SUSE-SU-2026:2763-1

Description of the patch:

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Security issue fixed:
  • CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter (bsc#1248699)

golang-github-lusitaniae-apache_exporter:

• Non customer facing changes

golang-github-prometheus-node_exporter updated to version 1.10.2:

• Security issues fixed:

  • CVE-2025-22870: Fixed potential proxy bypass using IPv6 zone IDs (v1.9.1) (bsc#1238686)
  • CVE-2023-45288: Close connections when receiving too many headers (v1.9.0) (bsc#1236516)

• Highlights of other changes and bug fixes:

  • Backward Compatibility and packaging changes:
    • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
    • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility
  • Version 1.10.2:
    • Fixed typo in Zswap metric name (meminfo)
  • Version 1.10.1:
    • Fixed mount points being collected multiple times (filesystem)
    • Refactored mountinfo parsing (bsc#1261810)
    • Added Zswap/Zswapped metrics (meminfo)
  • Version 1.10.0:
    • New collectors: PCIe devices, swaps
    • Added systemd virtualization metrics, AIX metrics
    • WiFi packet metrics, additional PCIe and TLB metrics
    • Changed mdadm to use sysfs, added erofs to excluded filesystems
    • Fixed bugs: cpufreq collector, ethtool metrics
  • Version 1.9.1:
    • Fixed missing IRQ on older kernels (pressure)
  • Version 1.9.0 (jsc#PED-12485):
    • Switched to Go log/slog for logging
    • Converted meminfo to use procfs library
    • New features: filesystem mount info, Btrfs commit stats, interrupt filtering, slabinfo filters, IRQ PSI metrics, hwmon filtering, network interface alias labels, GPU clock frequencies, AIX support,
    • Enhancements: TCP receive queue drop, block device rotational status, CPU online status, performance optimizations
    • Fixed: ZFS integer underflow, CPU pressure on...