PMM-14577 Fix CVEs by bump versions.

[JiriCtvrtka]

I dont have permissions to push into Percona PMM Dump. So I created fork.

Ticket: https://perconadev.atlassian.net/browse/PMM-14577

PMM PR: percona/pmm#4848

[JiriCtvrtka]

@ademidoff @idoqo @svetasmirnova

I don’t have permission to push to Percona PMM Dump, so I created a fork. It would be great if I could get the necessary permissions.

1. I created another PR with only a comment (no code changes), but CI/tests is also failing. Could someone take a look?
   PR: Test #344

2. Can someone check why Snyk is failing? I don’t have access to the output/logs.

[ademidoff]

@ademidoff @idoqo @svetasmirnova

I don’t have permission to push to Percona PMM Dump, so I created a fork. It would be great if I could get the necessary permissions.

1. I created another PR with only a comment (no code changes), but CI/tests is also failing. Could someone take a look?
   PR: Test #344
2. Can someone check why Snyk is failing? I don’t have access to the output/logs.

I don't have access to that namespace of Snyk either, the access is granted on a per-team basis.

[idoqo]

@JiriCtvrtka i think PR should be against pmm-3.4.1 branch since:

• it's the branch on pmm-submodules.
• we haven't tested/updated pmm to use changes from main branch (e.g encryption).

[idoqo]

nicee, this resolves cves?

[JiriCtvrtka]

This is latest one I was able to find and it is working. One mentioned in CVE report: 1.9.2-0.20250521205822-0ba0b99665a9 is not existing for me. So I am going to check report if this one is fine.

go: github.com/grafana/[email protected]: invalid version: unknown revision 1.9.2-20250521205822-0ba0b99665a9
osr-mb-044:tools jiri.ctvrtka$ go get github.com/grafana/[email protected]
go: github.com/grafana/[email protected]: invalid version: unknown revision 0.1.9.2-20250521205822-0ba0b99665a9

[JiriCtvrtka]

@JiriCtvrtka i think PR should be against pmm-3.4.1 branch since:

• it's the branch on pmm-submodules.
• we haven't tested/updated pmm to use changes from main branch (e.g encryption).

@idoqo I see, ok let me fix it.

[JiriCtvrtka]

We agreed to merge this PR and then review the new vulnerability report. If needed, another iteration will be done.