Report the use of components with vulnerabilities in prometheus about prometheus HOT 1 CLOSED

Please see https://prometheus.io/docs/operating/security/#automated-security-scanners -- most scanners do not generate good results and just cause us more work, we keep dependencies up-to-date and do regular releases, so it's very unlikely a CVE from 2022 will still affect a recent Prometheus release (you didn't actually mention what version you used).

This scanner seems particularly bad, it finds a CVE where the description says "Fixed in 1.9.17, 1.10.10, and 1.11.5." and also extracts the package and version number pkg:golang/github.com/hashicorp/consul/[email protected] -- just reading the report is enough to see the scanner is plain wrong. (hashicorp/consul@3b44343 is the fix commit which shows the tags if you want to double check).

from prometheus.