SUSE-SU-2025:01987-1

Description of the patch:

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

• Security issues fixed:

  • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
  • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

• Other bugs fixes from version 2.53.4:

  • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
  • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

• Security issues fixed:

  • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
  • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

• Other changes from version 0.26.0:

  • Changes:
    • Replace go-kit/log with log/slog module.
  • Features:
    • Add metric to record tls ciphersuite negotiated during handshake.
    • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  • Enhancement:
    • Add stale workflow to start sync with stale.yaml in Prometheus.
  • Bug fixes:
    • Only register grpc TLS metrics on successful handshake.

• Other changes from version 0.25.0:

  • Features:
    • Allow to get Probe logs by target.
    • Log errors from probe.
  • Bug fixes:
    • Prevent logging confusing error message.
    • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:
  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683). *...