From 516641bbbad4a8de06e9d907b3f6f9a8c1205459 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] monitoring: five image versions, measured before choosing
 (#0051)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The operating stack carried 30 critical and 676 high findings. These five lines
remove fourteen and 278 of them. Every target was scanned before it was written
into the file:

  trivy          0.58.2  -> 0.74.0    critical 4 -> 0, high 98 -> 0
  grafana        12.0.0  -> 12.4.9    critical 7 -> 1, high 70 -> 3
  prometheus     v3.3.1  -> v3.14.0   critical 2 -> 0, high 46 -> 2
  alertmanager   v0.28.1 -> v0.34.0   critical 1 -> 0, high 41 -> 2
  node-exporter  v1.9.1  -> v1.12.1   critical 1 -> 0, high 38 -> 8

Three candidates were measured and rejected, which is the point of measuring.
Grafana 13.2.0 clears all seven critical findings but takes high from 70 to 162,
so the minor jump inside 12.x beats the major one by a wide margin. cadvisor only
goes from five critical to four. And python:3.13-slim is unchanged — the host
already holds the current build, so a repull buys nothing.

Configuration was validated against the new tools rather than the old ones:
promtool v3.14.0 accepts prometheus.yml with both rule files, all 20 plus 5
rules, and the rule unit tests; amtool v0.34.0 accepts alertmanager.yml.

⚠️ Needs a deploy on the operating host. Recreate rather than up: the images
change, and the CVE targets themselves move with trivy and the exporter.
---
 monitoring/docker-compose.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml
index 7eaa8b4..c63674d 100644
--- a/monitoring/docker-compose.yml
+++ b/monitoring/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   prometheus:
-    image: prom/prometheus:v3.3.1
+    image: prom/prometheus:v3.14.0
     container_name: prometheus
     restart: unless-stopped
     volumes:
@@ -26,7 +26,7 @@ services:
       - traefik
 
   alertmanager:
-    image: prom/alertmanager:v0.28.1
+    image: prom/alertmanager:v0.34.0
     container_name: alertmanager
     restart: unless-stopped
     volumes:
@@ -91,7 +91,7 @@ services:
   # (Ziele aus /targets/targets.txt - abgeleitet vom cve-exporter, NICHT von Hand
   #  pflegen: #0106 / ADR-0026)
   cve-scan:
-    image: aquasec/trivy:0.58.2
+    image: aquasec/trivy:0.74.0
     container_name: cve-scan
     restart: unless-stopped
     entrypoint: ["/bin/sh", "/config/scan-loop.sh"]
@@ -173,7 +173,7 @@ services:
       - loki
 
   grafana:
-    image: grafana/grafana:12.0.0
+    image: grafana/grafana:12.4.9
     container_name: grafana
     restart: unless-stopped
     environment:
@@ -199,7 +199,7 @@ services:
       - traefik
 
   node-exporter:
-    image: prom/node-exporter:v1.9.1
+    image: prom/node-exporter:v1.12.1
     container_name: node-exporter
     restart: unless-stopped
     volumes: