openSUSE-SU-2026:22026-1

This update for prometheus-blackbox_exporter fixes the following issues:

Changes in prometheus-blackbox_exporter:

• CVE-2026-84304: Fix heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 (bsc#1279126)

• CVE-2026-39821: Fix potential validation bypass and privilege escalation by bumping golang.org/x/net to version 0.57.0 (bsc#1266556)

• CVE-2026-39821: Bump golang.org/x/net to version 0.55.0 (bsc#1266556)

• Build only for SUSE distributions

• Upgrade to version 0.26.0 (jsc#PED-12872):

  • Changes: Replace go-kit/log with log/slog module.
  • Features: Add metric to record tls ciphersuite negotiated during handshake. Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  • Enhancement: Add stale workflow to start sync with stale.yaml in Prometheus.
  • Bug fixes: Only register grpc TLS metrics on successful handshake.

• Upgrade to version 0.25.0:

  • Features: Allow to get Probe logs by target. Log errors from probe.
  • Bug fixes: Prevent logging confusing error message. Explicit registration of internal exporter metrics.

• Security:

  • CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238680)
  • CVE-2023-45288: Fix closing connections when receiving too many headers (bsc#1236515)