@grafana/create-plugin 7.11.0 → 7.12.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [7.12.1](https://github.com/grafana/plugin-tools/compare/@grafana/create-plugin@7.12.0...@grafana/create-plugin@7.12.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **create-plugin:** bump grafana-app-sdk to v0.60.3 in experimental-app-sdk ([#2899](https://github.com/grafana/plugin-tools/issues/2899)) ([f57e8a8](https://github.com/grafana/plugin-tools/commit/f57e8a837d36c1b5e566ad81cf8fe426337aca88))
+* **docs:** redirect dead plugin-tools urls and fix two broken links ([#2931](https://github.com/grafana/plugin-tools/issues/2931)) ([d26d21c](https://github.com/grafana/plugin-tools/commit/d26d21c6d3be60ba7db7a4576f794e2fcddeb324))
+* **templates:** Update dependency @grafana/plugin-e2e to v3.14.0 ([#2897](https://github.com/grafana/plugin-tools/issues/2897)) ([690dcf8](https://github.com/grafana/plugin-tools/commit/690dcf8f935c3ed741c6bb57ea82df83e5b29fa1))
+
+## [7.12.0](https://github.com/grafana/plugin-tools/compare/@grafana/create-plugin@7.11.0...@grafana/create-plugin@7.12.0) (2026-09-22)
+
+
+### Features
+
+* **deps:** bump grafana libs to latest in templates in create plugin ([#2893](https://github.com/grafana/plugin-tools/issues/2893)) ([d3c3f4b](https://github.com/grafana/plugin-tools/commit/d3c3f4b2a775d9bfcb0a9209a0c62a2ef16bbd58))
+
+
+### Bug Fixes
+
+* **create-plugin:** Improve experimental-app-sdk templates with RBAC guidance. ([#2892](https://github.com/grafana/plugin-tools/issues/2892)) ([ec59abe](https://github.com/grafana/plugin-tools/commit/ec59abe7f7508e6dc206a24a0658d121d64b3f1f))
+* **create-plugin:** support @grafana/eslint-config v10 in scaffold ([#2873](https://github.com/grafana/plugin-tools/issues/2873)) ([67f6fec](https://github.com/grafana/plugin-tools/commit/67f6fec1321943ae8062e130745b37f3e45c1d72))
+
 ## [7.11.0](https://github.com/grafana/plugin-tools/compare/@grafana/create-plugin@7.10.1...@grafana/create-plugin@7.11.0) (2026-09-16)
 
 

package/CONTRIBUTING.md

@@ -111,6 +111,9 @@ Note that certain files are intentionally named differently (e.g. npmrc, package
 
 Migrations are scripts that update a particular aspect of a project created with create-plugin. When users run `@grafana/create-plugin@latest update`, the command compares their project's version against the running package version and executes any necessary migrations to bring their project up to date.
 
+> [!TIP]
+> If you use Claude Code, the `write-codemod` skill in [`.claude/skills/write-codemod`](../../.claude/skills/write-codemod/SKILL.md) helps you write migrations and additions. Ask Claude to "write a migration" or run `/write-codemod`.
+
 ```js
 └── src/
     ├── migrations/
@@ -135,19 +138,26 @@ The update command follows these steps:
 
 #### How to add a migration?
 
-1. Create a new migration script file with a descriptive name (e.g. `add-webpack-profile.ts`)
-2. Register your migration in `migrations.ts`:
+1. Create a new migration script file named with the next number in sequence and a short summary (e.g. `015-add-webpack-profile.ts`)
+2. Register your migration at the end of the array in `migrations.ts`:
 
    ```typescript
-   migrations: {
-      'add-webpack-profile': {
-         version: '5.13.0',
-         description: 'Update build command to use webpack profile flag.',
-         migrationScript: './scripts/add-webpack-profile.js',
-      },
+   {
+     name: '015-add-webpack-profile',
+     version: '0.0.0-unreleased', // x-release-please-version
+     description: 'Update build command to use webpack profile flag.',
+     scriptPath: import.meta.resolve('./scripts/015-add-webpack-profile.js'),
    },
    ```
 
+   Copy the `version` line exactly, including the comment. Don't choose a version yourself: the release that ships
+   your migration isn't known until release-please opens the release pull request.
+   - `0.0.0-unreleased` is the `UNRELEASED` constant. It resolves to the running create-plugin version, so your
+     migration runs locally, in CI, and in `pkg.pr.new` previews.
+   - release-please replaces it with the released version in the release pull request, and the release workflow
+     removes the comment.
+   - The registry tests in `migrations.test.ts` fail if the line or the comment is missing or changed.
+
 3. Write your migration script:
 
    The migration script makes changes to files in a Grafana plugin to bring updates or improvements to the project. It should be isolated to a single task (e.g. add profile flag to webpack builds) rather than update the entire .config directory and all the projects dependencies.
@@ -227,6 +237,5 @@ describe('Migration - append profile to webpack', () => {
 
 To test a migration locally you'll need a plugin to test on.
 
-- Bump the version of create-plugin _(This can be necessary if your plugin was already updated using the latest create-plugin version.)_
-- Verify that the `.config/.cprc.json` in your plugin has a version that is lower than the bumped `create-plugin` version. `.cprc.json` holds the version of `create-plugin` that was used to scaffold or make the last update of the plugin.
+- Verify that the `.config/.cprc.json` in your plugin has a version no higher than the version in `packages/create-plugin/package.json`. `.cprc.json` holds the version of `create-plugin` that was used to scaffold or make the last update of the plugin. You don't need to bump the create-plugin version: unreleased migrations run even when the plugin is on the current version.
 - Run `npx create-plugin update` in your plugin (see instructions on how to link your create-plugin dev version)

package/dist/codemods/additions/scripts/experimental-app-sdk.js

@@ -158,7 +158,7 @@ function wireGoBackend(context) {
   wireMainGo(context);
   addGoModDependency(context);
 }
-const GRAFANA_APP_SDK_VERSION = "v0.60.0";
+const GRAFANA_APP_SDK_VERSION = "v0.60.3";
 function addGoModDependency(context) {
   addRequireToGoMod(context, "github.com/grafana/grafana-app-sdk", GRAFANA_APP_SDK_VERSION);
   addRequireToGoMod(context, "github.com/grafana/grafana-app-sdk/plugin", GRAFANA_APP_SDK_VERSION);

package/dist/codemods/migrations/manager.js

@@ -1,15 +1,28 @@
 import defaultMigrations from './migrations.js';
 import { runCodemod } from '../runner.js';
-import { satisfies, gte } from 'semver';
+import { gt, eq, satisfies, compare } from 'semver';
 import { CURRENT_APP_VERSION } from '../../utils/utils.version.js';
-import { gitCommitNoVerify } from '../../utils/utils.git.js';
+import { gitCommitNoVerify, isGitDirectoryClean } from '../../utils/utils.git.js';
 import { output } from '../../utils/utils.console.js';
 import { setRootConfig } from '../../utils/utils.config.js';
+import { UNRELEASED } from '../../constants.js';
 
+function resolveVersion(migration, toVersion) {
+  return migration.version === UNRELEASED ? toVersion : migration.version;
+}
+function isUpToDate(fromVersion, toVersion, migrations = defaultMigrations) {
+  if (gt(fromVersion, toVersion)) {
+    return true;
+  }
+  if (eq(fromVersion, toVersion)) {
+    return !migrations.some((migration) => migration.version === UNRELEASED);
+  }
+  return false;
+}
 function getMigrationsToRun(fromVersion, toVersion, migrations = defaultMigrations) {
   const semverRange = `${fromVersion} - ${toVersion}`;
-  return migrations.filter((meta) => satisfies(meta.version, semverRange)).sort((a, b) => {
-    return gte(a.version, b.version) ? 1 : -1;
+  return migrations.filter((meta) => satisfies(resolveVersion(meta, toVersion), semverRange)).sort((a, b) => {
+    return compare(resolveVersion(a, toVersion), resolveVersion(b, toVersion));
   });
 }
 async function runMigrations(migrations, options = {}) {
@@ -26,9 +39,9 @@ ${migration.description}`);
     }
   }
   await setRootConfig({ version: CURRENT_APP_VERSION });
-  if (options.commitEachMigration) {
+  if (options.commitEachMigration && !await isGitDirectoryClean()) {
     await gitCommitNoVerify(`chore: update .config/.cprc.json to version ${CURRENT_APP_VERSION}.`);
   }
 }
 
-export { getMigrationsToRun, runMigrations };
+export { getMigrationsToRun, isUpToDate, runMigrations };

package/dist/codemods/migrations/migrations.js

@@ -78,9 +78,18 @@ var defaultMigrations = [
     version: "7.10.1",
     description: "Support @grafana/ui@13.2.0 in Jest by transforming @react-hookz/web and @ver0/deep-equal ESM dependencies.",
     scriptPath: import.meta.resolve("./scripts/013-jest-esmodules.js")
+  },
+  {
+    name: "014-eslint-config-v10",
+    version: "7.11.1",
+    description: "Update @grafana/eslint-config to v10: drop the removed ./flat.js subpath import and swap @stylistic/eslint-plugin-ts for @stylistic/eslint-plugin.",
+    scriptPath: import.meta.resolve("./scripts/014-eslint-config-v10.js")
   }
   // Do not use LEGACY_UPDATE_CUTOFF_VERSION for new migrations. It is only used above to force migrations to run
   // for those written before the switch to updates as migrations.
+  //
+  // New migrations never pick a version: copy the unreleased version line from ../AGENTS.md exactly.
+  // Do not paste it into a comment in this file, as release-please rewrites every line that carries it.
 ];
 
 export { defaultMigrations as default };

package/dist/codemods/migrations/scripts/014-eslint-config-v10.js

@@ -0,0 +1,35 @@
+import { isVersionGreater, addDependenciesToPackageJson, removeDependenciesFromPackageJson } from '../../utils.js';
+
+const OLD_IMPORT = "import grafanaConfig from '@grafana/eslint-config/flat.js';";
+const NEW_IMPORT = "import grafanaConfig from '@grafana/eslint-config';";
+const ESLINT_CONFIG_PATH = ".config/eslint.config.mjs";
+function migrate(context) {
+  if (!context.doesFileExist("package.json")) {
+    return context;
+  }
+  const packageJson = JSON.parse(context.getFile("package.json") || "{}");
+  const currentVersion = packageJson.devDependencies?.["@grafana/eslint-config"];
+  if (!currentVersion || !isVersionGreater("^10.0.0", currentVersion)) {
+    return context;
+  }
+  if (context.doesFileExist(ESLINT_CONFIG_PATH)) {
+    const content = context.getFile(ESLINT_CONFIG_PATH) || "";
+    if (content.includes(OLD_IMPORT)) {
+      context.updateFile(ESLINT_CONFIG_PATH, content.replace(OLD_IMPORT, NEW_IMPORT));
+    }
+  }
+  addDependenciesToPackageJson(
+    context,
+    {},
+    {
+      "@grafana/eslint-config": "^10.0.0",
+      "@stylistic/eslint-plugin": "^5.10.0",
+      "eslint-config-prettier": "^10.1.0",
+      "eslint-plugin-react-hooks": "^7.1.0"
+    }
+  );
+  removeDependenciesFromPackageJson(context, [], ["@stylistic/eslint-plugin-ts"]);
+  return context;
+}
+
+export { migrate as default };

package/dist/commands/update.command.js

@@ -1,6 +1,6 @@
-import { getMigrationsToRun, runMigrations } from '../codemods/migrations/manager.js';
+import { isUpToDate, getMigrationsToRun, runMigrations } from '../codemods/migrations/manager.js';
 import { getPackageManagerWithFallback, getPackageManagerExecCmd, getPackageManagerSilentInstallCmd } from '../utils/utils.packageManager.js';
-import { lt, gte } from 'semver';
+import { lt } from 'semver';
 import { performPreCodemodChecks } from '../utils/utils.checks.js';
 import { CURRENT_APP_VERSION } from '../utils/utils.version.js';
 import { LEGACY_UPDATE_CUTOFF_VERSION } from '../constants.js';
@@ -15,7 +15,7 @@ const update = async (argv) => {
     preparePluginForMigrations(argv);
   }
   try {
-    if (gte(version, CURRENT_APP_VERSION)) {
+    if (isUpToDate(version, CURRENT_APP_VERSION)) {
       output.log({
         title: "Nothing to update, exiting."
       });

package/dist/constants.js

@@ -26,6 +26,7 @@ var PLUGIN_TYPES = /* @__PURE__ */ ((PLUGIN_TYPES2) => {
   return PLUGIN_TYPES2;
 })(PLUGIN_TYPES || {});
 const LEGACY_UPDATE_CUTOFF_VERSION = "5.27.1";
+const UNRELEASED = "0.0.0-unreleased";
 const EXTRA_TEMPLATE_VARIABLES = {
   grafanaImage: "grafana-enterprise"
 };
@@ -59,4 +60,4 @@ const MIGRATION_CONFIG = {
   devNpmDependenciesToRemove: ["@grafana/toolkit", "@grafana/runtime", "@grafana/data", "@grafana/ui"]
 };
 
-export { DEFAULT_FEATURE_FLAGS, EXPORT_PATH_PREFIX, EXTRA_TEMPLATE_VARIABLES, GRAFANA_FE_PACKAGES, IS_DEV, LEGACY_UPDATE_CUTOFF_VERSION, MIGRATION_CONFIG, PARTIALS_DIR, PLUGIN_TYPES, TEMPLATES_DIR, TEMPLATE_PATHS };
+export { DEFAULT_FEATURE_FLAGS, EXPORT_PATH_PREFIX, EXTRA_TEMPLATE_VARIABLES, GRAFANA_FE_PACKAGES, IS_DEV, LEGACY_UPDATE_CUTOFF_VERSION, MIGRATION_CONFIG, PARTIALS_DIR, PLUGIN_TYPES, TEMPLATES_DIR, TEMPLATE_PATHS, UNRELEASED };

package/dist/utils/utils.templates.js

@@ -78,7 +78,7 @@ function getTemplateData(cliArgs) {
       isNPM: isNPM(packageManagerName),
       version: currentVersion,
       bundleGrafanaUI,
-      scenesVersion: "^7.0.0",
+      scenesVersion: "^8.17.0",
       useExperimentalRspack: Boolean(features.useExperimentalRspack),
       frontendBundler
     };
@@ -99,7 +99,7 @@ function getTemplateData(cliArgs) {
       isNPM: isNPM(packageManagerName),
       version: currentVersion,
       bundleGrafanaUI,
-      scenesVersion: "^7.0.0",
+      scenesVersion: "^8.17.0",
       pluginExecutable: pluginJson.executable,
       useExperimentalRspack: Boolean(features.useExperimentalRspack),
       frontendBundler

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grafana/create-plugin",
-  "version": "7.11.0",
+  "version": "7.12.1",
   "repository": {
     "type": "git",
     "directory": "packages/create-plugin",

package/src/codemods/AGENTS.md

@@ -5,7 +5,15 @@ This guide provides specific instructions for working with migrations and additi
 ## Agent Behavior
 
 - Refer to current migrations and additions typescript files found in @./additions/scripts and @./migrations/scripts
-- When creating a new migration add it to the exported migrations object in @./migrations/migrations.ts
+- When creating a new migration add it to the end of the exported migrations array in @./migrations/migrations.ts
+- Never choose a version for a new migration. Use this `version` line exactly, including the comment, and never paste it into a comment in @./migrations/migrations.ts:
+
+  ```ts
+  version: '0.0.0-unreleased', // x-release-please-version
+  ```
+
+  release-please replaces it with the released version. The registry tests in @./migrations/migrations.test.ts enforce this
+
 - Always refer to @./context.ts to know what methods are available on the context class
 - Always check for file existence using the @./context.ts class before attempting to do anything with it
 - Never write files with any 3rd party npm library. Use the context for all file operations

package/src/codemods/additions/scripts/experimental-app-sdk.ts

@@ -248,7 +248,7 @@ function wireGoBackend(context: Context) {
 }
 
 // The go.mod version for grafana-app-sdk and its plugin/ submodule.
-const GRAFANA_APP_SDK_VERSION = 'v0.60.0';
+const GRAFANA_APP_SDK_VERSION = 'v0.60.3';
 
 /**
  * Adds github.com/grafana/grafana-app-sdk and its plugin/ submodule to go.mod. The generated Go kind

package/src/codemods/migrations/manager.test.ts

@@ -1,9 +1,10 @@
 import { flushChanges, formatFiles, printChanges } from '../utils.js';
-import { getMigrationsToRun, runMigrations } from './manager.js';
+import { getMigrationsToRun, isUpToDate, runMigrations } from './manager.js';
 
 import { Context } from '../context.js';
+import { UNRELEASED } from '../../constants.js';
 import { Migration } from './migrations.js';
-import { gitCommitNoVerify } from '../../utils/utils.git.js';
+import { gitCommitNoVerify, isGitDirectoryClean } from '../../utils/utils.git.js';
 import migrationFixtures from './fixtures/migrations.js';
 import { setRootConfig } from '../../utils/utils.config.js';
 import { vi } from 'vitest';
@@ -34,6 +35,7 @@ vi.mock('../../utils/utils.config.js', () => ({
 }));
 vi.mock('../../utils/utils.git.js', () => ({
   gitCommitNoVerify: vi.fn(),
+  isGitDirectoryClean: vi.fn(),
 }));
 
 vi.mock('@libs/version', () => ({
@@ -43,6 +45,40 @@ vi.mock('@libs/version', () => ({
 describe('Migrations', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    vi.mocked(isGitDirectoryClean).mockResolvedValue(false);
+  });
+
+  describe('isUpToDate', () => {
+    const released: Migration = {
+      name: '001-released',
+      version: '5.0.0',
+      description: 'Shipped in 5.0.0',
+      scriptPath: './001-released.js',
+    };
+    const unreleased: Migration = {
+      name: '002-unreleased',
+      version: UNRELEASED,
+      description: 'Not yet shipped',
+      scriptPath: './002-unreleased.js',
+    };
+
+    it('should be up to date when the plugin is on the running version', () => {
+      expect(isUpToDate('5.0.0', '5.0.0', [released])).toBe(true);
+    });
+
+    it('should not be up to date when the plugin is behind the running version', () => {
+      expect(isUpToDate('4.0.0', '5.0.0', [released])).toBe(false);
+    });
+
+    it('should be up to date when the plugin is ahead of the running version', () => {
+      expect(isUpToDate('6.0.0', '5.0.0', [released, unreleased])).toBe(true);
+    });
+
+    it('should not be up to date on the running version when there are unreleased migrations', () => {
+      // Local and preview builds report the latest release version, so plugins already on it must still get
+      // unreleased migrations.
+      expect(isUpToDate('5.0.0', '5.0.0', [released, unreleased])).toBe(false);
+    });
   });
 
   describe('getMigrationsToRun', () => {
@@ -127,6 +163,64 @@ describe('Migrations', () => {
         'migration-key1',
       ]);
     });
+
+    it('should always include unreleased migrations', () => {
+      const migrations = getMigrationsToRun('5.1.0', '5.5.0', [
+        {
+          name: 'released',
+          version: '5.0.0',
+          description: 'Already applied to plugins at 5.1.0',
+          scriptPath: './released.js',
+        },
+        {
+          name: 'unreleased',
+          version: UNRELEASED,
+          description: 'Not yet shipped',
+          scriptPath: './unreleased.js',
+        },
+      ]);
+
+      expect(migrations.map((m) => m.name)).toEqual(['unreleased']);
+    });
+
+    it('should run unreleased migrations after released ones', () => {
+      const migrations = getMigrationsToRun('2.0.0', '6.0.0', [
+        {
+          name: 'unreleased',
+          version: UNRELEASED,
+          description: 'Not yet shipped',
+          scriptPath: './unreleased.js',
+        },
+        {
+          name: 'released',
+          version: '5.3.0',
+          description: 'Shipped in 5.3.0',
+          scriptPath: './released.js',
+        },
+      ]);
+
+      expect(migrations.map((m) => m.name)).toEqual(['released', 'unreleased']);
+    });
+
+    it('should keep declaration order for migrations with the same version', () => {
+      const names = ['012-a', '013-b', '014-c', '015-d', '016-e', '017-f'];
+      const unreleased = names.map((name) => ({
+        name,
+        version: UNRELEASED,
+        description: 'Not yet shipped',
+        scriptPath: `./${name}.js`,
+      }));
+      const released = {
+        name: '011-released',
+        version: '5.3.0',
+        description: 'Shipped in 5.3.0',
+        scriptPath: './011-released.js',
+      };
+
+      const migrations = getMigrationsToRun('2.0.0', '6.0.0', [released, ...unreleased]);
+
+      expect(migrations.map((m) => m.name)).toEqual(['011-released', ...names]);
+    });
   });
 
   describe('runMigrations', () => {
@@ -213,6 +307,17 @@ describe('Migrations', () => {
       expect(gitCommitNoVerify).toHaveBeenCalledTimes(2);
     });
 
+    it('should not create a version update commit when nothing changed', async () => {
+      // Re-running unreleased migrations on a plugin already on the running version leaves .cprc.json as it was.
+      migrationOneFn.mockImplementation(async (context: Context) => context);
+      migrationTwoFn.mockImplementation(async (context: Context) => context);
+      vi.mocked(isGitDirectoryClean).mockResolvedValue(true);
+
+      await runMigrations(migrations, { commitEachMigration: true });
+
+      expect(gitCommitNoVerify).not.toHaveBeenCalled();
+    });
+
     it('should update version in ".config/.cprc.json" on a successful update', async () => {
       await runMigrations(migrations);
 

package/src/codemods/migrations/manager.ts

@@ -1,10 +1,35 @@
 import defaultMigrations, { Migration } from './migrations.js';
 import { runCodemod } from '../runner.js';
-import { gte, satisfies } from 'semver';
+import { compare, eq, gt, satisfies } from 'semver';
 import { CURRENT_APP_VERSION } from '../../utils/utils.version.js';
-import { gitCommitNoVerify } from '../../utils/utils.git.js';
+import { gitCommitNoVerify, isGitDirectoryClean } from '../../utils/utils.git.js';
 import { output } from '../../utils/utils.console.js';
 import { setRootConfig } from '../../utils/utils.config.js';
+import { UNRELEASED } from '../../constants.js';
+
+// An unreleased migration has not shipped in any version a plugin can be on yet, so it resolves to the
+// version being updated to. That keeps it inside the range, and running it last.
+function resolveVersion(migration: Migration, toVersion: string): string {
+  return migration.version === UNRELEASED ? toVersion : migration.version;
+}
+
+// Local and preview builds report the latest release version, so a plugin already on it still needs its unreleased
+// migrations.
+export function isUpToDate(
+  fromVersion: string,
+  toVersion: string,
+  migrations: Migration[] = defaultMigrations
+): boolean {
+  if (gt(fromVersion, toVersion)) {
+    return true;
+  }
+
+  if (eq(fromVersion, toVersion)) {
+    return !migrations.some((migration) => migration.version === UNRELEASED);
+  }
+
+  return false;
+}
 
 export function getMigrationsToRun(
   fromVersion: string,
@@ -14,9 +39,9 @@ export function getMigrationsToRun(
   const semverRange = `${fromVersion} - ${toVersion}`;
 
   return migrations
-    .filter((meta) => satisfies(meta.version, semverRange))
+    .filter((meta) => satisfies(resolveVersion(meta, toVersion), semverRange))
     .sort((a, b) => {
-      return gte(a.version, b.version) ? 1 : -1;
+      return compare(resolveVersion(a, toVersion), resolveVersion(b, toVersion));
     });
 }
 
@@ -45,7 +70,8 @@ export async function runMigrations(migrations: Migration[], options: RunMigrati
 
   await setRootConfig({ version: CURRENT_APP_VERSION });
 
-  if (options.commitEachMigration) {
+  // Nothing to commit when only unreleased migrations re-ran on a plugin already on this version.
+  if (options.commitEachMigration && !(await isGitDirectoryClean())) {
     await gitCommitNoVerify(`chore: update .config/.cprc.json to version ${CURRENT_APP_VERSION}.`);
   }
 }

package/src/codemods/migrations/migrations.test.ts

@@ -1,6 +1,24 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { lte, valid } from 'semver';
 import defaultMigrations from './migrations.js';
+import { UNRELEASED } from '../../constants.js';
+
+const RELEASE_PLEASE_ANNOTATION = 'x-release-please-version';
+
+const packageVersion: string = JSON.parse(
+  readFileSync(new URL('../../../package.json', import.meta.url), 'utf-8')
+).version;
+
+// release-please rewrites the registry as text, so some rules can only be checked against the source.
+const registrySource = readFileSync(new URL('./migrations.ts', import.meta.url), 'utf-8');
+const versionLines = registrySource
+  .slice(registrySource.indexOf('export default ['))
+  .split('\n')
+  .filter((line) => /^\s*version:/.test(line));
+
+const releasedMigrations = defaultMigrations.filter((migration) => migration.version !== UNRELEASED);
 
 describe('migrations json', () => {
   // As migration scripts are imported dynamically when update is run we assert the path is valid
@@ -14,4 +32,67 @@ describe('migrations json', () => {
       expect(existsSync(sourceFilePath)).toBe(true);
     });
   });
+
+  it('should only use released versions that exist', () => {
+    // An invalid version never satisfies a range, so the migration would silently never run. A version above
+    // package.json has not been released yet, so the migration would stay dormant until it is.
+    releasedMigrations.forEach((migration) => {
+      expect(valid(migration.version), migration.name).not.toBeNull();
+      expect(lte(migration.version, packageVersion), `${migration.name} (${migration.version})`).toBe(true);
+    });
+  });
+
+  it('should order released versions ascending and list unreleased migrations last', () => {
+    releasedMigrations.slice(1).forEach((migration, index) => {
+      expect(lte(releasedMigrations[index].version, migration.version), migration.name).toBe(true);
+    });
+
+    const firstUnreleasedIndex = defaultMigrations.findIndex((migration) => migration.version === UNRELEASED);
+    const isUnreleasedLast =
+      firstUnreleasedIndex === -1 ||
+      defaultMigrations.slice(firstUnreleasedIndex).every((migration) => migration.version === UNRELEASED);
+    expect(isUnreleasedLast).toBe(true);
+  });
+
+  it('should number migrations sequentially and match their script names', () => {
+    defaultMigrations.forEach((migration, index) => {
+      const expectedPrefix = String(index + 1).padStart(3, '0');
+      expect(migration.name.startsWith(`${expectedPrefix}-`), migration.name).toBe(true);
+      expect(basename(fileURLToPath(migration.scriptPath), '.js')).toBe(migration.name);
+    });
+
+    const names = defaultMigrations.map((migration) => migration.name);
+    expect(new Set(names).size).toBe(names.length);
+  });
+
+  describe('release-please annotations', () => {
+    it('should find one version line per migration', () => {
+      expect(versionLines).toHaveLength(defaultMigrations.length);
+    });
+
+    it('should write unreleased versions as a literal release-please can rewrite', () => {
+      // release-please matches digits in the source text, so `version: UNRELEASED` would never be replaced.
+      versionLines.forEach((line) => {
+        expect(line).not.toMatch(/version:\s*UNRELEASED\b/);
+      });
+    });
+
+    it('should only use the annotation on migration version lines', () => {
+      // release-please rewrites any semver on an annotated line, including one inside a comment.
+      const annotatedLines = registrySource.split('\n').filter((line) => line.includes(RELEASE_PLEASE_ANNOTATION));
+      annotatedLines.forEach((line) => {
+        expect(line, line.trim()).toMatch(/^\s*version:/);
+      });
+    });
+
+    it('should annotate unreleased migrations and only those', () => {
+      // Without the annotation an unreleased migration is never frozen and re-runs on every release.
+      // A left-over annotation on a released migration would be re-stamped with the next release version.
+      versionLines.forEach((line, index) => {
+        const isUnreleased = line.includes(`'${UNRELEASED}'`);
+        const isAnnotated = line.includes(RELEASE_PLEASE_ANNOTATION);
+        expect(isAnnotated, `${defaultMigrations[index].name}: ${line.trim()}`).toBe(isUnreleased);
+      });
+    });
+  });
 });

package/src/codemods/migrations/migrations.ts

@@ -2,6 +2,7 @@ import { LEGACY_UPDATE_CUTOFF_VERSION } from '../../constants.js';
 import { Codemod } from '../types.js';
 
 export interface Migration extends Codemod {
+  /** The create-plugin release that shipped this migration, or UNRELEASED if it has not shipped yet. */
   version: string;
 }
 
@@ -91,6 +92,16 @@ export default [
       'Support @grafana/ui@13.2.0 in Jest by transforming @react-hookz/web and @ver0/deep-equal ESM dependencies.',
     scriptPath: import.meta.resolve('./scripts/013-jest-esmodules.js'),
   },
+  {
+    name: '014-eslint-config-v10',
+    version: '7.11.1',
+    description:
+      'Update @grafana/eslint-config to v10: drop the removed ./flat.js subpath import and swap @stylistic/eslint-plugin-ts for @stylistic/eslint-plugin.',
+    scriptPath: import.meta.resolve('./scripts/014-eslint-config-v10.js'),
+  },
   // Do not use LEGACY_UPDATE_CUTOFF_VERSION for new migrations. It is only used above to force migrations to run
   // for those written before the switch to updates as migrations.
+  //
+  // New migrations never pick a version: copy the unreleased version line from ../AGENTS.md exactly.
+  // Do not paste it into a comment in this file, as release-please rewrites every line that carries it.
 ] satisfies Migration[];

package/src/codemods/migrations/scripts/014-eslint-config-v10.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it } from 'vitest';
+import migrate from './014-eslint-config-v10.js';
+import { Context } from '../../context.js';
+
+const SCAFFOLD_ESLINT_CONFIG = `/*
+ * ⚠️⚠️⚠️ THIS FILE WAS SCAFFOLDED BY \`@grafana/create-plugin\`. DO NOT EDIT THIS FILE DIRECTLY. ⚠️⚠️⚠️
+ */
+
+import { defineConfig } from 'eslint/config';
+import grafanaConfig from '@grafana/eslint-config/flat.js';
+
+export default defineConfig([...grafanaConfig]);
+`;
+
+function addPackageJson(context: Context, eslintConfigVersion = '^9.0.0') {
+  context.addFile(
+    'package.json',
+    JSON.stringify({
+      devDependencies: {
+        '@grafana/eslint-config': eslintConfigVersion,
+        '@stylistic/eslint-plugin-ts': '^4.4.0',
+        'eslint-config-prettier': '^8.8.0',
+        'eslint-plugin-react-hooks': '^7.0.0',
+      },
+    })
+  );
+}
+
+describe('014-eslint-config-v10', () => {
+  it('should replace the removed flat.js subpath import', () => {
+    const context = new Context('/virtual');
+    context.addFile('.config/eslint.config.mjs', SCAFFOLD_ESLINT_CONFIG);
+    addPackageJson(context);
+
+    const result = migrate(context);
+    const content = result.getFile('.config/eslint.config.mjs') || '';
+
+    expect(content).toContain("import grafanaConfig from '@grafana/eslint-config';");
+    expect(content).not.toContain('@grafana/eslint-config/flat.js');
+    expect(content).toContain('DO NOT EDIT THIS FILE DIRECTLY');
+  });
+
+  it('should update package.json dependencies for eslint-config v10', () => {
+    const context = new Context('/virtual');
+    context.addFile('.config/eslint.config.mjs', SCAFFOLD_ESLINT_CONFIG);
+    addPackageJson(context);
+
+    const result = migrate(context);
+    const packageJson = JSON.parse(result.getFile('package.json') || '{}');
+
+    expect(packageJson.devDependencies['@grafana/eslint-config']).toBe('^10.0.0');
+    expect(packageJson.devDependencies['@stylistic/eslint-plugin']).toBe('^5.10.0');
+    expect(packageJson.devDependencies['@stylistic/eslint-plugin-ts']).toBeUndefined();
+    expect(packageJson.devDependencies['eslint-config-prettier']).toBe('^10.1.0');
+    expect(packageJson.devDependencies['eslint-plugin-react-hooks']).toBe('^7.1.0');
+  });
+
+  it('should not modify anything when package.json does not exist', () => {
+    const context = new Context('/virtual');
+
+    const result = migrate(context);
+
+    expect(result.hasChanges()).toBe(false);
+  });
+
+  it('should not modify anything when @grafana/eslint-config is already on v10', () => {
+    const context = new Context('/virtual');
+    context.addFile('.config/eslint.config.mjs', SCAFFOLD_ESLINT_CONFIG.replace('/flat.js', ''));
+    addPackageJson(context, '^10.0.0');
+
+    const initialChanges = context.listChanges();
+    migrate(context);
+
+    expect(context.listChanges()).toEqual(initialChanges);
+  });
+
+  it('should not modify anything when there are no devDependencies', () => {
+    const context = new Context('/virtual');
+    context.addFile('package.json', JSON.stringify({}));
+
+    const initialChanges = context.listChanges();
+    migrate(context);
+
+    expect(context.listChanges()).toEqual(initialChanges);
+  });
+
+  it('should be idempotent', async () => {
+    const context = new Context('/virtual');
+    context.addFile('.config/eslint.config.mjs', SCAFFOLD_ESLINT_CONFIG);
+    addPackageJson(context);
+
+    await expect(migrate).toBeIdempotent(context);
+  });
+});

package/src/codemods/migrations/scripts/014-eslint-config-v10.ts

@@ -0,0 +1,40 @@
+import type { Context } from '../../context.js';
+import { addDependenciesToPackageJson, isVersionGreater, removeDependenciesFromPackageJson } from '../../utils.js';
+
+const OLD_IMPORT = "import grafanaConfig from '@grafana/eslint-config/flat.js';";
+const NEW_IMPORT = "import grafanaConfig from '@grafana/eslint-config';";
+const ESLINT_CONFIG_PATH = '.config/eslint.config.mjs';
+
+export default function migrate(context: Context) {
+  if (!context.doesFileExist('package.json')) {
+    return context;
+  }
+
+  const packageJson = JSON.parse(context.getFile('package.json') || '{}');
+  const currentVersion = packageJson.devDependencies?.['@grafana/eslint-config'];
+
+  if (!currentVersion || !isVersionGreater('^10.0.0', currentVersion)) {
+    return context;
+  }
+
+  if (context.doesFileExist(ESLINT_CONFIG_PATH)) {
+    const content = context.getFile(ESLINT_CONFIG_PATH) || '';
+    if (content.includes(OLD_IMPORT)) {
+      context.updateFile(ESLINT_CONFIG_PATH, content.replace(OLD_IMPORT, NEW_IMPORT));
+    }
+  }
+
+  addDependenciesToPackageJson(
+    context,
+    {},
+    {
+      '@grafana/eslint-config': '^10.0.0',
+      '@stylistic/eslint-plugin': '^5.10.0',
+      'eslint-config-prettier': '^10.1.0',
+      'eslint-plugin-react-hooks': '^7.1.0',
+    }
+  );
+  removeDependenciesFromPackageJson(context, [], ['@stylistic/eslint-plugin-ts']);
+
+  return context;
+}

package/src/commands/update.command.ts

@@ -1,10 +1,10 @@
-import { getMigrationsToRun, runMigrations } from '../codemods/migrations/manager.js';
+import { getMigrationsToRun, isUpToDate, runMigrations } from '../codemods/migrations/manager.js';
 import {
   getPackageManagerExecCmd,
   getPackageManagerSilentInstallCmd,
   getPackageManagerWithFallback,
 } from '../utils/utils.packageManager.js';
-import { gte, lt } from 'semver';
+import { lt } from 'semver';
 import { performPreCodemodChecks } from '../utils/utils.checks.js';
 
 import { CURRENT_APP_VERSION } from '../utils/utils.version.js';
@@ -23,7 +23,7 @@ export const update = async (argv: minimist.ParsedArgs) => {
   }
 
   try {
-    if (gte(version, CURRENT_APP_VERSION)) {
+    if (isUpToDate(version, CURRENT_APP_VERSION)) {
       output.log({
         title: 'Nothing to update, exiting.',
       });

package/src/constants.ts

@@ -42,6 +42,12 @@ export enum PLUGIN_TYPES {
 // Plugins >= 5.27.1 use the new migration-based update system.
 export const LEGACY_UPDATE_CUTOFF_VERSION = '5.27.1';
 
+// Version placeholder for a migration that has not been released yet. It resolves to the running
+// create-plugin version, so the migration runs in local dev, CI and preview builds. release-please
+// replaces it with the released version (see `extra-files` in release-please-config.json).
+// Must stay semver-shaped: release-please only rewrites strings that look like a version.
+export const UNRELEASED = '0.0.0-unreleased';
+
 // This gets merged into variables coming from user prompts (when scaffolding) or any other dynamic variables,
 // and will be available to use in the templates.
 export const EXTRA_TEMPLATE_VARIABLES = {

package/src/utils/utils.templates.ts

@@ -121,7 +121,7 @@ export function getTemplateData(cliArgs?: GenerateCliArgs): TemplateData {
       isNPM: isNPM(packageManagerName),
       version: currentVersion,
       bundleGrafanaUI,
-      scenesVersion: '^7.0.0',
+      scenesVersion: '^8.17.0',
       useExperimentalRspack: Boolean(features.useExperimentalRspack),
       frontendBundler,
     };
@@ -145,7 +145,7 @@ export function getTemplateData(cliArgs?: GenerateCliArgs): TemplateData {
       isNPM: isNPM(packageManagerName),
       version: currentVersion,
       bundleGrafanaUI,
-      scenesVersion: '^7.0.0',
+      scenesVersion: '^8.17.0',
       pluginExecutable: pluginJson.executable,
       useExperimentalRspack: Boolean(features.useExperimentalRspack),
       frontendBundler,

package/templates/app/README.md

@@ -18,5 +18,5 @@ App plugins can let you create a custom out-of-the-box monitoring experience by
 Below you can find source code for existing app plugins and other related documentation.
 
 - [Basic app plugin example](https://github.com/grafana/grafana-plugin-examples/tree/master/examples/app-basic#readme)
-- [`plugin.json` documentation](https://grafana.com/developers/plugin-tools/reference/plugin-jsonplugin-json)
+- [`plugin.json` documentation](https://grafana.com/developers/plugin-tools/reference/plugin-json)
 - [Sign a plugin](https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin)

package/templates/app/src/plugin.json

@@ -58,7 +58,7 @@
     }
   ],
   "dependencies": {
-    "grafanaDependency": ">=12.3.0",
+    "grafanaDependency": ">=13.2.0",
     "plugins": []
   }
 }

package/templates/app-sdk/.config/AGENTS/app-sdk.md

@@ -22,8 +22,8 @@ TypeScript types and an app manifest that Grafana reads from the plugin bundle.
   ```
 - **Generated code is committed.** Commit the regenerated files alongside the CUE change so schema
   changes are reviewable and a fresh clone builds without running code generation.
-- **This plugin generates no Go code.** `kinds/config.cue` sets `codegen: goEnabled: false`, so
-  generation emits only TypeScript and the JSON definitions. Do not add Go output paths or a Go
+- **Go code generation follows `kinds/config.cue`'s `codegen.goEnabled` setting.** If it's `false`,
+  generation emits only TypeScript and the JSON definitions — don't add Go output paths or a Go
   backend to work around a generation problem.
 - **Do not set `GRAFANA_APP_SDK_BIN`.** It overrides the pinned CLI with a local build, and is meant
   for people working on the app-sdk itself. Code generated with it can differ from what `VERSION` in
@@ -31,6 +31,18 @@ TypeScript types and an app manifest that Grafana reads from the plugin bundle.
   `generate:kinds` without it.
 - **Do not add code generation to the build.** It is a schema-change-time step, not a build step. The
   frontend build must keep working without a Go toolchain.
+- **Never write authorization/permission checks in app code.** Access is declared in the manifest and
+  enforced by Grafana's API server, not by this plugin.
+- **A `Namespaced` kind is folder-scoped by default:** callers need the Stack Role *and* folder access,
+  and every write must set the `grafana.app/folder` annotation to a real folder the caller can access —
+  this applies to anything your backend writes on a user's behalf too. Set `folderScoped: false` on the
+  kind if it shouldn't be gated by folders (writes then skip the annotation).
+- **Every role needs a `roleBindings` entry to be granted to anyone.** Defining a role in
+  `kinds/manifest.cue` without binding it to a basic role (`viewer`/`editor`/`admin`) leaves it unused.
+- **Set `appDisplayName` in `kinds/manifest.cue`** so the app's roles show a readable name in Grafana's
+  role picker, instead of the raw `appName`.
+- **`admin` currently grants the same actions as `editor`.** Don't design a feature assuming admin has
+  extra permissions today.
 
 ## Layout
 
@@ -83,5 +95,5 @@ Resources are served under a Kubernetes-style path:
 The namespace is deployment-dependent — `default` on single-tenant Grafana, `stacks-<id>` on Grafana
 Cloud. Read it from `config.namespace` in `@grafana/runtime`; never hardcode it.
 
-This plugin has no Go backend, and does not need one for storage or CRUD. Admission (validation and
-mutation), conversion between versions, and custom routes would require adding one.
+No backend is needed for storage or CRUD — that comes from the manifest alone. Admission (validation
+and mutation), conversion between versions, and custom routes require a backend.

package/templates/app-sdk/.config/app-sdk/README.md

@@ -58,3 +58,69 @@ be required for:
 - Controller logic (informers, watchers, or any other background work)
 
 If this plugin has a backend, `pkg/provider/provider.go` is where you wire those up as your app grows.
+
+## Authorization & RBAC
+
+You don't write permission checks in code. You declare roles and scoping in the manifest, and Grafana's
+aggregated API server enforces them for every caller (kubectl, Terraform, generated clients, your
+frontend). This only applies to requests from users (UI, Service Account tokens) — requests from a
+Service Identity (another internal operator) are less strict.
+
+### Folder scoping
+
+Namespaced kinds (set in `kinds/*.cue`, see `example.cue`) are **folder-scoped by default**. Access
+requires *both* the right Stack Role (see below) *and* folder access on the resource's
+`grafana.app/folder`. If your kind's data doesn't belong in folders, opt out with
+`folderScoped: false` — access then comes down to the Stack Role alone, and adding a folder annotation
+to a request is rejected.
+
+```cue
+examplev1alpha1: exampleKind & {
+    // Opt this kind out of folder-scoped access.
+    folderScoped: false
+    schema: {
+        spec: {
+            title:       string
+            description: string
+        }
+    }
+}
+```
+
+### Roles and role bindings
+
+Declare custom roles in `kinds/manifest.cue`. A role name follows `<app>:<role>` and grants one of three
+tiers — `viewer` (read), `editor` (read + write), or `admin` (currently identical to `editor` — don't
+design around admin having extra powers yet). Role bindings attach your app's roles to Grafana's basic
+roles (`viewer`, `editor`, `admin`), so every Grafana user inherits the matching app role automatically.
+Set `appDisplayName` so your app shows up with a readable name in the Grafana UI's role picker, instead
+of the raw `appName`.
+
+```cue
+manifest: {
+    appName: "{{ pluginId }}"
+    appDisplayName: "{{ pluginId }}"
+    versions: {
+        "v1alpha1": v1alpha1
+    }
+    extraPermissions: {
+        accessKinds: []
+    }
+    // roles your app grants, and which Grafana basic role gets each one by default.
+    roles: [
+        {
+            name: "{{ pluginId }}:editor"
+            permissionSet: "editor"
+        },
+    ]
+    roleBindings: [
+        {
+            roleName: "{{ pluginId }}:editor"
+            basicRole: "editor"
+        },
+    ]
+}
+```
+
+Without a `roleBindings` entry, a role you define is never granted to anyone — add one for every role you
+want users to actually have.

package/templates/app-sdk/.config/app-sdk/generate-kinds.mjs

@@ -21,7 +21,7 @@ import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs
 import { join, resolve } from 'node:path';
 import { arch, platform, tmpdir } from 'node:os';
 
-const VERSION = 'v0.60.0';
+const VERSION = 'v0.60.3';
 const REPO = 'grafana/grafana-app-sdk';
 const BIN = 'grafana-app-sdk';
 

package/templates/app-sdk/.github/workflows/generate-kinds-drift.yml

@@ -36,7 +36,7 @@ jobs:
 {{#if_eq packageManagerName "pnpm"}}
       # pnpm action uses the packageManager field in package.json to
       # understand which version to install.
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 {{/if_eq}}
       - name: Setup Node.js environment
         uses: actions/setup-node@v6
@@ -62,7 +62,7 @@ jobs:
         run: {{ packageManagerInstallCmd }}
 
       - name: Cache grafana-app-sdk CLI
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: node_modules/.cache/grafana-app-sdk
           key: grafana-app-sdk-cli-${{ '{{' }} hashFiles('.config/app-sdk/generate-kinds.mjs') {{ '}}' }}

package/templates/app-sdk/kinds/example.cue

@@ -7,6 +7,9 @@ exampleKind: {
 	pluralName: "Examples"
 	// Namespaced resources are created per-tenant. Use "Cluster" for global resources.
 	scope: "Namespaced"
+	// Namespaced kinds are folder-scoped by default: callers need both the Stack Role (see roles in
+	// manifest.cue) and folder access. Uncomment to opt this kind out of folder scoping.
+	// folderScoped: false
 	codegen: {
 		ts: {
 			enabled: true

package/templates/app-sdk/kinds/manifest.cue

@@ -7,6 +7,10 @@ manifest: {
 	// different group.
 	appName: "{{ pluginId }}"
 
+	// appDisplayName is the human-readable name shown for your app's roles in Grafana's role picker.
+	// Set it to something more readable than appName.
+	appDisplayName: "{{ pluginId }}"
+
 	// versions maps each version your app serves to the kinds it exposes. Version names follow the
 	// format "v<integer>" or "v<integer>(alpha|beta)<integer>".
 	versions: {
@@ -18,6 +22,26 @@ manifest: {
 	extraPermissions: {
 		accessKinds: []
 	}
+
+	// roles declares custom RBAC roles for your app. Each role name follows "<app>:<role>" and grants
+	// one of three tiers: "viewer" (read), "editor" (read + write), or "admin" (currently identical
+	// to "editor"). A role you define here is never granted to anyone without a matching entry in
+	// roleBindings below.
+	// roles: [
+	// 	{
+	// 		name:          "{{ pluginId }}:editor"
+	// 		permissionSet: "editor"
+	// 	},
+	// ]
+
+	// roleBindings attaches your app's roles to Grafana's basic roles (viewer/editor/admin), so every
+	// Grafana user with that basic role automatically inherits the matching app role.
+	// roleBindings: [
+	// 	{
+	// 		roleName:  "{{ pluginId }}:editor"
+	// 		basicRole: "editor"
+	// 	},
+	// ]
 }
 
 // v1alpha1 is the v1alpha1 version of the app's API.

package/templates/app-sdk/pkg/provider/provider.go

@@ -2,6 +2,7 @@ package provider
 
 import (
 	"github.com/grafana/grafana-app-sdk/app"
+	"github.com/grafana/grafana-app-sdk/plugin"
 	"github.com/grafana/grafana-app-sdk/simple"
 
 	examplev1alpha1 "github.com/{{ kebabCase orgName }}/{{ kebabCase pluginName }}/pkg/generated/example/v1alpha1"
@@ -18,9 +19,12 @@ func New() app.Provider {
 // config. Attach a Validator, Mutator, or Reconciler per kind as you need one — see
 // simple.AppManagedKind and ./.config/AGENTS/app-sdk.md.
 func newApp(cfg app.Config) (app.App, error) {
+	// The client generator creates clients for interacting with resources.
+	clientGenerator := plugin.BuildClientGenerator(cfg.KubeConfig)
+
 	return simple.NewApp(simple.AppConfig{
-		Name:       "{{ pluginId }}",
-		KubeConfig: cfg.KubeConfig,
+		Name:            "{{ pluginId }}",
+		ClientGenerator: clientGenerator,
 		ManagedKinds: []simple.AppManagedKind{
 			{
 				Kind: examplev1alpha1.Kind(),

package/templates/common/.config/docker-compose-base.yaml

@@ -7,7 +7,7 @@ services:
       context: .
       args:
         grafana_image: ${GRAFANA_IMAGE:-{{~grafanaImage~}} }
-        grafana_version: ${GRAFANA_VERSION:-13.1.0}
+        grafana_version: ${GRAFANA_VERSION:-13.2.2}
         development: ${DEVELOPMENT:-false}
         anonymous_auth_enabled: ${ANONYMOUS_AUTH_ENABLED:-true}
     ports:

package/templates/common/.config/eslint.config.mjs

@@ -6,7 +6,7 @@
  */
 
 import { defineConfig } from 'eslint/config';
-import grafanaConfig from '@grafana/eslint-config/flat.js';
+import grafanaConfig from '@grafana/eslint-config';
 
 export default defineConfig([
   ...grafanaConfig,

package/templates/common/.config/jest-setup.js

@@ -7,8 +7,10 @@
 
 import '@testing-library/jest-dom';
 import { TextEncoder, TextDecoder } from 'util';
+import { MessageChannel, MessagePort } from 'worker_threads';
 
-Object.assign(global, { TextDecoder, TextEncoder });
+// React 19's scheduler relies on MessageChannel, which jsdom does not implement.
+Object.assign(global, { TextDecoder, TextEncoder, MessageChannel, MessagePort });
 
 // https://jestjs.io/docs/manual-mocks#mocking-methods-which-are-not-implemented-in-jsdom
 Object.defineProperty(global, 'matchMedia', {

package/templates/common/_package.json

@@ -16,14 +16,14 @@
   "author": "{{ sentenceCase orgName }}",
   "license": "Apache-2.0",
   "devDependencies": {
-    "@grafana/eslint-config": "^9.0.0",
-    "@grafana/plugin-e2e": "^3.12.0",
+    "@grafana/eslint-config": "^10.0.0",
+    "@grafana/plugin-e2e": "^3.14.0",
     "@grafana/sign-plugin": "^3.3.3",
     "@grafana/tsconfig": "^2.2.0",
     "@playwright/test": "^1.62.1",{{#if useExperimentalRspack}}
     "@rspack/core": "^1.6.0",
     "@rspack/cli": "^1.6.0",{{/if}}
-    "@stylistic/eslint-plugin-ts": "^4.4.0",
+    "@stylistic/eslint-plugin": "^5.10.0",
     "@swc/core": "^1.15.0",
     "@swc/helpers": "^0.5.0",
     "@swc/jest": "^0.2.0",
@@ -31,8 +31,8 @@
     "@testing-library/react": "^16.3.0",
     "@types/jest": "^29.5.0",
     "@types/node": "^24.0.0",
-    "@types/react": "^18.3.0",
-    "@types/react-dom": "^18.3.0",{{#if useExperimentalRspack}}
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",{{#if useExperimentalRspack}}
     "@types/ws": "^8.18.1",{{/if}}
     "@typescript-eslint/eslint-plugin": "^8.38.0",
     "@typescript-eslint/parser": "^8.38.0",{{#unless useExperimentalRspack}}
@@ -42,7 +42,7 @@
     "eslint-config-prettier": "^10.1.0",
     "eslint-plugin-jsdoc": "^52.0.0",
     "eslint-plugin-react": "^7.37.0",
-    "eslint-plugin-react-hooks": "^7.0.0",
+    "eslint-plugin-react-hooks": "^7.1.0",
     "eslint-webpack-plugin": "^5.0.0",{{#unless useExperimentalRspack}}
     "fork-ts-checker-webpack-plugin": "^9.1.0",{{/unless}}
     "glob": "^11.1.0",
@@ -74,14 +74,14 @@
   },
   "dependencies": {
     "@emotion/css": "11.10.6",
-    "@grafana/data": "13.1.0",
-    "@grafana/i18n": "13.1.0",
-    "@grafana/runtime": "13.1.0",
-    "@grafana/ui": "13.1.0",
-    "@grafana/schema": "13.1.0",{{#if_eq pluginType "scenesapp" }}
+    "@grafana/data": "13.2.2",
+    "@grafana/i18n": "13.2.2",
+    "@grafana/runtime": "13.2.2",
+    "@grafana/ui": "13.2.2",
+    "@grafana/schema": "13.2.2",{{#if_eq pluginType "scenesapp" }}
     "@grafana/scenes": "{{ scenesVersion }}",{{/if_eq}}
-    "react": "^18.3.0",
-    "react-dom": "^18.3.0"{{#if isAppType}},
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"{{#if isAppType}},
     "react-router-dom": "^6.22.0",
     "rxjs": "7.8.2"{{/if}}
   },

package/templates/datasource/src/plugin.json

@@ -22,7 +22,7 @@
     "updated": "%TODAY%"
   },
   "dependencies": {
-    "grafanaDependency": ">=12.3.0",
+    "grafanaDependency": ">=13.2.0",
     "plugins": []
   }
 }

package/templates/panel/src/plugin.json

@@ -19,7 +19,7 @@
     "updated": "%TODAY%"
   },
   "dependencies": {
-    "grafanaDependency": ">=12.3.0",
+    "grafanaDependency": ">=13.2.0",
     "plugins": []
   }
 }

package/templates/scenes-app/src/plugin.json

@@ -52,7 +52,7 @@
     }
   ],
   "dependencies": {
-    "grafanaDependency": ">=12.3.0",
+    "grafanaDependency": ">=13.2.0",
     "plugins": []
   }
 }