docs: [#428] record prometheus upgrade verification results

- update scan baseline to prom/prometheus:v3.5.1

- document reduction from 16/4 to 6/4 (HIGH/CRITICAL)

- mark prometheus verification/docs subtasks complete

Author: josecelano

docs/issues/428-docker-vulnerability-analysis-apr8-2026.md

@@ -104,9 +104,9 @@ For each image, execute these steps in order:
 
 - [x] Analysis and triage completed
 - [x] Easy remediation implemented (if available)
-- [ ] Image rebuilt and validated
-- [ ] Trivy re-scan completed and compared
-- [ ] Scan docs updated
+- [x] Image rebuilt and validated
+- [x] Trivy re-scan completed and compared
+- [x] Scan docs updated
 - [ ] Follow-up issue created (only if unresolved)
 - [ ] Image marked done
 

docs/security/docker/scans/README.md

@@ -11,7 +11,7 @@ This directory contains historical security scan results for Docker images used
 | `torrust/tracker-ssh-server`           | 3.23.3  | 0    | 0        | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-ssh-server.md)                   |
 | `torrust/tracker-provisioned-instance` | 24.04   | 0    | 0        | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-tracker-provisioned-instance.md) |
 | `caddy`                                | 2.10.2  | 14   | 4        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](caddy.md)                                |
-| `prom/prometheus`                      | v3.5.0  | 20   | 0        | ⚠️ CVE update detected    | Apr 8, 2026 | [View](prometheus.md)                           |
+| `prom/prometheus`                      | v3.5.1  | 6    | 4        | ⚠️ Partial remediation    | Apr 8, 2026 | [View](prometheus.md)                           |
 | `grafana/grafana`                      | 12.3.1  | 24   | 0        | ⚠️ CVE update detected    | Apr 8, 2026 | [View](grafana.md)                              |
 | `mysql`                                | 8.4     | 8    | 0        | ⚠️ Minor CVE update       | Apr 8, 2026 | [View](mysql.md)                                |
 

docs/security/docker/scans/prometheus.md

@@ -4,12 +4,39 @@ Security scan history for the `prom/prometheus` Docker image.
 
 ## Current Status
 
-| Version | HIGH | CRITICAL | Status                 | Last Scan   | Support EOL  |
-| ------- | ---- | -------- | ---------------------- | ----------- | ------------ |
-| v3.5.0  | 20   | 0        | ⚠️ CVE database update | Apr 8, 2026 | Jul 31, 2026 |
+| Version | HIGH | CRITICAL | Status                               | Last Scan   | Support EOL  |
+| ------- | ---- | -------- | ------------------------------------ | ----------- | ------------ |
+| v3.5.1  | 6    | 4        | ⚠️ Partial improvement after upgrade | Apr 8, 2026 | Jul 31, 2026 |
 
 ## Scan History
 
+### April 8, 2026 - Remediation Pass 1 (Issue #428)
+
+**Image**: `prom/prometheus:v3.5.1`
+**Trivy Version**: 0.68.2
+**Scan Mode**: `--scanners vuln --severity HIGH,CRITICAL`
+**Status**: ⚠️ **10 vulnerabilities** (6 HIGH, 4 CRITICAL)
+
+#### Summary
+
+Easy remediation applied by upgrading Prometheus from `v3.5.0` to `v3.5.1`.
+
+Vulnerability comparison:
+
+- Previous (`v3.5.0`): 16 HIGH, 4 CRITICAL
+- Current (`v3.5.1`): 6 HIGH, 4 CRITICAL
+
+Improvement: -10 HIGH, 0 CRITICAL
+
+#### Target Breakdown (`v3.5.1`)
+
+| Target           | Type     | HIGH | CRITICAL |
+| ---------------- | -------- | ---- | -------- |
+| `bin/prometheus` | gobinary | 3    | 2        |
+| `bin/promtool`   | gobinary | 3    | 2        |
+
+Remaining vulnerabilities are in upstream Prometheus binary dependencies.
+
 ### April 8, 2026
 
 **Image**: `prom/prometheus:v3.5.0`