docs: [#428] record Grafana upgrade verification results

- update scan baseline to grafana/grafana:12.4.2

- document reduction from 18/6 to 4/0 (HIGH/CRITICAL)

- mark Grafana verification/docs subtasks complete

Author: josecelano

docs/issues/428-docker-vulnerability-analysis-apr8-2026.md

@@ -114,9 +114,9 @@ For each image, execute these steps in order:
 
 - [x] Analysis and triage completed
 - [x] Easy remediation implemented (if available)
-- [ ] Image rebuilt and validated
-- [ ] Trivy re-scan completed and compared
-- [ ] Scan docs updated
+- [x] Image rebuilt and validated
+- [x] Trivy re-scan completed and compared
+- [x] Scan docs updated
 - [ ] Follow-up issue created (only if unresolved)
 - [ ] Image marked done
 

docs/security/docker/scans/README.md

@@ -12,7 +12,7 @@ This directory contains historical security scan results for Docker images used
 | `torrust/tracker-provisioned-instance` | 24.04   | 0    | 0        | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-tracker-provisioned-instance.md) |
 | `caddy`                                | 2.10.2  | 14   | 4        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](caddy.md)                                |
 | `prom/prometheus`                      | v3.5.1  | 6    | 4        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](prometheus.md)                           |
-| `grafana/grafana`                      | 12.3.1  | 24   | 0        | ⚠️ CVE update detected    | Apr 8, 2026 | [View](grafana.md)                              |
+| `grafana/grafana`                      | 12.4.2  | 4    | 0        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](grafana.md)                              |
 | `mysql`                                | 8.4     | 8    | 0        | ⚠️ Minor CVE update       | Apr 8, 2026 | [View](mysql.md)                                |
 
 **Overall Status**: ⚠️ **CVE database update detected** - Most images still show increased vulnerability counts from previous scans (Feb-Dec 2025). Deployer has a first remediation pass applied (49 HIGH -> 44 HIGH, with 1 CRITICAL still open).

docs/security/docker/scans/grafana.md

@@ -4,12 +4,32 @@ Security scan history for the `grafana/grafana` Docker image.
 
 ## Current Status
 
-| Version | HIGH | CRITICAL | Status                 | Last Scan   | Support EOL  |
-| ------- | ---- | -------- | ---------------------- | ----------- | ------------ |
-| 12.3.1  | 24   | 0        | ⚠️ CVE database update | Apr 8, 2026 | Feb 24, 2026 |
+| Version | HIGH | CRITICAL | Status                               | Last Scan   | Support EOL |
+| ------- | ---- | -------- | ------------------------------------ | ----------- | ----------- |
+| 12.4.2  | 4    | 0        | ⚠️ Partial improvement after upgrade | Apr 8, 2026 | Unknown     |
 
 ## Scan History
 
+### April 8, 2026 - Remediation Pass 1 (Issue #428)
+
+**Image**: `grafana/grafana:12.4.2`
+**Trivy Version**: 0.68.2
+**Scan Mode**: `--scanners vuln --severity HIGH,CRITICAL`
+**Status**: ⚠️ **4 vulnerabilities** (4 HIGH, 0 CRITICAL)
+
+#### Summary
+
+Easy remediation applied by upgrading Grafana from `12.3.1` to `12.4.2`.
+
+Vulnerability comparison:
+
+- Previous (`12.3.1`): 18 HIGH, 6 CRITICAL
+- Current (`12.4.2`): 4 HIGH, 0 CRITICAL
+
+Improvement: -14 HIGH, -6 CRITICAL
+
+This is a strong reduction and clears all CRITICAL findings.
+
 ### April 8, 2026
 
 **Image**: `grafana/grafana:12.3.1`