update to 9.0.9 tagged upstream community sources, see CHANGELOG
resolve CVE-2022-35957 grafana: Escalation from admin to server admin when auth proxy is used (rhbz#2128565)

update to 9.0.8 tagged upstream community sources, see CHANGELOG
do not list /usr/share/grafana/conf twice
drop makefile in favor of create_bundles.sh script
sync provides/obsoletes with CentOS versions
drop husky patch

update to 9.0.5 tagged upstream community sources, see CHANGELOG (rhbz#2107413)
run integration tests in check phase
remove conditional around go-rpm-macros
resolve CVE-2022-31107 grafana: OAuth account takeover (rhbz#2107435)
resolve CVE-2022-31097 grafana: stored XSS vulnerability (rhbz#2107436)

Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

fix quoting in grafana-cli wrapper script (rhbz#2107046)

use systemd-sysusers to create the Grafana user and group

update to 9.0.2 tagged upstream community sources, see CHANGELOG

update to 8.5.6 tagged upstream community sources, see CHANGELOG
updated license to AGPLv3
place commented sample config file in /etc/grafana/grafana.ini
enable Go modules in build process
adapt Node.js bundling to yarn v3 and Zero Install feature

Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
2022-29526, CVE-2022-30629

use clamp-mtime when generating the vendor and webpack tarballs,
round tarball mtime timestamp to midnight, to match SOURCE_DATE_EPOCH

update to 7.5.15 tagged upstream community sources, see CHANGELOG
resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
resolve CVE-2021-23648 sanitize-url: XSS
resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
declare Node.js dependencies of subpackages
make vendor and webpack tarballs reproducible

update to 7.5.13 tagged upstream community sources, see CHANGELOG
support Go 1.18

Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

use HMAC-SHA-256 instead of SHA-1 to generate password reset tokens
update FIPS tests in check phase

resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache

update to 7.5.11 tagged upstream community sources, see CHANGELOG
resolve CVE-2021-39226