SUSE-SU-2025:0524-1

This update fixes the following issues:

golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):

• Security issues fixed:

  • CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error handling (bsc#1232970)

• Highlights of other changes:

  • Performance:
    • Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and remote write operations.
    • Default GOGC value lowered to 75 for better memory management.
    • Option to limit memory usage from dropped targets added.
  • New Features:
    • Experimental OpenTelemetry ingestion.
    • Automatic memory limit handling.
    • Native histogram support, including new functions, UI enhancements, and improved scraping.
    • Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.
    • Expanded service discovery options with added metadata and support for new services.
    • New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.
  • Bug Fixes:
    • Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.
  • For a detailed list of changes consult the package changelog or https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3

golang-github-prometheus-promu was updated to version 0.17.0:

• Added codesign utility function

grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

• Security issues fixed:
  • CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading golang.org/x/crypto (bsc#1234554)
  • CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
  • CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
  • CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
  • CVE-2024-8118: Fixed permission on external alerting rule write endpoint...