RED-175742: Sync with upstream master

[petar-valchev-redis]

There is a fix for this vulnerability in prometheus/node_exporter repo. However, it's merged only in master and there is no new version since October, 2025 (check versions).

This is why we will do the following:

1. Sync RedisLabs/node_exporter master branch with prometheus/node_exporter master branch.
   NOTE: We have previously fixed some security vulnerabilities in our fork. However, we should prefer the versions of go.sum and go.mod in prometheus/node_exporter master branch as the version in RedisLabs/node_exporter master branch was not used for a long time now and it's outdated.
2. Create a tag with a downstream version (e.g. node_exporter-rl-1.10.2-patched) from master in RedisLabs/node_exporter.
3. Build and upload tar.gz from the tag to s3

shasum -a 256 node_exporter-rl-1.10.2-patched.tar.gz
aws s3 cp node_exporter-rl-1.10.2-patched.tar.gz s3://redislabs-dev-public-deps/node_exporter-rl-1.10.2-patched.tar.gz --acl public-read

4. Create a PR in Redis-Enterprise with upgrade to the patched version (like this one)

This PR addresses only step 1 from the plan above.

There are 2 security vulnerabilities found by jit-ci, related to golang.org/x/crypto version. They already exist in prometheus/node_exporter (we are not introducing any new vulnerabilities) and will be addressed in this ticket.

[jit-ci]

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

[jit-ci]

🛡️ Jit Security Scan Results

🚨 Summary

• Critical vulnerability in golang.org/x/crypto may lead to authorization bypass

• High severity denial of service vulnerability in golang.org/x/crypto

• Immediate update to golang.org/x/crypto version 0.35.0 or later recommended

🔍 Findings

CRITICAL - 1 finding

1. Critical Authorization Bypass in golang.org/x/crypto

ID	Type	Finding	File	Severity
76d1ccba12	GHSA-v778-237x-gjrc	Critical Authorization Bypass in golang.org/x/crypto - Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass. This vulnerability could allow attackers to bypass authentication controls.	go.mod (lines 56-56)	CRITICAL

🔍 AI Analysis: This is a critical severity vulnerability that could lead to unauthorized access, affecting a core security component.

Remediation:

- golang.org/x/crypto v0.23.0
+ golang.org/x/crypto v0.31.0

HIGH - 1 finding

1. Denial of Service Vulnerability in golang.org/x/crypto

ID	Type	Finding	File	Severity
3686f74005	GHSA-hcg3-q754-cr77	Denial of Service Vulnerability in golang.org/x/crypto - SSH servers implementing file transfer protocols are vulnerable to DoS attacks from clients with slow or incomplete key exchange.	go.mod (lines 56-56)	HIGH

🔍 AI Analysis: This high severity vulnerability could lead to service disruption and affects a widely used cryptographic library.

Remediation:

- golang.org/x/crypto v0.23.0
+ golang.org/x/crypto v0.35.0

▶️ Advanced Options

Help section with supported ignore actions and syntax.

Need to ignore a finding? Use commands like:

@sera ignore <finding_id> reason:accepted (reason is optional)

@sera ignore all reason:other - this is a test PR (reason is optional)

@sera ignore type:GHSA-hcg3-q754-cr77

@sera ignore type:GHSA-v778-237x-gjrc

---

^{Security scan by Jit}