prometheus-config-reloader
Technical details about the ‘prometheus-config-reloader’ component.
Generated on: 2026-10-23
Software Bill of Materials
Dependencies (Image)
| Dependency | Version | License | Vulnerabilities | Severity | Status |
|---|---|---|---|---|---|
| github.com/golang-jwt/jwt/v5 | v5.2.1 | Unknown | CVE-2025-30204 (golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing) | HIGH | fixed (in 5.2.2) |
| github.com/klauspost/compress | v1.17.8 | Unknown | CVE-2026-63209 (github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing) | HIGH | fixed (in 1.18.7) |
| github.com/prometheus/prometheus | v0.52.0 | Unknown | CVE-2026-42151 (github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API) | HIGH | fixed (in 0.311.3) |
| golang.org/x/crypto | v0.23.0 | Unknown | CVE-2024-45337 (golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto) | HIGH | fixed (in 0.31.0) |
| golang.org/x/net | v0.25.0 | Unknown | CVE-2024-45338 (golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html) | HIGH | fixed (in 0.33.0) |
| golang.org/x/oauth2 | v0.19.0 | Unknown | CVE-2025-22868 (golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws) | HIGH | fixed (in 0.27.0) |
| golang.org/x/text | v0.15.0 | Unknown | CVE-2026-56851 (golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile) | HIGH | fixed (in 0.41.0) |
| github.com/Azure/azure-sdk-for-go/sdk/azidentity | v1.5.2 | Unknown | CVE-2024-35255 (azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity) | MEDIUM | fixed (in 1.6.0-beta.4.0.20240610221955-50774cd97099) |
| go.mongodb.org/mongo-driver | v1.14.0 | Unknown | CVE-2026-2303 (CVE-2026-2303 affecting package telegraf for versions less than 1.29.4-21) | MEDIUM | fixed (in 1.17.7) |
| busybox | 1.36.1 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/azcore | v1.11.1 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/internal | v1.5.2 | Unknown | - | ||
| github.com/AzureAD/microsoft-authentication-library-for-go | v1.2.2 | Unknown | - | ||
| github.com/alecthomas/kingpin/v2 | v2.4.0 | Unknown | - | ||
| github.com/alecthomas/units | v0.0.0-20231202071711-9a357b53e9c9 | Unknown | - | ||
| github.com/asaskevich/govalidator | v0.0.0-20230301143203-a9d515a09cc2 | Unknown | - | ||
| github.com/aws/aws-sdk-go | v1.51.25 | Unknown | - | ||
| github.com/bboreham/go-loser | v0.0.0-20230920113527-fcc2c21820a3 | Unknown | - | ||
| github.com/beorn7/perks | v1.0.1 | Unknown | - | ||
| github.com/blang/semver/v4 | v4.0.0 | Unknown | - | ||
| github.com/cespare/xxhash/v2 | v2.3.0 | Unknown | - | ||
| github.com/coreos/go-systemd/v22 | v22.5.0 | Unknown | - | ||
| github.com/davecgh/go-spew | v1.1.2-0.20180830191138-d8f796af33cc | Unknown | - | ||
| github.com/dennwc/varint | v1.0.0 | Unknown | - | ||
| github.com/distribution/reference | v0.6.0 | Unknown | - | ||
| github.com/edsrzf/mmap-go | v1.1.0 | Unknown | - | ||
| github.com/efficientgo/core | v1.0.0-rc.2 | Unknown | - | ||
| github.com/emicklei/go-restful/v3 | v3.12.0 | Unknown | - | ||
| github.com/facette/natsort | v0.0.0-20181210072756-2cd4dd1e2dcb | Unknown | - | ||
| github.com/fsnotify/fsnotify | v1.7.0 | Unknown | - | ||
| github.com/go-kit/log | v0.2.1 | Unknown | - | ||
| github.com/go-logfmt/logfmt | v0.6.0 | Unknown | - | ||
| github.com/go-logr/logr | v1.4.1 | Unknown | - | ||
| github.com/go-logr/stdr | v1.2.2 | Unknown | - | ||
| github.com/go-openapi/analysis | v0.22.2 | Unknown | - | ||
| github.com/go-openapi/errors | v0.22.0 | Unknown | - | ||
| github.com/go-openapi/jsonpointer | v0.21.0 | Unknown | - | ||
| github.com/go-openapi/jsonreference | v0.21.0 | Unknown | - | ||
| github.com/go-openapi/loads | v0.21.5 | Unknown | - | ||
| github.com/go-openapi/runtime | v0.27.1 | Unknown | - | ||
| github.com/go-openapi/spec | v0.20.14 | Unknown | - | ||
| github.com/go-openapi/strfmt | v0.23.0 | Unknown | - | ||
| github.com/go-openapi/swag | v0.23.0 | Unknown | - | ||
| github.com/go-openapi/validate | v0.23.0 | Unknown | - | ||
| github.com/gogo/protobuf | v1.3.2 | Unknown | - | ||
| github.com/golang/groupcache | v0.0.0-20210331224755-41bb18bfe9da | Unknown | - | ||
| github.com/golang/protobuf | v1.5.4 | Unknown | - | ||
| github.com/golang/snappy | v0.0.4 | Unknown | - | ||
| github.com/google/gnostic-models | v0.6.8 | Unknown | - | ||
| github.com/google/go-cmp | v0.6.0 | Unknown | - | ||
| github.com/google/gofuzz | v1.2.0 | Unknown | - | ||
| github.com/google/uuid | v1.6.0 | Unknown | - | ||
| github.com/grafana/regexp | v0.0.0-20221122212121-6b5c0a4cb7fd | Unknown | - | ||
| github.com/imdario/mergo | v0.3.16 | Unknown | - | ||
| github.com/jmespath/go-jmespath | v0.4.0 | Unknown | - | ||
| github.com/josharian/intern | v1.0.0 | Unknown | - | ||
| github.com/jpillora/backoff | v1.0.0 | Unknown | - | ||
| github.com/json-iterator/go | v1.1.12 | Unknown | - | ||
| github.com/klauspost/cpuid/v2 | v2.2.5 | Unknown | - | ||
| github.com/kylelemons/godebug | v1.1.0 | Unknown | - | ||
| github.com/mailru/easyjson | v0.7.7 | Unknown | - | ||
| github.com/metalmatze/signal | v0.0.0-20210307161603-1c9aa721a97a | Unknown | - | ||
| github.com/minio/sha256-simd | v1.0.1 | Unknown | - | ||
| github.com/mitchellh/go-ps | v1.0.0 | Unknown | - | ||
| github.com/mitchellh/mapstructure | v1.5.0 | Unknown | - | ||
| github.com/modern-go/concurrent | v0.0.0-20180306012644-bacd9c7ef1dd | Unknown | - | ||
| github.com/modern-go/reflect2 | v1.0.2 | Unknown | - | ||
| github.com/munnerz/goautoneg | v0.0.0-20191010083416-a7dc8b61c822 | Unknown | - | ||
| github.com/mwitkow/go-conntrack | v0.0.0-20190716064945-2f068394615f | Unknown | - | ||
| github.com/oklog/run | v1.1.0 | Unknown | - | ||
| github.com/oklog/ulid | v1.3.1 | Unknown | - | ||
| github.com/opencontainers/go-digest | v1.0.0 | Unknown | - | ||
| github.com/opentracing/opentracing-go | v1.2.0 | Unknown | - | ||
| github.com/pkg/browser | v0.0.0-20240102092130-5ac0b6a4141c | Unknown | - | ||
| github.com/pkg/errors | v0.9.1 | Unknown | - | ||
| github.com/pmezard/go-difflib | v1.0.1-0.20181226105442-5d4384ee4fb2 | Unknown | - | ||
| github.com/prometheus-community/prom-label-proxy | v0.8.1 | Unknown | - | ||
| github.com/prometheus-operator/prometheus-operator | UNKNOWN | Unknown | - | ||
| github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring | UNKNOWN | Unknown | - | ||
| github.com/prometheus-operator/prometheus-operator/pkg/client | UNKNOWN | Unknown | - | ||
| github.com/prometheus/alertmanager | v0.27.0 | Unknown | - | ||
| github.com/prometheus/client_golang | v1.19.1 | Unknown | - | ||
| github.com/prometheus/client_model | v0.6.1 | Unknown | - | ||
| github.com/prometheus/common | v0.53.0 | Unknown | - | ||
| github.com/prometheus/common/sigv4 | v0.1.0 | Unknown | - | ||
| github.com/prometheus/exporter-toolkit | v0.11.0 | Unknown | - | ||
| github.com/prometheus/procfs | v0.12.0 | Unknown | - | ||
| github.com/simonpasquier/klog-gokit/v3 | v3.4.0 | Unknown | - | ||
| github.com/spf13/cobra | v1.7.0 | Unknown | - | ||
| github.com/spf13/pflag | v1.0.5 | Unknown | - | ||
| github.com/stretchr/testify | v1.9.0 | Unknown | - | ||
| github.com/thanos-io/thanos | v0.35.0 | Unknown | - | ||
| github.com/xhit/go-str2duration/v2 | v2.1.0 | Unknown | - | ||
| go.opentelemetry.io/otel | v1.25.0 | Unknown | - | ||
| go.opentelemetry.io/otel/metric | v1.25.0 | Unknown | - | ||
| go.opentelemetry.io/otel/trace | v1.25.0 | Unknown | - | ||
| go.uber.org/atomic | v1.11.0 | Unknown | - | ||
| go.uber.org/automaxprocs | v1.5.3 | Unknown | - | ||
| go.uber.org/goleak | v1.3.0 | Unknown | - | ||
| golang.org/x/exp | v0.0.0-20240325151524-a685a6edb6d8 | Unknown | - | ||
| golang.org/x/sync | v0.7.0 | Unknown | - | ||
| golang.org/x/sys | v0.20.0 | Unknown | CVE-2026-39824 (Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows) | UNKNOWN | fixed (in 0.44.0) |
| golang.org/x/term | v0.20.0 | Unknown | - | ||
| golang.org/x/time | v0.5.0 | Unknown | - | ||
| google.golang.org/protobuf | v1.34.1 | Unknown | - | ||
| gopkg.in/inf.v0 | v0.9.1 | Unknown | - | ||
| gopkg.in/yaml.v2 | v2.4.0 | Unknown | - | ||
| gopkg.in/yaml.v3 | v3.0.1 | Unknown | - | ||
| k8s.io/api | v0.30.1 | Unknown | - | ||
| k8s.io/apiextensions-apiserver | v0.30.1 | Unknown | - | ||
| k8s.io/apimachinery | v0.30.1 | Unknown | - | ||
| k8s.io/client-go | v0.30.1 | Unknown | - | ||
| k8s.io/component-base | v0.30.1 | Unknown | - | ||
| k8s.io/kube-openapi | v0.0.0-20240322212309-b815d8309940 | Unknown | - | ||
| k8s.io/utils | v0.0.0-20240310230437-4693a0247e57 | Unknown | - | ||
| sigs.k8s.io/controller-runtime | v0.18.2 | Unknown | - | ||
| sigs.k8s.io/json | v0.0.0-20221116044647-bc3834ca7abd | Unknown | - | ||
| sigs.k8s.io/structured-merge-diff/v4 | v4.4.1 | Unknown | - | ||
| sigs.k8s.io/yaml | v1.4.0 | Unknown | - | ||
| stdlib | go1.22.3 | BSD-3-Clause | - | ||
| busybox | 1.36.1 | Unknown | - | ||
| /bin/[ | Unknown | Unknown | - | ||
| /bin/prometheus-config-reloader | Unknown | Unknown | - |