Update prometheus-common dependency to address CVE

[Fiona-Waters]

Issue link

https://issues.redhat.com/browse/RHOAIENG-1311

What changes have been made

This PR will address a Medium level CVE:

Introduced through: golang.org/x/[email protected], golang.org/x/[email protected] and others.
Fixed in: golang.org/x/[email protected]

In order to update this indirect dependency I updated prometheus-common dependency to v.0.46.0 which uses crypto v.0.18.0.

Verification steps

E2E tests passing successfully will suffice.

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • Testing is not required for this change

[ChristianZaccaria]

You got the right idea! But, usually, when an upgrade adds/removes a lot of dependencies (direct, indirect or transitive) it is best to verify that no new CVEs were introduced in the process.

I have Snyk setup in my own org to scan my own forked repositories on PRs made, for scenarios that include lots of changes. I made a PR in my fork with this fix, which show that the CVE was effectively fixed, but a new one was introduced: ChristianZaccaria#7

I think we could look into golang.org/x/[email protected] as it was also introduced through that one, perhaps changes are less involved there.

[ChristianZaccaria]

/lgtm great work!

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ChristianZaccaria, sutaakar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sutaakar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment