security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-9h8m-3fm2-qjrq	go.opentelemetry.io/otel/sdk	None	v1.38.0	1.43.0		confirmed

Not Included

• Deferred by batch limit: 25 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	google.golang.org/grpc	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Lockfile-only semver bumps on observability dependencies; no logic changes, though OTLP/trace/metric behavior should be smoke-tested if OTel is enabled in production.

Overview
Bumps OpenTelemetry core modules from v1.38.0 to v1.40.0 (otel, metric, sdk, sdk/metric, trace) and golang.org/x/sys from v0.38.0 to v0.40.0, with matching go.sum entries. There are no application code changes—only dependency manifests.

This is aimed at GHSA-9h8m-3fm2-qjrq on go.opentelemetry.io/otel/sdk. OTel is used when otel.enabled is on (HTTP via otelchi, manual spans on WebSocket exec/cp paths in lib/otel and API handlers).

^{Reviewed by Cursor Bugbot for commit 9787bed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	go.opentelemetry.io/​otel@​v1.38.0 ⏵ v1.40.0	+1
	golang.org/​x/​sys@​v0.38.0 ⏵ v0.40.0	+1
	go.opentelemetry.io/​otel/​sdk@​v1.38.0 ⏵ v1.40.0	+1	+6
	go.opentelemetry.io/​otel/​sdk/​metric@​v1.38.0 ⏵ v1.40.0	+1
	go.opentelemetry.io/​otel/​trace@​v1.38.0 ⏵ v1.40.0	+1
	go.opentelemetry.io/​otel/​metric@​v1.38.0 ⏵ v1.40.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9787bed. Configure here.}

[cursor]

OTel bump breaks resource merge

High Severity

The go.opentelemetry.io/otel/sdk update to v1.40.0 introduces a schema version conflict. resource.Default() now uses semconv/1.39.0, but lib/otel/otel.go still merges attributes with semconv/1.37.0. This ErrSchemaURLConflict prevents the API from initializing and starting up.

 

^{Reviewed by Cursor Bugbot for commit 9787bed. Configure here.}