The filter field was documented as targeting the Catalog API but since
PR #17349 it was also passed to the Health API. This broke existing
configs using Catalog-only fields like ServiceTags, which the Health API
rejects (it uses Service.Tags instead).

Introduce a separate health_filter field that is passed exclusively to
the Health API, while filter remains catalog-only. Update the docs to
explain the two-phase discovery (Catalog for service listing, Health for
instances) and the field name differences between the two APIs.

Fixes #18479

Signed-off-by: Julien Pivotto <[email protected]>

When health_filter is set without explicit services, the catalog needs
to be watched to enumerate services. Add watchedFilter to the condition
that triggers catalog watching.

Improve the filter test suite:
- Replace defer with t.Cleanup for stub servers.
- Rewrite TestFilterOption to assert that the catalog receives the filter
  and the health endpoint does not.
- Rewrite TestHealthFilterOption to assert that health_filter is routed
  correctly to the health endpoint only.
- Add TestBothFiltersOption to verify both filters are routed to their
  respective endpoints when both are configured.

Signed-off-by: Julien Pivotto <[email protected]>

Metric names, label names, and label values containing HTML/JavaScript were
inserted into `innerHTML` without escaping in several UI code paths, enabling
stored XSS attacks via crafted metrics. This mostly becomes exploitable in
Prometheus 3.x, since it defaults to allowing any UTF-8 characters in metric
and label names.

Apply `escapeHTML()` to all user-controlled values before innerHTML
insertion in:

* Mantine UI chart tooltip
* Old React UI chart tooltip
* Old React UI metrics explorer fuzzy search
* Old React UI heatmap tooltip

See GHSA-vffh-x6r8-xx99

Signed-off-by: Julius Volz <[email protected]>

…-issue

UI: Fix stored XSS via unescaped metric names and labels

Co-authored-by: George Krajcsovits <[email protected]>
Signed-off-by: Julien <[email protected]>

…h-filter-3.11

discovery/consul: add health_filter for Health API filtering

Signed-off-by: Mohammad Varmazyar <[email protected]>

…onfig-fixtures

config: add consul health_filter fixture coverage

Signed-off-by: Julien Pivotto <[email protected]>

Release 3.11.2