Update OpenTelemetry so govulncheck passes

[om986]

Summary

• govulncheck on main failed because go.opentelemetry.io/otel/sdk v1.44.0 is affected by GO-2026-6505 (CVE-2026-81870): exporter config logging can leak endpoint URLs.
• The GCP storage client and the Postgres pool both reach that code, so the scan treats it as called. v1.45.0 is the fixed release. The matching OpenTelemetry API modules and go-logr/logr move with it.
• go test ./... passes, and govulncheck no longer reports a reachable vulnerability.

Test plan

• CI govulncheck job is green
• CI go job (build and tests, including Postgres) is green

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: OpenSourceOM/core/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 5063c4e3-1c47-4992-8f5b-fe52e8de8e1a

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}