Bumps [dompurify](https://github.com/cure53/DOMPurify) from 2.5.6 to 3.2.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.2.4</h2> <ul> <li>Fixed a conditional and config dependent mXSS-style <a href="https://nsysean.github.io/posts/dompurify-323-bypass/">bypass</a> reported by <a href="https://github.com/nsysean"><code>@nsysean</code></a></li> <li>Added a new feature to allow specific hook removal, thanks <a href="https://github.com/davecardwell"><code>@davecardwell</code></a></li> <li>Added <em>purify.js</em> and <em>purify.min.js</em> to exports, thanks <a href="https://github.com/Aetherinox"><code>@Aetherinox</code></a></li> <li>Added better logic in case no window object is president, thanks <a href="https://github.com/yehuya"><code>@yehuya</code></a></li> <li>Updated some dependencies called out by dependabot</li> <li>Updated license files etc to show the correct year</li> </ul> <h2>DOMPurify 3.2.3</h2> <ul> <li>Fixed two conditional sanitizer bypasses discovered by <a href="https://github.com/parrot409"><code>@parrot409</code></a> and <a href="https://x.com/slonser_"><code>@Slonser</code></a></li> <li>Updated the attribute clobbering checks to prevent future bypasses, thanks <a href="https://github.com/parrot409"><code>@parrot409</code></a></li> </ul> <h2>DOMPurify 3.2.2</h2> <ul> <li>Fixed a possible bypass in case a rather specific config for custom elements is set, thanks <a href="https://github.com/yaniv-git"><code>@yaniv-git</code></a></li> <li>Fixed several minor issues with the type definitions, thanks again <a href="https://github.com/reduckted"><code>@reduckted</code></a></li> <li>Fixed a minor issue with the types reference for trusted types, thanks <a href="https://github.com/reduckted"><code>@reduckted</code></a></li> <li>Fixed a minor problem with the template detection regex on some systems, thanks <a href="https://github.com/svdb99"><code>@svdb99</code></a></li> </ul> <h2>DOMPurify 3.2.1</h2> <ul> <li>Fixed several minor issues with the type definitions, thanks <a href="https://github.com/reduckted"><code>@reduckted</code></a> <a href="https://github.com/ghiscoding"><code>@ghiscoding</code></a> <a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a> <a href="https://github.com/MiniDigger"><code>@MiniDigger</code></a></li> <li>Fixed an issue with non-minified dist files and order of imports, thanks <a href="https://github.com/reduckted"><code>@reduckted</code></a></li> </ul> <h2>DOMPurify 3.2.0</h2> <ul> <li>Added type declarations, thanks <a href="https://github.com/reduckted"><code>@reduckted</code></a> , <a href="https://github.com/philmayfield"><code>@philmayfield</code></a>, <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>, <a href="https://github.com/ssi02014"><code>@ssi02014</code></a> and others</li> <li>Fixed a minor issue with the handling of hooks, thanks <a href="https://github.com/kevin-mizu"><code>@kevin-mizu</code></a></li> </ul> <h2>DOMPurify 3.1.7</h2> <ul> <li>Fixed an issue with comment detection and possible bypasses with specific config settings, thanks <a href="https://github.com/masatokinugawa"><code>@masatokinugawa</code></a></li> <li>Fixed several smaller typos in documentation and test & build files, thanks <a href="https://github.com/christianhg"><code>@christianhg</code></a></li> <li>Added better support for Angular compiler, thanks <a href="https://github.com/jeroen1602"><code>@jeroen1602</code></a></li> <li>Added several new attributes to HTML and SVG allow-list, thanks <a href="https://github.com/Gigabyte5671"><code>@Gigabyte5671</code></a> and <a href="https://github.com/Rotzbua"><code>@Rotzbua</code></a></li> <li>Removed the <code>foreignObject</code> element from the list of HTML entry-points, thanks <a href="https://github.com/masatokinugawa"><code>@masatokinugawa</code></a></li> <li>Bumped several dependencies to be more up to date</li> </ul> <h2>DOMPurify 3.1.6</h2> <ul> <li>Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks <a href="https://github.com/kevin-mizu"><code>@kevin-mizu</code></a></li> <li>Fixed an issue with element removal leading to uncaught errors through DOM Clobbering, thanks <a href="https://github.com/realansgar"><code>@realansgar</code></a></li> <li>Fixed a minor problem with the bower file pointing to the wrong dist path</li> <li>Fixed several minor typos in docs, comments and comment blocks, thanks <a href="https://github.com/Rotzbua"><code>@Rotzbua</code></a></li> <li>Updated several development dependencies</li> </ul> <h2>DOMPurify 3.1.5</h2> <ul> <li>Fixed a minor issue with the dist paths in <code>bower.js</code>, thanks <a href="https://github.com/HakumenNC"><code>@HakumenNC</code></a></li> <li>Fixed a minor issue with sanitizing HTML coming from copy&paste Word content, thanks <a href="https://github.com/kakao-bishop-cho"><code>@kakao-bishop-cho</code></a></li> </ul> <h2>DOMPurify 3.1.4</h2> <ul> <li>Fixed an issue with the recently implemented <code>isNaN</code> checks, thanks <a href="https://github.com/tulach"><code>@tulach</code></a></li> <li>Added several new popover attributes to allow-list, thanks <a href="https://github.com/Gigabyte5671"><code>@Gigabyte5671</code></a></li> <li>Fixed the tests and adjusted the test runner to cover all branches</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|---|---|---|
| .github | ||
| .tilt | ||
| dev | ||
| docs | ||
| engine | ||
| grafana-plugin | ||
| helm | ||
| terraform | ||
| tools | ||
| .dockerignore | ||
| .gitattributes | ||
| .gitignore | ||
| .markdownlint.json | ||
| .markdownlintignore | ||
| .nvmrc | ||
| .pre-commit-config.yaml | ||
| .prettierignore | ||
| .prettierrc.js | ||
| .yamllint.yml | ||
| CHANGELOG.md | ||
| docker-compose-developer.yml | ||
| docker-compose-mysql-rabbitmq.yml | ||
| docker-compose.yml | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| Tiltfile | ||
Grafana OnCall
Developer-friendly incident response with brilliant Slack integration.
![]() |
- Collect and analyze alerts from multiple monitoring systems
- On-call rotations based on schedules
- Automatic escalations
- Phone calls, SMS, Slack, Telegram notifications
Getting Started
Important
These instructions are for using Grafana 11 or newer. You must enable the feature toggle for
externalServiceAccounts. This is already done for the docker files and helm charts. If you are running Grafana separately see the Grafana documentation on how to enable this.
We prepared multiple environments:
- production
- developer
- hobby (described in the following steps)
-
Download
docker-compose.yml:curl -fsSL https://raw.githubusercontent.com/grafana/oncall/dev/docker-compose.yml -o docker-compose.yml -
Set variables:
echo "DOMAIN=http://localhost:8080 # Remove 'with_grafana' below if you want to use existing grafana # Add 'with_prometheus' below to optionally enable a local prometheus for oncall metrics # e.g. COMPOSE_PROFILES=with_grafana,with_prometheus COMPOSE_PROFILES=with_grafana # to setup an auth token for prometheus exporter metrics: # PROMETHEUS_EXPORTER_SECRET=my_random_prometheus_secret # also, make sure to enable the /metrics endpoint: # FEATURE_PROMETHEUS_EXPORTER_ENABLED=True SECRET_KEY=my_random_secret_must_be_more_than_32_characters_long" > .env -
(Optional) If you want to enable/setup the prometheus metrics exporter (besides the changes above), create a
prometheus.ymlfile (replacingmy_random_prometheus_secretaccordingly), next to yourdocker-compose.yml:echo "global: scrape_interval: 15s evaluation_interval: 15s scrape_configs: - job_name: prometheus metrics_path: /metrics/ authorization: credentials: my_random_prometheus_secret static_configs: - targets: [\"host.docker.internal:8080\"]" > prometheus.ymlNOTE: you will need to setup a Prometheus datasource using
http://prometheus:9090as the URL in the Grafana UI. -
Launch services:
docker-compose pull && docker-compose up -d -
Provision the plugin (If you run Grafana outside the included docker files install the plugin before these steps):
If you are using the included docker compose file use
admin/admincredentials andlocalhost:3000to perform this task. If you have configured Grafana differently adjust your credentials and hostnames accordingly.# Note: onCallApiUrl 'engine' and grafanaUrl 'grafana' use the name from the docker compose file. If you are # running your grafana or oncall engine instance with another hostname adjust accordingly. curl -X POST 'http://admin:admin@localhost:3000/api/plugins/grafana-oncall-app/settings' -H "Content-Type: application/json" -d '{"enabled":true, "jsonData":{"stackId":5, "orgId":100, "onCallApiUrl":"http://engine:8080", "grafanaUrl":"http://grafana:3000"}}' curl -X POST 'http://admin:admin@localhost:3000/api/plugins/grafana-oncall-app/resources/plugin/install' -
Start using OnCall, log in to Grafana with credentials as defined above:
admin/admin -
Enjoy! Check our OSS docs if you want to set up Slack, Telegram, Twilio or SMS/calls through Grafana Cloud.
Troubleshooting
Here are some API calls that can be made to help if you are having difficulty connecting Grafana and OnCall. (Modify parameters to match your credentials and environment)
# Use this to get more information about the connection between Grafana and OnCall
curl -X GET 'http://admin:admin@localhost:3000/api/plugins/grafana-oncall-app/resources/plugin/status'
# If you added a user or changed permissions and don't see it show up in OnCall you can manually trigger sync.
# Note: This is called automatically when the app is loaded (page load/refresh) but there is a 5 min timeout so
# that it does not generate unnecessary activity.
curl -X POST 'http://admin:admin@localhost:3000/api/plugins/grafana-oncall-app/resources/plugin/sync'
Update version
To update your Grafana OnCall hobby environment:
# Update Docker image
docker-compose pull engine
# Re-deploy
docker-compose up -d
After updating the engine, you'll also need to click the "Update" button on the plugin version page. See Grafana docs for more info on updating Grafana plugins.
Join community
Have a question, comment or feedback? Don't be afraid to open an issue!
Stargazers over time
Further Reading
- Automated migration from other on-call tools - Migrator
- Documentation - Grafana OnCall
- Overview Webinar - YouTube
- How To Add Integration - How to Add Integration
- Blog Post - Announcing Grafana OnCall, the easiest way to do on-call management
- Presentation - Deep dive into the Grafana, Prometheus, and Alertmanager stack for alerting and on-call management



