security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-2v4p-qf9q-27wj	google.golang.org/grpc	None	v1.77.0	1.83.2		confirmed

Not Included

• Deferred by batch limit: 33 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	google.golang.org/grpc	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Medium Risk
No business-logic edits, but gRPC and OTel power OTLP export and instrumentation, so dependency upgrades could subtly affect telemetry behavior or connectivity at runtime.

Overview
This PR remediates a reported gRPC advisory (GHSA-2v4p-qf9q-27wj) by upgrading google.golang.org/grpc from v1.77.0 to v1.82.2, with matching go.sum updates.

It also aligns the OpenTelemetry stack to v1.43.0 (otel, metric, sdk, trace, sdk/metric) and bumps related transitive deps (golang.org/x/net, sync, sys, crypto, protobuf, etc.).

The only non-lockfile code change is in lib/otel/otel.go, switching semantic conventions from semconv/v1.37.0 to semconv/v1.40.0 so resource attributes (service name, version, environment, etc.) use the newer schema URL expected by the upgraded SDK.

^{Reviewed by Cursor Bugbot for commit cca9f87. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​net@​v0.46.1-0.20251013234738-63d1a5100f82 ⏵ v0.53.0	+1
	google.golang.org/​grpc@​v1.77.0 ⏵ v1.82.2	+1	+58
	google.golang.org/​protobuf@​v1.36.10 ⏵ v1.36.11	+1
	go.opentelemetry.io/​otel@​v1.38.0 ⏵ v1.43.0	+1	+15
	golang.org/​x/​sys@​v0.38.0 ⏵ v0.43.0	+1
	go.opentelemetry.io/​otel/​sdk@​v1.38.0 ⏵ v1.43.0	+1	+22
	golang.org/​x/​sync@​v0.17.0 ⏵ v0.20.0
	go.opentelemetry.io/​otel/​sdk/​metric@​v1.38.0 ⏵ v1.43.0	+1
	go.opentelemetry.io/​otel/​trace@​v1.38.0 ⏵ v1.43.0	+1
	go.opentelemetry.io/​otel/​metric@​v1.38.0 ⏵ v1.43.0	+1

View full report

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit cca9f87. Configure here.}