security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-2v4p-qf9q-27wj	google.golang.org/grpc	None	v1.77.0	1.83.2		confirmed

Not Included

• Deferred by batch limit: 30 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	google.golang.org/grpc	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Medium Risk
Upgrades gRPC and the OpenTelemetry stack used for API tracing/metrics export without code changes; behavior should be compatible but warrants smoke-testing OTLP and any gRPC clients.

Overview
This PR bumps Go module dependencies for vulnerability remediation, with no application source changes—only go.mod and a large go.sum refresh.

The direct upgrades include google.golang.org/grpc (v1.77.0 → v1.82.2) to address GHSA-2v4p-qf9q-27wj, the OpenTelemetry core stack (go.opentelemetry.io/otel, metric, SDK, trace) from v1.38.0 → v1.43.0, and several golang.org/x/* packages (net, sync, sys, plus indirect crypto, mod, text, tools). google.golang.org/protobuf moves to v1.36.11 and genproto googleapis/api and rpc pins are updated to match the new gRPC/OTel graph.

go.sum gains many new checksum lines from transitive dependency resolution after those bumps (not new first-party code).

^{Reviewed by Cursor Bugbot for commit c50f4e1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​net@​v0.46.1-0.20251013234738-63d1a5100f82 ⏵ v0.53.0	+1
	google.golang.org/​grpc@​v1.77.0 ⏵ v1.82.2	+1	+58
	google.golang.org/​protobuf@​v1.36.10 ⏵ v1.36.11	+1
	go.opentelemetry.io/​otel@​v1.38.0 ⏵ v1.43.0	+1	+15
	golang.org/​x/​sys@​v0.38.0 ⏵ v0.43.0	+1
	go.opentelemetry.io/​otel/​sdk@​v1.38.0 ⏵ v1.43.0	+1	+22
	golang.org/​x/​sync@​v0.17.0 ⏵ v0.20.0
	go.opentelemetry.io/​otel/​sdk/​metric@​v1.38.0 ⏵ v1.43.0	+1
	go.opentelemetry.io/​otel/​trace@​v1.38.0 ⏵ v1.43.0	+1
	go.opentelemetry.io/​otel/​metric@​v1.38.0 ⏵ v1.43.0	+1

View full report

[ulziibay-kernel]

Bumped to otel 1.44.0 so this also covers CVE-2026-29181, which needs 1.41.0 and was not addressed by the original 1.40.0 bump. Realigned the semconv import to v1.41.0 to fix the conflicting schema URL that was breaking every lib/otel test. test and test-darwin now pass.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 9596f3c. Configure here.}

[cursor]

Incomplete x/net security upgrade

High Severity

The PR claims a confirmed upgrade of golang.org/x/net to 0.55.0 for GHSA-5cv4-jp36-h3mw, but go.mod pins v0.53.0. Every release before 0.55.0 stays vulnerable, so the HTML-parser DoS and the other x/net advisories fixed in 0.55.0 remain open.

 

^{Reviewed by Cursor Bugbot for commit 9596f3c. Configure here.}