… v3.11.2) (#152)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [quay.io/prometheus/prometheus](https://github.com/prometheus/prometheus) | patch | `v3.11.1` → `v3.11.2` |

---

### Release Notes

<details>
<summary>prometheus/prometheus (quay.io/prometheus/prometheus)</summary>

### [`v3.11.2`](https://github.com/prometheus/prometheus/releases/tag/v3.11.2): 3.11.2 / 2026-04-13

[Compare Source](prometheus/prometheus@v3.11.1...v3.11.2)

This release has a fix for a Stored XSS vulnerability that can be triggered via crafted metric names and label values in Prometheus web UI tooltips and metrics explorer. Thanks to Duc Anh Nguyen from TinyxLab for reporting it.

- \[SECURITY] UI: Fix stored XSS via unescaped metric names and labels. CVE-2026-40179. [#&#8203;18506](prometheus/prometheus#18506)
- \[ENHANCEMENT] Consul SD: Introduce `health_filter` field for Health API filtering. [#&#8203;18499](prometheus/prometheus#18499)
- \[BUGFIX] Consul SD: Fix filter parameter being incorrectly applied to the Health API. [#&#8203;18499](prometheus/prometheus#18499)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/152
Co-authored-by: bot-owl <[email protected]>
Co-committed-by: bot-owl <[email protected]>

…React UI (CVE-2026-40179, CVE-2026-44903, CVE-2026-44990) (#336)

* fix(ui): escape metric names and label values in React UI (CVE-2026-40179, CVE-2026-44903)

Backports upstream prometheus/prometheus#18506 (GHSA-vffh-x6r8-xx99 /
CVE-2026-40179) and prometheus/prometheus#18588 (GHSA-fw8g-cg8f-9j28 /
CVE-2026-44903) for the React web UI we still ship.

Affected sinks now call escapeHTML before interpolation into innerHTML:
- Graph tooltips: __name__ and label keys (GraphHelpers.ts)
- Metrics Explorer fuzzy search: escapeHTML option on Fuzzy
- Heatmap bucket tooltip: le label (jquery.flot.heatmap.js)
- Heatmap y-axis tick labels: le label (Graph.tsx)

This blocks stored XSS in the Prometheus UI from metric names/label
values ingested via scrape, remote-write or OTLP receivers when
UTF-8 metric/label names allow <, > and " characters.

Co-authored-by: Cursor <[email protected]>

* fix(ui): pre-escape Flags fuzzy output before sanitize-html (CVE-2026-44990)

Defense-in-depth for GHSA-rpr9-rxv7-x643 (sanitize-html xmp raw-text
passthrough), for which no upstream patch is released yet.

The Flags page renders fuzzy-search results through sanitize-html
with allowedTags=['strong']. Under the default config sanitize-html
preserves the content of disallowed <xmp> tags verbatim, so a flag
value containing <xmp>...</xmp> would survive sanitization.

Set escapeHTML: true on the Fuzzy instance (same pattern we just used
in MetricsExplorer for CVE-2026-40179) so the search output is fully
entity-encoded except for the <strong> match markers. sanitize-html
then sees only the strong tags plus harmless entity-encoded text and
the xmp bypass is unreachable.

Co-authored-by: Cursor <[email protected]>

---------

Co-authored-by: Cursor <[email protected]>