… v3.11.3) (#303)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [quay.io/prometheus/prometheus](https://github.com/prometheus/prometheus) | patch | `v3.11.2` → `v3.11.3` |

---

### Release Notes

<details>
<summary>prometheus/prometheus (quay.io/prometheus/prometheus)</summary>

### [`v3.11.3`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3): 3.11.3 / 2026-04-27

[Compare Source](prometheus/prometheus@v3.11.2...v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@&#8203;iiihaiii](https://github.com/iiihaiii) and [@&#8203;Ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#&#8203;18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#&#8203;18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#&#8203;18588](prometheus/prometheus#18588)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/303

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

##### [\`v3.11.3\`](https://github.com/prometheus/prometheus/releases/tag/v3.11.3)

This release fixes mutiple security issues.

We would like to thank the following people for the responsible disclosures:

- Shadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.

- Brett Gervasoni for the AzureAD OAuth `client_secret` vulnerability.

- [@iiihaiii](https://github.com/iiihaiii) and [@ngocnn97](https://github.com/Ngocnn97) for the Old UI XSS vulnerability.

- \[SECURITY] AzureAD remote write: Fix OAuth `client_secret` being exposed in plaintext via `/-/config` endpoint. GHSA-wg65-39gg-5wfj / CVE-2026-42151 [#18590](prometheus/prometheus#18590)

- \[SECURITY] Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. GHSA-8rm2-7qqf-34qm / CVE-2026-42154 [#18584](prometheus/prometheus#18584)

- \[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels. GHSA-fw8g-cg8f-9j28 [#18588](prometheus/prometheus#18588)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

CVE-2026-42154 (CVSS 7.5) is a DoS vulnerability in the Prometheus
server's /api/v1/read remote read endpoint (Go binary, fixed in
v3.5.3 and v3.11.3). OWASP dependency-check incorrectly matches
io.prometheus:simpleclient* Java jars against the same CPE
(cpe:2.3:a:prometheus:prometheus) due to the shared "prometheus" name.

The Java simpleclient library is a metrics instrumentation library
and does not contain the affected remote read endpoint. This is a
confirmed false positive per NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-42154)
which lists only the prometheus/prometheus Go server as affected.

References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42154
- Fix PRs: prometheus/prometheus#18584, prometheus/prometheus#18585
- Advisory: GHSA-8rm2-7qqf-34qm

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore: upgrade Jetty from 11.0.26 to 12.1.9 (ee10)

Migrate from Jetty 11 to Jetty 12.1.9 using ee10 servlet compatibility layer:
- Update hypertrace-bom catalog version to 0.3.79 (includes Jetty 12.1.9)
- Update jakarta-servlet-api from 6.0.0 to 6.1.0
- Update servlet imports from o.e.j.servlet.* to o.e.j.ee10.servlet.*
- Update servlets imports from o.e.j.servlets.* to o.e.j.ee10.servlets.*
- Fix setVirtualHosts(String[]) to setVirtualHosts(List<String>)
- Remove setShowServlet(false) (method removed in 12.1.x, behavior is now default)
- Change ErrorHandler variable type to ErrorHandler from ee10 package
- Regenerate all gradle lock files

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: suppress false positive CVE-2026-42154 for prometheus simpleclient

CVE-2026-42154 (CVSS 7.5) is a DoS vulnerability in the Prometheus
server's /api/v1/read remote read endpoint (Go binary, fixed in
v3.5.3 and v3.11.3). OWASP dependency-check incorrectly matches
io.prometheus:simpleclient* Java jars against the same CPE
(cpe:2.3:a:prometheus:prometheus) due to the shared "prometheus" name.

The Java simpleclient library is a metrics instrumentation library
and does not contain the affected remote read endpoint. This is a
confirmed false positive per NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-42154)
which lists only the prometheus/prometheus Go server as affected.

References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42154
- Fix PRs: prometheus/prometheus#18584, prometheus/prometheus#18585
- Advisory: GHSA-8rm2-7qqf-34qm

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Revert "fix: suppress false positive CVE-2026-42154 for prometheus simpleclient"

This reverts commit f95e9d0.

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

Backport of upstream prometheus/prometheus#18584 (GHSA-8rm2-7qqf-34qm).
DecodeReadRequest now checks snappy.DecodedLen before allocating, so a
small crafted payload that claims a huge decoded size is rejected
instead of triggering a multi-GB heap allocation per request.

Signed-off-by: Bastrykov Evgeniy <[email protected]>
Co-authored-by: Cursor <[email protected]>