference/scorecard#check-pinned-dependencies) | 4 | Dependency not pinned by hash detected -- score normalized to 4 |
| [SAST](https://minimal.dev/docs/reference/scorecard#check-sast) | 1 | SAST tool is not run on all commits -- score normalized to 1 |
| [Security-Policy](https://minimal.dev/docs/reference/scorecard#check-security-policy) | 10 | Security policy file detected |
| [Signed-Releases](https://minimal.dev/docs/reference/scorecard#check-signed-releases) | 0 | Project has not signed or included provenance with any releases. |
| [Token-Permissions](https://minimal.dev/docs/reference/scorecard#check-token-permissions) | 2 | Detected GitHub workflow tokens with excessive permissions |

## Links

- Homepage: https://grafana.com
- Package page (HTML): https://minimal.dev/pkgs/grafana
- JSON API (floats latest): https://minimal.dev/api/pkgs/grafana.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/grafana/sbom.json
- Build attestations (JSON): https://minimal.dev/api/pkgs/grafana/attestation.json