Security update for golang-github-prometheus-prometheus
This update for golang-github-prometheus-prometheus fixes the following issues:
- Security issues fixed:
* CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
* CVE-2025-22870: Bump golang.org/x/net to version 0.39.0 (bsc#1238686)
- Version was updated to 2.53.4 with the following bug fixes:
* Runtime: fix GOGC is being set to 0 when installed
with empty prometheus.yml file resulting high cpu usage
* Scrape: fix dropping valid metrics after previous
scrape failed
golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):
- Security issues fixed:
* CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error
handling (bsc#1232970)
- Highlights of other changes:
* Performance:
+ Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and
remote write operations.
+ Default GOGC value lowered to 75 for better memory management.
+ Option to limit memory usage from dropped targets added.
* New Features:
+ Experimental OpenTelemetry ingestion.
+ Automatic memory limit handling
Security update for golang-github-prometheus-prometheus
This update for golang-github-prometheus-prometheus fixes the following issues:
- Require Go > 1.20 for building
- Bump go-retryablehttp to version 0.7.7
(CVE-2024-6104, bsc#1227038)
- Migrate from `disabled` to `manual` service mode
- Add0003-Bump-go-retryablehttp.patch
- Update to 2.45.6 (jsc#PED-3577):
* Security fixes in dependencies
- Update to 2.45.5:
* [BUGFIX] tsdb/agent: ensure that new series get written to WAL
on rollback.
* [BUGFIX] Remote write: Avoid a race condition when applying
configuration.
- Update to 2.45.4:
* [BUGFIX] Remote read: Release querier resources before encoding
the results.
- Update to
Security update for golang-github-prometheus-prometheus
This update for golang-github-prometheus-prometheus fixes the following issues:
golang-github-prometheus-prometheus:
- Security issues fixed in this version update to 2.37.6:
* CVE-2022-46146: Fix basic authentication bypass vulnerability (bsc#1208049, jsc#PED-3576)
* CVE-2022-41715: Update our regexp library to fix upstream (bsc#1204023)
* CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding (bsc#1208298)
- Other non-security bugs fixed and changes in this version update to 2.37.6:
* [BUGFIX] TSDB: Turn off isolation for Head compaction to fix a memory leak.
* [BUGFIX] TSDB: Fix 'invalid magic number
Security update for golang-github-prometheus-prometheus
This update for golang-github-prometheus-prometheus fixes the following issues:
- CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit (bsc#1208049).