prometheus-3.0/3.0.1-r0: cve remediation

[octo-sts]

prometheus-3.0/3.0.1-r0: fix GHSA-v778-237x-gjrc

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/prometheus-3.0.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "npm error Internal error. Icu error."

• Error Category: Build/Dependency

• Failure Point: During npm install in the web/ui directory when running make assets-compress

• Root Cause Analysis:
The error appears to be related to ICU (International Components for Unicode) library incompatibility with the installed Node.js version. This typically occurs when there's a mismatch between the ICU versions used by Node.js and the system.

• Suggested Fix:

1. Add icu package explicitly to environment dependencies:

environment:
  contents:
    packages:
      - bash
      - busybox
      - ca-certificates-bundle
      - go
      - nodejs
      - npm
      - icu
      - icu-libs

2. Alternatively, try using an older Node.js version that matches the ICU version:

environment:
  contents:
    packages:
      - bash
      - busybox
      - ca-certificates-bundle
      - go
      - nodejs-20
      - npm

• Explanation:
Node.js has a dependency on ICU for internationalization support. The error suggests there's an incompatibility between the system ICU libraries and Node.js's expectations. Adding the explicit ICU dependencies or using a more stable Node.js version should resolve the conflict.

• Additional Notes:

• Node.js 23 is very recent and might have stability issues
• The error is occurring during the frontend build process
• ICU-related issues are common when building Node.js applications in container environments

• References:

• Node.js ICU requirements: https://nodejs.org/api/intl.html#internationalization-support
• Similar ICU error discussion: stream: allow transfer of readable byte streams nodejs/node#45955
• Wolfi Node.js packaging: https://github.com/wolfi-dev/os/tree/main/nodejs

[kranurag7]

we had issues with icu package which is resolved now, I rebased the PR to main and we should be good with merging this.